ShellWard: security and compliance gateway for AI agents
ShellWard
MCP server and CLI that check commands, paths, replies and MCP tool definitions, plus a scan for Chinese AI compliance risks
- 139 ★ on the repository
- Last commit
Extended access
Why this level
- Blocks and rates agent commands, so a wrong rule can stop a legitimate call
- Reads project files and agent replies to find keys and personal data
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/shellwardDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Blocks and rates agent commands, so a wrong rule can stop a legitimate call
- Reads project files and agent replies to find keys and personal data
This is third-party code. Review the repository files before installing.
What it does
ShellWard comes in three forms. The `npx shellward scan` command reads a project and sends nothing out: it looks for keys in code, personal data in files, `.env` permissions and calls to overseas models, which Chinese law treats as cross-border data transfer. The result is a 0 to 100 score with file and line. The second form, the MCP server `shellward-mcp`, gives an agent checking tools. `check_command` rates a shell command for danger, `check_injection` looks for prompt injection with 37 rules in Chinese and English, `scan_data` finds personal data and keys, `check_path` looks at paths like `.ssh` and `.env`, and `scan_mcp_tool` catches hidden instructions in third-party MCP tool descriptions and silent changes. There are 9 tools in all. The third form, the `china-ai-compliance-audit` skill, has an agent run a full audit against 14 control points and checks each finding against a quote from the file. An SDK for embedding in your own apps is included.
Who it is for. Teams shipping AI products for the Chinese market, and anyone who wants agent commands and replies checked before they run.
Good fit when
- Before releasing an AI app in China you need to see where the project breaks rules on personal data and data export
- You want CI to fail the build when a key or a critical risk lands in the repository
- An agent has shell and mail access and you need to block the chain "read a secret, send it out"
- You are plugging in a third-party MCP server and want its descriptions checked for hidden instructions
Not a fit when
- You need a legal opinion: the tool is a technical self-check
- The project has nothing to do with Chinese law and you only want a general secret scanner: ShellWard centers on Chinese rules
- You need OS-level protection or a sandbox: ShellWard checks calls but does not isolate the process
Example request
Run `npx shellward scan` on this project and say which files send personal data to overseas models.MCP
- Transport
- stdio
- Authentication
- not required
Environment variables
SHELLWARD_MODE- `enforce` blocks, `audit` only logs; the default is `enforce`.
SHELLWARD_THRESHOLD- Risk threshold from 0 to 100, default 40.
Limitations
The description and messages are written mainly in Chinese, and the English part of the README is shorter. The scan shows only what is visible in files: 11 of 14 control points are marked as needing manual review. The author states that the tool does not replace a lawyer, and filings and privacy impact assessment remain the organization's own work.
A separate GitHub Action mode checks pull requests in a build. The last commit is from September 2026.
How to disable. Remove the shellward entry from the client config. The `scan` command installs nothing and leaves no service behind, so simply stop running it.
FAQ
How do I run a project check?
With `npx shellward scan` in the project folder. No install is needed and no data is sent. The `--open` and `--serve` flags show the report in a browser, and `--json` and `--ci` fit a build.
How do I connect ShellWard to Claude Desktop or Cursor?
Add a server to the config with `"command": "npx"` and `"args": ["-y", "-p", "shellward", "shellward-mcp"]`. After a global install the `shellward-mcp` command is enough.
Does it block data or only warn?
The `SHELLWARD_MODE` variable sets it: `enforce` blocks by default and `audit` only logs. Data comes back in full, and sending out is blocked when personal data was read recently.
Which agents are supported?
Claude Desktop, Cursor, Claude Code, OpenClaw, Hermes Agent and any MCP client, with an SDK via `npm install shellward` for other platforms.
Does ShellWard replace a lawyer?
No. It is a technical self-check: the scan marks 11 of 14 control points as needing manual confirmation, and filings and impact assessment remain the organization's own work.
Discussion
No questions or reviews yet.
Related
MCP serversSecurity scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
Security scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.
An AI security verification CLI: scans models and code, probes live endpoints and MCP servers, and analyzes recorded agent runs
A static scanner for vulnerabilities in AI agent code and MCP configs with 66 rules mapped to OWASP Agentic Top 10
MCP checks shell commands, while shellfirm hooks apply rules to supported agent calls before they execute
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
README in short
The README opens with the 30-second `scan` check, then describes the audit skill with three evidence gates, the MCP mode, supported platforms, eight defense layers and the SDK. A table of Chinese models with OpenAI-compatible addresses is given as an alternative to overseas ones.