zeph-sanitizer

Content sanitization, exfiltration guard, PII filtering, and quarantine for Zeph — untrusted input isolation before LLM context injection.

Overview

Implements a multi-stage security pipeline that processes all external data before it enters the LLM context window. The pipeline detects prompt injection patterns, wraps content in spotlighting XML delimiters, optionally routes high-risk sources through an isolated quarantine LLM call, and guards outbound paths against data exfiltration. Memory retrieval sources are classified via MemorySourceHint to suppress false positive injection flags on recalled user conversations and LLM-generated summaries.

Key types

Architecture

The crate is a layered defense-in-depth pipeline; each layer is independently configurable and optional except layer 1:

[!NOTE] media::MediaSanitizer is a separate, image-specific validation pipeline for MCP tool-result passthrough ([mcp.media]) — it does not sit in the text-content layer chain above and is invoked directly by zeph-mcp's tool executor when a server has media_passthrough enabled.

Sanitization pipeline (layer 1 detail)

External data
    ↓ 1. Truncate to max_content_size
    ↓ 2. Strip null bytes and control characters
    ↓ 3. Detect 17 injection patterns (OWASP variants + encoding)
    ↓ 4. Wrap in spotlighting XML delimiters
        <tool-output>…</tool-output>       (local sources)
        <external-data>…</external-data>   (external sources)

Usage

use zeph_sanitizer::{ContentSanitizer, ContentSource, ContentSourceKind};
use zeph_config::ContentIsolationConfig;

let config = ContentIsolationConfig::default();
let sanitizer = ContentSanitizer::new(&config);

let source = ContentSource::new(ContentSourceKind::WebScrape);
let result = sanitizer.sanitize("Hello world", source);

// result.body contains the wrapped, injection-cleaned text
// result.injection_flags contains any detected patterns (advisory — content is never removed)
for flag in &result.injection_flags {
    tracing::warn!("Injection detected: {}", flag.pattern_name);
}

Configuration

[security.content_isolation]
enabled = true
max_content_size = 65536     # bytes; content truncated before injection detection

[security.content_isolation.quarantine]
enabled = true
sources = ["web_scrape", "a2a_message"]  # source kinds routed through quarantine
model = "claude-haiku-4-5-20251001"   # optional; defaults to primary provider
max_tokens = 2048

[security.exfiltration_guard]
enabled = true
block_markdown_images = true
validate_tool_urls = true
block_injection_flagged_memory_writes = true

[security.pii_filter]
enabled = true    # default: true — scrubs email/phone/SSN/credit-card before LLM context and debug dumps
filter_names = false  # opt-in: higher-recall, lower-precision name heuristic

[security.content_isolation.secret_masking]
enabled = true    # default: true — vault-resolved secrets replaced with placeholders before outbound LLM calls

[!NOTE] PiiFilterConfig and SecretMaskingConfig both default to enabled = true. An operator's explicit enabled = false in an existing config.toml is always respected.

Features

zeph-memory (and transitively zeph-db) needs exactly one backend selected to compile; sqlite is the default so the crate builds in isolation.

Security metrics

ContentSanitizer exposes metrics via the shared MetricsSnapshot:

Installation

cargo add zeph-sanitizer

Documentation

Full documentation: https://bug-ops.github.io/zeph/

License

Licensed under either of MIT or Apache License, Version 2.0 at your option.