Light install (15 minutes)

Usual first path for builders. Offline npx first (DENY then REQUIRE_APPROVE without paid cloud), then register an agent, evaluate tools by toolId, and optionally run a local MCP gate, without cloning the monorepo or installing Java.

What you get

• Offline sample evaluate (--offline) for day-1 demo
• Agent register + identity
• Policy evaluate: ALLOW / DENY / REQUIRE_APPROVE
• Your own tools (no prebuilt adapter required)
• Dual plane tags: host=ide or host=runtime
• Optional local MCP gate
• Creating an agent is a tool: kya.agent.register (offline: REQUIRE_APPROVE)

CLI sketch

npx @shield-agent/kya@latest --help
npx @shield-agent/kya@latest eval-tool --offline --tool-id org.sample.never.event --irreversible
npx @shield-agent/kya@latest eval-tool --offline --tool-id org.sample.data.write --irreversible
npx @shield-agent/kya@latest init
npx @shield-agent/kya@latest register-agent --name builder-local
npx @shield-agent/kya@latest serve-mcp --stdio

Fail closed: missing API key against an authenticated plane exits non-zero (use --offline for local sample). Missing APPROVED on a high-stakes tool blocks the side effect. Offline sample is not the production PEP.

Vertical packs are optional. Path order on /install: npx → MCP → local free → enterprise hosted. Full console + Postgres: solo free local.

Repo detail: docs/guides/kya-light-install.md.