{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_s347m6c7f3sj","handle":"intentshield-mcp","url":"https://wellknown.network/agents/intentshield-mcp","links":{"self":"https://wellknown.network/agents/intentshield-mcp/record.json","html":"https://wellknown.network/agents/intentshield-mcp","markdown":"https://wellknown.network/agents/intentshield-mcp/record.md","api":"https://wellknown.network/api/v1/agents/intentshield-mcp","status":"https://wellknown.network/api/v1/agents/intentshield-mcp/status","claim":"https://wellknown.network/agents/intentshield-mcp/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/intentshield-mcp/claim.json","badge":"https://wellknown.network/agents/intentshield-mcp/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/intentshield-mcp/history","tools":"https://wellknown.network/api/v1/agents/intentshield-mcp/tools"},"ard":{"identifier":"urn:air::server:intentshield-mcp","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"intentshield-mcp","summary":"IntentShield for MCP: an offline-first security guardrail against prompt injection in MCP tool calls, with hooks for Claude Code, Codex CLI, Cursor and Gemini CLI and a transparent MCP proxy","description":"# IntentShield for MCP\n\n**What:** an offline-first guardrail between an AI agent and its MCP tools. Every proposed tool call is normalized, checked by a deterministic policy, audited, and answered **ALLOW**, **REVIEW** or **BLOCK** before any side effect.<br>\n**For:** anyone running Claude Code, Codex CLI, Cursor or Gemini CLI against MCP servers who wants tool calls checked locally; the core needs no API key.<br>\n**Headline:** on 220 held-out MSB attack cases (218/220/216 paired per local agent), harmful actions executed fell from 15–59% unguarded to 0.0%, and the gateway left no harmful call waiting in the human's review queue (the hooks left 5/2/3 cases on qwen/llama/ornith). That is not unique: a trivial guard that holds every state-changing call for a human also reaches 0.0%, though it leaves up to 19% of cases in the queue. The cost is 8–14 points of task completion and, on all 4 agents, more benign calls held for review. Read the [caveats](#results) before quoting it.<br>\n**Not covered by default:** the harness's built-in shell and file tools (only MCP calls are checked unless you install with `--builtin-tools`, which is opt-in and best effort); HTTP (`url`) MCP servers, which `wrap` skips (guard those with the gateway); injections written in plain language with no instruction marker, which the rules mostly miss (the optional LLM judge with `--judge-outputs` reads them; see [Results](#results)); injections in other languages, where the rules read only \"ignore the previous instructions\" and \"new task:\" (in 11 languages); and the learned detectors' PyTorch path, which CI does not exercise. Codex CLI runs the hooks only after you trust them once in Codex (until then it is unguarded); Cursor has been run live twice with its `auto` model: in the MCP run its model refused the attack even unguarded, so that run shows the hooks work, not that they stop an attack; in the opt-in built-in-tools run (1 repetition, guarded arm only, no valid unguarded arm) it tried the u…","publisher":null,"homepage":"https://github.com/Suhas-123-cell/IntentShield/blob/main/docs/README.md","repository":"https://github.com/Suhas-123-cell/IntentShield/blob/main/CHANGELOG.md","version":"0.4.2","license":null,"protocols":["mcp"],"tags":["agent-security","ai-security","claude-code","codex","cursor","gemini-cli","guardrail","guardrails","intentshield","llm-security","mcp","mcp-proxy","mcp-security","model-context-protocol","prompt-injection","tool-poisoning"],"pricing":null,"endpoints":[{"url":"pypi:intentshield-mcp","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","repoUrl":"pypi","summary":"pypi","version":"pypi","description":"pypi","homepageUrl":"pypi"}},"derived":{"capabilities":[{"slug":"security.scanning","name":"Security Scanning","confidence":1,"provenance":"derived"}],"categories":["security"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"intentshield-mcp","registry":"pypi","observedAt":"2026-11-05T21:26:45.348Z","publishedAt":"2026-10-31T16:26:29.761087Z","latestVersion":"0.4.2"},"toolSurface":null,"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"intentshield-mcp","url":"https://pypi.org/project/intentshield-mcp/","firstSeenAt":"2026-10-30T19:25:57.742Z","fetchedAt":"2026-11-05T21:25:54.083Z","normalizedAt":"2026-11-05T21:25:54.083Z"}]},"firstSeenAt":"2026-10-30T19:25:57.742Z","updatedAt":"2026-11-05T21:26:45.348Z"}