> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mcpmanager.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Prompt Shields

> How to connect Azure AI Content Safety Prompt Shields to MCP Manager as a custom rule engine: what it detects, how tool calls and tool results are screened, the resource endpoint and key setup, size limits, and how its verdict drives a gateway rule.

The **Azure Prompt Shields** template connects Microsoft's Prompt Shields to MCP Manager as a [custom rule engine](https://docs.mcpmanager.ai/features/gateway-rules/custom-rules-engines.md). Prompt Shields detects **prompt-injection and jailbreak attacks**. MCP Manager sends each screened tool call or tool result to your Azure AI Content Safety resource and blocks the message when Azure reports an attack. Add it from **Rule Engines** → **Add** → **Azure Prompt Shields**.

> [!NOTE]
>
> This page summarizes Prompt Shields so you can decide how to use it with MCP Manager. Microsoft owns the service and changes it over time. Treat the [Prompt Shields documentation](https://learn.microsoft.com/en-us/azure/ai-services/content-safety/concepts/jailbreak-detection) as the authoritative source for what it detects, its limits, regions, and pricing.

> [!TIP]
>
> Prompt Shields and [Azure AI Content Safety](https://docs.mcpmanager.ai/features/azure-ai-content-safety.md) run on the **same Azure resource** and use the **same key**. Prompt Shields looks for attacks on the agent; Content Safety looks for harmful content (hate, sexual, violence, self-harm). You can add both as separate engines and attach each to its own rule.

## What Prompt Shields detects

Prompt Shields is a classifier, not a pattern list. It recognizes attack intent in phrasings it has not seen before. It looks for two kinds of attack:

* **Direct attacks (jailbreaks)** — text that tries to make the model ignore its instructions or safety rules, for example "ignore all previous instructions and…".
* **Indirect attacks** — instructions hidden inside third-party content, such as a document, email, web page, or tool result, that try to take over the agent when it reads that content.

The second kind matters most for MCP. A tool result is third-party content that your agent reads and acts on, which makes it a common path for indirect prompt injection.

## How MCP Manager screens each direction

MCP Manager maps each [detection hook](https://docs.mcpmanager.ai/features/gateway-rules/overview.md#detection-hook-when-a-rule-fires) to the Prompt Shields input that fits it:

| Direction | What MCP Manager sends | Prompt Shields treats it as |
| - | - | - |
| **Request** | The tool call's arguments | The user prompt — checked for a direct attack |
| **Response** | The tool result | A document — checked for an indirect attack |

The engine pre-selects **both** directions when you add a rule that uses it, because prompt attacks can arrive either way. You can change this per rule.

## What you need from Azure

**1. Create a Content Safety resource**

In the Azure portal, create an **Azure AI Content Safety** resource ([create one here](https://aka.ms/acs-create)). If you already have one for [Azure AI Content Safety](https://docs.mcpmanager.ai/features/azure-ai-content-safety.md), reuse it.

**2. Copy the endpoint and a key**

Open the resource and go to **Keys and Endpoint**. Copy the **Endpoint**, which looks like `https://<resource>.cognitiveservices.azure.com/`, and **KEY 1** or **KEY 2**.

> [!WARNING]
>
> Use the resource endpoint on `*.cognitiveservices.azure.com`. The regional endpoint (`<region>.api.cognitive.microsoft.com`) is **not supported**, because it does not accept a resource key. MCP Manager rejects it when you save.

## Connecting it in MCP Manager

In the **Azure Prompt Shields** rule-engine form, enter:

* **Resource endpoint** — the endpoint you copied. The resource name alone (for example `my-resource`) also works.
* **Azure key** — KEY 1 or KEY 2. MCP Manager sends it in the `Ocp-Apim-Subscription-Key` header.

You don't enter the endpoint URL or the HTTP method. MCP Manager builds the URL from the resource name and fixes the method to POST:

```text theme={null}
https://<resource>.cognitiveservices.azure.com/contentsafety/text:shieldPrompt?api-version=2024-09-01
```

### How the key is protected

* The key is stored **encrypted at rest**. Only the gateway reads it, when it makes a call.
* Before every call, the gateway checks that the URL is exactly this Azure endpoint. The key is never sent anywhere else, and the gateway does not follow redirects.
* If you change the endpoint later, MCP Manager asks you to enter the key again. A stored key never moves to a new endpoint.
* MCP Manager authenticates with a resource key. Microsoft Entra ID tokens are not supported.

## How it behaves as a rule

Once saved, the engine appears in the **Detection method** dropdown on any gateway rule. On the rule's detection hook, MCP Manager sends the tool call or tool result to Prompt Shields and acts on the result:

| Prompt Shields result | What MCP Manager does |
| - | - |
| No attack detected | **Pass** — the message continues unchanged. |
| Attack detected | **Block** — the call never reaches the server, or the result never reaches the client. The alert and [logs](https://docs.mcpmanager.ai/features/viewing-logs.md) say whether the attack was found in the tool call arguments or in the tool result. |
| Nothing to screen (empty arguments or result) | **Pass**, without calling Azure. |
| Azure is unreachable, returns an error, or returns a response MCP Manager can't read | Handled by the rule's [failure mode](https://docs.mcpmanager.ai/features/gateway-rules/overview.md#failure-mode-what-happens-when-a-detection-method-fails). The default is **Block**. Azure's error code and message appear on the alert. |

Prompt Shields only detects. It never rewrites text, so it never **modifies** a message.

To try the engine on real traffic before you enforce it, set the rule's **On detection** to **Warn only**. The call then goes through unchanged, and you get an alert that shows what Prompt Shields would have blocked. See [On detection: enforce or warn only](https://docs.mcpmanager.ai/features/gateway-rules/overview.md#on-detection-enforce-or-warn-only).

You can also [test](https://docs.mcpmanager.ai/features/gateway-rules/custom-rules-engines.md#testing-an-engine) the engine with sample text before you attach it to a gateway.

## Size limit

Azure screens at most **10,000 characters** (Unicode code points) per call. When a tool call's arguments or a tool result is longer, MCP Manager does not send it. The rule's **failure mode** decides what happens instead, so with the default **Block** an oversized message is blocked. **Warn only** does not change this: it applies to detections, not to messages the engine could not screen.

> [!NOTE]
>
> When a tool result holds JSON as text, MCP Manager screens the decoded values. If the decoded form is over the limit but the original text fits, MCP Manager screens the original text instead.

## Cost

Prompt Shields calls are billed by **Microsoft Azure** on your Content Safety resource, under Azure's pricing. Each screened tool call or tool result is one call. See [Azure AI Content Safety pricing](https://azure.microsoft.com/en-us/pricing/details/cognitive-services/content-safety/) for current rates and the free tier.

> [!NOTE]
>
> MCP Manager does **not** meter or charge per call for routing traffic to Prompt Shields, as long as your plan includes custom rule engines.

## Further reading

> **[Azure AI Content Safety](https://docs.mcpmanager.ai/features/azure-ai-content-safety.md)**
>
> Block hate, sexual, violent, and self-harm content with the same Azure resource.

> **[Lakera Guard](https://docs.mcpmanager.ai/features/lakera-guard.md)**
>
> Another classifier-based engine for prompt injection, jailbreaks, and PII.

> **[Custom Rule Engines](https://docs.mcpmanager.ai/features/gateway-rules/custom-rules-engines.md)**
>
> How custom engines are added, tested, and applied to gateway rules.

> **[Gateway Rules Overview](https://docs.mcpmanager.ai/features/gateway-rules/overview.md)**
>
> Detection methods, hooks, failure modes, actions, and rule ordering.

## External sources

> **[Prompt Shields](https://learn.microsoft.com/en-us/azure/ai-services/content-safety/concepts/jailbreak-detection)**

> **[Azure AI Content Safety overview](https://learn.microsoft.com/en-us/azure/ai-services/content-safety/overview)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.