Install (npx first + marketplaces)

Day-1 order: npx → MCP → local free console → enterprise hosted. Marketplaces are optional accelerators. Light install: /docs/kya/light-install.

npx @shield-agent/kya@latest --help
npx @shield-agent/kya@latest eval-tool --offline --tool-id org.sample.never.event --irreversible

Standards we use

• MCP for agent tools (any MCP host)
• OpenAPI for HTTP clients and ChatGPT Actions
• Generic webhooks for work ingress (HMAC when signing)
• OAuth 2.1 / OIDC for operator and machine identity
• Cloud marketplace SaaS contracts on AWS, Azure, GCP when you buy there

Descriptor: /connectors/mcp.json · Hub: /install · /connectors

Claude

Install the Shield connector from Claude Marketplace / connectors (or Claude Code plugin) using MCP. Tools call policy evaluate and session ingest under your org entitlement.

ChatGPT

Add Shield as a marketplace app or GPT Action against the published OpenAPI paths. Auth is OAuth/OIDC or marketplace-issued tokens, not a custom login form.

Grok

Where Grok or xAI agent surfaces accept MCP or OpenAPI tools, point them at the same connector descriptors. Same tools, same policy path.

Gemini

Use Gemini / Google AI connector flows that support MCP or OpenAPI. No Shield-only SDK.

AWS Marketplace

Subscribe on AWS Marketplace. Entitlement follows AWS SaaS APIs. Operators sign in with your IdP (OIDC/SAML) when configured.

Azure Marketplace

Azure SaaS offer plus Microsoft identity. Marketplace handshake, then KYA.

Google Cloud Marketplace

GCP SaaS procurement and Google identity. Install from Marketplace instead of a greenfield form.

Optional operator console

A hosted UI for approvals and trail is optional. Agents and marketplaces do not wait on console signup. Console: /login.

Dual plane: tag sessions host=ide (authoring) or host=runtime (production). Same PEP on both.