---
title: "veilbreaker"
description: "Deterministic, zero-dependency coverage of the latest documented (2025 to 2026) prompt-injection concealment and exfiltration TTPs. Built to pair with an ML classifier."
canonical: https://agentpluginsdirectory.com/plugins/veilbreaker
last-updated: 2026-10-23
---

# veilbreaker
Deterministic, zero-dependency coverage of the latest documented (2025 to 2026) prompt-injection concealment and exfiltration TTPs. Built to pair with an ML classifier.
- Slug: veilbreaker
- Publisher: @pixelrainbownft
- Repository: https://github.com/shagghiesuperstar/veilbreaker
- Manifest: plugin.json
- Version: 0.3.1
- License: MIT
- Category (editorial): other
- Skills: 15 (agent-worms, covert-url-dns-exfil, decode-and-follow, echoleak-markdown-exfil, encoded-payloads, getting-started, hidden-html-and-role-tokens, homoglyph-and-normalization, mcp-tool-poisoning, memory-poisoning, step-0-untrusted-content, unicode-tag-smuggling, watch-and-report, why-deterministic, zero-width-and-bidi)
- MCP servers: 1 (veilbreaker)
- Stars: 0
- Repository created: 2026-10-18
- Repository last pushed: 2026-10-21
- Publisher type: User
- Listing: https://agentpluginsdirectory.com/plugins/veilbreaker
- Schema: https://agent-plugins.org/schemas/1.0.0/plugin.schema.json

## What veilbreaker does, in the publisher's words

Deterministic, zero-dependency coverage of the latest documented (2025 to 2026) prompt-injection concealment and exfiltration TTPs. Built to pair with an ML classifier.

VeilBreaker is a zero-dependency Node MCP plugin of deterministic tools and skills. No model is involved in any decision. Every finding carries a severity and an id. Every TTP finding also carries a citation; operational notes (VB-I01 size cap, VB-I02 unsupported input) do not.

- VeilBreaker does not stop every prompt injection. It targets specific, documented techniques that hide instructions or smuggle data out.
- Out of scope: reworded or purely semantic attacks in plain visible text, and split / multi-message payloads (an attack spread across several messages, files, pages or tool results that only becomes harmful when combined). Each scan call looks at one input on its own. Images, audio and PDFs are also out of scope: binary input returns unsupported.

From the project README, punctuation lightly normalized. Full text: https://raw.githubusercontent.com/shagghiesuperstar/veilbreaker/HEAD/README.md

## MCP servers

- veilbreaker: transport: stdio; command: node ${CURSOR_PLUGIN_ROOT}/server/index.mjs; env: VEILBREAKER_MODE, VEILBREAKER_PIN_FILE, VEILBREAKER_LOG

Read from the plugin's own mcp.json. Environment variable names only, never values.