Agenten stärken
Installation vom Herausgeber. Kein PlugMCP-Endpunkt.
Host a copy with our keys and logs.
Noch kein paketiertes Release in der Registry. Folgen Sie der README des Repositorys.
Remote-URL oder ein Befehl auf Ihrem Rechner? Worin sich die beiden Installationen unterscheiden
Auf PlugMCP ausführen
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
StartenVom Herausgeber
🛡️ Offline Rust security scanner for AI agent tools & MCP servers — MCP, Hermes Agent, CrewAI, LangChain/LangGraph, GPT Actions, Cursor Rules. Catches command injection, credential exfiltration, SSRF & unsafe file access; a typical MCP server scans in <50 ms. CLI, GitHub Action, VS Code, SARIF.
AgentShield is an offline, high-performance Rust security engine for teams shipping tool-enabled AI agents across the modern AI stack. Native adapters cover MCP servers, OpenClaw skills, Hermes Agent configs, CrewAI, LangChain/LangGraph, GPT Actions, and Cursor Rules; the same checks help harden repositories built around OpenAI Agents SDK, Claude Code, Claude Desktop MCP setups, Browser Use, FastMCP, GitHub MCP Server, Playwright MCP, and other tool-heavy workflows.
It catches command injection, credential exfiltration, SSRF, unsafe file access, runtime package installs, prompt-injection surfaces, and dependency hygiene issues before an agent can call those tools.
AgentShield runs as a CLI, GitHub Action, VS Code extension, or Rust library. It operates 100% offline, keeping source code on your machine, and emits console, JSON, SARIF for GitHub Code Scanning, and standalone HTML reports. The current release line is 1.0.2 (General Availability).
For runtime guard scope and roadmap, see docs/RUNTIME_GUARD.md.
AgentShield is useful anywhere an agent can call local tools, remote APIs, browser automation, file operations, shell commands, or MCP servers.
Runnable examples live under examples/, with focused guides for Claude MCP security, MCP security scanning, and OpenAI Agents security.
AI agents are being connected to tools that can execute commands, read and write files, make HTTP requests, install packages, and call external services. A single malicious or poorly-written extension can:
AgentShield catches these patterns with static analysis, framework adapters, policy evaluation, suppressions, baselines, egress policy generation, attestations, and SARIF output for GitHub Code Scanning.
AgentShield complements general-purpose security tooling; it is not a replacement for SAST, secret scanning, or broad dependency analysis. A practical security stack is:
Use agentshield ci install --suite when you want a starter GitHub Actions
workflow that runs CodeQL, Gitleaks, Semgrep CE, and AgentShield together.
Install the AgentShield VS Code Extension for inline security findings and lightbulb quick-fixes:
Cmd + . / Alt + Enter): Instant 1-click remediation for unsafe deserializers (yaml.load $\to$ safe_load) and unpinned dependencies..agentshield.toml.Add to .github/workflows/security.yml:
name: Agent Security
on: [push, pull_request]
permissions:
actions: read
contents: read
security-events: write
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: aiconnai/agentshield@main
with:
path: '.'
fail-on: 'high'
ignore-tests: true
strict: true # set false only when no supported adapter layout is expected
upload-sarif: true
Findings appear as PR annotations and in the repository's Security > Code scanning tab when SARIF upload is enabled.
[!IMPORTANT] Shipping fast without a security team?
Give us a ⭐ star to bookmark AgentShield. Run a 50ms scan before your next deploy so you never push rogue tools or leaked credentials to production.
# 🐍 Install via PyPI (Python & uv)
pip install agentshield
# or: uv add --dev agentshield
# ⚡ 1-Line Universal Installer (macOS & Linux: Apple Silicon, Intel, ARM64, x86_64)
curl -fsSL https://aiconnai.github.io/agentshield/install.sh | sh
# 🍺 Or install via Homebrew (macOS & Linux)
brew tap aiconnai/tap && brew install agentshield
# 🦀 Or install via crates.io
cargo install agent-shield --features full
# Or install from source with Cargo
cargo install --git https://github.com/aiconnai/agentshield --tag v1.0.2 --features full --force
# First-run setup: config + explained first scan
agentshield quickstart
# Scan an agent extension or MCP repository
agentshield scan . --ignore-tests --fail-on high --explain
# Automatically remediate fixable findings (preview diff with --dry-run)
agentshield fix . --dry-run
agentshield fix .
# Scan with custom declarative rules
agentshield scan . --rules-dir .agentshield/rules
# Run runtime guard reverse-proxy for remote MCP SSE/HTTP endpoint
agentshield guard --listen 127.0.0.1:8080 --target http://127.0.0.1:3000
# Discover allowlisted local client configs without executing them
agentshield discover --no-default-paths --root .
# Add a GitHub Actions workflow
agentshield ci install
# Add a broader security suite: CodeQL + Gitleaks + Semgrep CE + AgentShield
agentshield ci install --suite
# Adopt in an existing repo without blocking on known findings
agentshield scan --write-baseline .agentshield-baseline.json
agentshield ci install --baseline .agentshield-baseline.json
# Generate a standalone HTML report
agentshield scan ./my-agent-extension --format html --output report.html
# List all built-in and custom rules
agentshield list-rules
Add AgentShield to .pre-commit-config.yaml to block vulnerable tools before each commit:
repos:
- repo: https://github.com/aiconnai/agentshield
rev: v1.0.2
hooks:
- id: agentshield
Integrate AgentShield directly into test suites or tool definitions:
import agentshield
from agentshield import shield
# Programmatic scan in pytest or build pipelines
report = agentshield.scan(".", fail_on="high")
if not report.passed:
print(f"Violations detected: {report.summary.total}")
# Protect agent tool functions at runtime against SSRF and credential leaks
@shield(block_ssrf=True, redact_secrets=True)
def query_external_api(target_url: str) -> str:
...
If you only need static scanning in a published crates.io version, cargo install agent-shield is also supported. Use the GitHub tag command above when
you need the latest release line before crates.io has been updated.
Download from the latest release for Linux, macOS, and Windows targets.
For container consumers, the release image tag is:
ghcr.io/aiconnai/agentshield:1.0.2
The GHCR image is built with the full feature set, including runtime wrap support and experimental runtime guard commands. The image is published for linux/amd64 and linux/arm64.
docker pull ghcr.io/aiconnai/agentshield:1.0.2
docker run --rm -v "$PWD:/scan" ghcr.io/aiconnai/agentshield:1.0.2 scan .
docker run --rm ghcr.io/aiconnai/agentshield:1.0.2 --version
If the GHCR package is private in your organization, authenticate first:
gh auth refresh -h github.com -s read:packages
gh auth token | docker login ghcr.io -u "$(gh api user --jq .login)" --password-stdin
git clone https://github.com/aiconnai/agentshield.git
cd agentshield
cargo build --release
./target/release/agentshield scan /path/to/agent-extension
AgentShield can produce noisy command output during local development, especially from cargo test, cargo clippy, and scanner runs that emit JSON or SARIF. If rtk is installed, use the optional wrapper to reduce output shown to humans and coding agents:
scripts/rtk-check.sh quick
scripts/rtk-check.sh test
scripts/rtk-check.sh clippy
scripts/rtk-check.sh scan-fixture
The wrapper is intentionally local-only. RTK filters local command output only. It must not alter AgentShield JSON, SARIF, HTML, or console output contracts consumed by users, clients, CI, or GitHub Code Scanning.
Use raw output for debugging, audit, and security decisions:
scripts/rtk-check.sh raw -- cargo test
scripts/rtk-check.sh raw -- cargo run -- scan tests/fixtures/mcp_servers/safe_calculator --format sarif --output target/agentshield/scan.sarif
Policy:
json and sarif reports to files when clients or CI consume them.AgentShield runs all matching adapters in a repository instead of stopping at the first match.
Useful scan options include --config, --format, --fail-on, --output, --ignore-tests, --explain, --experimental-risk, --baseline, --write-baseline, and --emit-egress-policy.
Configured [scan] include and [scan] exclude filters scope source and
metadata-derived findings before detectors run.
For mature repositories with existing findings, write a baseline first and use it in CI:
agentshield scan --write-baseline .agentshield-baseline.json
agentshield scan --baseline .agentshield-baseline.json --explain
agentshield ci install --baseline .agentshield-baseline.json
--explain is intentionally console-only. It will not append text to JSON,
SARIF, or HTML output. Explain output includes the scan root, metadata root
when different, and hotspot summaries for concentrated blocking findings.
--experimental-risk is a separate console/JSON-only mode and cannot be
combined with --explain. Its versioned index is informational: it does not
change findings, PASS/FAIL, policy thresholds, baselines, suppressions, or the
process exit status. SARIF, HTML, and DSSE remain unchanged.
AgentShield ships 37 built-in contextual rules (SHIELD-001..037) covering command execution, SQL injection in database tools, system prompt injection surfaces, insecure network binds, insecure temporary file creation, credential exfiltration, composite toxic flows, local file exfiltration via webhooks, SSRF, arbitrary file access, runtime package installation, prompt injection surfaces, excessive capabilities, dependency hygiene, dynamic code execution, metadata service access, unsafe deserialization, insecure agent checkpoints, unauthenticated MCP SSE transports, tool response prompt injection, agent memory poisoning, and secret leakage.
Use the CLI for the authoritative rule list in your installed version:
agentshield list-rules
agentshield list-rules --format json
You can define custom organization security policies in .agentshield/rules/*.yaml or pass --rules-dir <path>:
id: "ORG-001"
name: "Banned Production Credentials"
description: "Detects legacy hardcoded connection strings"
severity: "high"
attack_category: "credential_access"
cwe_id: "CWE-798"
match:
regex: "postgres://prod_admin:[^@]+@"
file_glob: "*.{py,ts,js}"
message: "Hardcoded production database connection string detected"
remediation: "Inject database credentials via environment variables or secret store"
Banned dependency rules and prohibited tool name rules are also supported:
id: "ORG-002"
name: "Banned Deprecated Library"
description: "Disallow telnetlib in agent tools"
severity: "medium"
attack_category: "supply_chain"
match:
banned_dependencies:
- name: "telnetlib"
reason: "Insecure unencrypted remote protocol"
tool_name_regex: "^telnet_"
AgentShield includes trust workflow documentation for baselines, suppressions, certification attestations, and egress enforcement:
docs/BASELINES.md: write and use .agentshield-baseline.json for known findings.docs/SUPPRESSIONS.md: suppress individual findings by fingerprint with required reasons and optional expiry.docs/CERTIFICATION.md: generate unsigned or Ed25519-signed DSSE attestations.docs/EGRESS.md: emit agentshield.egress.toml and enforce it with agentshield wrap.Release binaries are built with the full feature set, including Python parsing, TypeScript parsing, runtime wrap support, and experimental runtime guard commands. If building from source, use cargo build --features full --release to include agentshield wrap and agentshield guard.
Create .agentshield.toml in your project root or run agentshield init:
[policy]
# Minimum severity to fail the scan: info, low, medium, high, critical
fail_on = "high"
# Rules to skip entirely
ignore_rules = ["SHIELD-008"]
# Downgrade specific rules
[policy.overrides]
"SHIELD-012" = "info"
[scan]
# Skip test files before parsing
ignore_tests = true
# Optional path filters are relative to the scan root.
# Empty include means all scan-supported files are eligible.
# Use ** for recursive directories; * and ? stay within one path segment.
include = ["src/**", "tools/**"]
exclude = ["legacy/**", "**/generated/**", "vendor/**"]
[runtime.proxy]
# Runtime MCP proxy guard blocking threshold: block, warn, or never.
fail_on = "block"
[[runtime.proxy.tool]]
name = "calculator.add"
fail_on = "never"
Suppressions can be added through agentshield suppress <fingerprint> --reason "..." after obtaining finding fingerprints from JSON output.
When both include and exclude match a file, exclude wins. Use
agentshield scan . --explain to confirm the active path filters and parsed
source-file count before relying on a focused scan in CI.
Path filter matching is case-sensitive, accepts / on all platforms, treats
leading ./ or / as relative to the scan root, and treats a trailing slash
such as legacy/ as matching that directory's contents.
Go, Ruby, Java, and Rust source files are not execution-parsed or included in the normalized execution surface in this release. They may be scanned by other tools in a security stack, but AgentShield does not claim language-level source or taint coverage for them yet.
TypeScript tree-sitter support is feature-gated; the Python compatibility flag keeps existing build commands stable:
cargo build --no-default-features
cargo build --features python
cargo build --features full
The full feature enables language parsers plus the runtime proxy used by agentshield wrap and the experimental runtime guard commands.
CLI / GitHub Action / Library API
|
v
Scan Engine -> ScanReport
|
v
Adapters -> Parsers -> Cross-file analysis -> Unified IR (ScanTarget)
|
v
Rule Engine -> Policy / Suppressions / Baseline filtering
|
v
Console / JSON / SARIF / HTML / DSSE attestation
Adapters translate framework-specific files into a unified intermediate representation. Detectors consume only that IR, so new frameworks can be added without rewriting every rule. Policy, suppressions, and baselines are separate from detection so scans remain explainable and repeatable.
Please report vulnerabilities privately. See SECURITY.md for supported versions, reporting guidance, and disclosure scope.
AgentShield is an open-source project created and maintained by Ronaldo Lima (@limaronaldo) under the aiconnai organization.
cargo test
cargo clippy -- -D warnings
cargo fmt --check
cargo run -- scan tests/fixtures/mcp_servers/vuln_cmd_inject
cargo run -- list-rules
For release-specific notes, see docs/releases/1.0.2.md,
docs/releases/1.0.1.md, docs/releases/1.0.0.md, and
docs/RELEASE_CHECKLIST.md.
🛡️ Offline Rust security scanner for AI agent tools & MCP servers — MCP, Hermes Agent, CrewAI, LangChain/LangGraph, GPT Actions, Cursor Rules. Catches command injection, credential exfiltration, SSRF
Übersicht
🛡️ Offline Rust security scanner for AI agent tools & MCP servers — MCP, Hermes Agent, CrewAI, LangChain/LangGraph, GPT Actions, Cursor Rules. Catches command injection, credential exfiltration, SSRF & unsafe file access; a typical MCP server scans in <50 ms. CLI, GitHub Action, VS Code, SARIF.
Tools
Noch keine Tool-Liste. Remote-Server erhalten eine nach dem ersten Health-Check.
FAQ
Kopieren Sie auf dieser Seite die stdio-Konfiguration für Cursor, Claude Desktop, Claude Code oder VS Code. Sie nutzt die Installation des Herausgebers, keinen PlugMCP-Proxy.
In diesem Eintrag ist keine erforderliche Umgebungsvariable aufgeführt.
Agentshield läuft lokal über stdio.
Zuletzt geprüft: 2026-11-13. 🛡️ Offline Rust security scanner for AI agent tools & MCP servers — MCP, Hermes Agent, CrewAI, LangChain/LangGraph, GPT Actions, Cursor Rules. Catches command injection, credential exfiltration, SSRF & unsafe file access; a typical MCP server scans in <50 ms. CLI, GitHub Action, VS Code, SARIF.