Shield Kya

@shield-agent/kya

Audit trail and traceability for AI agents. See what every coding agent did and check each tool call against policy. KYA records every tool call your coding agents make, on a local dashboard, and by default denies a short list of destructive commands, secret reads and exfiltration (list below). Everything else is recorded, not blocked. Local hooks fail open. Real blocking and human approval run on the MCP policy path against a hosted workspace (the Shield Agent cloud service). One command. Free forever under MIT.

npm i -g @shield-agent/kya@latest && kya start

Permission denied (EACCES) on Linux? No sudo and no install needed:

npx @shield-agent/kya@latest start

Requires Node.js 22+ (24 recommended). Restart Cursor / Claude Code / Codex once so MCP loads. Hosted desk: shield-agent.com.

CLI and local MCP gate for Shield’s Know Your Agent path.

An agent that asks Shield first gets Allow, Review, or Deny: you register the agent, wrap the tool (or route it through the MCP gate or the hosted plane), and Review waits for a person. Local hooks only record and block the never-list and the guard pack (see Hook interception). Hosted is where enforcement lives. This package does not scan your network. Agents that never call evaluate stay invisible on purpose.

Walkthrough: how you use it.

npx @shield-agent/kya@latest --help

npx @shield-agent/kya@latest --version

--version, -v, -V and kya version print the installed package version on one line and exit 0. They read the local package only: no network, no banner, no config.

Requires Node.js 22+ (engines.node: >=22); 24 is the recommended line. Node 20 and 21 are unsupported but work: the CLI prints a one-line warning. Node 18 and older are unsupported and some features break there (HTTP serve-mcp, the gateway OTLP receiver). Below 22 the CLI offers to install Node 24 for you (via volta / fnm / nvm / brew), reinstall itself, and finish the command. If you decline, it just prints the warning and continues. kya hook never warns or prompts.

It works with any host that speaks MCP or OpenAPI. Vertical packs are optional. Shield is the only policy decision point (the one place that decides Allow or Deny). This gate never auto-approves an irreversible side effect (a change you cannot undo).

If KYA_API_KEY is empty against an authenticated plane, network commands exit non-zero. eval-tool, wrap, and invoke exit 0 on ALLOW, 4 on REQUIRE_APPROVE, and 1 on DENY or unknown, so a line like eval-tool && write cannot skip the gate. wrap runs in observe mode by default, so it exits 0 on REQUIRE_APPROVE too. Set KYA_HOLD=1 or pass --hold to get the 4.

--offline runs sample evaluate without a paid cloud (useful for DENY and REQUIRE_APPROVE demos). Creating an agent is itself a tool: offline, kya.agent.register comes back REQUIRE_APPROVE. Allow, break-glass, and approve mint modes (the modes that create approvals) live on the control plane.

One liner

npm i -g @shield-agent/kya@latest && kya start

Permission denied (EACCES) on Linux? No sudo and no install needed:

npx @shield-agent/kya@latest start

Run it in your project directory. (From a clone of this repo, ./scripts/install-local.sh replaces the npm install.)

If the install fails with EACCES (the global npm folder belongs to root, common on Linux), do not use sudo. Run without a global install: npx @shield-agent/kya@latest start. Or give npm a folder you own: npm config set prefix ~/.npm-global, add ~/.npm-global/bin to your PATH, then run the install again.

More ways to install (same package; npm stays the reference path):

# Homebrew. Homebrew 7 may ask you to trust a third-party tap: run `brew tap The-Pixel-Boys/tap` first.

The formula does not install the semantic-search runtime. Search stays lexical until you opt in (see Natural-language search).

brew install The-Pixel-Boys/tap/shield-kya

Scoop (not yet verified on Windows)

scoop bucket add The-Pixel-Boys https://github.com/The-Pixel-Boys/scoop-bucket.git scoop install shield-kya

Where each channel is counted. The table has no counts on purpose. Downloads are not installs and not people.

Homebrew, Scoop, plugins and the GitHub Action fetch the npm package, so they are inside the npm count and are not added again.

Adoption, measured. The badge reads a public file that a daily job writes. A count under 50 is not shown. The badge reads "unavailable" when the last measurement failed. The website also hides any figure older than 48 hours.

Repos using kya-action: public repos outside The-Pixel-Boys, counted by GitHub code search. This count is approximate. Private repos are not counted, and the search covers default branches only.

Hosted channel counts (Slack, Teams, webhook, helpdesk) and the date of each count are on https://shield-agent.com.

Claude Code users can also install the plugin; GitHub Copilot CLI users the Copilot CLI plugin (read its first paragraph before installing); Codex CLI users the Codex plugin; Gemini CLI users the Gemini CLI extension. Cline users: npm install -g @shield-agent/kya@latest, then follow llms-install.md. It is written so Cline can follow it; a Cline run from that file alone has not been tested yet.

That inits .kya/, wires local MCP (.mcp.json, mcp.json, .cursor/mcp.json → kya serve-mcp --stdio), also wires user-level configs for every installed host it detects (~/.claude.json, ~/.kimi-code/, ~/.grok/, ~/.cursor/, …), and opens the live activity report. The report runs in the background, so you get your terminal back. kya stop stops it. kya receipt --open reopens it. Cursor, Kiro, Qwen, Amp, Droid, Cline, and Grok pick the server up live with no restart (Kimi: just a new session). Claude Code, Codex, OpenCode, Gemini, Copilot CLI, and Kilo CLI load it on next launch. claude --resume keeps your conversation.

kya start --no-open   # wire only

kya start --force # rewrite MCP blocks

Receipt change previews (clipped + redacted): on by default for writes

KYA_DIFF_PREVIEW=0 to disable

One command per host

kya start covers Claude Code, Cursor, and any host that reads .mcp.json. It also auto-wires the user-level config of every installed host it detects. For the rest, kya connect writes the host's own config dialect directly:

kya connect claude              # ~/.claude.json (merges mcpServers only)

kya connect grok # ~/.grok/config.toml (appends [mcp_servers.shield-kya]) kya connect opencode # ~/.config/opencode/opencode.json kya connect qwen # ~/.qwen/settings.json kya connect amp # ~/.config/amp/settings.json kya connect qwen --project # project scope instead of global kya connect kiro --force # overwrite an existing shield-kya entry

Connect merges. It never rewrites a host config it cannot parse, and it keeps your other servers and keys. Supported hosts: claude, codex, grok, opencode, kilo, kiro, qwen, kimi, mastracode, amp, copilot, cursor. Each wires serve-mcp --stdio with KYA_OFFLINE=1 so the gate starts keyless (no API key). Set KYA_API_KEY in the host env when you point at an authenticated plane.

Hosts without a connect target still work: kya wrap --offline -- puts the same evaluate gate in front of any CLI. Per-host recipes with verify steps and troubleshooting live in docs/hosts/.

Hook interception

kya start also wires a PreToolUse hook into every installed hook-capable host it detects: Claude Code (~/.claude/settings.json, merge-only), Grok (~/.grok/hooks/shield-kya.json, kya-managed file), and Kimi Code (~/.kimi-code/config.toml, [[hooks]] append). Every tool call the agent makes then passes through kya hook first: it is evaluated locally (offline, sub-second, no network) and written to the global record (trail). (If you opted in to anonymous usage stats, the hook also starts a detached helper at most once a day; see Anonymous usage stats.)

Decision mapping: a local never-list or guard pack DENY blocks the tool call (exit 2 plus hookSpecificOutput deny JSON with permissionDecision: "deny"). ALLOW and REQUIRE_APPROVE are written to the record as advisory and the call proceeds. Manual wiring can pass --strict on the hook command to also block REQUIRE_APPROVE.

The never-list also blocks three groups added on 2026-10-30, pending owner review: agent-driven persistence (writes to ~/.ssh/authorized_keys, cron, LaunchAgents