Your agent asks for a URL or a query, and the response comes back as sanitized markdown carrying a scan verdict, a content hash, and a provenance record, written to an immutable per-key log. That log is the kind of evidence a reviewer asks for. Clearfetch is a retrieval firewall for the open web, and it is In early-access, so requesting access reserves an API key that activates at launch.
The first serious enterprise prospect sends a security questionnaire before anyone sends a contract. Among its rows: does your product access the public internet, how do you prevent indirect prompt injection, list every subprocessor that touches customer-adjacent data, and how is third-party content logged.
Those rows are no longer generic. The Cloud Security Alliance publishes an AI-specific control matrix (AICM v1.0) and an AI-CAIQ alongside it, and SIG Evolution launched in March 2026.1 Both ask for model and data provenance, and both ask you to disclose AI subprocessors by name.2
“We call fetch() on whatever URL the agent wants” is an honest answer and a disqualifying one. It describes unbounded ingress from sources nobody vetted, with no record of what came back. The follow-up questions are harder, because there is nothing to show.
The founder writing that answer usually has no security team and no appetite to build a sanitization pipeline before the deal closes.
1. Copla, guide to vendor security and risk assessment questionnaires · 2. Aetos Data on enterprise AI security questionnaires
Clearfetch does two different jobs on ingress, and they carry different guarantees. We keep them apart here, in the docs, and in the response, because a reviewer will ask which is which.
HTML is re-rendered into strict markdown. That render provably strips scripts, CSS-hidden text, zero-width characters, and document metadata, because the output format has nowhere to put them. Images are re-rendered or captioned instead of being passed through as live references.
This layer is a transform rather than a judgement, so we can name exactly what it removes. Strict markdown also drops layout and interactivity, which is the trade you are making.
Whatever survives the transform is scanned for instruction-bearing text. Every response carries a verdict of clean, sanitized, or blocked, plus the findings behind it, each with a category, a confidence, and a plain-language detail line.
Detection is statistical. We publish detection rates instead of claiming immunity, and those numbers publish with the API rather than after it, so your reviewer gets a number to compare against whatever you run today.
the retrieval rows, answered
On the allowlist row: an allowlist governs what that key retrieves through Clearfetch. It does not control what your agent does through other tools, and approved domains still get the full sanitization and scanning pipeline — an allowlist bounds where we fetch, not what we trust.
Example answers, not filings we have made for a customer.
Your reviewer has probably read the same material you have, and the researchers who track this problem do not treat it as solved. OWASP has ranked prompt injection the top risk for AI applications in two consecutive editions of its list, and writes that “it is unclear if there are fool-proof methods of prevention.”3 The UK's NCSC wrote in December 2025 that, unlike SQL injection, prompt injection “may never be totally mitigated.”4 So the answer that holds up in review names the two layers separately, publishes rates for the probabilistic one, and shows the log.
3. OWASP on prompt injection (LLM01) · 4. NCSC, “Prompt injection is not SQL injection”
A supplier knowledge-base page is the sort of thing an agent reads without anyone thinking about it. Here is the shape of the response, with the fields a reviewer tends to care about.
The content block is what the model sees. The provenance block and the request id are what you hand over when someone asks you to prove it.
These are the four questions we expect first.
Teams answer these rows themselves every day, and their mitigations are real. Evidence is the harder half: per-response scan verdicts, content hashes, and an immutable audit log your customer's security team can read.
Clearfetch is the difference between “we sanitize inputs” and “here is every URL our agents read, with a verdict on each one.”
It adds one, and it takes an unbounded set of unvetted websites out of your effective data supply chain. That trade is the point.
AI subprocessors are on the questionnaire either way. A named one with a defined scope and an audit log is a row you can answer.
Open-source scanners validate the problem, and they score content that has already been flattened. Clearfetch owns the whole retrieval path instead.
Owning the path is what makes the deterministic work possible: strict-markdown re-rendering, hidden-text and zero-width stripping, image re-rendering, with provenance and hosted audit logs on the same response.
A proxy is the right tool for some threat models. Our detection rates publish with the API, so the comparison is a number rather than an argument.
No one can guarantee a review outcome. What we hand you is the retrieval half of the answer: a deterministic sanitization layer we can describe precisely, published detection rates for the probabilistic layer, and audit logs your customer can inspect.
Reviews also cover authentication, hosting, data residency, and model choice. Clearfetch touches none of those.
Firecrawl, Tavily, Exa, and Bright Data-class APIs are engineered to maximize coverage, including getting through anti-bot defenses. That is their design goal, and they are good at it. Plenty of agent products work because of it.
Firecrawl shipped Lockdown Mode in April 2026, marketed on prompt-injection defense and approval workflows,5 so the contrast here is not that scraper-tier vendors ignore security.
The contrast is which posture is the default. Clearfetch is governance-first end to end: deterministic channel elimination, a verdict on every response, provenance, declared license status, and immutable per-key audit logs. We do not circumvent bot protections, so no part of the business pulls against that default. Pick by which default you want to explain to a security team.
For bot-walled and JavaScript-heavy targets, a scraper will retrieve more than we do, by design, because we do not circumvent. If your workload depends on that content, we are not a full replacement. Some teams will run both, with Clearfetch as the governed default path and scraper output quarantined for higher-risk review. We would rather say that before you integrate than after.
The supply-chain version of this question got sharper in July 2026, when Reddit's anti-circumvention claims survived dismissal against SerpApi, a scraping vendor in the pipeline, rather than against the AI company alone.6 Survived dismissal is the whole of it. The claims proceed and nothing has been decided on the merits. Read that as a fact about the supply chain, not as an accusation against any tool you run today.
Other vendors use “retrieval firewall” for other products, including data-loss prevention in front of vector databases. We did not coin the phrase. We use it for the open-web ingress path, meaning what your agents read.
5. Firecrawl on Lockdown Mode · 6. Bloomberg Law on Reddit v. Perplexity and SerpApi
The full product overview is on the Clearfetch home page. Field definitions and the API shape are in the docs.
Clearfetch is In early-access. Confirming your email reserves an API key in your name and tells us which problem to build against first.
We sent a confirmation link to . Click it to verify your address and reserve your API key. If it hasn't arrived in a few minutes, check spam.