Unicode smuggling check for strings (prompts, tool args, URLs)

Overview

Checks up to 100 strings in one call against the 19 deterministic rules of unicode-safety-check: bidi controls (Trojan Source), invisible and zero-width characters, tag-character and variation-selector payloads, homoglyph and mixed-script hosts or names. Built for an agent's hot path: run it on a prompt, a tool argument, a URL or a model output before acting on it. Returns BLOCK / REVIEW / NO_FINDING per string with the code point and position. Pure code, no model.

Health