For programmers

Text hygiene as an MCP server

Let Claude Code, Cursor, Cline, and other AI tools clean text before they feed it to an LLM — strip invisible characters and flag prompt injection. The same engines behind noatmark.com, in a single noatmark-mcp package.

📦 npm noatmark-mcp ⚙️ 3 tools sanitize · scan · clean_format 🔒 local — nothing leaves your machine

What it does

Tool	What it does
`sanitize_text`	Strip invisible/zero-width chars + flag prompt-injection patterns before feeding text to an LLM
`scan_text`	Report hidden characters, injection risks, and hidden-text HTML signals
`clean_format`	Clean LLM formatting: line endings, blank lines, stray fences, heading depth

Install & configure

npm install -g noatmark-mcp

Then add it to your AI tool:

Claude Code

# claude mcp add noatmark -- npx -y noatmark-mcp

Cursor / Cline (MCP config)

{
  "mcpServers": {
    "noatmark": {
      "command": "npx",
      "args": ["-y", "noatmark-mcp"]
    }
  }
}

Why use it

Prevent prompt injection. Untrusted text you paste into a prompt (a resume, a web page, a PDF) can carry hidden instructions. sanitize_text flags them before they reach the model.
Clean hidden characters. Invisible zero-width chars break string matching and code. Sanitizing before the model sees them keeps your context clean.
Deterministic & local. It's a fixed algorithm, not another AI call — runs on your machine, never sends your text anywhere.

Honest limits

Injection patterns are flagged, not auto-deleted — removing natural-language injection would corrupt legitimate content. Review flagged text yourself.
This is a heuristic — it catches common patterns, not every possible attack. It can't remove statistical AI watermarks. See why.

Prefer a REST API?

There's also POST /api/sanitize and the rest of the text hygiene API for pipelines that aren't MCP.