Shellward
If you're exposing shell commands, file system access, or email tools to an AI agent, this gives you seven security checks to wrap around those calls. It scans for prompt injection patterns across 32 rules in English and Chinese, detects PII like SSNs and API keys in tool outputs without redacting them, blocks dangerous commands like rm -rf or reverse shells, and stops data exfiltration chains where the agent reads sensitive data then tries to email or curl it externally. Works as a standalone MCP server over stdio or as an SDK you can embed in any agent framework. The data loss prevention model lets PII flow internally but blocks outbound sends when sensitive data was recently accessed.
- GitHub stars
- 108
- tools
- 9
- transport
- STDIO
- env vars
- 3
- last updated
- Mar 23, 2026
Tools
9 toolsPublic tool metadata for what this MCP can expose to an agent.
check_commandCheck if a shell command is safe (rm -rf, reverse shell, fork bomb...)
Check if a shell command is safe (rm -rf, reverse shell, fork bomb...)
No parameter schema in public metadata yet.
check_injectionDetect prompt injection in text (37+ rules, zh+en)
Detect prompt injection in text (37+ rules, zh+en)
No parameter schema in public metadata yet.
scan_dataScan for PII & sensitive data (CN ID/phone/bank, API keys, SSN...)
Scan for PII & sensitive data (CN ID/phone/bank, API keys, SSN...)
No parameter schema in public metadata yet.
check_pathCheck if file path operation is safe (.env, .ssh, credentials...)
Check if file path operation is safe (.env, .ssh, credentials...)
No parameter schema in public metadata yet.
check_toolCheck if tool name is allowed (blocks payment/transfer tools)
Check if tool name is allowed (blocks payment/transfer tools)
No parameter schema in public metadata yet.
check_responseAudit AI response for canary leaks & PII exposure
Audit AI response for canary leaks & PII exposure
No parameter schema in public metadata yet.
scan_mcp_toolScan an MCP tool definition for poisoning + rug-pull
Scan an MCP tool definition for poisoning + rug-pull
No parameter schema in public metadata yet.
security_statusGet current security config & active layers
Get current security config & active layers
No parameter schema in public metadata yet.
compliance_checkRun a China AI-compliance health check (网安法/PIPL/等保/出境/标识) → red/yellow/green scorecard
Run a China AI-compliance health check (网安法/PIPL/等保/出境/标识) → red/yellow/green scorecard
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageConfiguration
SHELLWARD_MODESecurity mode: enforce (block + log) or audit (log only)
SHELLWARD_LOCALELocale: auto, zh, or en
SHELLWARD_THRESHOLDInjection detection threshold 0-100 (lower = stricter)
Readme
ShellWard Logo
ShellWard
AI 应用合规网关 — 为中国监管而生的 AI Agent 安全合规工具（网安法 2026 / PIPL / 等保2.0 / 数据出境 / AI标识）。先一行命令体检项目合规风险，再在运行时拦截提示注入、数据外泄与危险命令。中文威胁检测 + 中文 PII + 零依赖——英文工具不做的事。
🌐 官网: https://jnmetacode.github.io/shellward/
30 秒合规体检
零安装、只读、不上传任何数据。一行命令，扫出你的 AI 项目踩了哪些合规红线：
npx shellward scan
输出一张映射到 网安法 / PIPL / 等保2.0 / 数据出境 / AI标识 的红黄绿评分卡，并精确到 文件:行：
## 🔍 项目实测风险
🌐 数据出境风险: 2 ｜ 🔑 硬编码密钥: 3 ｜ 🪪 个人信息暴露: 2 ｜ 📂 .env 权限: 1
- .env:2 境外大模型端点: OpenAI — 向其发送个人信息即构成数据出境
- package.json:12 境外大模型 SDK 依赖: openai — 项目内含数据出境通道
- src/config.ts:3 硬编码 GitHub Token: ghp_12*** — 凭据不应写入源码
- customers.csv:2 手机号 13912*** — 个人信息出现在文件中，需评估脱敏
合规得分: 63/100 [C]
Details
- Repository
- github.com/jnmetacode/shellward
- Categories
- AI & LLM Tools, Security & Pentesting
- Package
shellward- Transport
- STDIO
- Registry
- MCP registry, active
Related AI & LLM Tools MCP servers
View all
Docs Mcpfrumu-ai/tandemRemote MCP server for Tandem docs, install guides, SDKs, workflows, and agent setup help.107stars
Pensyvemajor7apps/pensyveUniversal memory runtime for AI agents — episodic, semantic, and procedural memory.99stars
emem, the verifiable memory protocol for the physical worldvortx-ai/ememShared, verifiable memory for machines and AI. Encode where data lives; decode with any AI.89stars
Sverklosverklo/sverkloLocal-first MCP code intelligence: 37 tools — hybrid search, blast-radius, diff review, memory.71stars
Token Enhancerxelektron/token-enhancerCuts AI web-fetching costs up to 99.9% by stripping page junk before it reaches your LLM.66stars
Threadline Mcpsagemindai/instarAgent-to-agent messaging relay. Discover agents, send messages, and receive replies. Zero-config.0stars