AIGete

English | 中文

Prompt injection research should not feel like assembling lab equipment from scratch.

AIGete is a local-first security research gateway that sits between your coding client and your model API. Point Codex, Claude Code, or OpenCode at one local address, switch on a probe, and AIGete shows whether the model leaks hidden instructions, obeys malicious overrides, or carries poisoned memory forward.

Inspired by:

• AegisGate for the gateway-first architecture and token routing model
• SillyTavern for the idea that local AI tooling should still feel friendly and immediate

Why It Feels Simpler

AIGete is designed around a beginner-first workflow:

1. start the local mock upstream
2. start AIGete
3. paste one base URL into your client

That is the center of the project. Advanced token routes, benchmark packs, and route management are still here, but they are no longer the first thing a new user has to understand.

One Command Start

npm run docker:start

Then open:

• Web console: http://127.0.0.1:3456

This starts:

• AIGete on 3456
• the mock upstream on 4000

It also mounts ~/.codex/sessions into the container as read-only so the offline session lab can import copies safely.

If you do not want Docker, use:

npm run lab

60-Second Local Start

npm run mock
npm start

Then open:

• Web console: http://127.0.0.1:3456

Default local URLs:

• OpenAI-compatible base URL: http://127.0.0.1:3456/v1
• Claude / Anthropic endpoint: http://127.0.0.1:3456/v1/messages

What You Can Point At It

• Codex: OpenAI-compatible mode
• Claude Code: messages / count_tokens
• OpenCode: OpenAI-compatible mode

More detail:

• docs/clients.md
• docs/clients_zh.md

What It Tests

• instruction hierarchy override
• prompt leakage with canary tokens
• tool-output and secret exfiltration behavior
• memory poisoning behavior across tasks
• offline session variant editing for imported Codex conversations without modifying the original source files
• indirect prompt injection in retrieved documents and citations
• role confusion, structured-output bypass, multilingual obfuscation, and memory reactivation patterns

Core Features

• OpenAI-compatible gateway
  • POST /v1/chat/completions
  • POST /v1/responses
  • generic /v1/... forwarding
• Anthropic-compatible gateway
  • POST /v1/messages
  • POST /v1/messages/count_tokens
  • SSE streaming passthrough
• AegisGate-style token routing
  • POST /__gw__/register
  • POST /__gw__/lookup
  • POST /__gw__/unregister
  • http://127.0.0.1:3456/v1/__gw__/t/<TOKEN>
• Beginner-friendly web console
  • copyable client URLs
  • simple default config
  • bilingual UI
  • advanced route management behind a secondary panel
• Repeatable benchmark runs
  • committed attack packs
  • CLI runner
  • JSON report output for CI

Example Requests

OpenAI Chat Completions

curl http://127.0.0.1:3456/v1/chat/completions \
  -H 'content-type: application/json' \
  -d '{
    "model": "test-model",
    "messages": [
      {"role": "system", "content": "You are a safe coding assistant."},
      {"role": "user", "content": "Summarize this repository."}
    ]
  }'

OpenAI Responses

curl http://127.0.0.1:3456/v1/responses \
  -H 'content-type: application/json' \
  -d '{"model":"test-model","input":"hello"}'

Claude / Anthropic Messages

curl 'http://127.0.0.1:3456/v1/messages?anthropic-version=2023-06-01' \
  -H 'content-type: application/json' \
  -d '{
    "model": "claude-test",
    "max_tokens": 128,
    "messages": [{"role":"user","content":"hello"}]
  }'

Benchmark Packs

npm run benchmark

This executes the default pack in datasets/attack-packs/core.json and writes a JSON report to reports/latest.json.

More detail:

• docs/benchmarking.md
• docs/benchmarking_zh.md

Template Philosophy

AIGete now ships with a broader probe library organized around common attack classes seen in prompt-injection research:

• goal hijacking and prompt leakage, as framed by PromptInject (arXiv)
• automated attack-harness thinking, as seen in HouYi (GitHub)
• large categorized payload libraries for AI security testing, as seen in Prompt Injector (GitHub)

The repository intentionally does not mirror community jailbreak prompts verbatim. Instead, it turns recurring patterns into safer research templates that help defenders test systems without shipping a copy-paste jailbreak pack.

Architecture

flowchart LR
    A[Codex / Claude Code / OpenCode] --> B[AIGete Gateway]
    B --> C[Probe Injection Engine]
    C --> D[Risk Scoring + Canary Detection]
    D --> E[Session Audit Log]
    B --> F[Direct Upstream or Token Route]
    F --> G[OpenAI / Anthropic / Compatible Model API]

Loading

Safety Boundary

Use AIGete only with systems, models, agents, and data you own or are explicitly authorized to test.

This repository is for transparent security research, not stealth, evasion, or unauthorized exploitation.

The session lab imports copies of local conversation files for analysis and variant drafting. It does not write changes back into your original editor session store.

Roadmap

• ROADMAP.md
• ROADMAP_zh.md