Hidden-character scanner
Prompts, skills and rules files can carry characters you cannot see but a model reads as instructions. Paste the text or give a file address. Xray shows every hidden character, decodes smuggled messages and spots look-alike letters.
GitHub and GitLab file pages are read as the raw file. The file is fetched by our server once and not kept.
Orange marks are characters you cannot see on screen. Only lines with findings are shown.
Unicode tag characters can spell a whole sentence that never shows on screen, and many models read it as an instruction. Bidi overrides make code display in a different order than it runs. A Cyrillic "а" makes a fake domain look real.
Tag characters and variation-selector payloads (decoded), zero-width runs, bidi overrides, terminal escapes, control characters, mixed-script look-alikes, styled letters, odd spaces and HTML comments, each with line and column.
Instructions written in normal visible words are not flagged, and neither is text hidden with CSS or images. Common legitimate uses (emoji sequences, flags, Arabic and Indic joiners) are left alone.
Add the MCP server https://xray.clawhard.com/mcp (tool xray_scan_text) or call the JSON API described at /openapi.json. Before an agent installs a skill, follows a rules file or merges a diff, it can pass the text or the file URL and get the same findings as this page, with any hidden message decoded as data.
Add Xray to ChatGPT, Claude, Cursor or any assistant that supports MCP, then ask it to find invisible Unicode, ASCII-smuggled instructions, bidi overrides and look-alike letters in a prompt, skill, rules file or web page, with the hidden text decoded. No key, no login.
https://xray.clawhard.com/mcpclaude mcp add --transport http clawhard-xray https://xray.clawhard.com/mcp
Press Add to Claude, or open Customize → Connectors → Add custom connector, paste the URL and leave sign-in empty.
Open Plugins → + → Add custom MCP server, paste the URL, choose No authentication, accept the warning, then Create as a plugin. Start a chat and type @ to use it.
codex mcp add clawhard-xray --url https://xray.clawhard.com/mcp
gemini mcp add --transport http clawhard-xray https://xray.clawhard.com/mcp
{
"mcpServers": {
"clawhard-xray": { "url": "https://xray.clawhard.com/mcp" }
}
}{
"servers": {
"clawhard-xray": { "type": "http", "url": "https://xray.clawhard.com/mcp" }
}
}No desktop app? Add to VS Code in the browser · VS Code Insiders · Add to Cursor in the browser
Other apps: Goose · LM Studio. Any MCP client works with the URL (Streamable HTTP, no headers).
OpenAPI (custom GPT Actions, scripts) · llms.txt · MCP server card · Agent card · All Clawhard tools in one connector
Xray shows the characters you cannot see but an AI reads: Unicode tag characters (with the hidden message decoded), zero-width characters, bidi overrides, terminal escapes and look-alike letters, with the exact line and column, plus a cleaned copy. No account.
Unicode has a block of "tag" characters (U+E0000 to U+E007F) that mirror ASCII letters but are invisible in almost every app. A sentence written in tag characters looks like nothing on screen, yet many AI models read it as normal text, so it can carry instructions inside an innocent-looking prompt, skill or web page. Xray decodes those characters back to the hidden sentence.
Paste the file into Xray or give it the file URL (a GitHub file page works). It lists every invisible character, bidi override and look-alike letter with its line and column, and decodes any hidden message. An AI agent can do the same through the MCP tool xray_scan_text before it installs the skill.
Trojan Source (CVE-2021-42574) uses Unicode bidirectional control characters such as U+202E RIGHT-TO-LEFT OVERRIDE so that code is displayed in a different order than the compiler reads it. A reviewer sees one thing and the program does another. Xray flags every bidi override and isolate.
No for the common cases: zero-width joiners inside emoji sequences, flag emoji built from tag characters, a single emoji variation selector, joiners in Arabic, Persian and Indic text, and direction marks next to Hebrew or Arabic letters are recognised as normal. Words fully in Cyrillic or Greek are only flagged inside mostly Latin text.
Yes. Add the MCP server https://xray.clawhard.com/mcp (tool xray_scan_text) or call the JSON API described at /openapi.json. It is also on the Clawhard MCP server at https://mcp.clawhard.com/mcp.
For AI assistants and developers: llms.txt · API (OpenAPI) · MCP server · sitemap