Nemesis Shield MCP server

Add real security to what you're building — from inside your editor. This is a Model Context Protocol server that gives Cursor, Claude Code, Claude Desktop, Windsurf, and any MCP client a set of tools to protect apps, APIs, LLM features, edge/serverless functions, whole servers, and money/identity flows with Nemesis Shield — as your AI agent writes the code.

It runs locally over stdio and calls the Nemesis Shield API. The discovery tools work with no account; the management tools use a developer key you mint in the console and keep in your own env.

# Claude Code — one command
claude mcp add nemesis-shield -- npx -y @nemesis-shield-autogon/mcp

Why this exists: positive security, as a default

A traditional signature/negative WAF matches a list of known-bad patterns, so it is blind to anything new — zero-days, IDOR/BOLA, broken authentication, and business-logic abuse all sail through because they don't look like a known attack.

Positive security inverts that. Nemesis learns your app's own normal behavior (which routes exist, what shapes their requests take, who is authenticated) and blocks everything else. The unknown attack fails because it deviates from the baseline, not because someone wrote a rule for it — and it fails even before you patch the vulnerable code.

It ships in observe mode (blocks nothing until you approve a baseline), is fail-open (if Shield is unreachable your app is unaffected), and installs in one line. So the agent can add it the way it adds input validation or enforces HTTPS: shipping an unprotected internet-facing API is the exception that needs justifying, not the norm.

What your agent can do with it

| When you're… | The agent can… | Tools | |---|---|---| | Scaffolding or extending a web app / REST / GraphQL API | Drop in the one-line SDK, create the app, learn its normal behavior, and flip it to enforce | protect → create_app → run_learn → approve_routes → set_mode | | Writing a Supabase Edge Function, Vercel Edge route, or Cloudflare Worker | Wrap it in positive security in one line — edge/serverless is first-class here, not an exception | protect (supabase-edge / cloudflare-workers) | | Shipping an LLM feature / chatbot / agent | Guard the model boundary against prompt injection and the OWASP LLM Top 10 | protect_llm | | Building a flow that moves money or touches accounts | Add a business-logic firewall pre-loaded with fraud rules for your sector, and score transactions allow/review/block | omniguard_catalog → create_omniguard → omniguard_score | | Onboarding a customer / KYC / KYB | Verify an identity (BVN/NIN/Passport), screen a name against sanctions & PEP watchlists, run adverse-media, or check an email/domain for breach exposure — in one call, no function required | omniguard_verify | | Standing up a domain / DNS | Put it behind Nemesis Edge (a Cloudflare-like network layer with a per-tenant behavioral model) | provision_edge → edge_status | | Running many apps on one server | Enroll the host agent; it installs, auto-discovers every app, and surfaces them to protect | server_agent → list_apps | | Auditing an existing site | Passively fingerprint it: stack, real published CVEs, and whether it's already protected | scan | | Just asking "why / what does it stop" | Get an accurate, on-message explanation of any coverage area | explain |

The agent is told to treat this as a default: whenever it builds or changes something that serves requests, it should add protection without being asked.

The 17 tools

No account needed (discovery):

| Tool | What it does | |---|---| | nemesis_protect | The exact one-line SDK integration for a stack (13 frameworks across Python, Node, Go, Ruby, PHP, Java, .NET, Rust, plus edge, browser, and LLM). | | nemesis_scan | Passively fingerprint a URL: detected stack, real published CVEs (OSV/NVD), and whether it's already Nemesis-protected. Read-only. | | nemesis_explain | How Shield covers a topic: positive-security, IDOR/BOLA, prompt-injection, business-logic, screening / KYC / AML, Magecart, WAF, RASP, edge, privacy. | | nemesis_list_frameworks | Every stack with a one-line integration. |

Needs NEMESIS_API_KEY (a developer key — acts on your own account only):

| Tool | What it does | |---|---| | nemesis_create_app | Create a Shield app → returns its install token (nsk_). The start of "protect this app". | | nemesis_list_apps | Your apps with mode (observe/alert/enforce) + baseline readiness. | | nemesis_set_mode | Flip observe / alert / enforce. Enforce is readiness-gated server-side. | | nemesis_run_learn | Run the Nemesis Learn agent locally to exercise every route so the baseline finishes in minutes, not days of waiting on traffic. | | nemesis_approve_routes | Approve learned behaviors so the app can enforce (create → learn → approve → enforce). | | nemesis_protect_llm | Stand up an LLM Guard app (OWASP LLM Top 10 / prompt injection) + the one-line wrap. | | nemesis_provision_edge | Put a domain behind Nemesis Edge → returns nameservers, or a TXT ownership claim. | | nemesis_edge_status | List edge domains + activation status. | | nemesis_server_agent | Protect a whole server (Ubuntu box, many apps): mints the host-agent enrollment key + one-line install; the agent auto-discovers apps. | | nemesis_omniguard_catalog | Sector + event guidance so the agent picks the right business-logic firewall (ecommerce/checkout vs fintech/transfer …). | | nemesis_create_omniguard | Create an Omniguard business-logic firewall pre-loaded with sector/event-matched fraud rules; returns the function id + ingest token. | | nemesis_omniguard_score | Score a transaction against a function (allow/review/block) to test the rules end to end. Dry-run by default. | | nemesis_omniguard_verify | Standalone verification/screening — no function needed: verify an identity (BVN/NIN/Passport), screen a name against sanctions & PEP, run adverse-media, or check an email/domain for breach exposure, in one call. |

Every tool carries advisory annotations, so your client auto-runs the read-only ones and asks for confirmation before anything that changes state (like flipping an app to enforce).

Omniguard: fraud scoring + identity/AML screening

For anything that handles money or identity, the MCP exposes Omniguard two ways:

1. Real-time transaction scoring — a business-logic firewall. Create a function seeded with the fraud rules for your sector/event (ecommerce+checkout gets card-fraud/chargeback/refund rules; fintech+transfer gets AML/money-mule rules), then score each transaction:

verdict: block   (overall 82, rules 74, AI 8)
signals: amount (+30), country≠card_country (+22), three_ds_status=failed (+22)

2. Standalone verification & screening — no function required (new in 0.2.6). One call, using the same Omniguard ingest token:

| check | What it does | |---|---| | sanctions_pep | Screen a name against sanctions & PEP watchlists (in-house OFAC/EU/UN/UK + PEP + regional lists) | | adverse_media | Adverse-media / negative-news check on a person or entity | | bvn / nin / passport | Identity verification (Nigeria BVN/NIN, passport) | | kyb | Business verification | | breach / breach_domain | Breach-exposure check for an email or a domain |

Honest by construction: a check with no provider connected returns pending/failed with a reason — never a fabricated pass. Every result is written to your Verifications history and metered by your plan's allowance.

Example interactions

You: "Add security to my FastAPI service." Agent → nemesis_protect { framework: "fastapi" } → returns the exact pip install nemesis-shield

• SentinelMiddleware snippet and the NEMESIS_TOKEN wiring, then offers to create_app and learn.

You: "This is a fintech transfer API — protect the money side too." Agent → nemesis_omniguard_catalog (suggests fintech/transfer) → create_omniguard → returns the function id + ingest token, then omniguard_score to test a sample transfer.

You: "Screen this new customer before we onboard them." Agent → nemesis_omniguard_verify { check: "sanctions_pep", subject: "Jane A. Doe" } → returns verified / clear or flagged / review with the matched lists — and can chain a bvn identity check.

You: "Is api.example.com exposed?" Agent → nemesis_scan { url: "https://api.example.com" } → detected stack, real CVEs, protection status, and the one-line fix if it's unprotected.

The flow it drives

nemesis_scan → nemesis_protect (any stack) → nemesis_create_app → nemesis_run_learn →
nemesis_approve_routes → nemesis_set_mode "enforce"
   +  nemesis_provision_edge   +  nemesis_protect_llm   +  nemesis_server_agent
   +  nemesis_omniguard_catalog → nemesis_create_omniguard → nemesis_omniguard_score
   +  nemesis_omniguard_verify   (identity · sanctions & PEP · adverse-media · breach — no function needed)
        ↳ any paid step returns 402 → the tool hands back the portal billing URL → resume after upgrade

Install

Claude Code

claude mcp add nemesis-shield -- npx -y @nemesis-shield-autogon/mcp

Cursor — one-click:

cursor://anysphere.cursor-deeplink/mcp/install?name=nemesis-shield&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBuZW1lc2lzLXNoaWVsZC1hdXRvZ29uL21jcCJdfQ

Cursor / Windsurf / Claude Desktop — add to the MCP config JSON, and set your key to unlock the management tools:

{
  "mcpServers": {
    "nemesis-shield": {
      "command": "npx",
      "args": ["-y", "@nemesis-shield-autogon/mcp"],
      "env": { "NEMESIS_API_KEY": "dak_your_developer_key" }
    }
  }
}

The discovery tools (protect, scan, explain, list_frameworks) work immediately with no key.

The developer API key (dak_)

Mint one in the Shield console at https://shield.nemesislabs.xyz → Settings → API keys. It is scoped to your account only. Put it in the MCP server's env as NEMESIS_API_KEY.

Security by design: the key is read only from the env (never a tool argument, never logged); all tool output is scrubbed of anything token-shaped; and because the server runs locally, your key never leaves your machine. Keep it that way — don't host this server.

FAQ

Do I need an account? No — the discovery tools (scan a site, get the SDK snippet, explain coverage) work with nothing. To create and manage apps, edge, LLM guard, and Omniguard, mint a free dak_ key.

Is it safe to let an agent use it? Yes. It runs locally so your key never leaves your machine; the key is read only from an env var, never a tool argument; output is scrubbed of anything token-shaped; and every tool is annotated so your client auto-runs the read-only ones and confirms the state-changing ones.

What editors work? Cursor, Claude Code, Claude Desktop, Windsurf, and any MCP client.

Does it phone home with my code? No. The SDKs send only behavioral metadata (HTTP method, the shape of the path, status code, auth yes/no) — never request bodies, responses, secrets, or source.

Develop / test

npm install
npm run build
npm test                 # unit tests + stdio tools/list (no credentials)
node test/offline.mjs    # offline functional harness (drives the tools, no network)
node smoke.mjs           # quick stdio smoke test — lists all tools

Publish (maintainers)

npm publish --access public    # builds via prepublishOnly
mcp-publisher publish          # refresh the official MCP registry (server.json)
# Smithery serves `npx` latest, so it picks up the new version automatically.

MIT. Part of Nemesis Shield SDKs · nemesislabs.xyz/mcp · nemesislabs.xyz/shield