`@shield-agent/kya`BLOCK
AI agents audit trail & traceability — gate every tool call (Allow / Review / Deny), live activity dashboard, and continuous trust-baseline certification.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/@shield-agent/kya) [](https://www.npmjs.com/package/@shield-agent/kya) [](https://www.npmjs.com/package/@shield-agent/kya) [](./LICENSE) [](https://shield-agent.com/install) [](https://x.com/coscosmico)
Audit trail and traceability for AI agents. See what every coding agent did, with opt-in human approval and signed certify. Every tool call is recorded on a live local dashboard and certifiable against the Agent Trust Baseline. Locally KYA is advisory and fails open, except for a small never-list that is denied; enforcement lives on the MCP gate path and the hosted plane. One command. Free forever under MIT.
npm i -g @shield-agent/kya@latest && kya start
Requires Node.js 24+. Restart Cursor / Claude Code / Codex once so MCP loads. Hosted desk: shield-agent.com.
CLI and local MCP gate for Shield’s Know Your Agent path.
An agent that asks Shield first gets Allow, Review, or Deny: you register the agent, wrap the tool (or route it through the MCP gate or the hosted plane), and Review waits for a person. Local hooks only record and block the never-list (see Hook interception); hosted is where enforcement lives. This package does not scan your network. Agents that never call evaluate stay invisible on purpose.
Walkthrough: how you use it.
npx @shield-agent/kya@latest --hel
04f4898897e1OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add kya --env KYA_API_KEY=${KYA_API_KEY} -- npx -y @shield-agent/[email protected] serve-mcp --stdioExposed tools (6)
4 read · 1 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
drop_table | destructive | Drop a table |
kya.policy_evaluate | read | Evaluate ALLOW | DENY | REQUIRE_APPROVE for an agent action at the tool boundary. Sole PEP is Shield KYA; missing APPROVED means no irreversible side effect. |
kya.request_approval | write | Open a human approval request for a high-stakes side effect. Does not execute the side effect. |
kya.session_ingest | read | Ingest an AgentEvent-compatible session observation for raise-only risk. Risk may only raise severity, never auto-ALLOW. |
org.sample.never.event | read | never |
org.sample.safe.read | read | Read a record |
Trust audit
BLOCKgrade F · trust 52/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (10 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
exec(input: {const beacon = startSessionBeacon("report", { env, cwd });await beacon.stop();
const beacon = startSessionBeacon("gateway", { env, cwd });await beacon.stop();
const beacon = startSessionBeacon(result.mode === "http" ? "mcp-http" : "mcp-stdio", { env, cwd });"sk-ant-api03-abcdefghijklmnopqrstuvwxyz012345",
evidence: "sk-ant-api03-abcdefghijklmnopqrstuvwxyz012345",
description: "sk-ant-api03-abcdefghijklmnopqrstuvwxyz012345",
const token = "a9f3c17d2e8b4056a1c9f3d7e2b80654a9f3c17d2e8b4056";
JSON.stringify({ token: "kya-test-token-zzz-0011223344" }),const pem = `-----BEGIN RSA PRIVATE KEY-----
expect(() => assertNoSecrets("-----BEGIN RSA PRIVATE KEY-----")).toThrow(/secret/);"-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKFAKE\n-----END RSA PRIVATE KEY-----",
"-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKFAKE\n-----END RSA PRIVATE KEY-----",
const event = baseEvent({ summary: "token=sk_live_abcdef1234567890" });content: "sk_live_abcdefghijklmnopqrstuv",
accessToken: "sk_live_shouldneverappear",
expect(viaAccessToken).not.toContain("sk_live_shouldneverappear");drop_table
new Function("document", "location", "history", script!)(document, location, history);const fn = new Function("document", "location", "history", script);expect(() => new Function(script)).not.toThrow();
createHash("md5").update("kya.factory:" + trimmed, "utf8").digest(),return createHash("sha1").update(eventDocumentText(e)).digest("hex");Gates applied: no_behavioural_pass.
04f4898897e1full audit observations/trust-audit/mcp-server/the-pixel-boys__shield-kya.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 04f4898897e1 | BLOCK | F | 52 | first audit |
Questions
What is the @shield-agent/kya MCP server?
AI agents audit trail & traceability — gate every tool call (Allow / Review / Deny), live activity dashboard, and continuous trust-baseline certification.
What tools does @shield-agent/kya expose?
6 in total: 4 read-only, 1 that write, and 1 that can delete or overwrite (drop_table). Every one is listed on this page with its risk.
Is @shield-agent/kya safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (52/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does @shield-agent/kya need?
It reads FAKE_TOKEN, KYA_API_KEY and KYA_MCP_HTTP_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @shield-agent/kya run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @shield-agent/kya at 0.24.2.
How current is this page?
The grade is for one exact copy of the source (04f4898897e1), read on 2026-10-11. The repository is watched and re-audited when it changes.