RedCell
LIVEA scanner that tells a model obeying an injected instruction apart from one merely quoting it.
RedCell is an automated red-team scanner for LLM applications and the MCP (Model Context Protocol) agents built on top of them. It runs a battery of adversarial probes mapped to the OWASP LLM Top 10 and produces a graded report of where a target model or agent can be manipulated.
The problem
Most "prompt-injection detectors" are trivially fooled in both directions. They flag a model for repeating an attacker string even when it is safely quoting it, and they miss cases where the model actually acts on an injected instruction without echoing it. The result is noise: findings a security team cannot trust and will quickly ignore.
MCP makes the stakes concrete. An MCP server exposes real tools an agent can call, so an indirect injection is not a hypothetical — it can trigger an actual side effect. That demands testing that measures behaviour, not string similarity.
The approach
RedCell separates obedience from quotation by probing for the effect of an injected instruction rather than its presence in the output. For MCP targets it performs live excessive-agency testing: it presents the agent with instructions that should be refused and checks whether a tool actually fires.
Every probe maps to a specific OWASP LLM Top 10 category, and each finding carries a verdict and severity so a reviewer sees root cause, not a wall of raw transcript.
Result
Against hardened controls RedCell reports zero false positives — the bar that makes a scanner usable in practice, because a security team can act on every finding it raises. The scan output grades a target end to end (e.g. risk grade F with 20 findings on a deliberately vulnerable mock) and lays results out as a scannable table rather than logs to sift through.