Nemesis Shield MCP server

Add real security to what you're building — from inside your editor. This is a Model Context Protocol server that gives Cursor, Claude Code, Claude Desktop, Windsurf, and any MCP client a set of tools to protect apps, APIs, LLM features, edge/serverless functions, whole servers, and money/identity flows with Nemesis Shield — as your AI agent writes the code.

It runs locally over stdio and calls the Nemesis Shield API. The discovery tools work with no account; the management tools use a developer key you mint in the console and keep in your own env.

# Claude Code — one command
claude mcp add nemesis-shield -- npx -y @nemesis-shield-autogon/mcp

Why this exists: positive security, as a default

A traditional signature/negative WAF matches a list of known-bad patterns, so it is blind to anything new — zero-days, IDOR/BOLA, broken authentication, and business-logic abuse all sail through because they don't look like a known attack.

Positive security inverts that. Nemesis learns your app's own normal behavior (which routes exist, what shapes their requests take, who is authenticated) and blocks everything else. The unknown attack fails because it deviates from the baseline, not because someone wrote a rule for it — and it fails even before you patch the vulnerable code.

It ships in observe mode (blocks nothing until you approve a baseline), is fail-open (if Shield is unreachable your app is unaffected), and installs in one line. So the agent can add it the way it adds input validation or enforces HTTPS: shipping an unprotected internet-facing API is the exception that needs justifying, not the norm.

Related MCP server: agent immune

What your agent can do with it

The agent is told to treat this as a default: whenever it builds or changes something that serves requests, it should add protection without being asked.

The 17 tools

No account needed (discovery):

Needs NEMESIS_API_KEY (a developer key — acts on your own account only):

Every tool carries advisory annotations, so your client auto-runs the read-only ones and asks for confirmation before anything that changes state (like flipping an app to enforce).

Omniguard: fraud scoring + identity/AML screening

For anything that handles money or identity, the MCP exposes Omniguard two ways:

1. Real-time transaction scoring — a business-logic firewall. Create a function seeded with the fraud rules for your sector/event (ecommerce+checkout gets card-fraud/chargeback/refund rules; fintech+transfer gets AML/money-mule rules), then score each transaction:

verdict: block   (overall 82, rules 74, AI 8)
signals: amount (+30), country≠card_country (+22), three_ds_status=failed (+22)

2. Standalone verification & screening — no function required (new in 0.2.6). One call, using the same Omniguard ingest token:

Honest by construction: a check with no provider connected returns pending/failed with a reason — never a fabricated pass. Every result is written to your Verifications history and metered by your plan's allowance.

Example interactions

You: "Add security to my FastAPI service." Agent → nemesis_protect { framework: "fastapi" } → returns the exact pip install nemesis-shield

• SentinelMiddleware snippet and the NEMESIS_TOKEN wiring, then offers to create_app and learn.

You: "This is a fintech transfer API — protect the money side too." Agent → nemesis_omniguard_catalog (suggests fintech/transfer) → create_omniguard → returns the function id + ingest token, then omniguard_score to test a sample transfer.

You: "Screen this new customer before we onboard them." Agent → nemesis_omniguard_verify { check: "sanctions_pep", subject: "Jane A. Doe" } → returns verified / clear or flagged / review with the matched lists — and can chain a bvn identity check.

You: "Is api.example.com exposed?" Agent → nemesis_scan { url: "https://api.example.com" } → detected stack, real CVEs, protection status, and the one-line fix if it's unprotected.

The flow it drives

nemesis_scan → nemesis_protect (any stack) → nemesis_create_app → nemesis_run_learn →
nemesis_approve_routes → nemesis_set_mode "enforce"
   +  nemesis_provision_edge   +  nemesis_protect_llm   +  nemesis_server_agent
   +  nemesis_omniguard_catalog → nemesis_create_omniguard → nemesis_omniguard_score
   +  nemesis_omniguard_verify   (identity · sanctions & PEP · adverse-media · breach — no function needed)
        ↳ any paid step returns 402 → the tool hands back the portal billing URL → resume after upgrade

Install

Claude Code

claude mcp add nemesis-shield -- npx -y @nemesis-shield-autogon/mcp

Cursor — one-click:

cursor://anysphere.cursor-deeplink/mcp/install?name=nemesis-shield&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBuZW1lc2lzLXNoaWVsZC1hdXRvZ29uL21jcCJdfQ

Cursor / Windsurf / Claude Desktop — add to the MCP config JSON, and set your key to unlock the management tools:

{
  "mcpServers": {
    "nemesis-shield": {
      "command": "npx",
      "args": ["-y", "@nemesis-shield-autogon/mcp"],
      "env": { "NEMESIS_API_KEY": "dak_your_developer_key" }
    }
  }
}

The discovery tools (protect, scan, explain, list_frameworks) work immediately with no key.

The developer API key (dak_)

Mint one in the Shield console at https://shield.nemesislabs.xyz → Settings → API keys. It is scoped to your account only. Put it in the MCP server's env as NEMESIS_API_KEY.

Security by design: the key is read only from the env (never a tool argument, never logged); all tool output is scrubbed of anything token-shaped; and because the server runs locally, your key never leaves your machine. Keep it that way — don't host this server.

FAQ

Do I need an account? No — the discovery tools (scan a site, get the SDK snippet, explain coverage) work with nothing. To create and manage apps, edge, LLM guard, and Omniguard, mint a free dak_ key.

Is it safe to let an agent use it? Yes. It runs locally so your key never leaves your machine; the key is read only from an env var, never a tool argument; output is scrubbed of anything token-shaped; and every tool is annotated so your client auto-runs the read-only ones and confirms the state-changing ones.

What editors work? Cursor, Claude Code, Claude Desktop, Windsurf, and any MCP client.

Does it phone home with my code? No. The SDKs send only behavioral metadata (HTTP method, the shape of the path, status code, auth yes/no) — never request bodies, responses, secrets, or source.

Develop / test

npm install
npm run build
npm test                 # unit tests + stdio tools/list (no credentials)
node test/offline.mjs    # offline functional harness (drives the tools, no network)
node smoke.mjs           # quick stdio smoke test — lists all tools

Publish (maintainers)

npm publish --access public    # builds via prepublishOnly
mcp-publisher publish          # refresh the official MCP registry (server.json)
# Smithery serves `npx` latest, so it picks up the new version automatically.

MIT. Part of Nemesis Shield SDKs · nemesislabs.xyz/mcp · nemesislabs.xyz/shield