# Your agent can't safely read a web page it hasn't read yet > Source: > Published: 2026-07-28 10:01:27+00:00 ``` GET https://api.trustsource.cc/safefetch?url= ``` `SAFE` / `REVIEW` / `BLOCK` prompt-injection verdict.`BLOCK` → discard the content. `REVIEW` → use as data, never as instructions. `SAFE` → use normally.`402` with a `PAYMENT-REQUIRED` header. Sign the EIP-3009 authorization it describes and repeat the same request with an `X-PAYMENT` header.That's everything you need to call it. The rest explains how it decides. You want to know whether a page is safe **before** your model reads it. But the usual way to find out is to ask the model — which means feeding it the page. If the page contains a prompt injection, you've already lost. The attack runs the moment the text enters the context window. `fetch()` gives you no verdict. It hands your agent a string and hopes for the best. SafeFetch fetches the URL server-side, separates what a human would actually see from what's concealed in the markup, scans both, and returns clean text plus a verdict: ``` { "url": "https://example.com/", "verdict": "BLOCK", "risk": 0.95, "reasons": ["instruction override concealed in hidden content (matched in hidden content)"], "injection": { "detected": true, "techniques": ["instruction_override"], "findings": [ { "technique": "instruction_override", "placement": "hidden", "severity": 0.95, "weight": 0.95 } ] }, "content": { "text": "…sanitized page text…", "truncated": false } } ``` Your agent branches on one field instead of reasoning about raw HTML. **SAFE** means nothing concealed and aggregate risk under 0.25. **REVIEW** means risk between 0.25 and 0.7, or a content type that couldn't be scanned, or a low-trust host. **BLOCK** means a critical technique found in hidden or comment placement, or risk ≥ 0.7. This is the part that makes it usable in production. A blog post *about* prompt injection contains the exact phrases an injection scanner looks for. A naive keyword filter flags every security article on the internet and becomes noise you learn to ignore. SafeFetch weights each finding by **where** it was found — `hidden` 1.0, `comment` 0.95, `accessibility` 0.6, `metadata` 0.55, `script` 0.5, `visible` 0.2 — and caps visible-text hits in aggregate. So "ignore all previous instructions" printed in an article body scores low, while the same string in a `display:none` div scores high. Concealment *is* the signal. Nobody hides text from humans for a benign reason. Eleven techniques: `instruction_override` , `system_prompt_exfil` , `data_exfiltration` , `delimiter_spoof` , `encoded_payload` , `tool_call_bait` , `role_hijack` , `homoglyph_obfuscation` , `unicode_tag_smuggling` , `invisible_unicode` , `bidi_override` . That covers instructions buried in `display:none` elements, HTML comments and `alt` attributes; invisible Unicode-Tag (U+E0000) and zero-width smuggling; homoglyph and base64-encoded payloads; ChatML / `[INST]` delimiter spoofing; markdown-image exfiltration; and tool-call bait. Payloads split across several hidden elements are reassembled and scanned as one string, so chunking the attack doesn't evade it. The 402 response names the scheme (`exact` ), the network (`eip155:8453` — Base mainnet), the amount (`10000` atomic units, i.e. $0.01 USDC), the USDC contract, and the address to pay. The agent signs an EIP-3009 `transferWithAuthorization` for that exact amount, base64-encodes it, and repeats the identical request with an `X-PAYMENT` header. The facilitator settles on-chain and the endpoint returns `200` . Same URL twice, one extra header, one signature. No session, no nonce to track, and an abandoned 402 costs nothing. Any x402-aware HTTP client handles this for you. `injection.findings` are defanged for display. They're evidence, not instructions.One successful injection against an agent with tools, a wallet, or memory is worth considerably more than $0.01 to an attacker. SafeFetch is one of seven verification endpoints at [trustsource.cc](https://trustsource.cc) — the others cover URL safety verdicts, email spoofability, domain trust, TLS certs, security headers, and AI-crawler policy.