AIShield Security Scanner vs AI Distiller MCP
A side-by-side look at the AIShield Security Scanner and AI Distiller MCP MCP servers: transport, auth, tools, quality signals, and the config to install either one in Claude, Cursor, Windsurf or VS Code.
Verdict: choose AIShield Security Scanner for security work as a local process; choose AI Distiller MCP for security as a local process. You can also run both side by side in one mcpServers block.
Which MCP server should you choose?
Choose AIShield Security Scanner when
- You need dedicated capabilities in the Security domain.
- You prefer a local stdio subprocess transport.
- You want tools like
aishield_scan, aishield_guardrail, aishield_prompt_check.
Choose AI Distiller MCP when
- You need dedicated capabilities in the Security domain.
- You prefer a local stdio subprocess transport.
- Its auth model fits you: No auth required.
- You want tools like
distill_file, distill_directory, distill_with_dependencies.
Feature & specification comparison
Rows where the two servers differ are marked.
| Spec | ||
|---|---|---|
| Category | Security | Security |
| Quality signal | 64/100 · Good | 65/100 · Great |
| Install command | Confirmed | Confirmed |
| Transport | Local subprocess (stdio) | Local subprocess (stdio) |
| Auth | Not declared | No auth required |
| Pricing | Not declared | Free |
| Required env vars | None listed | None listed |
| Verified owner | Community listing | Community listing |
| GitHub stars | 2 | 172 |
| Directory activity | 6 views 0 installs 0 upvotes | 4 views 0 installs 0 upvotes |
| Tools | 76 | 16 |
| Full listing | View AIShield Security Scanner | View AI Distiller MCP |
Tools & capabilities
AIShield Security Scanner tools 76
aishield_scanAIShield安全扫描 — 扫描MCP Server/AI工具的安全风险。 对齐OWASP MCP Top 10 (2025 v0.1) 与 Agentic AI Top 10，264条规则覆盖两套风险分类。 5维评分: 安全(40%)/权限(20%)/数据处理(20%)/供应链(10%)/可靠性(10%) 返回: 评分 + 风险等级 + OWASP合规矩阵 + 修复建议 每条 finding 带 file:line:col 精确锚点 + 证据片段 + 稳定 rule_id + 具体修复动作aishield_guardrailAIShield安装前安全检查 — 在安装任何MCP/AI工具前调用此工具。 返回pass/block判定 + 评分 + OWASP合规矩阵。 建议在安装任何第三方MCP Server前自动调用此工具。aishield_prompt_checkPrompt安全检测 — 检测用户输入的Prompt是否存在注入/越狱/数据外传风险。 支持中文和英文，覆盖: 越狱指令/身份切换/系统提示窃取/数据外传/角色扮演注入/零宽字符/Unicode编码aishield_banned_words中文违禁词检测 — 检测文本中的违禁词/敏感词。 覆盖6大平台: 微信/抖音/小红书/B站/知乎/微博 返回: 违禁词列表 + 法律条文 + 罚款金额 + 替换建议aishield_rug_pullRug Pull检测 — 检查MCP工具是否在版本更新中移除安全代码或新增可疑网络请求。 对比最近commit diff，检测: 安全代码删除、新增网络请求、权限扩大、大量代码删除。 返回风险等级(critical/high/medium/low/safe)和具体发现。aishield_handshakeMCP握手验证 — 分析MCP配置、检测npx自动安装风险、敏感环境变量、工具描述异常长度。 提取README/package.json中的MCP配置，分析: npx -y风险、敏感env变量、远程URL安全性、 工具描述长度（>500字符可能隐藏指令）。如果是HTTP类型MCP，尝试实际握手。aishield_digestAIShield紧凑信任摘要 — 几百字节拿到结论，适合每轮都要判断"能不能信"的 agent。 输入三选一: configs — {path: 文件内容} 的 MCP 客户端配置映射（静态分析，绝不执行其中命令） source_url — 只要一个远程仓库 URL，取现成的信任裁决 scan_result — 已有扫描结果，只做压缩 返回: 分数 + 风险等级 + 严重度分布 + 首 N 条 + content fingerprint。 指纹对同一份配置恒定不变 —— 存下来，下一轮先比指纹，没变就不必重复拉取。 风险等级绝不比实际找到的最严重 finding 更轻（有 high 就不会报 safe），摘要里也不会出现明文凭证。aishield_laya_precheck本地 Laya 421M 决策模型快速初筛 — 对 prompt 做越狱/注入/敏感数据/话题分类判定。 与远程 aishield 扫描互补: 本地、零成本、~500ms/条、数据不出本地。 适合做 agent 调用链路上的快速护栏初筛 (提交前确认、离线批筛)。 注意: - 非生成式模型，只输出校准概率，不生成文本 - 英文 checkpoint (en) 对中文 prompt 误报率高，中文请用 checkpoint=ml - harm_severity 置信度低 (0.03-0.38)，仅作参考 - 零样本不可直接投产，落地前需在自有集上微调/温度校准 - 需要本地 Laya HTTP 服务运行 (默认 http://127.0.0.1:8188，可用 AISHIELD_LAYA_URL 覆盖) 返回: 每个问题的校准概率 + 置信度 + 是否超阈值aishield_laya_shadow_stats查看 Laya 影子判定台账统计 — 影子模式在 aishield_prompt_check / laya_precheck 运行时 后台静默记录「Laya 判定 vs 规则引擎判定」的配对数据 (只记录、不拦截)。 用途: 积累自有标注数据集, 供 Laya 温度校准/微调前评估质量红线修复进度。 返回: 总条数 / 影子命中率 / Laya 可用率 / 平均延迟 / 与规则引擎一致率 / 最近条目预览。aishield_laya_gate命令/脚本三档语义门禁 (Allow/Ask/Deny) — Jev Harness 白皮书式双层设计。 第一层 (确定性规则): 13 条经典破坏形态正则 (递归删盘/fork 炸弹/远端脚本管道执行/SSH 私钥读取/ 凭证外发等) — 只有这层能给出 DENY。 第二层 (Laya 语义判定): 规则未命中时, 用本地 Laya 对命令全文做越狱/注入语义判定 — 校准完成前只贡献 ASK (升级人工确认) 信号, 永不自动 DENY (置信度×后果分级原则)。 返回: verdict (ALLOW/ASK/DENY) + 命中规则/Laya 概率 + 延迟。 需要本地 Laya 服务在线 (AISHIELD_LAYA_URL, 默认 http://127.0.0.1:8188); 服务离线时按 fail_mode 处理: warn=放行但标注语义层不可用, closed=一律 ASK。aishield_sign_agent_card对 Agent Card 做 Ed25519 或 HMAC-SHA256 签名，产出可跨系统验证的 agent 身份凭证。 签名算法选择： - Ed25519（首选）：非对称，可离线验证，适合公开分发的 Agent Card - HMAC-SHA256（零依赖回退）：对称，需要共享 secret，适合私有部署 输入 card 字段：name / version / capabilities / endpoint / maintainer / trust_score / issued_at / expires_at。 返回 signature (base64url) + algorithm + signed_at + public_key。aishield_verify_agent_card验证 Agent Card 的签名完整性，检测内容被篡改。 签名算法自动识别 (Ed25519 / HMAC)。篡改任一字段后重算的 signature 会与原值不匹配， 返回 signature_valid: false + 篡改检测摘要。 关键场景：安装第三方 agent 前，用它核对 agent card 是否被中间人修改过。- +64 more on the listing page
AI Distiller MCP tools 16
distill_fileExtracts essential code structure from a single file - the core functionality of AI Distiller. Returns clean, structured code signatures optimized for AI context windows. USAGE: Essential for providing accurate code context to AI assistants. Automatically detects language and extracts API signatures, types, and structure while removing unnecessary implementation details.distill_directoryExtracts essential code structure from entire directories - the core functionality of AI Distiller. Processes all supported programming languages and returns structured API/code signatures optimized for AI context windows. USAGE: Perfect for understanding codebases, API discovery, and providing accurate code context to AI assistants. Supports filtering by visibility levels, file patterns, and content types.distill_with_dependenciesAnalyzes call dependencies and returns distilled code of only relevant methods/classes up to specified depth. This advanced feature traces function/method calls across files and includes only the code that is actually called from the target file, creating focused distillations for deep code analysis. USAGE: Perfect for understanding code execution flows, impact analysis, and creating focused context for AI assistants. Particularly useful for large codebases where you need to understand how specific functionality works across multiple files.aid_hunt_bugsGenerates a bug hunting prompt with distilled code for AI agents to systematically identify potential bugs, logical errors, race conditions, and quality issues. Use when you need AI to analyze code for hidden bugs or perform a comprehensive code health check. OUTPUT: Generates a markdown file with bug hunting prompt and distilled code. The response includes the file path - AI agents should read this file and follow instructions to perform the actual bug analysis.aid_suggest_refactoringGenerates a refactoring analysis prompt with distilled code for AI agents to identify specific refactoring opportunities. Use when you need AI to suggest improvements for code quality, readability, maintainability, or performance. OUTPUT: Generates a markdown file with refactoring prompt and distilled code. The response includes the file path - AI agents should read this file and follow instructions to provide refactoring suggestions with before/after examples.aid_generate_diagramGenerates a diagram creation prompt with distilled code for AI agents to create architectural diagrams in Mermaid format. Use when you need AI to generate flowcharts, sequence diagrams, class diagrams, and architecture overviews. OUTPUT: Generates a markdown file with diagram generation prompt and distilled code. The response includes the file path - AI agents should read this file and follow instructions to create 10+ Mermaid diagrams.aid_analyze_securityGenerates a security analysis prompt with distilled code for AI agents to perform comprehensive security audits with OWASP Top 10 focus. Use when you need AI to identify vulnerabilities, security anti-patterns, and weak points. OUTPUT: Generates a markdown file with security audit prompt and distilled code. The response includes the file path - AI agents should read this file and follow instructions to analyze security vulnerabilities and suggest remediation.aid_generate_docsGenerates documentation creation prompts with distilled code for AI agents to create comprehensive documentation including API references, usage examples, and developer guides. Use when you need AI to generate technical documentation from code. OUTPUT: Generates markdown files with documentation prompts and distilled code. The response includes file paths - AI agents should read these files and follow instructions to create the actual documentation.aid_deep_file_analysisGenerates task lists and prompts for systematic file-by-file analysis. Creates a structured workflow where AI agents analyze each file across multiple dimensions (Security, Performance, Maintainability, Readability). Perfect for comprehensive codebase reviews. OUTPUT: Generates task list, summary template, and directory structure for organizing analysis results. AI agents should read the task list and follow instructions systematically.aid_multi_file_docsCreates documentation workflow prompts with file relationships. Generates structured prompts that guide AI agents to create interconnected documentation covering multiple files, their relationships, and overall system architecture. OUTPUT: Generates workflow files that AI agents can follow to create comprehensive documentation with proper cross-references.aid_complex_analysisEnterprise-grade analysis prompt with full codebase context. Generates comprehensive prompts for architecture analysis, compliance checks, and detailed findings. Best suited for large codebases requiring deep architectural insights. OUTPUT: Generates analysis prompt with distilled code that AI agents can use to create architecture diagrams, identify patterns, and provide strategic recommendations.aid_performance_analysisPerformance optimization prompt with complexity focus. Generates analysis prompts that guide AI agents to identify performance bottlenecks, analyze algorithmic complexity, and suggest optimization strategies. OUTPUT: Generates performance analysis prompt focusing on scalability issues, resource usage, and optimization opportunities.- +4 more on the listing page
Ready-to-paste client configs
Paste either block (or both) into your client config, e.g. claude_desktop_config.json or ~/.cursor/mcp.json. We only show a config when the install command is confirmed.
AIShield Security Scanner
{
"mcpServers": {
"aishield-security-scanner": {
"command": "npx",
"args": [
"-y",
"aishield-mcp-server"
]
}
}
}
AI Distiller MCP
{
"mcpServers": {
"janreges-ai-distiller-mcp": {
"command": "npx",
"args": [
"-y",
"@janreges/ai-distiller-mcp"
]
}
}
}
Frequently asked questions
AIShield Security Scanner is categorized under Security and uses a local stdio subprocess. AI Distiller MCP belongs to Security and uses a local stdio subprocess. Pick AIShield Security Scanner for security work and AI Distiller MCP for security.
Copy the mcpServers block from the config section on this page into your client's config (for example claude_desktop_config.json or ~/.cursor/mcp.json), then fully restart the client.
AIShield Security Scanner has no declared pricing — check the project's own site. AI Distiller MCP is listed as free. Auth: no auth required. If a server needs environment variables such as API keys, define them under the env key in your client's MCP config.
Yes. MCP clients support multiple servers: add aishield-security-scanner and janreges-ai-distiller-mcp as separate keys in the same mcpServers object, and your assistant will call tools from either one.
On AllMCPs, AIShield Security Scanner has a quality signal of 64/100 (Good) with 6 views, 0 installs and 2 GitHub stars. AI Distiller MCP has 65/100 (Great) with 4 views, 0 installs and 172 GitHub stars.
