Every agent stack we've run was one well-crafted sentence away from handing its tools to whoever wrote the input. Retrieval chunks, issue titles, scraped pages. All untrusted text, flowing into a model that holds tool permissions. zn is our fix: a local-first gate between untrusted input and your agent. Two signals, fused at one pre-registered threshold plus deterministic rules for what's structurally true about an attack, plus a tiny neural classifier for paraphrase the rules can't see. No LLM call in the hot path. Median <5ms on CPU, prompts never leave the machine, MCP-native so you point your client at it and get back to work. We froze the eval before measuring: 217 vectors, identical thresholds. Published: 1.27% FPR / 9.42% FNR. The uncomfortable part. Meta reports ~97.5% recall @1% FPR for PromptGuard-2, and it did not transfer on our distribution. Credit where due: their pg2-86m beats us on the jailbreak slice (8.33% FNR). It's printed next to our own numbers, because "trust me" isn't a methodology. Does one thing. Fast, local, misses published. Roast the architecture and the methodology: https://usezn.com/blog/why-zns-f...

zn

zn: Local Prompt-Injection Gate for AI Agents — Rust + MCP

zn: Local Prompt-Injection Gate for AI Agents — Rust + MCP