shellward — Claude Code MCP server: agent security and compliance
Scans your project for data-leak risks and dangerous commands, then blocks prompt injection and exfiltration at runtime. Built for AI projects under Chinese regulation.
claude mcp add --env SHELLWARD_MODE=<SHELLWARD_MODE> --env SHELLWARD_LOCALE=<SHELLWARD_LOCALE> --env SHELLWARD_THRESHOLD=<SHELLWARD_THRESHOLD> --transport stdio shellward -- npx -y shellwardWhat shellward does
shellward is an MCP server with 7 tools: injection detection, PII scanning, command safety checks, and DLP. It sits between your agent and the outside world, intercepting suspicious calls before they leave.
Scanning runs with a single command, npx shellward scan — no install, read-only, nothing uploaded. You get a red/yellow/green scorecard mapped to Chinese regulatory requirements plus concrete findings with file:line locations. Calls to overseas LLM endpoints and SDKs are flagged as cross-border data channels. For any overseas model it finds, the server suggests domestic alternatives with a compatible base_url, so migration often means changing one line.
Setup uses the environment variables SHELLWARD_MODE, SHELLWARD_LOCALE, and SHELLWARD_THRESHOLD, passed when you add the server. Without them it still starts, but thresholds fall back to defaults. There is also a web mode: shellward web --local opens a local GUI where you paste a project path — code never leaves your machine.
What it helps with
- find calls to overseas LLM endpoints in a project
- check whether personal data leaks into prompts
- block dangerous commands before the agent runs them
- spot hardcoded keys and tokens in source files
- produce a compliance report for an audit
Example prompts for the agent
- Run
shellward scanand show me what risks are in this project - Check this file for personal data and hardcoded keys
- Compare our code against PIPL requirements and tell me what's missing
How to install shellward
Platform CLI
claude mcp add --env SHELLWARD_MODE=<SHELLWARD_MODE> --env SHELLWARD_LOCALE=<SHELLWARD_LOCALE> --env SHELLWARD_THRESHOLD=<SHELLWARD_THRESHOLD> --transport stdio shellward -- npx -y shellwardReplace <…> with your own values
Platform CLI
codex mcp add shellward --env SHELLWARD_MODE=<SHELLWARD_MODE> --env SHELLWARD_LOCALE=<SHELLWARD_LOCALE> --env SHELLWARD_THRESHOLD=<SHELLWARD_THRESHOLD> -- npx -y shellwardReplace <…> with your own values
Config file
{
"mcpServers": {
"shellward": {
"command": "npx",
"args": [
"-y",
"shellward"
],
"env": {
"SHELLWARD_MODE": "<SHELLWARD_MODE>",
"SHELLWARD_LOCALE": "<SHELLWARD_LOCALE>",
"SHELLWARD_THRESHOLD": "<SHELLWARD_THRESHOLD>"
}
}
}
}Replace <…> with your own values
Config file
{
"servers": {
"shellward": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"shellward"
],
"env": {
"SHELLWARD_MODE": "<SHELLWARD_MODE>",
"SHELLWARD_LOCALE": "<SHELLWARD_LOCALE>",
"SHELLWARD_THRESHOLD": "<SHELLWARD_THRESHOLD>"
}
}
}
}Replace <…> with your own values
Platform CLI
gemini mcp add -e SHELLWARD_MODE=<SHELLWARD_MODE> -e SHELLWARD_LOCALE=<SHELLWARD_LOCALE> -e SHELLWARD_THRESHOLD=<SHELLWARD_THRESHOLD> shellward npx -y shellwardReplace <…> with your own values
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about shellward
How do I install shellward in Claude Code?
Run claude mcp add shellward -- npx -y shellward. For custom settings, use the variant with environment variables: `claude mcp add --env SHELLWARD_MODE=<SHELLWARD_MODE> --env SHELLWARD_LOCALE=<SHELLWARD_LOCALE> --env SHELLWARD_THRESHOLD=<SHELLWARD_THRESHOLD> --transport stdio shellward -- npx -y shellward`.
What does shellward do?
It's an MCP server with 7 tools for AI agent security: it detects prompt injection, scans for PII, checks commands for danger, and prevents data exfiltration. It also scans projects for compliance with Chinese regulatory requirements.
What environment variables does shellward need?
SHELLWARD_MODE, SHELLWARD_LOCALE, and SHELLWARD_THRESHOLD. They set the operating mode, language, and detection threshold. Without them the server still runs, using its defaults.
