Install Shield KYA in one command
This post gives the install commands that are on our Install page today. You do not need to clone a repository. You do not need a paid account to try it.
What you need
You need Node 22 or later. We recommend Node 24. If your Node is older, the CLI offers to install Node 24 and finish for you. You do not need Java or Postgres.
The one command
To see the CLI help without an install, run:
npx @shield-agent/kya@latest --help
To install KYA and start it in a project, run:
npm i -g @shield-agent/kya@latest
cd your-project
kya start
kya start sets up KYA, connects it to your coding agents over MCP and opens a live activity report. The report runs in the background, so your terminal returns immediately. Cursor loads KYA live with no restart. In Claude Code, claude --resume keeps your conversation. To stop the report, run kya stop. To open it again, run kya receipt --open.
An offline sample
These two commands show a sample decision without a console. They are a sample, not the production gate:
kya eval-tool --offline --tool-id org.sample.never.event --irreversible
kya wrap --offline --tool-id Write --irreversible --args '{"path":"src/x.ts","content":"hi"}'
The first command gives DENY. The second command gives an observed REQUIRE_APPROVE.
By default, kya wrap only observes: it records the trail and does not ask for a second approval. The hosted console starts to receive events when you set KYA_BASE_URL and KYA_API_KEY. When you run a tool through kya wrap against a hosted workspace (KYA_BASE_URL and KYA_API_KEY set), set KYA_HOLD=1 to hold risky actions for a person. With --offline, no approval request opens.
Other ways to install
npm is the reference path. The other channels install the same package. On your laptop, KYA is advisory: it records the trail, lets work continue if something fails, and denies only a small built-in never-list. Real blocking is on the MCP policy path against a hosted workspace.
Claude Code plugin:
/plugin marketplace add The-Pixel-Boys/shield-kya
/plugin install kya@shield-kya
Codex CLI plugin (after the install, trust the two Shield KYA hooks in /hooks):
codex plugin marketplace add The-Pixel-Boys/shield-kya
codex plugin add kya@shield-kya
Homebrew (Homebrew 7 can ask you to trust the tap first with brew tap The-Pixel-Boys/tap). The formula installs about 270MB because of the optional semantic-search runtime:
brew install The-Pixel-Boys/tap/shield-kya
Scoop (not yet verified on Windows):
scoop bucket add The-Pixel-Boys https://github.com/The-Pixel-Boys/scoop-bucket.git
scoop install shield-kya
Gemini CLI extension:
gemini extensions install https://github.com/The-Pixel-Boys/shield-kya
License and provenance
The CLI is MIT licensed. The source is at The-Pixel-Boys/shield-kya. Version 0.32.6 of @shield-agent/kya on npm was published by GitHub Actions through npm trusted publishing and has an SLSA provenance attestation.
For the full guide, read Light install.