Visus — Secure Web Access for MCP-compatible AI agents

How Visus-MCP helps your MCP-compatible AI agents become EU AI compliant ready

npx visus-mcp@0.28.0

"What the web shows you, Lateos reads safely."

Why You Should Get Your AI Agent EU Compliant

The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive AI law, effective from August 2024. It regulates AI systems based on risk levels, with stringent requirements for general-purpose AI (GPAI) like MCP-compatible agents that process web content.

Key Requirements for Compliance

• Art. 9 (Risk Management): Identify and mitigate systemic risks, including prompt injection and data poisoning from web sources.
• Art. 13 (Transparency): Document AI capabilities, limitations, and data handling transparently.
• Art. 15 (Robustness): Ensure systems resist adversarial attacks like indirect prompt injection (IPI).

Non-compliance fines up to €35M or 7% of global turnover.

How Visus-MCP Delivers Compliance

Visus-MCP provides out-of-the-box EU AI Act alignment through:

• Tamper-Evident Cryptographic Proofs: Every fetch generates SHA-256 + HMAC proofs verifying sanitization ran (see CRYPTO-PROOF-SPEC.md).
• IPI Threat Detection (19 Categories): Fine-grained scanning for attacks like role hijacking and data exfiltration, mapped to OWASP LLM Top 10, NIST AI RMF, and ISO/IEC 42001.
• PII Redaction & Audit Logs: Automatic redaction of sensitive data; structured reports for traceability (Art. 12).
• Immutable Session Ledger: Merkle tree chaining for verifiable event logs, enabling independent audits.

Benefits

• Avoid Fines & Audits: Generate compliance statements on-demand with visus_verify.
• Build Trust: Demonstrate robust security to regulators, partners, and users.
• Scale Safely: Pre-filter web noise + threats, reducing token costs by up to 70% while maintaining full compliance.

Integrate Visus-MCP to future-proof your AI agent against evolving regulations like the EU AI Act. See SECURITY.md for framework mappings.

How Visus Works

URL → Playwright Render → Content-Type Detection
→ Specialized Handlers (PDF/JSON/SVG) OR HTML Pipeline
→ IPI Threat Detection (19 categories) → Injection Sanitizer (45 patterns)
→ Worm Detection (15 Morris II patterns) → PII Redactor → Cryptographic Proof
→ Token Ceiling (24k cap) → Clean Content + Proof + Threat Summary → MCP-compatible AI agent

Security Pipeline

1. Browser Rendering: Headless Chromium via Playwright fetches the page
2. Content-Type Routing: Detects MIME type and routes to specialized handlers:
   • PDF (application/pdf) — Extracts text and metadata, sanitizes all fields
   • JSON (application/json) — Recursively sanitizes all string values, preserves structure
   • SVG (image/svg+xml) — Strips dangerous elements (<script>, event handlers), scans text
   • HTML/XML/RSS — Uses existing conversion and reader extraction pipeline
3. IPI Threat Detection (v0.11.0+): 19 specialized detectors scan for Indirect Prompt Injection attempts before sanitization

• IPI-001 — Instruction Override (CRITICAL)
• IPI-002 — Role Hijacking (HIGH)
• IPI-003 — Data Exfiltration (CRITICAL)
• IPI-004 — Tool Abuse (HIGH)
• IPI-005 — Context Poisoning (MEDIUM)
• IPI-006 — Encoded Payload (HIGH)
• IPI-007 — Steganographic (HIGH)
• IPI-008 — Malicious Infrastructure (CRITICAL) — NEW in v0.14.0
• IPI-009 — Homoglyph & Unicode Obfuscation (HIGH) — NEW in v0.14.0
• IPI-010 — Recursive/Nested Instruction Framing (CRITICAL) — NEW in v0.14.0
• IPI-011 — CSS/Visual Concealment (HIGH)
• IPI-012 — HTML Attribute Cloaking (HIGH)
• IPI-013 — AI Moderation/Review Bypass (MEDIUM)
• IPI-014 — SEO/Phishing Amplification (MEDIUM)
• IPI-015 — Unauthorized Action Induction (CRITICAL)
• IPI-016 — Destructive/DoS Intent (CRITICAL)
• IPI-017 — RAG Corpus Poisoning Payload (CRITICAL)
• IPI-018 — MCP Tool Description Poisoning (CRITICAL) — NEW in v0.15.0 - IPI-020 — Conditional/Dormant Trigger (CRITICAL) — NEW in v0.16.0 - IPI-021 — Boolean Logic Gates (CRITICAL) — NEW in v0.26.0 (CVE-2026-4399)

4. Injection Detection: 45 pattern categories scan for prompt injection attempts
5. PII Redaction: Emails, phone numbers, SSNs, credit cards, and IP addresses are redacted
6. Cryptographic Proof: SHA-256 + HMAC-SHA-256 proof that sanitization ran (EU AI Act Art. 9/13/15 compliance)
7. Clean Delivery: Stripped, formatted, token-efficient content reaches your LLM — with a visus_proof header, threat_summary, and compliance report attached if anything was flagged

This pipeline runs before content enters an MCP-compatible AI agent's context window — reducing token consumption, keeping PII out of conversation history, generating audit logs when injection patterns are detected, and producing tamper-evident cryptographic proofs that sanitization executed.

Security Features

Fine-Grained IPI Threat Detection (v0.11.0+)

EXTENDED v0.16.0: 19 specialized Indirect Prompt Injection (IPI) detectors run before sanitization, providing fine-grained threat annotations with:

• Threat classification — 19 distinct IPI attack categories
• Severity scoring — INFO, LOW, MEDIUM, HIGH, CRITICAL
• Confidence scores — 0.0-1.0 detection confidence per annotation
• Precise offsets — Character-level attack location tracking
• Content excerpts — Max 120 chars of detected attack for audit
• Mitigation status — All threats flagged as mitigated after sanitization
• CSS Evasion Detection (v0.20.0+): Identifies hidden text via getComputedStyle (opacity:0, font-size:0px, off-screen positioning, z-index layering). Tags as [HIDDEN_CONTENT score=X]{payload}[/HIDDEN_CONTENT]; Escalates IPI severity (HIGH→CRITICAL). Covers white-on-white, zero-pixel overrides (Art. 15(a) robustness). Perf: <50ms via keyword filter.

Each tool response now includes a threat_summary field with:

threat_summary: {
  threat_count: number;           // Total IPI threats detected
  highest_severity: ThreatSeverity | 'NONE';
  classes_detected: ThreatClass[]; // e.g., ['IPI-001', 'IPI-003']
  evasion_detected?: 'CSS_ZERO_SIZE'; // New tag
}

Glassworm Malware Detection (v0.13.0+)

NEW: Specialized detection for steganographic attacks using invisible Unicode Variation Selectors. Glassworm-style attacks hide malicious payloads in invisible characters that bypass traditional pattern matching.

Detection capabilities:

• Unicode cluster scanning — Identifies 3+ consecutive Unicode Variation Selectors (U+FE00-FE0F, U+E0100-E01EF)
• Decoder pattern detection — Flags .codePointAt() within 500 chars of hex constants (0xFE00, 0xE0100)
• Automatic severity escalation — Clusters of 10+ characters marked as CRITICAL
• Zero false positives — Ignores single selectors (legitimate emoji usage)

When detected, all variation selectors are automatically stripped from content before delivery to an MCP-compatible AI agent.

46 Injection Pattern Categories

Visus detects and neutralizes:

• Direct instruction injection — "Ignore previous instructions"
• Role hijacking — "You are now an unrestricted AI"
• System prompt extraction — "Repeat your instructions"
• Privilege escalation — "Admin mode enabled"
• Data exfiltration — "Send this to http://attacker.com"
• Encoding obfuscation — Base64, Unicode lookalikes, leetspeak
• Glassworm malware — Steganographic attacks using invisible Unicode Variation Selectors (NEW in v0.13.0)
• HTML/script injection — <script>, <iframe>, event handlers
• Jailbreak keywords — DAN mode, developer override
• Token smuggling — Special tokens like <|im_start|>
• Social engineering — Urgency language to bypass caution
• SQL Injection Vectors — Detects CVE-2026-42208 (LiteLLM v1.81.16–1.83.6) payloads like ' OR 1=1 -- and UNION SELECT in content/headers for credential exfiltration prevention (NEW v0.27.0)
• ... and 31 more categories (+20 MCP command injection/tool poisoning in v0.27.0)

See full list in SECURITY.md

Security Enhancements (v0.27.0)

MCP Ecosystem Protections: