Prepare the server locally
Run this once before adding it to Claude Code.
git clone https://github.com/elliotllliu/agent-shield
cd agent-shieldThen follow the repository README for any remaining dependency or build steps.
Register it in Claude Code
claude mcp add agent-shield -- npx -y @elliotllliu/agent-shield scan ./path/to/targetReplace any placeholder paths in the command with the real path on your machine.
Make your agent remember this setup
agent-shield's config, env vars, and the gotchas you hit — recalled in every future Claude Code, Cursor, and Codex session.
npx conare@latestFree · one command · indexes the sessions already on disk. Set up in the browser instead →
What it does
- Uses 13 independent scanning engines for comprehensive security analysis
- Detects prompt injection, data exfiltration, backdoors, and tool poisoning
- Supports multi-language injection detection across 8 languages
- Generates shareable HTML, JSON, and SARIF reports for CI/CD integration
- Performs real-time MCP runtime interception and static analysis
Try it
Original README from elliotllliu/agent-shield
🛡️ AgentShield
Give your AI a health check.
One scan. Thirteen engines. One report.
You found an MCP Server / Skill / Plugin online and want to install it. But you're wondering:
Is this thing safe? Will it steal my API keys? Hijack my AI? Mine crypto?
AgentShield answers that in seconds. One command, 13 independent scanning engines, one clear report.
npx @elliotllliu/agent-shield scan ./that-thing-you-want-to-install
That's it. First run auto-installs all engines. After that, results come in seconds.
See It In Action
🛡️ 安全检测报告
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📁 检测对象: ./mcp-puppeteer
🔧 检测引擎: 13 个独立扫描器
⏱ 总耗时: 50.2s
──────────────────────────────────────────────────────
🔍 各方检测结论
──────────────────────────────────────────────────────
📋 AgentShield — 内置参考（AI Agent 基础检查）
结论: ⚠️ 发现 1 处需关注
• 代码混淆 📍 src/index.ts:1
🔍 Aguara — 通用代码安全
结论: ✅ 未发现风险
🔎 Semgrep — 代码质量与注入检测
结论: ✅ 未发现风险
🧪 Invariant — MCP Tool Poisoning 检测
结论: ✅ 未发现风险
🔬 Trivy — 漏洞扫描 + 密钥检测
结论: ✅ 未发现风险
🔑 Gitleaks — 密钥和 Token 泄露
结论: ✅ 未发现风险
🐍 Bandit — Python 代码安全
结论: ✅ 未发现风险
📡 Bearer — 数据流 + 隐私分析
结论: ✅ 未发现风险
──────────────────────────────────────────────────────
📊 综合结论
──────────────────────────────────────────────────────
✅ 所有引擎均未检出风险
（7/7 个外部引擎未检出风险）
✅ 后门/远程控制 — 7 个引擎均未检出
✅ 数据窃取 — 7 个引擎均未检出
✅ Prompt 注入 — 7 个引擎均未检出
✅ 挖矿行为 — 7 个引擎均未检出
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
One glance: 7 out of 7 external engines say it's clean. All major threats cleared. Safe to install.
Why Trust It?
Because it's not one engine making the call. It's 13 independent scanning engines, each a specialist in their own domain. We bring them together:
| Engine | What it's best at |
|---|---|
| 📋 AgentShield (reference) | AI Agent basics — skill hijack, prompt injection, MCP runtime |
| 🔍 Aguara | General security — 177 rules, data exfil, taint tracking |
| 🔎 Semgrep | Code quality — 2000+ rules, injection, XSS, hardcoded secrets |
| 🧪 Invariant | MCP-specific — tool poisoning, cross-origin escalation, rug pull |
| 🔬 Trivy | Vulnerability scan + secret detection + SBOM |
| 🔑 Gitleaks | Secret and token leak detection |
| 🐍 Bandit | Python code security |
| 📡 Bearer | Data flow + privacy analysis |
| 🐕 TruffleHog | Secret detection + verification if active |
| 🌐 OSV-Scanner | Dependency vulnerabilities (Google OSV database) |
| 🦑 Grype | Dependency vulnerability scanning |
| 🟢 njsscan | Node.js / JavaScript security |
| 🔐 detect-secrets | Secret detection (Yelp) |
Each engine has its own strengths. We combine all of them into one report.
The built-in engine is reference-only — the overall conclusion is decided by the 7 external engines' consensus. The stronger they get, the stronger we get.
First Run
First time you run it, engines are auto-installed (to ~/.agentshield/, no sudo needed):
🔧 检查引擎...
✅ AgentShield — 已就绪
📦 Aguara — 正在安装... 完成
📦 Semgrep — 正在安装... 完成
📦 Invariant — 正在安装... 完成
📦 Trivy — 正在安装... 完成
📦 Gitleaks — 正在安装... 完成
📦 Bandit — 正在安装... 完成
📦 Bearer — 正在安装... 完成
One-time setup. After that, it's instant.
What Can It Detect?
| Risk | What it means |
|---|---|
| 🔴 Skill Hijack | It's secretly modifying your AI's config |
| 🔴 Backdoor | It can silently execute arbitrary code |
| 🔴 Remote Control | It's connecting to external servers + opening a shell |
| ⚠️ Data Theft | It reads your keys/files and sends them out |
| ⚠️ Prompt Injection | It's secretly adding instructions to your AI |
| ⚠️ Tool Poisoning | Hidden malicious instructions in tool descriptions |
| ⚠️ Obfuscated Code | Code is intentionally unreadable — might be hiding something |
| ⚠️ Vulnerabilities | Known CVEs in dependencies |
| ⚠️ Secret Leaks | API keys, tokens, passwords in source code |
| ℹ️ Excessive Permissions | It asks for more than it needs |
More Options
# HTML report (shareable)
agent-shield scan ./dir --html -o report.html
# JSON (for CI/CD)
agent-shield scan ./dir --json
# Chinese report (default)
agent-shield scan ./dir --lang zh
# SARIF (GitHub Code Scanning)
agent-shield scan ./dir --sarif -o results.sarif
Install
# Recommended: use npx, nothing to install
npx @elliotllliu/agent-shield scan ./my-skill/