{"_id":"@armalo/mcp-shield","_rev":"2-26c81b279ff917afac1408cecae48cbd","name":"@armalo/mcp-shield","dist-tags":{"latest":"0.1.1"},"versions":{"0.1.0":{"name":"@armalo/mcp-shield","version":"0.1.0","keywords":["mcp","mcp-server","trust","agent-trust","armalo","rate-limit","prompt-injection","audit","shield","security"],"license":"MIT","_id":"@armalo/mcp-shield@0.1.0","maintainers":[{"name":"armalo","email":"ryan@armalo.ai"}],"homepage":"https://github.com/armalo-ai/armalo#readme","bugs":{"url":"https://github.com/armalo-ai/armalo/issues"},"bin":{"armalo-mcp-shield":"dist/bin/cli.js"},"dist":{"shasum":"02287d1ee2d086614e4aa20496f1706010830c3e","tarball":"https://registry.npmjs.org/@armalo/mcp-shield/-/mcp-shield-0.1.0.tgz","fileCount":18,"integrity":"sha512-tIgcZBJb1UNn5POZKNlM9q8YvGqxc1KeQWspg46sEZmFrtVeeeXfDzsq19I5nH9rUGQ9Q210mQk8+xCZtPQh6g==","signatures":[{"sig":"MEQCIFfOph3CL/+XLmlbWW5iD7SVfGwgZRJKsxVosNcgXZdxAiBllYlQu02AC5fNJk8mEG+sfW11bTGoXxDPNkBXbGagIQ==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":59092},"main":"./dist/index.js","type":"module","_from":"file:armalo-mcp-shield-0.1.0.tgz","types":"./dist/index.d.ts","module":"./dist/index.js","engines":{"node":">=18.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"},"./bin":{"types":"./dist/bin/cli.d.ts","import":"./dist/bin/cli.js"},"./middleware":{"types":"./dist/middleware.d.ts","import":"./dist/middleware.js"}},"scripts":{"test":"vitest run","build":"rm -rf dist && tsc","type-check":"tsc --noEmit"},"_npmUser":{"name":"armalo","email":"ryan@armalo.ai"},"_resolved":"/private/var/folders/14/n0ylldy508xgs8tcyqslfdt80000gn/T/028525dc92d81b72665101a459869076/armalo-mcp-shield-0.1.0.tgz","_integrity":"sha512-tIgcZBJb1UNn5POZKNlM9q8YvGqxc1KeQWspg46sEZmFrtVeeeXfDzsq19I5nH9rUGQ9Q210mQk8+xCZtPQh6g==","repository":{"url":"git+https://github.com/armalo-ai/armalo.git","type":"git","directory":"packages/mcp-shield"},"_npmVersion":"11.9.0","description":"Drop-in trust boundary for MCP servers: trust-score gating, per-tool rate limits, prompt-injection prefilter, audit forwarding. Free OSS shield.","directories":{},"_nodeVersion":"24.14.0","dependencies":{"zod":"^3.24.0","commander":"^12.0.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^2.0.0","typescript":"^5.7.0","@types/node":"^22.0.0"},"peerDependencies":{"express":"*","fastify":"*"},"peerDependenciesMeta":{"express":{"optional":true},"fastify":{"optional":true}},"_npmOperationalInternal":{"tmp":"tmp/mcp-shield_0.1.0_1778822640069_0.44259465304206524","host":"s3://npm-registry-packages-npm-production"}},"0.1.1":{"name":"@armalo/mcp-shield","version":"0.1.1","description":"Drop-in trust boundary for MCP servers: trust-score gating, per-tool rate limits, prompt-injection prefilter, audit forwarding. Free OSS shield. ESM-only.","type":"module","main":"./dist/index.js","module":"./dist/index.js","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","default":"./dist/index.js"},"./middleware":{"types":"./dist/middleware.d.ts","import":"./dist/middleware.js","default":"./dist/middleware.js"},"./bin":{"types":"./dist/bin/cli.d.ts","import":"./dist/bin/cli.js","default":"./dist/bin/cli.js"}},"bin":{"armalo-mcp-shield":"dist/bin/cli.js"},"engines":{"node":">=18.0.0"},"dependencies":{"commander":"^12.0.0","zod":"^3.24.0"},"peerDependencies":{"express":"*","fastify":"*"},"peerDependenciesMeta":{"express":{"optional":true},"fastify":{"optional":true}},"devDependencies":{"typescript":"^5.7.0","vitest":"^2.0.0","@types/node":"^22.0.0"},"keywords":["mcp","mcp-server","trust","agent-trust","armalo","rate-limit","prompt-injection","audit","shield","security"],"license":"MIT","repository":{"type":"git","url":"git+https://github.com/armalo-ai/armalo.git","directory":"packages/mcp-shield"},"publishConfig":{"access":"public"},"scripts":{"build":"rm -rf dist && tsc","type-check":"tsc --noEmit","test":"vitest run"},"_id":"@armalo/mcp-shield@0.1.1","bugs":{"url":"https://github.com/armalo-ai/armalo/issues"},"homepage":"https://github.com/armalo-ai/armalo#readme","_integrity":"sha512-bizK4vv9mCQpIXa2k5KseLW4HXIyP799pW1yKfePVk/i8wXQ8SCXjSSTPwrU1E/Zt5aVUj4KbMILu3NzC3ue+A==","_resolved":"/private/var/folders/14/n0ylldy508xgs8tcyqslfdt80000gn/T/dbdce1bf64e81b065d83e32bc1a1e717/armalo-mcp-shield-0.1.1.tgz","_from":"file:armalo-mcp-shield-0.1.1.tgz","_nodeVersion":"24.14.0","_npmVersion":"11.9.0","dist":{"integrity":"sha512-bizK4vv9mCQpIXa2k5KseLW4HXIyP799pW1yKfePVk/i8wXQ8SCXjSSTPwrU1E/Zt5aVUj4KbMILu3NzC3ue+A==","shasum":"c3bb982f5c5e05cf8e652e80f234a3bbc72f10a7","tarball":"https://registry.npmjs.org/@armalo/mcp-shield/-/mcp-shield-0.1.1.tgz","fileCount":18,"unpackedSize":59217,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQCU80apGEkviw7ByASa9VIgYirueTl/7OX2JMX8S4brwwIgAKjz5GaYwlr95zHg0Ej/NYmkFxjzUjIzctVUJHFTjHw="}]},"_npmUser":{"name":"armalo","email":"ryan@armalo.ai"},"directories":{},"maintainers":[{"name":"armalo","email":"ryan@armalo.ai"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/mcp-shield_0.1.1_1778825523043_0.6577776739815648"},"_hasShrinkwrap":false}},"time":{"created":"2026-05-15T05:23:59.998Z","modified":"2026-05-15T06:12:03.587Z","0.1.0":"2026-05-15T05:24:00.237Z","0.1.1":"2026-05-15T06:12:03.194Z"},"bugs":{"url":"https://github.com/armalo-ai/armalo/issues"},"license":"MIT","homepage":"https://github.com/armalo-ai/armalo#readme","keywords":["mcp","mcp-server","trust","agent-trust","armalo","rate-limit","prompt-injection","audit","shield","security"],"repository":{"type":"git","url":"git+https://github.com/armalo-ai/armalo.git","directory":"packages/mcp-shield"},"description":"Drop-in trust boundary for MCP servers: trust-score gating, per-tool rate limits, prompt-injection prefilter, audit forwarding. Free OSS shield. ESM-only.","maintainers":[{"name":"armalo","email":"ryan@armalo.ai"}],"readme":"# @armalo/mcp-shield\n\nDrop-in trust boundary for MCP servers. Free, OSS, no Armalo account required.\n\n`@armalo/mcp-shield` wraps your MCP tool handlers with four layers of defense before\nthey ever execute:\n\n1. **Trust-score gating** — if the calling agent's Armalo composite score is below\n   your threshold, the call is rejected. Anonymous callers bypass this layer.\n2. **Per-tool rate limits** — token-bucket limits keyed by `(toolName, callerAgentId)`,\n   with both per-minute and per-day windows.\n3. **Prompt-injection prefilter** — a curated list of high-signal markers (OWASP\n   LLM01, MCP tool-poisoning patterns) blocks the most common attack strings.\n4. **Audit forwarding** — every accepted call and every rejection is fire-and-forget\n   POSTed to an audit webhook, with secrets redacted.\n\n## Install\n\n```bash\n# Programmatic use\npnpm add @armalo/mcp-shield\n\n# Scaffold a config file (no install needed)\nnpx armalo-mcp-shield init\n```\n\n## Quick start\n\n```ts\nimport { createMcpShield } from '@armalo/mcp-shield';\n\nconst shield = createMcpShield({\n  agentId: 'your-mcp-server-uuid',\n  policy: {\n    defaultMinTrustScore: 600,\n    perTool: {\n      transfer_funds: {\n        minTrustScore: 800,\n        rateLimit: { perMinute: 5, perDay: 100 },\n      },\n      delete_everything: { deny: true },\n    },\n  },\n  failClosed: true,\n});\n\nconst shieldedHandler = shield.wrapTool('transfer_funds', async (args) => {\n  // Your original tool logic — only runs after every check passes.\n  return doTransfer(args);\n});\n```\n\nCallers identify themselves via either an `_armaloCallerAgentId` arg or an\n`X-Armalo-Caller` HTTP header. If neither is supplied, trust-gating is skipped\nfor that call (rate-limit + injection-filter still apply, keyed to `anonymous`).\n\n## HTTP middleware (Express / Fastify)\n\n```ts\nimport express from 'express';\nimport { createMcpShield } from '@armalo/mcp-shield';\n\nconst shield = createMcpShield({ policy: { defaultMinTrustScore: 500 } });\n\nconst app = express();\napp.use(express.json());\napp.post('/mcp', shield.middleware, yourMcpHandler);\n```\n\nThe middleware inspects JSON-RPC `tools/call` requests, applies the same checks\nas `wrapTool`, and rejects with a `403` (or `429` on rate-limit) before your\nhandler is reached.\n\n## CLI\n\n```\narmalo-mcp-shield init           # scaffold armalo-mcp-shield.config.json\narmalo-mcp-shield wrap server.ts # generate server.shielded.ts wrapper\narmalo-mcp-shield healthcheck    # validate config + emit diagnostics\narmalo-mcp-shield --version\n```\n\n## Standalone mode (no Armalo API key)\n\nLeave `armaloApiKey` unset and set `policy.defaultMinTrustScore: 0` to disable\nthe trust-oracle network call. You still get rate-limiting and injection\nfiltering — useful for a quick safety net on personal servers.\n\n## Upgrade to the hosted dashboard\n\nThe OSS shield is the runtime. For per-tool analytics, cross-server policy,\nmanaged allowlists, anomaly alerts, and a searchable audit log, the hosted\ndashboard at **[armalo.ai/products/mcp-shield](https://www.armalo.ai/products/mcp-shield)**\nis $29/mo via Whop. Same package, drop in an `armaloApiKey` and `auditWebhookUrl`,\nand your data shows up in your console.\n\n## License\n\nMIT\n","readmeFilename":"README.md"}