AI Shield
LLM security toolkit, direct and indirect injection, memory canary, circuit breakers
v0.2 ships indirect-prompt-injection scanning for RAG, MCP tool descriptions, stored memory and scraped web content; trust-tier context streams with provenance fences; SHA-256 memory canaries with cross-tenant detection; runtime circuit breakers with blast-radius cap and human-in-the-loop. Zero dependencies in the core, optional ONNX classifier sibling. 567 tests, three-round agent code review, MIT.
What it solves
An assistant cannot reliably tell an instruction from data. That is not a bug in one product, it is a property of how these models read their context, and it means text arriving from a scraped page, a PDF, a tool result or another agent can quietly become a command. AI Shield is the deterministic layer in front of that: it scans what goes in, masks personal data, checks what comes out, and enforces which tools may be called at all.
How it works
Three detection layers, and only the first is mandatory. The heuristic chain is more than forty patterns with score accumulation, fast and deterministic, and it folds the usual evasions first: unicode tags, leetspeak, typoglycemia, letter splitting and foreign-language paraphrase. On top of it you can compose an optional ONNX classifier and an asynchronous language-model judge for semantic coverage. Around the detection sit the parts that do not depend on a model at all: a tool policy that simply refuses a denied call, manifest pinning that notices when a server grows or loses tools, an external cost counter, canary tokens that reveal a successful attack, and an audit log.
When to use it
Use it as the cheap first line of triage in front of anything that reads text from outside your own system, and use the deterministic parts as a real boundary. The tool policy in particular is the closest thing here to a capability limit: the model cannot call a denied tool no matter what reasoning it produces.
When not to use it
Never as the only line. The README says so itself, and it is worth repeating: a pattern filter that lives inside the same reasoning system as the attack shares the same attention surface as the attack. It will miss a novel obfuscation, a polymorphic phrasing or an instruction buried in a long document. Indirect injection through trusted-looking channels is the bigger risk and this scans the user input, it does not deeply inspect every document the agent later ingests. It also does not enforce trust boundaries between cooperating agents, and output scanning covers injection and leakage but not toxicity, hallucination or bias. Treat it like a spam filter, not a firewall.
Stars
★ 3
Forks
⑂ 3
installs
↓ 1,500
Clones (14d)
⊟ 83
Language
TypeScript
Updated
2026-08-21
Install
npx -y ai-shield-core