Skip to main content
The Azure Prompt Shields template connects Microsoft’s Prompt Shields to MCP Manager as a custom rule engine. Prompt Shields detects prompt-injection and jailbreak attacks. MCP Manager sends each screened tool call or tool result to your Azure AI Content Safety resource and blocks the message when Azure reports an attack. Add it from Rule Engines → Add → Azure Prompt Shields.
This page summarizes Prompt Shields so you can decide how to use it with MCP Manager. Microsoft owns the service and changes it over time. Treat the Prompt Shields documentation as the authoritative source for what it detects, its limits, regions, and pricing.
Prompt Shields and Azure AI Content Safety run on the same Azure resource and use the same key. Prompt Shields looks for attacks on the agent; Content Safety looks for harmful content (hate, sexual, violence, self-harm). You can add both as separate engines and attach each to its own rule.

​
What Prompt Shields detects

Prompt Shields is a classifier, not a pattern list. It recognizes attack intent in phrasings it has not seen before. It looks for two kinds of attack:
  • Direct attacks (jailbreaks) — text that tries to make the model ignore its instructions or safety rules, for example “ignore all previous instructions and…”.
  • Indirect attacks — instructions hidden inside third-party content, such as a document, email, web page, or tool result, that try to take over the agent when it reads that content.
The second kind matters most for MCP. A tool result is third-party content that your agent reads and acts on, which makes it a common path for indirect prompt injection.

​
How MCP Manager screens each direction

MCP Manager maps each detection hook to the Prompt Shields input that fits it: The engine pre-selects both directions when you add a rule that uses it, because prompt attacks can arrive either way. You can change this per rule.

​
What you need from Azure

1

Create a Content Safety resource

In the Azure portal, create an Azure AI Content Safety resource (create one here). If you already have one for Azure AI Content Safety, reuse it.
2

Copy the endpoint and a key

Open the resource and go to Keys and Endpoint. Copy the Endpoint, which looks like https://<resource>.cognitiveservices.azure.com/, and KEY 1 or KEY 2.
Use the resource endpoint on *.cognitiveservices.azure.com. The regional endpoint (<region>.api.cognitive.microsoft.com) is not supported, because it does not accept a resource key. MCP Manager rejects it when you save.

​
Connecting it in MCP Manager

In the Azure Prompt Shields rule-engine form, enter:
  • Resource endpoint — the endpoint you copied. The resource name alone (for example my-resource) also works.
  • Azure key — KEY 1 or KEY 2. MCP Manager sends it in the Ocp-Apim-Subscription-Key header.
You don’t enter the endpoint URL or the HTTP method. MCP Manager builds the URL from the resource name and fixes the method to POST:

​
How the key is protected

  • The key is stored encrypted at rest. Only the gateway reads it, when it makes a call.
  • Before every call, the gateway checks that the URL is exactly this Azure endpoint. The key is never sent anywhere else, and the gateway does not follow redirects.
  • If you change the endpoint later, MCP Manager asks you to enter the key again. A stored key never moves to a new endpoint.
  • MCP Manager authenticates with a resource key. Microsoft Entra ID tokens are not supported.

​
How it behaves as a rule

Once saved, the engine appears in the Detection method dropdown on any gateway rule. On the rule’s detection hook, MCP Manager sends the tool call or tool result to Prompt Shields and acts on the result: Prompt Shields only detects. It never rewrites text, so it never modifies a message. To try the engine on real traffic before you enforce it, set the rule’s On detection to Warn only. The call then goes through unchanged, and you get an alert that shows what Prompt Shields would have blocked. See On detection: enforce or warn only. You can also test the engine with sample text before you attach it to a gateway.

​
Size limit

Azure screens at most 10,000 characters (Unicode code points) per call. When a tool call’s arguments or a tool result is longer, MCP Manager does not send it. The rule’s failure mode decides what happens instead, so with the default Block an oversized message is blocked. Warn only does not change this: it applies to detections, not to messages the engine could not screen.
When a tool result holds JSON as text, MCP Manager screens the decoded values. If the decoded form is over the limit but the original text fits, MCP Manager screens the original text instead.

​
Cost

Prompt Shields calls are billed by Microsoft Azure on your Content Safety resource, under Azure’s pricing. Each screened tool call or tool result is one call. See Azure AI Content Safety pricing for current rates and the free tier.
MCP Manager does not meter or charge per call for routing traffic to Prompt Shields, as long as your plan includes custom rule engines.

​
Further reading

Azure AI Content Safety

Block hate, sexual, violent, and self-harm content with the same Azure resource.

Lakera Guard

Another classifier-based engine for prompt injection, jailbreaks, and PII.

Custom Rule Engines

How custom engines are added, tested, and applied to gateway rules.

Gateway Rules Overview

Detection methods, hooks, failure modes, actions, and rule ordering.

​
External sources

Prompt Shields

Azure AI Content Safety overview