---
title: "AI Shield · LLM security toolkit, direct and indirect"
description: "LLM security toolkit, direct and indirect injection, memory canary, circuit breakers. v0.2 ships indirect-prompt-injection scanning for RAG, MCP tool"
canonical: "https://matthiasmeyer.tech/repos/ai-shield"
language: "en"
last_updated: "2026-08-21"
markdown_versions: ["https://matthiasmeyer.tech/repos/ai-shield.md", "https://matthiasmeyer.tech/de/repos/ai-shield.md", "https://matthiasmeyer.tech/es/repos/ai-shield.md"]
image: "https://matthiasmeyer.tech/api/og/repo/ai-shield?lang=en"
publisher: "Matthias Meyer, https://matthiasmeyer.tech (llms.txt: https://matthiasmeyer.tech/llms.txt)"
---

security stable TypeScript

# AI Shield

LLM security toolkit, direct and indirect injection, memory canary, circuit breakers

v0.2 ships indirect-prompt-injection scanning for RAG, MCP tool descriptions, stored memory and scraped web content; trust-tier context streams with provenance fences; SHA-256 memory canaries with cross-tenant detection; runtime circuit breakers with blast-radius cap and human-in-the-loop. Zero dependencies in the core, optional ONNX classifier sibling. 567 tests, three-round agent code review, MIT.

[View on GitHub →](https://github.com/studiomeyer-io/ai-shield)[npm](https://www.npmjs.com/package/ai-shield-core)

## What it solves

An assistant cannot reliably tell an instruction from data. That is not a bug in one product, it is a property of how these models read their context, and it means text arriving from a scraped page, a PDF, a tool result or another agent can quietly become a command. AI Shield is the deterministic layer in front of that: it scans what goes in, masks personal data, checks what comes out, and enforces which tools may be called at all.

## How it works

Three detection layers, and only the first is mandatory. The heuristic chain is more than forty patterns with score accumulation, fast and deterministic, and it folds the usual evasions first: unicode tags, leetspeak, typoglycemia, letter splitting and foreign-language paraphrase. On top of it you can compose an optional ONNX classifier and an asynchronous language-model judge for semantic coverage. Around the detection sit the parts that do not depend on a model at all: a tool policy that simply refuses a denied call, manifest pinning that notices when a server grows or loses tools, an external cost counter, canary tokens that reveal a successful attack, and an audit log.

## When to use it

Use it as the cheap first line of triage in front of anything that reads text from outside your own system, and use the deterministic parts as a real boundary. The tool policy in particular is the closest thing here to a capability limit: the model cannot call a denied tool no matter what reasoning it produces.

## When not to use it

Never as the only line. The README says so itself, and it is worth repeating: a pattern filter that lives inside the same reasoning system as the attack shares the same attention surface as the attack. It will miss a novel obfuscation, a polymorphic phrasing or an instruction buried in a long document. Indirect injection through trusted-looking channels is the bigger risk and this scans the user input, it does not deeply inspect every document the agent later ingests. It also does not enforce trust boundaries between cooperating agents, and output scanning covers injection and leakage but not toxicity, hallucination or bias. Treat it like a spam filter, not a firewall.

Stars

★ 3

Forks

⑂ 3

installs

↓ 1,500

Clones (14d)

⊟ 83

Language

TypeScript

Updated

2026-08-21

## Install

```
npx -y ai-shield-core
```

## Related repos

- Agent Fleet

    → shields

    →

    https://matthiasmeyer.tech/repos/agent-fleet

- Personal Suite MCP

    → shields

    →

    https://matthiasmeyer.tech/repos/mcp-personal-suite

- Local Memory MCP

    → shields

    →

    https://matthiasmeyer.tech/repos/local-memory-mcp

- MCP Armor

    ← Rust counterpart of

    →

    https://matthiasmeyer.tech/repos/mcp-armor

- MCP Server Attestation

    ← supply-chain layer for

    →

    https://matthiasmeyer.tech/repos/mcp-server-attestation

- AI Shield (Python)

    ← Python port of

    →

    https://matthiasmeyer.tech/repos/ai-shield-py

## Sitemap

Every page of this site as Markdown: [sitemap](https://matthiasmeyer.tech/sitemap.md). Curated entry point: [llms.txt](https://matthiasmeyer.tech/llms.txt).