Exepal / Injection feed

Prompt injections found in the wild, as a live feed

Every remote server in the official MCP Registry is scanned daily for poisoned tool descriptions, hidden instructions and other things that talk to the model instead of describing the tool. Hits land here with the exact evidence. Free, CC BY 4.0, built for guard models, evals and agent runtimes.

Use the feed

No key, no signup. Results are cached for 5 minutes. Attribution to Exepal is the only condition (CC BY 4.0).

GET https://api.exepal.com/v1/feed?limit=100&severity=high&active=1
GET https://api.exepal.com/v1/feed?since=2026-11-01T00:00:00Z     # changes since a time
GET https://api.exepal.com/v1/feed?host=example.com                # one server
GET https://api.exepal.com/v1/feed/stats

Each hit: url, name, locator (tool:<name>, resource:<uri>, prompt:<name>, instructions or page), rule, severity, message, evidence (the exact snippet, up to 300 characters), firstSeen, lastSeen, active.

Found one? Submit a URL

An MCP server endpoint or a web page. It is scanned right away; if it has an injection-class finding it joins the feed and gets re-scanned daily. Nothing is stored for clean URLs.

Questions

What counts as a hit?

Only injection-class findings from the MCP server audit and the prompt injection scanner: text that gives the model instructions (ignore, exfiltrate, read keys), hidden Unicode, misleading safety annotations, resources pointing at credentials, financial tools, and homoglyph names. Missing descriptions or annotations are hygiene, not attacks, and stay out.

Is every hit a real attack?

No. Rules are deterministic and some servers trip them on purpose for testing, or by writing "do not share the API key" in a description. The evidence snippet is there so you can judge. Treat it as a stream of candidates with ground truth attached, which is what guard-model training and evals need.

Where do the servers come from?

The official MCP Registry: every active entry with a remote Streamable HTTP endpoint, re-synced hourly. Plus public submissions above. Servers that need sign-in are skipped, since we only see what any anonymous client sees.

My server is listed. How do I get it off?

Fix the description and it drops to inactive at the next daily scan (history stays, marked inactive). Think a rule is wrong? Write to contact@laxmankafle.com with the hit id.

Can my agent check a server before connecting?

Yes: GET /v1/feed?host=<host>&active=1 is free, or run the paid MCP server audit ($0.005) for the full grade of any server, including ones not in the registry.