# nemesis-shield [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/eobi/nemesis_shield_sdks  
**GitHub Stars:** 0  
**npm Downloads (last month):** 34  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/nemesis-shield

## Description
Add Nemesis Shield security as you build: one-line SDK per stack, plus a site+CVE scan.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "nemesis-shield": {
    "command": "npx",
    "args": ["-y","@nemesis-shield-autogon/learn"]
  }
}
```

## Documentation

## What nemesis-shield does

The nemesis-shield MCP server exposes Nemesis Shield actions to AI coding assistants through 17 callable tools. Its documented tool set includes `nemesis_protect` for adding security protection, `nemesis_scan` for scanning a site, and `nemesis_explain` for describing coverage. It also includes Omniguard fraud scoring and standalone identity and AML screening through `nemesis_omniguard_verify`.

The server is intended for agents working inside Cursor, Claude Code, Claude Desktop, or Windsurf. An agent can use the tools while building an application, rather than requiring the developer to perform each security setup step manually in a separate console.

## How it works

Nemesis Shield uses a positive-security model based on an application’s observed behavior. Its SDKs learn a per-application baseline, then can flag or block requests that do not match approved behavior when enforcement is enabled. The default operating mode is observe, allowing the application to build a baseline before enforcement is turned on.

The SDKs compute request shape locally and make enforcement decisions in the application process before the request reaches the handler. They report behavioral metadata such as HTTP method, normalized path shape, response status, and authentication state. SDKs fail open if Nemesis is unreachable.

## Tools and capabilities

The nemesis-shield MCP server supports these documented workflows:

- Add Nemesis Shield protection while building an application.
- Scan a website.
- Explain the security coverage applied to an application.
- Perform Omniguard fraud scoring.
- Verify identities with standalone identity and AML screening.

The broader repository includes SDK integrations for Node.js, Python, Go, Ruby, PHP, WordPress, Java, .NET, Rust, edge runtimes, Supabase direct database APIs, and browser front ends. Those integrations are separate from the MCP tool interface but provide the runtime components an agent may add to an application.

## Setup and configuration

The repository places the MCP implementation in the `mcp/` directory.

Using Nemesis Shield requires an account at `shield.nemesislabs.xyz` and an application install token. The documented SDK setup uses tokens beginning with `nsk_`, supplied through application configuration such as `NEMESIS_TOKEN`. For SDK-based protection, the developer adds the package or middleware for the target stack, deploys in observe mode, reviews learned behavior in the console, and then enables enforcement there.

## Limitations and notes

Confirm those details in the repository’s `mcp/` directory before automating installation or configuration.

MCP access does not by itself describe the runtime protection of an application. The relevant SDK or plugin still needs to be added to the target stack. Browser protection, WordPress scanning features, edge middleware, and Supabase proxy protection are separate repository integrations with their own setup paths.

_Full upstream README: https://allmcps.com/mcp/nemesis-shield/readme_