escapekit

Agentic-first string escaping and unescaping service. Escape and unescape text for 13 different contexts: HTML, HTML attributes, XML, JSON, CSV, regex, shell, SQL, URL query, URL path, JavaScript, CSS, and Unicode.

Quick Start

# Build
make build

# Run (no auth for development)
./escapekit -no-auth

# Escape text for HTML
curl -X POST http://localhost:7199/escape -d '{"text":"<script>alert(1)</script>","type":"html"}'

# Unescape HTML
curl -X POST http://localhost:7199/unescape -d '{"text":"&lt;script&gt;","type":"html"}'

# Detect escaping
curl -X POST http://localhost:7199/detect -d '{"text":"&lt;hello&gt;"}'

# List types
curl http://localhost:7199/types

API

Method	Endpoint	Description
POST	/escape	Escape text for a given context
POST	/unescape	Unescape text from a given context
POST	/detect	Detect what escaping was applied
GET	/types	List all escape types
GET	/help	Self-documenting API manual
POST	/mcp	MCP JSON-RPC 2.0 endpoint

Escape Types

Type	Description	Reversible
html	HTML entity escaping (&, <, >, ", ')	yes
html-attr	HTML attribute escaping (stricter)	yes
xml	XML escaping (&, <, >, ", ')	yes
json	JSON string escaping	yes
csv	CSV field escaping (double-quote doubling)	yes
regex	Regex special character escaping (Go RE2)	no
shell	Shell single-quote argument escaping	yes
sql	SQL string literal escaping	yes
url-query	URL query parameter percent-encoding	yes
url-path	URL path segment percent-encoding	yes
javascript	JavaScript string literal escaping	yes
css	CSS string escaping	yes
unicode	Unicode escape sequences (\uXXXX)	yes

Configuration

Flag	Env	Default	Description
-addr	ESCAPEKIT_ADDR	:7199	Listen address
-no-auth	ESCAPEKIT_NO_AUTH	false	Disable auth (dev mode)

Build

CGO_ENABLED=0 go build -trimpath -o escapekit ./cmd/escapekit

Single static binary, zero external dependencies, no database needed.

License

MIT