shellward
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| SHELLWARD_MODE | No | Determines whether to block and log (enforce) or log only (audit). | enforce |
| SHELLWARD_LOCALE | No | The language locale for the server. Auto-detects from system LANG if set to auto. | auto |
| SHELLWARD_THRESHOLD | No | Risk score threshold for injection detection, ranging from 0 to 100. | 60 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| check_commandA | Check if a shell command is safe to execute. Detects rm -rf, reverse shells, fork bombs, curl|sh, etc. |
| check_injectionA | Detect prompt injection attempts in text. Supports 37+ rules for Chinese and English, with hidden character detection. |
| scan_dataA | Scan text for sensitive data: PII (Chinese ID cards, phone numbers, bank cards), API keys, passwords, private keys, JWT tokens, SSN, credit cards. |
| check_pathA | Check if a file path operation is safe. Protects .env, .ssh/, .aws/credentials, private keys, /etc/passwd, etc. |
| check_toolA | Check if a tool name is allowed. Blocks payment/transfer tools, flags exec/shell tools as sensitive. |
| check_responseA | Check an AI response for security issues: canary token leaks and sensitive data exposure. |
| scan_mcp_toolA | Scan an MCP tool definition for tool-poisoning (hidden/invisible-character instructions, concealment directives, sensitive-file access, exfiltration hints) AND rug-pull (description silently changed since first seen). Pass a tool as { name, description, inputSchema }; provide "server" to enable rug-pull baselining. |
| security_statusA | Get current ShellWard security status: mode, active layers, detection capabilities. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 8 tools
Each tool has a clearly distinct purpose: checking commands, injections, paths, responses, tool names, scanning data, scanning MCP tools, and getting security status. No overlaps.
All tools follow a consistent verb_noun pattern (check_*, scan_*, security_*) with underscores, making them predictable and easy to understand.
With 8 tools, the count is well-scoped for a security scanning server, covering various attack vectors without being excessive or insufficient.
The tool set covers command safety, injection detection, file path safety, AI response safety, tool safety, sensitive data scanning, and MCP-specific security checks. No obvious gaps for the stated purpose.