🛡️ aperion-shield

The free guardrail
your AI coding agent needs.

aperion-shield is a local MCP middleman that blocks destructive AI agent actions — DROP DATABASE, rm -rf /, git push --force, unscoped UPDATE — before they reach your database, repo, or filesystem. Free. Open source. Apache 2.0. No cloud account, no telemetry.

Install in 60 seconds View on GitHub →

✓ Cursor ✓ Claude Code ✓ macOS / Linux / Windows ✓ 13 default rules ✓ Zero telemetry

your-agent ➜ aperion-shield ➜ postgres

# Agent decides to "clean up" the prod database
agent> tools/call execute_sql {"query": "DROP DATABASE prod;"}

[shield] BLOCK rule=sql.drop_database severity=Critical tool=execute_sql
[shield] reason="DROP DATABASE forbidden — open a DBA ticket."

agent  (received shield_blocked, picks a different plan)

agent> tools/call execute_sql {"query": "UPDATE users SET deleted=true"}

[shield] APPROVAL REQUIRED rule=sql.unscoped_update tool=execute_sql
[shield] reason="Unbounded UPDATE — add a WHERE clause or get approval."
[shield] ticket=shld_4f1c2a... (60s timeout)

# in a second terminal, the engineer:
$ echo "deny shld_4f1c2a..." >> .aperion-shield/inbox

agent  (receives shield_approval_denied, asks the user instead)

Why Shield?

AI coding agents are powerful, and they also confidently make catastrophic mistakes — running DROP TABLE on the wrong database, force-pushing over main, rm -rf'ing the wrong directory. Shield is a tiny, fast, local guardrail that lives between your IDE and the real tools.

🛑

Hard blocks for hard 'no's

13 default rules cover SQL, git, and filesystem destruction. DROP DATABASE, rm -rf /, git push --force to main — blocked at the MCP layer, never reach the upstream tool.

✋

Human-in-the-loop on grey areas

High-severity actions (unscoped UPDATE/DELETE, history rewrite) pause and wait 60 s for you to approve in a terminal. Default-deny on timeout.

⚡

Local, fast, zero-config

Runs as a stdio MCP server. Single binary, ~3 MB. No cloud account, no API key, no telemetry. Bundled defaults work out of the box.

🧩

One config, two products

The free standalone and the paid Smartflow gateway use the same YAML rule language. Author once, deploy anywhere.

🪞

Shadow mode

Start with --shadow to log what Shield would have blocked without actually blocking it. Walk to enforce mode at your pace.

📂

Custom rules

Drop a shield.yaml in ~/.aperion-shield/. Regex matchers, named SQL predicates, anomaly detectors — all documented.

Install in 60 seconds

Pick one. Then point your IDE's MCP config at Shield.

# macOS / Linux (Homebrew)
brew install AperionAI/tap/aperion-shield

# any platform (Cargo)
cargo install aperion-shield

# pre-built binaries (any platform)
# https://github.com/AperionAI/shield/releases

Cursor — `~/.cursor/mcp.json`

{
  "mcpServers": {
    "postgres": {
      "command": "aperion-shield",
      "args": [
        "--",
        "npx", "-y",
        "@modelcontextprotocol/server-postgres",
        "postgresql://user:pass@localhost:5432/mydb"
      ]
    }
  }
}

Claude Code — `~/.claude/config.json`

{
  "mcpServers": {
    "shell": {
      "command": "aperion-shield",
      "args": ["--", "npx", "-y", "@modelcontextprotocol/server-shell"]
    }
  }
}

Full walk-throughs: Cursor quickstart · Claude Code quickstart · Custom rules

What does Shield catch out-of-the-box?

13 rules across SQL, git, filesystem, LLM plans, and anomaly detection. All in config/shieldset.yaml; all overridable.

🗄️

SQL

DROP DATABASE, DROP TABLE, TRUNCATE, unscoped UPDATE / DELETE, GRANT ALL.

🌿

Git

git push --force to main / master, git filter-repo, git reset --hard HEAD~, git branch -D.

💽

Filesystem

rm -rf /, rm -rf $HOME, dd if=… of=/dev/sda, deletes under /etc, /var, /usr.

🧠

LLM plans

The assistant mentions a destructive plan in its reply text, even before it reaches for a tool. Enterprise seam.

📈

Anomaly

5+ destructive ops by the same actor in 5 minutes. Catches "agent went rogue" loops.

⚙️

Your rules

Layer company-specific rules on top via YAML. Regex + named SQL predicates + anomaly detectors.

Free standalone vs. Smartflow

The free product is great on its own. The paid product (Smartflow) adds the team / compliance layer for regulated industries.

	aperion-shield free, Apache 2.0	Smartflow paid, commercial
Local rule engine + 13 defaults	✓	✓
Cursor / Claude Code MCP wrapper	✓	✓
Custom rules (YAML)	✓	✓
Shadow / enforce / audit modes	✓	✓
Local stderr audit log	✓	✓
Hosted approval queue + dashboard	—	✓
Tamper-evident audit chain (RFC 3161)	—	✓
WORM connectors (S3 Object Lock, etc.)	—	✓
EU AI Act conformity console + AI-BOM	—	✓
Shared team rules + role-based approval	—	✓
MCP trust registry (signed servers)	—	✓
Sigstore-signed binaries + admission policies	—	✓

Need the team layer? Explore Smartflow →

Privacy

The free standalone product does not phone home. There is no telemetry, no usage counters sent to APERION, no account ever created. Logs are written to your local stderr only.

An optional opt-in public "block ticker" (a counter of how many destructive ops Shield blocked across the entire user base — never including SQL, prompts, or payloads) is under design. If/when it ships, it will be explicitly opt-in at install time and gated on legal + DPO review.

The free guardrailyour AI coding agent needs.