1. Wire + report
Inits .kya/, writes MCP configs, opens the activity feed in your browser.
Know Your Agent · OSS
Gate agent tools before they write or shell.
One command inits the project, wires local MCP, and opens a live activity report. Restart your host once. Unwrapped tools stay invisible on purpose.
npm i -g @shield-agent/kya@latest && kya start
Windows / any shell: same command. Details on /install.
Runs where you already work
OSS recipes for the hosts you use
KYA sees tools that go through wrap or MCP. It does not replace Claude Code, Cursor, Codex, Gemini, or Grok.
Not an island — add another host.
60 seconds
What you get after
What you get after kya start
2. Never-events DENY
Silent deny for never-events. No second approve prompt on the free path.
3. Observe by default
High-stakes writes land on the trail. Org Hold when you set KYA_HOLD=1.
4. Change summaries
Receipt rows show path / shell bin, not just a tool id.
Medusa of integrations
Grow the host set in the open
Each coding host is a tentacle: Claude Code, Cursor, Codex, Gemini, Grok, and whatever you PR next. Merged recipes show up here and on /integrations.
Product
What Shield does
Same inventory on this site, in the console, and in the public tree. Source is The-Pixel-Boys/shield-kya (mark in the header).
Identity
Named agents in a registry. Kill or revoke stops them. Parent and orphan are visible.
Dual plane
Tag work host=ide while authoring or host=runtime in production. Same policy both ways.
Policy
Every tool call is ALLOW, DENY, or REQUIRE_APPROVE. One enforcement point.
Mint and spawn
A person registering an agent follows the workspace mint mode. An agent creating another agent is itself a tool.
Session clearance
Read, Build, or Deploy. A live session can lose powers without killing the agent.
Signed claims
Agent passports and session claims are RS256 documents you can verify.
Trail
Hash-chained events: who ran, who approved, what was redacted.
Observe
Session risk can only make a verdict stricter. It cannot approve a submit.
Source
npx @shield-agent/kya and
the public GitHub tree.
Offline demo first. Same PEP once a plane is wired.
Get started
Install where you already work
Marketplace button, or start from npx and the public GitHub tree. Connect with OAuth/OIDC or MCP. No private Shield protocol.
Agent marketplaces
Claude, ChatGPT, Grok, Gemini via MCP tools or OpenAPI Actions.
Cloud marketplaces
AWS, Azure, GCP. Subscribe with the cloud account you already bill through.
Common standards
MCP, OAuth 2.1 / OIDC, OpenAPI, and marketplace entitlements.
Product
One console for agents, policy, and approvals
Approvals, agent identity, sessions, and policy live in one tenant view. You manage that here, not inside a chat window.
Hold3
Clear2
Watch1
REQUIRE_APPROVE spawn waiting · human
Watch session sess_9f · HIGH · Build
Clearance desk
Hold, Clear, Watch. Same lanes as the signed-in dashboard.
export.case · Approve · Rejecttool.invoke · Approve · RejectBlocked until APPROVED
Approval queue
High-stakes actions wait here. Risk can only make a decision stricter.
name:
ops-workerstatus: ACTIVE · canAct: true
version:
a1b2c3d4…Kill / revoke · JSON export
Agents and passports
Who may act, which version is live, and a kill switch when you need it.
Observe: tool timeline · unknown tools highlighted
Policy playground: ALLOW | DENY | REQUIRE_APPROVE
Edge: optional after Shield APPROVED
Observe, policy, edge
Complements can raise risk. Shield still decides what may run.
What stays with you
Policy and human approval
If policy needs approval, the action waits. The model can draft. You decide what actually runs.
Evidence you can re-read
Which agent, which version, which policy, what was redacted, who approved. You can inspect it later.
Personal data handled before the model
Sensitive fields are tokenized before prompts. Raw personal data should not sit in model traces by default.
Architecture
Six layers
Identity, authority, policy, monitoring, and evidence sit in the product core. Workflows use that path. They do not invent a second one.
L1 Identity
Agent principals, versions, registry, kill and revoke.
L2 to L3 Authority
Sign-in, authorization, delegation scopes, time bounds.
L4 Policy
ALLOW, DENY, or REQUIRE_APPROVE when a tool is called.
L5 Monitor
Behavior signals and kill switch. Observe can only raise risk.
L6 Evidence
Graph, hash-chained event log, passports, export.
Side effects
Irreversible actions only after policy and, when required, a person approves.
Modules
Core, Observe, Audit, optional Edge
Shield decides allow, deny, or wait for a person. Other pieces add risk signals or trail data. They do not approve work on their own.
KYA Core
Registry, policy, human approval, redaction, event log.
KYA Observe
Session ingest, tool timelines, risk that can only get stricter.
KYA Audit
Optional graph dual-write and decision chain when you need an exportable account.
Edge (optional)
Shield Agent Gatekeeper only after Shield has approved. It does not replace that decision.
Use cases
Same rules on different jobs
Ops and platform agents
Hold restarts, deploys, and external side effects until someone approves. Kill switch included.
Compliance and labeling agents
Post-transaction work uses the same approval and trail rules. Pair with AccessioAI if you also need storefront labeling.
Coding-agent gates
Watch IDE or CLI sessions, raise risk on unknown tools, and block irreversible actions from running alone.
How KYA works
From signal to approved action
Register and connect
Register agent principals. Connect the systems they may read.
Work under policy
Agents gather context with redaction and checks at each tool call.
Human approval
When policy says REQUIRE_APPROVE, the action waits until someone decides.
Act and record
Only after APPROVED does the side effect run. The event log keeps the trail.
Defaults
Fail closed
Missing approval stops the action
If approval is missing or policy says DENY, the side effect does not run.
Risk only gets stricter
Observe and guardrails can raise severity. They cannot approve a submit on their own.
One place decides
Optional edge steps run only after Shield has approved. An edge click does not replace that.
Questions
What is KYA?
Know Your Agent: which agent ran, under whose authority, on what evidence, how personal data was handled, and who approved the action.
Is this a single-industry product?
Shield works for agents in many domains. See use cases and how KYA works.
Do I need AccessioAI?
No. Shield runs on its own. AccessioAI is optional if you also want storefront accessibility and EU AI Act labeling.
Why only one enforcement path?
Two systems that both claim allow or deny can disagree. Shield keeps one decision path for actions that can change production systems.
Can I cancel anytime?
Yes. Cancel when you want and export your trail data.