Shield

What AperionAI/shield MCP server does

AperionAI/shield MCP server is a local proxy for MCP traffic generated by AI coding agents. It sits between the agent and an upstream MCP server, including local stdio processes and remote Streamable HTTP services. The proxy evaluates tool calls before forwarding them, so actions such as destructive SQL, recursive file deletion, force-pushes, privilege escalation, cloud changes, or security-control changes can be blocked before execution.

The project also covers threats outside a single tool call. It can pin an upstream tool catalog using a trust-on-first-use model, inspect tool descriptions for poisoning, and scan tool results for prompt injection. Additional features include pre-install MCP auditing, OS-level process sandboxing, secret cloaking, cross-tool secret taint tracking, approval gates, and audit records.

How it works

A call passes through Shield before reaching the configured upstream server. Rules classify activity across areas such as SQL, Git, filesystems, secrets, shells, containers, Kubernetes, IAM, cloud platforms, NoSQL systems, Windows, and PowerShell. Depending on policy, Shield denies the call, pauses for approval, or forwards it with a warning.

AperionAI/shield MCP server can also protect native agent actions through fail-closed hooks for supported coding environments. The --scan-ide mode examines MCP configuration files and skill files without executing them, reporting issues such as unwrapped command servers, unpinned package runners, and project-local configurations. The same binary can install hooks, scan configurations, and sandbox an upstream process.

Secret cloaking lets an agent send a placeholder such as {{cloak:NAME}}. Shield substitutes the stored value only in the forwarded request and removes it from returned results when echoed. The vault is stored locally with restrictive filesystem permissions, and values are not included in audit events.

Setup and configuration

The repository describes a standalone binary and provides a shell installation command:

curl -fsSL https://shield-get.aperion.ai | sh

After installation, agent hooks can be configured with:

aperion-shield --install-agent-hooks

Supported hook setup includes Cursor and Claude Code, with additional host configurations for Codex, Gemini CLI, and Copilot CLI. The project also documents integrations with Cline, Continue, Windsurf, and Zed. Project-level hook files are not modified by the installer.

Cloaked values can be registered through SHIELD_CLOAK_VALUE or standard input, rather than command-line arguments. The documented commands include --cloak-add NAME, --cloak-list, and --cloak-remove NAME. Hook and cloak bypass flags exist, so deployments should account for the documented disable controls.

Tools and capabilities

• Intercept stdio and Streamable HTTP MCP servers.
• Apply 65 or more adaptive safety rules, with an optional 40-rule community pack.
• Block, approve, or warn on destructive tool calls.
• Pin tool catalogs and inspect descriptions and results.
• Scan IDE MCP and skill configuration without executing it.
• Sandbox upstream processes on supported operating systems.
• Install native agent hooks and maintain audit logs.
• Cloak registered secrets and track secret taint across tool boundaries.
• Gate selected rules with ID.me or a pluggable OIDC provider.

Limitations and notes

AperionAI/shield MCP server is local-first, so its basic proxy model is centered on one machine. The README describes an optional Smartflow control plane for organization-wide policy and upstream audit shipping, but using that mode introduces external enrollment and identity-provider requirements. Linux sandbox behavior depends on kernel capabilities; strict mode can refuse to start when network denial is unavailable. The repository material also presents conflicting license indicators: the current description says Apache-2.0, while the README badge says Proprietary, so the license should be verified before adoption.