AperionAI/shield

**Works with:**
> ### ⭐ Star this repo if you think AI agents shouldn't touch prod unsupervised
>
> aperion-shield is the free reference implementation of **consequence-level control** for AI coding agents — the layer that stops a destructive tools/call *before* it lands, not a log you read after the damage is done. It's transparent insurance: you don't notice it until the day it saves you.
>
> If that's a problem you take seriously, a ⭐ is the fastest way to help other engineers in regulated and high-stakes shops find it **before** they need it → **Star aperion-shield on GitHub**
aperion-shield is a tiny, local MCP guardrail that sits between your
AI coding agent (Cursor, Claude Code, …) and the **real** MCP servers
your agent talks to (postgres, github, shell, filesystem, …) — local
stdio servers *and*, since v0.9, remote Streamable HTTP ones. On every
tools/call it evaluates **65+ adaptive safety rules** (plus an
optional 40-rule community pack) across destructive surfaces —
SQL, git, filesystem, secrets exfiltration, supply-chain RCE, reverse
shells, sudo / privilege escalation, cloud (AWS/GCP/Azure),
Kubernetes, Docker, IAM / cloud privilege escalation, anti-forensics
(audit & log tampering), NoSQL / cache / search (Mongo, Redis,
Elasticsearch, Cassandra), disabling host security controls, and
Windows / PowerShell — and either blocks the call, prompts you for
approval, or lets it through with a warning banner. And since v0.9 it
watches the **other direction** too: tool catalogs are TOFU-pinned
against rug pulls, descriptions are scanned for tool poisoning, and
tool results are scanned for prompt injection. v1.0 completes the
story **before install and below the protocol**: --scan audits an
MCP server before you ever wire it in, and --sandbox confines the
server *process* at the OS level. And since v1.4, **reversible secret
cloaking** lets your agent reference a real credential as a
{{cloak:NAME}} placeholder — the secret is substituted in only on the
frame Shield forwards upstream and scrubbed back out of any result, so it
never enters the model's context, transcript, or prompt cache. **v1.5**
adds the seam the August 2026 market actually demos: native Cursor /
Claude Code PreToolUse hooks (fail-closed), --scan-ide for TrustFall
project MCP + Skills, and curl -fsSL https://shield-get.aperion.ai | sh.
Plus, when you need to prove **who** approved a destructive call —
not just that *someone* did — Shield can gate selected rules behind
**biometric identity verification** (ID.me, or a pluggable OIDC provider).
And when you outgrow the single-machine model, the **same binary**
enrolls into a Smartflow control plane with one command to pull
org-wide policy, ship audit upstream, and use your existing IdP as
the relying party — no rewrite, no re-install.
---
What's new in v1.20
v1.8 and v1.9 ship together as shield-v1.20.0. Same ask on every
host we install hooks for: Claude Code and Gemini get
permissionDecision: ask on PreToolUse. Cursor, Codex, and Copilot
get permission: ask on beforeShellExecution and
beforeMCPExecution, which is the event those hosts actually prompt
on. A rule written as Critical (rm -rf /, a reverse shell, an agent
editing Shield) is still a hard deny.
---
What's new in v1.9
A watcher that sits next to the hooks, not in front of them.
1. **--guard.** Polls your hook configs, MCP configs, and agent rules
files (AGENTS.md, CLAUDE.md, .cursorrules, .cursor/rules).
When one changes it runs the IDE scan again. If an agent deleted
Shield's hook entry, the entry is put back. A desktop notification
is the alert. No root.
2. **--install-guard / --uninstall-guard.** Writes a user launchd
agent on macOS or a systemd --user unit on Linux and loads it.
--guard-once is a single pass.
3. **--scan-ide covers rules files and extensions.** Hidden Unicode
and injected instructions in rules files. Cursor and VS Code
extensions: missing publisher, a name sitting next to a known
extension, and anything installed in the last 14 days.
A credential read followed by curl is an ask, the same allow/deny
card Cursor already shows for a git push. rm -rf /, a reverse
shell, and an agent editing Shield's own hooks stay a hard deny.
---
What's new in v1.8
Shield already stopped a bad tool call before it ran. It did not
watch what the agent had just read, so "read .env, then curl it
somewhere" got through whenever the two steps were separate. v1.8
closes that on the machine you already installed, with no cloud and
no model in the loop.
1. **Post-tool hook.** --install-agent-hooks now also registers