Proxy catches what passes through. Injection via tool descriptions or memory artifacts doesn't pass through.

We handle it at the content evaluation layer, not the network layer. Curious how you're catching the indirect stuff.