Images & PDFs

At a glance

• On automatically — there is nothing to turn on.
• Works through the Anthropic proxy (see below for what that is) and the Claude Code and Codex plugins — update the plugin to the latest version. Gemini CLI and Copilot CLI plugins: not yet.
• Anything that can't be screened is allowed and recorded in your decisions log — unless you turn on blocking.

What is scanned, by setup

✅ scanned · ⚪ passed through unscreened and recorded — your block option decides · — not applicable. The self-hosted appliance gets image and PDF screening in a future release.

What is "the Anthropic proxy"?

Normally your app or agent sends its requests straight to Anthropic (api.anthropic.com). With the proxy, it sends them to AgentGuards instead; we screen everything in the request — the prompt, and now the images and PDFs in it — and forward clean requests to Anthropic with the Anthropic key you saved in Settings. You are on the proxy if your client's Anthropic base URL is AgentGuards. Two examples:

Claude Code, signed in with an API key

{
  "env": {
    "ANTHROPIC_BASE_URL": "https://prod.agentguards.co",
    "ANTHROPIC_API_KEY": "ag_YOUR_AGENTGUARDS_TOKEN"
  }
}

Your own app, using the Anthropic SDK

from anthropic import Anthropic

client = Anthropic(
    base_url="https://prod.agentguards.co",   # AgentGuards instead of api.anthropic.com
    api_key="ag_YOUR_AGENTGUARDS_TOKEN",      # your AgentGuards token, not an Anthropic key
)

Claude Pro / Max logins can't use the proxy — they use the Claude Code plugin, which scans images and PDFs too (next section). Full setup: Claude Code proxy.

On the Claude Code and Codex plugins

When the agent is about to open an image or a PDF, the plugin sends the file to AgentGuards first. A clean file opens as normal. A file with an attack isn't opened: the agent is told why, and the attempt appears in your decisions log. A file is read the same way as on the proxy, so the PDF and image rows of the next table apply.

If AgentGuards can't be reached, the file isn't opened, like every other check in the plugin (unless you configured it to fail open). Files are scanned and not stored; your log records only the file type, size and result — never its name or content.

What happens to each kind of file (on the proxy)

Text a person couldn't see (hidden or faint) is checked with the strictest prompt checks — nobody hides text in a document for the reader's benefit. Visible text is checked the way we check web pages your agent fetches.

Your options

All three are on the Checks page. The first is on by default; the other two are off.

What a block looks like

On the proxy, the request never reaches the model; your client receives an error like:

AgentGuards blocked this prompt (media_scan): hidden text in image:
prompt_injection - Prompt injection pattern detected (critical)

On a plugin, the file isn't opened and the agent is told:

🛡️ [AgentGuards] File blocked
Reason: media_scan - hidden text in image: prompt_injection - Prompt injection pattern detected (critical)

media_scan means the text we read was an attack. unscreened_media means you turned on blocking and the request contained something we couldn't read. Both appear in your decisions log.

Privacy, speed and limits

• Images and PDFs are read on AgentGuards' own scanning server and are not stored; only the text is checked.
• Typical added time per image: well under a second for most, about 2–3 seconds when the text is rotated.
• Limits per request: 8 MB in total, files included (larger requests are rejected); 8 images scanned; 300 pages per PDF. Images and pages beyond those counts are not screened (⚪).
• Plugins: 5 MB per file; larger files aren't sent (⚪). A scan can add a few seconds before the agent opens the file.
• Only the newest message is scanned; earlier messages were scanned when they were new.