Log inSubmit server
Shieldapi MCP logo

Shieldapi MCP

by alberthild

Security checks for URLs, domains, IPs, emails, passwords, prompts, MCP endpoints, and AI skill files.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Shieldapi MCP

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "alberthild-shieldapi-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "shieldapi-mcp"
      ],
      "env": {
        "SHIELDAPI_URL": "YOUR_VALUE_HERE",
        "SHIELDAPI_WALLET_PRIVATE_KEY": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

Install not yet sandbox-tested— the server itself is confirmed live (we called its tools/list endpoint). The stdio install command is a separate, ongoing check.

Overview

The alberthild/shieldapi-mcp MCP server exposes security intelligence tools for AI agents, including breach lookups, reputation checks, prompt injection detection, skill scanning, and MCP endpoint trust scoring. It runs locally through npm and calls the ShieldAPI service, with a free demo tier that requires no credentials. An optional EVM wallet private key enables x402 USDC payments on Base for unlimited paid requests. Reach for it when an agent needs to screen untrusted content, inspect infrastructure, or assess the risk of connecting to another MCP server.

Use cases

  • Screen untrusted prompts for injection before processing
  • Check URLs, domains, IPs, and emails for security risk
  • Scan AI skills and plugins for supply-chain issues
  • Assess whether an MCP endpoint is safe to connect to
  • Look up exposed passwords and email addresses

Key features

  • Prompt injection detection with pattern evidence
  • Static AI skill and plugin security scanning
  • URL, domain, IP, email, and password reputation checks
  • Combined target scanning with full_scan
  • MCP endpoint trust scoring
  • Free demo tier and x402 USDC payments

Tools10

What Shieldapi MCP lets your agent do. Expand a tool for its parameters.

Verified live~1.2k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 3d ago via OSV.dev · shieldapi-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars1Stargazers on the source repository.
npm downloads38Package downloads in the last 30 days.
Last commit8mo agoMost recent push to the default branch.
Tools exposed10Callable tools this server registers over MCP.
Directory activity5 viewsConfig copies, upvotes, and views on AllMCPs.

How Shieldapi MCP works

What alberthild/shieldapi-mcp MCP server does

The alberthild/shieldapi-mcp MCP server provides security-oriented tools for agents handling potentially unsafe content or infrastructure. It can inspect URLs for malware and phishing indicators, evaluate domains and IP addresses using reputation and network signals, and check email addresses or SHA-1 password hashes against breach data associated with Have I Been Pwned. The full_scan tool combines relevant checks for a URL, domain, IP address, or email target.

It also covers AI-specific risks. check_prompt analyzes text for prompt injection across direct instruction overrides, encoding tricks, exfiltration attempts, and indirect injection patterns. scan_skill statically reviews an AI skill or plugin for eight risk categories, including malicious code, credential handling, secrets, suspicious downloads, dependencies, and financial access. check_mcp_trust returns a composite assessment of an MCP endpoint using security, injection, supply-chain, reliability, and on-chain reputation signals.

How it works

The MCP process runs locally and forwards tool requests to the ShieldAPI API. Calls can run in demo mode without a wallet, subject to daily per-endpoint limits.

For paid access, the process uses the x402 payment flow. When the API requests payment, the server can use USDC on Base from the configured EVM wallet and then return the requested security result. Listed paid prices range from $0.001 to $0.02 per request, depending on the endpoint.

Setup and configuration

Install and run the server with:

Terminal
npx shieldapi-mcp

Claude Desktop and Cursor can configure the same command with -y and the package name shieldapi-mcp. Leaving the wallet variable unset selects the free demo mode. Paid usage requires USDC on Base and the wallet's EVM private key.

Supported configuration variables include:

  • SHIELDAPI_URL: API base URL; the documented default is https://shield.vainplex.dev.
  • SHIELDAPI_WALLET_PRIVATE_KEY: EVM private key used for x402 payments. It is optional for demo access.

Tools and capabilities

  • check_url: checks URL malware and phishing risk using URLhaus and heuristic analysis.
  • check_password and check_password_range: perform HIBP breach checks for SHA-1 hashes or hash prefixes.
  • check_domain: examines DNS, blacklists, SPF, DMARC, and SSL signals.
  • check_ip: checks blacklists, Tor exit-node status, and reverse DNS.
  • check_email: checks whether an email address appears in known breaches.
  • full_scan: combines applicable checks for one target.
  • check_prompt: returns an injection verdict, confidence, matched evidence, and decoded content when obfuscation is found.
  • scan_skill: reports a 0–100 risk score and severity-ranked findings with file locations; it does not execute code.
  • check_mcp_trust: produces a 0–100 trust score, tier, and per-signal breakdown for an MCP endpoint.

Limitations and notes

Results depend on the external ShieldAPI service and its underlying data sources. The skill scanner performs static analysis only, so it does not observe behavior by executing the submitted code. Free access is rate-limited by endpoint and does not provide unlimited usage. Paid requests require a funded wallet, USDC on Base, and safe handling of the configured private key. The documented prompt detector is intended for inline screening before processing untrusted text and reports a confidence score rather than a guarantee of correctness.

The alberthild/shieldapi-mcp MCP server is released under the MIT license. Its API base URL, x402 discovery document, and OpenAPI document are documented in the project README for clients that need direct service information.

For agents evaluating whether to connect to another MCP service, the alberthild/shieldapi-mcp MCP server's trust check is the relevant tool: it combines endpoint security, tool-description injection analysis, supply-chain signals, reliability, and AgentProof ERC-8004 reputation into one assessment. That score should be treated as an input to a connection decision, not as proof that an endpoint is safe.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Shieldapi MCP

Run `npx shieldapi-mcp`. Claude Desktop and Cursor configurations use `npx` with `-y shieldapi-mcp`.

Yes. The README provides a Claude Desktop configuration using the local `npx` command.

No API key is required. The free demo mode works without a wallet; paid access uses an EVM private key for x402 USDC payments.

The `check_prompt` tool analyzes text across direct injection, encoding tricks, exfiltration, and indirect injection categories, returning a verdict, confidence score, evidence, and decoded content when applicable.

No. `scan_skill` performs static analysis only and does not execute submitted code.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewShieldapi MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/alberthild-shieldapi-mcp?style=directory)](https://allmcps.com/mcp/alberthild-shieldapi-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/alberthild-shieldapi-mcp"><img src="https://allmcps.com/api/badge/alberthild-shieldapi-mcp?style=directory" alt="Shieldapi MCP on AllMCPs" /></a>