Shellward
Guard agent tool use with injection detection, PII scanning, command safety checks, and DLP before risky actions run.
Overview
Shellward is a MCP server for the Ship phase that provides 7 security tools for agent injection detection, PII scanning, command safety, and DLP.
What is this MCP server?
- 7 MCP security tools covering injection detection, PII scan, command safety, and DLP
- SHELLWARD_MODE: enforce (block + log) or audit (log only) for gradual rollout
- Configurable injection threshold 0–100 via SHELLWARD_THRESHOLD (lower = stricter)
- Locale support auto, zh, or en via SHELLWARD_LOCALE
- npm shellward package v0.5.11 with stdio MCP transport
- 7 MCP security tools (injection, PII, command safety, DLP per description)
- Package shellward version 0.5.11 on npm stdio transport
- Env vars: SHELLWARD_MODE, SHELLWARD_LOCALE, SHELLWARD_THRESHOLD (0–100)
Community signal: 108 GitHub stars.
What problem does it solve?
Autonomous coding agents can run dangerous shell commands or leak PII without a guardrail layer you control in MCP.
Who is it for?
Builders shipping agent workflows with terminal and file tools who want MCP-native security gates before going live.
Skip if: Static-only repos with no agent tool execution or teams that only need SAST on application code, not agent runtime.
What do I get? / Deliverables
Tool calls pass through configurable enforce or audit checks so unsafe injections, commands, and sensitive data are blocked or logged.
- Seven security MCP tools available to the agent toolchain
- Logged or blocked risky injections, commands, and PII per your mode
- Tuned SHELLWARD_THRESHOLD and locale for your risk appetite
Recommended MCP Servers
Journey fit
How it compares
Agent-runtime security MCP, not a dependency vulnerability scanner or generic code-review skill.
Common Questions / FAQ
Who is Shellward for?
Solo and indie developers operating AI agents with shell and file access who need injection, PII, command-safety, and DLP controls at the MCP layer.
When should I use Shellward?
Use it in ship and security prep when agents can execute commands or handle user data and you want enforce or audit modes before production traffic.
How do I add Shellward to my agent?
Install the npm package shellward (0.5.11) as a stdio MCP server, set SHELLWARD_MODE, optional SHELLWARD_THRESHOLD and SHELLWARD_LOCALE, then wire it into Claude Code, Cursor, or Codex MCP settings.