Aperion Shield — Claude Code MCP server: what it does, how to install
A local proxy that intercepts tool execution to stop destructive actions and credential exfiltration before changes hit your system.
claude mcp add aperion-shield -- docker run -i --rm ghcr.io/aperionai/shield:shield-v1.0.1What Aperion Shield does
Aperion Shield operates between coding assistants and connected tool servers. It evaluates incoming calls against 65 safety rules targeting dangerous patterns in databases and terminal commands. Harmful requests trigger an approval dialog or an immediate block.
The proxy monitors traffic in both directions. It pins tool catalogs to guard against rug pulls, scans tool outputs for prompt injection attempts, and masks credentials with placeholders. A background watcher --guard monitors agent instruction files and restores safety hooks if an agent removes them.
Running this server requires an active Docker daemon on your host system. High-risk patterns like rm -rf / or spawning a reverse shell fail immediately with a deterministic denial.
What it helps with
- intercept destructive terminal and database commands before execution
- stop credential exfiltration following local file reads
- detect prompt injections inside tool response outputs
- mask API tokens before they enter the language model context
Example prompts for the agent
- Install agent hooks for aperion-shield in this IDE workspace
- Run an IDE security scan on project rules files using
--scan-ide - Audit the MCP server using
--scanbefore adding it to the project config
How to install Aperion Shield
Platform CLI
claude mcp add aperion-shield -- docker run -i --rm ghcr.io/aperionai/shield:shield-v1.0.1Platform CLI
codex mcp add aperion-shield -- docker run -i --rm ghcr.io/aperionai/shield:shield-v1.0.1Config file
{
"mcpServers": {
"aperion-shield": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/aperionai/shield:shield-v1.0.1"
]
}
}
}Config file
{
"servers": {
"aperion-shield": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/aperionai/shield:shield-v1.0.1"
]
}
}
}Platform CLI
gemini mcp add aperion-shield docker run -i --rm ghcr.io/aperionai/shield:shield-v1.0.1Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Aperion Shield
How to install Aperion Shield in Claude Code?
Run claude mcp add aperion-shield -- docker run -i --rm ghcr.io/aperionai/shield:shield-v1.0.1 in your terminal. Ensure Docker is running locally before executing the command.
What does Aperion Shield do?
It acts as a local security gateway between your coding agent and connected tools. It stops dangerous operations, guards against tool poisoning, and prevents credentials from leaking to external endpoints.
Which commands are blocked without an approval prompt?
Critical threats such as rm -rf /, reverse shell scripts, or attempts by an agent to modify Shield configuration files are rejected outright with an immediate deny.
