Shrike

Shrike MCP

Govern what your AI agents do: every tool call, command, and query checked against your policy before it runs. 15 MCP tools; 9-layer engine. Works without an API key.

Shrike MCP is the Model Context Protocol server for Shrike. It puts a policy checkpoint at the moment an AI agent acts: every tool call, SQL query, file write, CLI command, web search, and agent-to-agent message is evaluated against your policy and allowed, flagged for approval, or blocked before it executes, on your terms, independent of your model or cloud. Underneath, a 9-layer engine detects prompt injection, jailbreaks, data leakage, PII exposure, and multi-turn manipulation so those verdicts are accurate.

Shrike Platform

Shrike is the independent governance layer for AI interactions. It evaluates inputs, outputs, tool calls, and agent-to-agent communication through a 9-layer cognitive pipeline, from sub-millisecond pattern matching to LLM-powered semantic analysis and multi-turn session correlation. Governs employees using AI tools, developers using coding assistants, autonomous agents, and customer-facing chatbots through the same pipeline.

This repo is the MCP server, one of several ways to integrate:

Quick Start

Works immediately: no API key required. Anonymous usage gets L1-L5 pattern-based detection. Register for a free account for a dashboard, higher rate limits, and scan history; LLM-powered semantic analysis (L6-L9) is available on Pro.

1. Add to your MCP client config:

{

"mcpServers": { "shrike-security": { "command": "npx", "args": ["-y", "shrike-mcp"] } } }

2. (Optional) Add an API key for full pipeline access:

{

"mcpServers": { "shrike-security": { "command": "npx", "args": ["-y", "shrike-mcp"], "env": { "SHRIKE_API_KEY": "your-api-key" } } } }

Get a free key at shrikesecurity.com/signup: instant, no credit card.

npm only. The Shrike MCP server is distributed on npm and runs via npx shrike-mcp (Node.js required). There is no pip install shrike-mcp; an unrelated third-party package happens to hold that name on PyPI. For Python *code* integration, use the Python SDK: pip install shrike-guard.

3. Your agent now has 15 security tools (9 governance scanners, 1 scope declaration, 1 outcome report, and 4 session & approval tools). Every prompt, response, and tool call can be scanned before execution.

Fifteen Tools

How It Works

Shrike uses a scan-sandwich pattern: every agent action is scanned on both sides:

User Input → scan_prompt → LLM Processing → scan_response → User Output

↓ Tool Call (SQL, File, Command, Search) ↓ scan_sql_query / scan_file_write / scan_command / scan_web_search ↓ Tool Execution

Agent-to-Agent Communication: Inbound A2A → scan_a2a_message → Process → scan_a2a_message → Outbound A2A Discovery → scan_agent_card → Trust decision

Inbound scans catch injection attacks. Outbound scans catch data leaks. Tool-specific scans catch SQL injection, path traversal, command injection, and PII exposure. A2A scans catch east-west injection between agents. Flagged actions trigger human-in-the-loop approval via check_approval.

Pro and above add session correlation (L9), tracking multi-turn patterns like trust escalation, payload splitting, and blocked retry sequences across an entire conversation.

Detection Pipeline

Every scan runs through the 9-layer cognitive pipeline. Lower layers are sub-millisecond pattern matching; higher layers add LLM-powered semantic analysis. Tier determines how deep the scan goes. The table below shows the specialized sub-detectors within each layer.

The cascade optimizer exits early when high-confidence detection is achieved at a lower layer, so most scans complete in under 10ms without needing the LLM layer.

Tiers

All 15 tools are available on every tier. Tiers control detection depth and volume.

Anonymous (no API key): Pattern-based detection only (L1-L5). Good for evaluation and basic protection.

Community (free): Same L1-L5 pattern-based detection, plus a dashboard, 1,000 scans/month, and audit history. Register at shrikesecurity.com/signup.

Pro/Enterprise: Full 9-layer pipeline: adds LLM-powered semantic analysis (L6-L7), response intelligence (L8), and multi-turn session correlation (L9).

Compliance

Built-in policy catalogues with sensitive-data detection aligned to 5 major regulatory frameworks:

Detection coverage is not a certification claim; see shrikesecurity.com/compliance for our current certification status.

Configuration

Environment Variables

Claude Desktop

{

"mcpServers": { "shrike-security": { "command": "npx", "args": ["-y", "shrike-mcp"], "env": { "SHRIKE_API_KEY": "your-api-key" } } } }

Cursor

Add to .cursor/mcp.json:

{

"mcpServers": { "shrike-security": { "command": "npx", "args": ["-y", "shrike-mcp"], "env": { "SHRIKE_API_KEY": "your-api-key" } } } }

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json:

{

"mcpServers": { "shrike-security": { "command": "npx", "args": ["-y", "shrike-mcp"], "env": { "SHRIKE_API_KEY": "your-api-key" } } } }

Security Model

This server implements a fail-closed security model:

• Network timeouts result in BLOCK (not allow)
• Backend errors result in BLOCK (not allow)
• Unknown content types result in BLOCK (not allow)

This prevents bypass attacks via service disruption.

Response Format

Blocked:

{

"blocked": true, "threat_type": "prompt_injection", "severity": "high", "confidence": "high", "guidance": "This prompt contains patterns consistent with instruction override attempts.", "request_id": "req_lxyz123_a8f3k2m9" }

Safe:

{

"blocked": false, "request_id": "req_lxyz123_a8f3k2m9" }

Use Cases

How This Differs From a Prompt S