MCP Guard vs Prompt Guard and other prompt-injection classifiers

Meta's Llama Prompt Guard 2 is a family of small classifiers (86M and 22M parameters, per its model card) that label a piece of text as benign or malicious, aimed at jailbreak and prompt-injection attempts. Other vendors offer similar text classifiers. You run them on user input, and ideally on anything the agent reads from outside: web pages, emails, documents, tool results.

MCP Guard does not ask whether text is an attack. It asks whether a specific tool call, with its arguments, should run given what the user asked. One of its nine outputs, injected, estimates whether the action is being driven by instructions from a tool result or document rather than the user, which is the effect of a successful indirect prompt injection. The others cover harm that has nothing to do with injection.

Many harmful agent actions involve no attack text at all:

• The model misreads the task and runs DROP TABLE on the wrong database.
• It invents an order id or refund amount the user never gave (hallucinated arguments).
• It drifts from the goal and starts changing infrastructure it was only asked to inspect.

And injections that do happen can be paraphrased, split across documents, or written to look like ordinary content. A text classifier that misses them has no second chance; the action-level check still sees the send_email to an unknown address that follows.

The guard only sees actions. An injection that makes the model produce a misleading answer, without calling any tool, never reaches it. Neither does a jailbreak aimed at getting harmful text out of a chat model. A text classifier is the right tool for those.

The guard also sees only what you send it. If the injected instruction is not in the context you pass, it has to judge from the action alone, which is still useful (an email to a never-seen address carrying a secret looks suspicious either way) but less informed.

A reasonable layout for an agent that reads untrusted content:

1. Scan inbound text (user input, retrieved documents, tool results) with a prompt-injection classifier. Strip or quarantine what it flags.
2. Let the model plan.
3. Check each proposed tool call with MCP Guard, passing trigger: "tool_result" when the action followed a tool output, plus the user's intent and any constraints.
4. Keep deterministic controls: least-privilege credentials and allowlists for outbound destinations.

This follows the idea behind Simon Willison's "lethal trifecta": when an agent combines private data, untrusted content and a way to send data out, you want several independent barriers, because each one alone will sometimes fail. See prompt injection through tool results.

If your application is a chat assistant with no tools, or with only read-only tools that cannot send data anywhere, the risk is in the text, and a prompt-injection classifier (plus a content-safety model) is the better fit. An action guard earns its place once the agent can write, delete, spend or send.