PromptShield

AI security gateway built with Cursor that detects prompt injection, credential leaks, jailbreaks, and unsafe queries—then sanitizes or blocks them before they reach Gemini or production

Comment

Project Story: PromptShield from StackSmith

💡 Inspiration

When developers use AI-first IDEs like Cursor to rapidly construct full-stack applications, two critical bottlenecks emerge at opposite ends of the lifecycle:

  1. Scaffolding Friction: Translating an initial concept into a production-ready, multi-service architecture (database, multi-model LLM routing, transactional email, edge hosting) involves tedious boilerplate and manual credential management.
  2. Runtime Security & Token Bleed: Autonomous coding agents and LLM gateways frequently process untrusted user inputs that leak raw credentials (such as production Stripe keys or AWS secrets), fall victim to prompt injections, or enter runaway tool recursion loops that rapidly drain API budgets.

We built Stacksmith (featuring the PromptShield Neural Ingress Engine) at Cursor Dhaka: Build with Cursor to address both frontiers in a unified developer environment. It acts as an autonomous cloud architecture forge for the Stripe Projects (projects.dev) catalog and a sub-millisecond zero-trust ingress firewall.

⚙️ How We Built It

We used Cursor with Next.js 14 (App Router), TypeScript, and Tailwind CSS to design a high-density, low-latency developer security workbench.

                  ┌──────────────────────────────────────────────┐
                  │      Stacksmith Developer Console (Next.js)  │
                  └──────────────┬────────────────┬──────────────┘
                                 │                │
            [Architecture Forge] │                │ [PromptShield Ingress]
                                 ▼                ▼
                  ┌────────────────────────┐    ┌────────────────────────┐
                  │  Stripe Projects CLI   │    │  Zero-Trust AST Engine │
                  │  Recipe Generator      │    │  Regex & Heuristic HUD │
                  └──────────────┬─────────┘    └────────────┬───────────┘
                                 │                           │ (Pass / Clean)
                                 ▼                           ▼
                  ┌────────────────────────┐    ┌────────────────────────┐
                  │  Supabase / OpenRouter │    │  Google GenAI Engine   │
                  │  Vercel Deploy Config  │    │  (Gemini 2.5 Flash)    │
                  └────────────────────────┘    └────────────────────────┘
  • The Architecture Forge: Synthesizes natural-language application prompts into full cloud blueprints targeting verified Stripe Projects catalog items (openrouter/api, supabase/database, resend/email, vercel/deploy). It outputs automated CLI recipes (stripe projects add ..., stripe projects env --pull) and shareable encoded URLs.
  • PromptShield Neural Ingress Shield (/api/v1/chat): Intercepts raw prompts before upstream model dispatch. It evaluates incoming payloads across four threat tiers (SAFE, LOW, MEDIUM, DEFCON_1) to quarantine credential leaks, jailbreak vectors, and SQL injection probes.
  • Google Gemini Integration: Connected to gemini-2.5-flash via the @google/genai SDK with multi-key failover and resilient offline fallback synthesis.
  • Unit Test Coverage: Verified JSON AST extractors (extract-json.ts), plan-sharing encoders (plan-share.ts), and Markdown plan renderers (plan-markdown.ts) using Vitest.

📐 Threat Evaluation & Economics Model

PromptShield uses a zero-trust heuristic evaluation model to determine the risk coefficient $R(p)$ for any input prompt $p$:

$$R(p) = \max_{i} \left( w_i \cdot \mathbb{I}_{{p \in \mathcal{T}_i}} \right)$$

Where:

  • $\mathcal{T}_i$ represents threat categories (Credential Exfiltration, Jailbreak Signatures, SQL Injection AST, Recursive Loops).
  • $w_i \in [0, 100]$ is the calibrated severity weight:
    • $w_{\text{Credential}} = 99 \implies \text{DEFCON 1}$
    • $w_{\text{Jailbreak}} = 96 \implies \text{DEFCON 1}$
    • $w_{\text{Tool Injection}} = 78 \implies \text{MEDIUM}$
    • $w_{\text{Clean Query}} \le 10 \implies \text{SAFE}$

When a threat is intercepted ($R(p) \ge 75$), upstream LLM dispatch is aborted. The total cost savings $\Delta C$ and rescued tokens $T_{\text{rescued}}$ are calculated in real time:

$$\Delta C = \left( \frac{T_{\text{rescued}}}{1000} \right) \times P_{\text{token}}$$

Where $P_{\text{token}}$ represents the weighted price per 1,000 prompt/completion tokens. Total request processing time satisfies:

$$T_{\text{total}} = T_{\text{guardrail}} \ll 3\text{ ms}$$

Preventing token consumption entirely whenever malicious ingress is detected.

🧗 Challenges We Faced

  1. Regional Merchant Payment Workarounds: Because standard Stripe accounts cannot be directly activated in our local region, we designed our architecture around Stripe Projects (projects.dev), unlocking CLI-driven developer provisioning across Supabase, OpenRouter, and Vercel without requiring local credit card registration.
  2. Sub-Millisecond Guardrail Latency: Ensuring that ingress security checks did not introduce latency into streaming responses required optimizing our AST and regular expression passes down to $\le 2\text{ ms}$.
  3. Resilient JSON AST Extraction: Upstream LLMs frequently wrap structured output in noisy Markdown code fences or conversational prose. We implemented a deterministic parser (lib/extract-json.ts) backed by automated unit tests to guarantee clean parsing across all models.
  4. Multi-Key Rate-Limit Failovers: Implemented a resilient rotation engine across GEMINI_API_KEY_1, GEMINI_API_KEY_2, and fallback configurations to gracefully absorb transient 429 quota exhaustion during live demonstrations.

📚 What We Learned

  • Cursor Agent Orchestration: Leveraging Cursor Composer to parallelize full-stack scaffolding, refactoring complex multi-route handlers, and generating clean TypeScript interfaces.
  • Zero-Trust Ingress Patterns: How to implement pre-flight sanitization and token preservation mechanics in production AI agent workflows.
  • Stripe Projects Ecosystem: Utilizing the Stripe Projects CLI to provision databases, model routers, and deployment targets through unified environment variable pulls.

🔮 What's Next

  • Model Context Protocol (MCP) Server: Expose the PromptShield firewall directly as an MCP tool for Cursor and Claude Desktop.
  • Edge Semantic Caching: Integrate Upstash Redis vector caching to store deterministic responses and achieve $0 token costs on repeated queries.
  • Automated GitHub PR Provisioner: Automatically generate repository scaffolds and deployment workflows directly from forged architecture plans.

Built With

Share this project:

Updates

Submission history