The Minimum Protection Every AI Agent Should Have Is Free

Right now, most AI agents in production execute whatever reaches them: no screen between the input and the action, no floor at all. If that describes your agent, this post is about the cheapest possible upgrade. Every scan Shrike runs, at every tier, on every channel, starts in the L1-L5 pattern layers: the deterministic floor of the 9-layer pipeline. It answers in milliseconds, and it is what the free tier is made of. Since we hand it to anyone with a config block and no credit card, it is worth being precise about what it actually does for your agent, because "pattern matching" undersells it and "AI-powered detection" would oversell it.

"Pattern" is doing more work than you think

The naive version of pattern detection is a list of bad strings, and the naive version is easy to beat: encode the payload, pad it with invisible characters, swap letters for look-alikes from another alphabet. Which is why the pattern layers spend much of their effort not on matching but on normalization: decoding what is encoded, stripping what is invisible, resolving look-alike characters to what a model will actually read. The screen sees the payload the way your agent would see it, not the way the attacker dressed it.

On top of that normalized view, the layers screen for the attack classes that have stable signatures. Known prompt-injection and jailbreak phrasings, the "ignore previous instructions" family and its many descendants. Payloads smuggled inside encodings. Invisible Unicode carrying instructions a human reviewer literally cannot see. Structurally malformed content built to confuse parsers. And for the specialized scan types, the signature end of each domain: injection shapes in SQL, destructive and exfiltrating shapes in shell commands, traversal shapes in file paths.

Why a deterministic floor is worth having in the LLM era

It is fair to ask why pattern screening still matters when LLM-based analysis exists. Three reasons, and none of them is nostalgia.

Speed and cost. The pattern path answers in roughly 10-50ms. That is a latency budget an agent hot path can absorb on every single action, and a cost floor low enough that we can give it away. Deep analysis on every action would be neither.

Determinism is an evidence property. The same input produces the same verdict with the same category, every time. When a blocked action shows up in an audit or an incident review, "this matched a known injection signature" is a finding you can replay and defend. Deterministic layers make deterministic evidence.

A different failure mode than the layers above it. An LLM judge reads language, which means language can argue with it. A decoder cannot be sweet-talked and a normalizer does not have a context window to poison. Defense in depth only works when layers fail differently, and the pattern floor fails differently from everything above it by construction.

That is also why the pattern layers never turn off. Paid tiers add layers on top; they do not swap the floor out. Every scan that reaches the LLM-powered analysis has already been through the same screen the free tier gets.

The ceiling, stated plainly

Here is what patterns cannot do, and we would rather you size this correctly than discover it in production. A pattern cannot judge intent: "delete the staging database" and "delete the production database" have identical shapes and very different consequences. It cannot catch the novel paraphrase, the attack composed politely across several turns, or the instruction that is only malicious in the context of what this particular agent is supposed to be doing. Those need judgment and memory: L7 LLM analysis for meaning, L8 response intelligence for what comes back, L9 session correlation for the slow multi-turn build, and a declared scope for what "supposed to be doing" even means. That is the paid pipeline, and the honest framing is that the free floor screens the commodity attack while the paid layers handle the crafted one.

Where you already have this

The Community tier is the pattern layers with 1,000 scans a month, no credit card. Anonymous calls through the MCP server get the same stateless screen with zero setup. If you are a person reading this, or a coding agent that has been asked to add protection to one, the whole install is this block in your MCP client config:

{
  "mcpServers": {
    "shrike-security": {
      "command": "npx",
      "args": ["-y", "shrike-mcp"]
    }
  }
}

Or, if the agent lives in code rather than an MCP client, the SDKs (pip install shrike-guard, npm install shrike-guard) wrap the same scan in one call, gating the action on the verdict:

from shrike_guard import ScanClient

client = ScanClient(api_key=os.environ["SHRIKE_API_KEY"])
result = client.scan(user_prompt)   # pattern floor answers in milliseconds
if not result["safe"]:
    raise SecurityError("Policy Violation")

Either way the habit is the same: scan inputs before acting on them, scan tool definitions before registering them. No API key is required for the pattern floor over MCP; the quickstart covers both paths, TypeScript and Go included.

If you take one habit away from this post, make it this: milliseconds of deterministic screening on every agent action is now free, and the commodity end of the attack spectrum, which is most of it by volume, is exactly the part that never should have reached your agent in the first place.