Reveal hidden prompt injection & supply-chain risks in AI agent extensions — scans Claude/agent Skills, MCP servers & rules files for invisible Unicode instruction smuggling, tool poisoning & the lethal trifecta. Terminal · JSON · SARIF · zero deps.
Quick Install
Copy the config for your editor. Some servers may need additional setup — check the README.
Add to claude_desktop_config.json:
{
"mcpServers": {
"uncloak": {
"command": "uvx",
"args": [
"uncloak"
]
}
}
}
Run in terminal:
claude mcp add uncloak uvx uncloak
Add to .cursor/mcp.json:
{
"mcpServers": {
"uncloak": {
"command": "uvx",
"args": [
"uncloak"
]
}
}
}
Or install with pip: pip install uncloak