A side-by-side look at the Emilia Protocol and Shieldly IO MCP MCP servers: transport, auth, tools, quality signals, and the config to install either one in Claude, Cursor, Windsurf or VS Code.
Verdict: choose Emilia Protocol for security work as a local process; choose Shieldly IO MCP for security as a local process. You can also run both side by side in one mcpServers block.
ep_guard_action, ep_check_signoff, ep_verify_receipt.SHIELDLY_API_KEY.analyze_iam_policy, analyze_cloudformation_template.Rows where the two servers differ are marked.
| Spec | ||
|---|---|---|
| Category | Security | Security |
| Quality signal | 71/100 · Great | 57/100 · Good |
| Install command | Confirmed | Confirmed |
| Transport | Local subprocess (stdio) | Local subprocess (stdio) |
| Auth | No auth required | No auth required |
| Pricing | Free | Freemium |
| Required env vars | None listed | SHIELDLY_API_KEY |
| Verified owner | Community listing | Community listing |
| GitHub stars | 612 | 0 |
| Directory activity | 5 views 0 installs 0 upvotes | 2 views 0 installs 0 upvotes |
| Tools | 3 | 2 |
| Full listing | View Emilia Protocol | View Shieldly IO MCP |
ep_guard_actionRequest authorization before an irreversible action: payments, wire transfers, fund releases, deletions, record or account changes, or sending messages with real-world effect. Submits the exact action for policy evaluation and human authorization. This MCP tool does not itself sit at the executor choke point: even after approval, the executor MUST match the returned action_hash and atomically consume the receipt before effect. If BLOCKED, poll ep_check_signoff with the receipt_id.ep_check_signoffPoll a pending authorization after ep_guard_action returns BLOCKED. Pass the receipt_id. Returns PENDING, APPROVED_PENDING_CONSUME, CONSUMED, or DENIED. Approval alone is not permission to execute: the executor must match action_hash and atomically consume the receipt at its own choke point.ep_verify_receiptAsk the configured EMILIA service to verify a stored trust receipt and report its hash and anchor status. Read-only, but not an offline verifier: the result is the service response for the supplied receipt_id.analyze_iam_policyAI-Powered security analysis of an AWS IAM policy (identity policy or cross-account trust+identity pair). Flags privilege-escalation paths, wildcards, and other over-permissive access. Runs in demo mode (rate-limited, no signup) if SHIELDLY_API_KEY is not set.analyze_cloudformation_templateAI-Powered security analysis of a CloudFormation template — extracts IAM roles/policies and flags over-permissive access. Runs in demo mode (rate-limited, no signup) if SHIELDLY_API_KEY is not set.Paste either block (or both) into your client config, e.g. claude_desktop_config.json or ~/.cursor/mcp.json. We only show a config when the install command is confirmed.
{
"mcpServers": {
"emiliaprotocol-emilia-protocol": {
"command": "npx",
"args": [
"-y",
"@emilia-protocol/mcp-server"
]
}
}
}
{
"mcpServers": {
"shieldly-io-mcp": {
"command": "npx",
"args": [
"-y",
"@shieldly/mcp"
],
"env": {
"SHIELDLY_API_KEY": "YOUR_SHIELDLY_API_KEY_HERE"
}
}
}
}