1. Wire + report
Creates .kya/, writes MCP configs, and opens the activity feed in your browser.
Shield KYA - Know Your AI Agent
Audit trail and traceability for AI agents.
Gate, record, and certify every tool call. One command wires Claude Code, Cursor, Codex, Gemini, Grok and Kimi to a local gate and a live dashboard. Certify the setup against the Agent Trust Baseline whenever you need proof.
npm i -g @shield-agent/kya@latest && kya start
Windows / any shell: same command. Details on /install.
Runs where you already work
OSS recipes for the hosts you use
KYA sees tools that go through wrap or MCP. It does not replace Claude Code, Cursor, Codex, Gemini, or Grok.
Cursor (IDE + Agent CLI)OpenCodeQwen CodeKimi Code CLIKiro CLIKilo Code CLIMastraCodeAmpGitHub Copilot CLIClaude Code / Desktop / claude.aiCodex (OpenAI)Gemini CLIGrokCline (VS Code)Droid (Factory)PiOMPDevin CLIHermes AgentQoder CLIMakiMuseAntigravity CLI
Works with your tools. Add another host.
60 seconds
What you get after
What you get after kya start
2. Always blocked
Actions on the built-in never-list are denied every time. No second approve prompt on the free path.
3. Observe by default
Risky writes are recorded on the trail. To hold them for a person, set KYA_HOLD=1.
4. Change summaries
Each record shows the file path or shell command, not just a tool id.
Many integrations
Grow the host set in the open
23 recipes shipped. One command wires nine of them. Your pull request adds the next one. Merged recipes show up here and on /integrations.
Product
What Shield does
What you see on this site matches the console and the public source. Source is The-Pixel-Boys/shield-kya on GitHub.
Identity
Named agents in a registry. Kill or revoke stops them. You can see which agent created which.
Two environments
Tag work host=ide while you build or host=runtime in production. The same policy applies to both.
Policy
Every tool call is ALLOW, DENY, or REQUIRE_APPROVE. One enforcement point.
Create agents
A person registering an agent follows the workspace create mode. An agent that creates another agent goes through policy too.
Session clearance
Read, Build, or Deploy. A live session can lose permissions without killing the agent.
Signed claims
Agent passports and session claims are signed documents (RS256) that anyone can verify.
Trail
A tamper-evident event log: who ran it, who approved it, what was hidden.
Observe
Session risk can only make a decision stricter. It can never approve an action on its own.
Source
npx @shield-agent/kya and
the public GitHub tree.
Offline demo first. The same policy check runs once you connect a console.
Certify your setup against the Agent Trust Baseline: run kya certify and get the live requirement table with evidence.
Works with your observability stack
Keep Langfuse and friends. Add the gate.
Tracing tools explain what the agent did. Shield KYA decides what it may do and proves it. The two work together.
Import traces
kya import --from langsmith|langfuse|phoenix|otel converts existing
trace exports into the trail, so old runs count as evidence.
On hosted plans, drop the same export in the console or POST it to the import API.
Monthly limits depend on your plan.
Guide
Investigate incidents
kya investigate runs fixed local checks
(PII leaks, deny spikes, approval retry loops) and writes fix notes in Markdown.
No AI model calls. On hosted plans, the same checks scan your trail on a schedule,
hourly on Pro and Scale, and open incidents in the console.
Guide
Route alerts
Denied and approval-needed events go to Slack, Linear, Jira, or any webhook. If sending fails, Shield retries with growing delays and pauses after too many failures. Personal data is removed first. Guide
Export OTLP
Send every decision as an OpenTelemetry span to Grafana, Datadog, Langfuse, or any OTLP-compatible backend. Guide
Hosted certify
The Agent Trust Baseline runs against your hosted trail. No local setup. Every plan gets the live gap report. Pro and Scale download a signed, publicly verifiable evidence bundle for auditors. Guide
Get started
Install where you already work
Marketplace button, or start from npx and the public GitHub tree. Connect with OAuth/OIDC or MCP. No private Shield protocol.
Agent hosts
Claude, ChatGPT, Grok, Gemini through standard MCP tools or OpenAPI Actions.
Cloud marketplaces
Planned, not available yet. Today, sign up or use the open-source CLI.
Common standards
MCP, OAuth 2.1 / OIDC, and OpenAPI.
Product
One console for agents, policy, and approvals
Approvals, agent identity, sessions, and policy live in one workspace view. You manage that here, not inside a chat window.
Hold3
Clear2
Watch1
REQUIRE_APPROVE agent creation waiting · human
Watch session sess_9f · HIGH · Build
Clearance desk
Hold, Clear, Watch. The same labels as the signed-in dashboard.
export.case · Approve · Rejecttool.invoke · Approve · RejectBlocked until APPROVED
Approval queue
High-stakes actions wait here. Risk can only make a decision stricter.
name:
ops-workerstatus: ACTIVE · canAct: true
version:
a1b2c3d4…Kill / revoke · JSON export
Agents and passports
Who may act, which version is live, and a kill switch when you need it.
Observe: tool timeline · unknown tools highlighted
Policy playground: ALLOW | DENY | REQUIRE_APPROVE
Edge: optional after Shield APPROVED
Observe, policy, edge
Complements can raise risk. Shield still decides what may run.
What stays with you
Policy and human approval
If policy needs approval, the action waits. The model can draft. You decide what actually runs.
Evidence you can re-read
Which agent, which version, which policy, what was redacted, who approved. You can inspect it later.
Personal data handled before the model
Sensitive fields are replaced with placeholders before any prompt is sent. Raw personal data should not sit in model traces by default.
Architecture
Six layers
Identity, authority, policy, monitoring, and evidence sit in the product core. Workflows use that path. They do not invent a second one.
L1 Identity
Agent identities, versions, registry, kill and revoke.
L2 to L3 Authority
Sign-in, permissions, delegation limits, time limits.
L4 Policy
ALLOW, DENY, or REQUIRE_APPROVE when a tool is called.
L5 Monitor
Behavior signals and kill switch. Observe can only raise risk.
L6 Evidence
Graph, tamper-evident event log, passports, export.
Actions that cannot be undone
Irreversible actions run only after policy allows them and, when required, a person approves.
Modules
Core, Observe, Audit, optional Edge
Shield decides allow, deny, or wait for a person. Other pieces add risk signals or trail data. They do not approve work on their own.
KYA Core
Registry, policy, human approval, redaction, event log.
KYA Observe
Session ingest, tool timelines, risk that can only get stricter.
KYA Audit
Optional evidence graph and decision history when you need an export you can hand to an auditor.
Edge (optional)
Shield Agent Gatekeeper only after Shield has approved. It does not replace that decision.
Use cases
Same rules on different jobs
Ops and platform agents
Hold restarts, deploys, and external actions until someone approves. Kill switch included.
Compliance and labeling agents
Post-transaction work uses the same approval and trail rules. Pair with AccessioAI if you also need storefront labeling.
Coding-agent gates
Watch IDE or CLI sessions, raise risk on unknown tools, and block irreversible actions from running alone.
How KYA works
From signal to approved action
Register and connect
Register your agents. Connect the systems they may read.
Work under policy
Agents gather context. Personal data is removed and policy is checked at each tool call.
Human approval
When policy says REQUIRE_APPROVE, the action waits until someone decides.
Act and record
The action runs only after a person approves it. The event log keeps the record.
Defaults
Fail closed
Missing approval stops the action
If approval is missing or policy says DENY, the action does not run.
Risk only gets stricter
Observe and guardrails can raise severity. They cannot approve an action on their own.
One place decides
Optional edge steps run only after Shield has approved. An edge click does not replace that.
Questions
What is KYA?
Know Your Agent: which agent ran, under whose authority, on what evidence, how personal data was handled, and who approved the action.
Is this a single-industry product?
Shield works for agents in many domains. See use cases and how KYA works.
Do I need AccessioAI?
No. Shield runs on its own. AccessioAI is optional if you also want storefront accessibility and EU AI Act labeling.
Why only one enforcement path?
Two systems that both claim allow or deny can disagree. Shield keeps one decision path for actions that can change production systems.
Can I cancel anytime?
Yes. Cancel when you want and export your trail data.