A retrieval firewall for the open web

Approve, scan, and log every page your agent reads

Clearfetch fetches the page, strips scripts and hidden text, and returns strict markdown with an injection verdict and a record of the source, its content hash, and its license status on every response.

Request early access Read the docs

POST /v1/fetch Example

verdict

verdict sanitized content delivered, one span removed

ok true

license_status unknown no machine-readable license signal on this source

scans · findings

category prompt_injection

confidence 0.94

detail A hidden block told the reader to send its API keys to an external address. The span was removed from the returned markdown.

channels removed scripts, css_hidden_text, zero_width_chars, metadata

content

text/markdown · strict render

# Changelog — 4.2.0Webhook retries now use exponential backoff.[ removed · injected_instruction ]Existing integrations keep working unchanged.Deprecation: the v3 export endpoint stops takingnew jobs on 2026-10-01.

provenance

url https://example-vendor-notes.com/changelog

domain example-vendor-notes.com

fetched_at 2026-08-01T14:22:09Z

upstream_status 200

content_sha256 9f31c2…d7a4

request_id req_01JZ6M4T8W

More detail by use case

Drop-in safe fetch Replace an agent fetch or search tool without giving up clean markdown.
Injection defense Channels eliminated before the model reads anything, plus a verdict on what remains.
Passing a security review The web-access rows of an enterprise vendor questionnaire, answered with evidence.
Audit-ready agents Per-key logs of what your agents read, for SOC 2, ISO 42001, or EU AI Act reviews.
Licensed retrieval Provenance and declared license status on every response, without circumvention.

01 — the problem

The attack arrives as content your agent reads

In 2025 a single crafted email made Microsoft 365 Copilot hand over private files and messages from the target's mailbox and SharePoint. Nobody had to open it.1 In February 2026 a prompt injection in a GitHub issue title chained into a tampered npm package that reached roughly 4,000 developer machines.2

Researchers have shown the same pattern against assistants from Salesforce, GitHub, GitLab, Slack, and OpenAI, and against six platforms at Black Hat 2025.3 The payload arrived as ordinary content — an email, a ticket, an issue, a web page — and in several cases the data left the same way it arrived, through a URL: an image reference, or a link carrying the payload in its query string.

Prompt injection ranked as the top AI risk in two consecutive editions of the industry's standard risk list.4 Clearfetch treats every fetched page as hostile input. We re-render it into strict markdown, scan what survives, and return a verdict and a provenance record with the text.

1. Cato Networks / Aim Labs on EchoLeak (CVE-2025-32711; CVSS 9.3 as assigned by Microsoft), NVD CVE-2025-32711. · 2. Snyk on the Cline compromise. · 3. Noma on ForcedLeak in Salesforce Agentforce, Legit Security on CamoLeak in GitHub Copilot Chat, Legit Security on GitLab Duo, PromptArmor on Slack AI, The Record on ShadowLeak in ChatGPT Deep Research, Zenity Labs on AgentFlayer. · 4. OWASP Top 10 for LLM Applications — prompt injection (LLM01).

02 — the mechanism

How it works

Clearfetch does two different jobs on the way in, and they carry different guarantees. We keep them apart here, in the docs, and in the response.

Layer 1 · deterministic

Channel elimination

HTML is re-rendered into strict markdown. That render provably strips scripts, CSS-hidden text, zero-width characters, and document metadata, because the output format has nowhere to put them. Images are re-rendered or captioned instead of passed through as live references.

This layer is a transform rather than a judgement, so we can tell you exactly what it removes. Strict markdown also drops layout and interactivity, which is the trade you are making.

Layer 2 · probabilistic

Injection detection

Whatever survives the transform is scanned for instruction-bearing text. Every response carries a verdict of clean, sanitized, or blocked, plus the findings behind it, each with a category, a confidence, and a plain-language detail line.

Detection is statistical. We publish detection rates instead of claiming immunity, and those numbers publish with the API rather than after it, so you can compare Clearfetch against whatever you run today.

The UK's NCSC says this class of attack may never be totally mitigated, and that lowering the likelihood and impact of attacks is the realistic goal.1 That is why every response carries a verdict instead of a promise.

1. NCSC, “Prompt injection is not SQL injection” (Dec 2025).

03 — the receipt

Every response carries its own record

Each response carries the source URL, the declared license status, a SHA-256 hash of the content, the scan verdict, and the time of the fetch. The same records are written to an immutable per-key audit log.

Retrieval that happens inside a tool call leaves nothing behind. Logs you did not capture at the moment of the fetch cannot be reconstructed afterwards, which is why this belongs inside the retrieval layer rather than beside it.

Each key can also carry a domain allowlist that bounds what it retrieves through Clearfetch, with every policy change written to the same log as the fetches; approved domains still get the full pipeline.

That log is what you show a security reviewer working through a vendor questionnaire, an auditor collecting SOC 2 or ISO 42001 evidence, or a lawyer asking where the data came from.

on every response

url: Final URL after redirects, plus the domains it passed through.
license_status: What we can declare about the terms the content was published under.
content_sha256: Hash of the bytes we fetched, so the record can be checked later.
verdict: clean, sanitized, or blocked, with the findings behind it.
fetched_at: Time of the fetch, with the upstream HTTP status.
request_id: The call this record belongs to, matching the per-key audit log.

04 — the integration

MCP server or REST

Clearfetch returns the same markdown a fetch tool returns today, with the verdict and the provenance block attached. Point the tool at Clearfetch and the rest of your agent code stays as it is.

mcp server config

{
  "mcpServers": {
    "clearfetch": {
      "url": "https://api.clearfetch.ai/mcp",
      "headers": { "Authorization": "Bearer cf_live_…" }
    }
  }
}

rest

curl https://api.clearfetch.ai/v1/fetch \
  -H "Authorization: Bearer cf_live_…" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example-vendor-notes.com/changelog"}'

Example — endpoints activate at launch.