# Aperion Shield

A local proxy that intercepts tool execution to stop destructive actions and credential exfiltration before changes hit your system.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 11
- Author: AperionAI
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/AperionAI/shield
- Updated: 2026-10-04
- HTML: https://affpapa.org/en/nevibecode/mcp/aperion-shield

## What it does

Aperion Shield operates between coding assistants and connected tool servers. It evaluates incoming calls against 65 safety rules targeting dangerous patterns in databases and terminal commands. Harmful requests trigger an approval dialog or an immediate block.

The proxy monitors traffic in both directions. It pins tool catalogs to guard against rug pulls, scans tool outputs for prompt injection attempts, and masks credentials with placeholders. A background watcher `--guard` monitors agent instruction files and restores safety hooks if an agent removes them.

Running this server requires an active Docker daemon on your host system. High-risk patterns like `rm -rf /` or spawning a reverse shell fail immediately with a deterministic denial.

## Requirements
- Needs: Docker

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add aperion-shield -- docker run -i --rm ghcr.io/aperionai/shield:shield-v1.0.1
```

### Codex

**Platform CLI**
```bash
codex mcp add aperion-shield -- docker run -i --rm ghcr.io/aperionai/shield:shield-v1.0.1
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "aperion-shield": {
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "ghcr.io/aperionai/shield:shield-v1.0.1"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "aperion-shield": {
            "type": "stdio",
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "ghcr.io/aperionai/shield:shield-v1.0.1"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add aperion-shield docker run -i --rm ghcr.io/aperionai/shield:shield-v1.0.1
```

## When to use it
- intercept destructive terminal and database commands before execution
- stop credential exfiltration following local file reads
- detect prompt injections inside tool response outputs
- mask API tokens before they enter the language model context

## Example prompts
- Install agent hooks for aperion-shield in this IDE workspace
- Run an IDE security scan on project rules files using `--scan-ide`
- Audit the MCP server using `--scan` before adding it to the project config

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md