How inject0 checks fetched content
inject0 is the local check in the poison0 agent (from poison0 agent 1.16.56). It checks fetched content for prompt injection before the agent acts on them, on the device. The service for your own applications is called inject0 Gateway and is a separate product.
What is checked
inject0 checks the result of a tool after it ran and before the agent reads it (hook PostToolUse). inject0 does not check your own input.
| Fetched content | Checked | Note |
|---|---|---|
| Web fetches | yes | For WebFetch in Claude Code the hook only sees the summary the tool writes. |
| Web search | yes | The list of search results |
| MCP tools | yes | Every result of an MCP server |
| Shell output | yes | The output of commands such as curl or git log |
| File reads | yes | Also search hits with file content, such as Grep in content mode |
| File lists | no | Glob, LS and Grep with file names only carry no content. |
Melira scores the whole text on the device with a score between 0.000 and 1.000. At or above the alarm threshold the result counts as a hit. No path is exempt.
Levels
| Level in the console | Value | Effect of a hit |
|---|---|---|
| Off | off | No check. Fetched content reaches the agent unchecked. |
| Observe | observe | The hit is written to the local audit. The agent gets the result unchanged. |
| Mark | hint | The result stays. The agent is told not to follow instructions in it. |
| Remove (default) | redact | The agent gets a short notice instead of the result. The text stays on the device. |
What Remove does
- The agent gets a notice with the score and the threshold instead of the whole result.
- The text is kept as a plain file in your own data folder:
~/.poisonzero/inject0-withheld, on Windows%LOCALAPPDATA%\PoisonZero\inject0-withheld. The notice names the file. - The files are not encrypted and do not expire. Delete them yourself when needed.
- If the agent reads such a file later, inject0 checks it again.
Alarm threshold
| Item | Value |
|---|---|
| Default | 0.30, allowed range 0.20 to 0.40 |
| Cloud devices | PoisonZero sets a different threshold for your account on request. |
| Private devices | A different threshold is part of the signed client-config.json. |
| On the device | The command poisonzero inject0 threshold shows the value and its source but does not change it. |
When a check cannot run
| Situation | Remove | Mark | Observe |
|---|---|---|---|
| Time budget exceeded, model still loading, engine error or result larger than 8 MiB | Result withheld, named as unchecked | Note “not checked” | Result unchanged, audit entry |
| PoisonZero service not reachable | Result withheld | Note “not checked” | Result unchanged |
If Melira is not installed on the device yet, inject0 checks nothing. The agent is then told once per session that fetched content is unchecked. poisonzero doctor names the reason.
Supported agents
inject0 uses the same hook entries as exec0 and leak0.
| Agent | What is checked | Effect |
|---|---|---|
| Claude Code | All results listed above | Remove and Mark. For WebFetch only the summary. |
| Codex (CLI and IDE) | All results listed above | Remove replaces the whole result with the notice. |
| Gemini CLI | All results listed above | Remove replaces the whole result. The note of Mark is shown to you only, not to the model. |
| Cursor | Only results of MCP tools | Remove and Mark |
| Antigravity CLI | None | No effect: the hook does not receive the fetched content. |
Working with leak0
When leak0 redacts a secret value in fetched content, inject0 checks the redacted version. inject0 never sees the secret value.
Settings
| Plan and device | Setting |
|---|---|
| Enterprise, cloud devices | Console: Settings → Profiles, Edit on the profile, tab inject0: the switch On and the Level. Devices take the setting at their next sync. |
| Enterprise, private devices | The level is part of the signed client-config.json from Export for private devices. Rollout: Installing the poison0 agent. |
| Pro and Solo Dev | Always on, at the level Remove |
| On the device | No local switch. poisonzero status shows the level and whether the check runs. |
Audit
| In the console | Action | Meaning | Console audit (cloud mode) |
|---|---|---|---|
| Withheld | inject0_withheld | Hit, the result was withheld | yes |
| Marked | inject0_marked | Hit at the level Mark | yes |
| Not checked | inject0_unchecked | The check did not finish | yes |
| Observed | inject0_observed | Hit at the level Observe | no, local only |
Fields per entry: time, agent, tool, size of the result, score, threshold, level and decision. Never included: the text, URLs and paths.
Privacy
| Data | Cloud mode | Private mode |
|---|---|---|
| Text of the fetched content | Checked on the device, never sent | Checked on the device, never sent |
| Withheld text | Only in your own data folder | Only in your own data folder |
| Audit entry, without content | On the device and in the console | On the device only |
| Model | Downloaded by the poison0 agent | Arrives with the licence check about every 30 days, with no extra request |
Full list: What cloud mode sends.
Availability
| Item | Value |
|---|---|
| Version | From poison0 agent 1.16.56 |
| Plans | Solo Dev, Pro and Enterprise |
| Hardware | Runs on the CPU. No GPU is needed. |
Further reading
For your own applications and LLM gateways: inject0 Gateway. Harmful tool calls: exec0. Secret leaks: leak0.