ThoughtLens

Every existing security tool — Datadog, LangSmith, Lobster Trap itself — logs or blocks after the fact. ThoughtLens takes a fundamentally different approach: it observes and freezes agents mid-execution, before damage occurs. ThoughtLens is a drop-in proxy that sits between any AI agent and its LLM backend. As the agent runs, every tool call, file access, API request, and reasoning chunk streams to a live security dashboard in real time. When the system detects a threat — whether a prompt injection hidden in plain text, an instruction smuggled in image EXIF metadata, a unicode direction override, or an unauthorized API call — it freezes the agent's response stream and holds the connection open. The operator sees exactly what happened, which part of the original prompt caused it (highlighted at character level), and chooses to kill or resume the session. Built on Lobster Trap for deep prompt inspection and PRISM (an open-source LLM protocol bridge) for stream interception, ThoughtLens combines three capabilities no existing tool offers together: live streaming agent forensics, mid-execution pause with human-in-the-loop control, and character-level injection source highlighting. Beyond these, the detection engine covers modern attack vectors including image EXIF metadata injection, emoji variation selector smuggling, base64 hidden payloads, and unicode bidirectional text overrides — all surfaced visually in the dashboard before execution continues. The detection engine is fully dynamic: it extracts the declared task scope from the initial prompt and scores deviations at runtime, rather than matching against hardcoded rule lists. All security analysis uses regex and heuristics — no LLM calls in the security layer, eliminating recursive injection risk.