---
title: "Inspect text for security threats"
method: POST
path: "/v1/shroud/inspect-content"
tags: ["Shroud"]
---

# Inspect text for security threats

`POST /v1/shroud/inspect-content`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/shroud/inspect-content`
- Auth: HTTP bearer

Standalone content inspection (MCP `inspect_content` parity). Scans for command
injection, encoding tricks, social engineering, PII, and suspicious URLs.
Fail-closed — returns `safe: false` when high/critical threats match.
Accepts plt_ platform keys, agent JWTs, and user JWTs.

## Request body

- InspectContentRequest
  - `content` string, required
  - `context` 'input' | 'output': Inspection context (reserved for future rules)

## Response `200`

Inspection report

- InspectContentResponse
  - `safe` boolean
  - `verdict` 'clean' | 'malicious'
  - `threat_count` integer
  - `threats` object[]
    - `type` string
    - `pattern` string
    - `severity` string
  - `unicode_normalized` boolean
  - `normalized_content` string

## Other responses

- `400`: Invalid request

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)