Project Shield

What it does

Your AI tools connect to MCP servers — but who checks if those servers are secure? Project Shield is a CLI that grades your MCP setup in one command: `npx project-shield scan` It catches prompt injection in tool descriptions, missing auth in MCP configs, leaked API keys (regex + entropy + context), and PII exposure. You get an A–F security grade, fix-it guides for every finding, and a deploy lock on F grade. No signup. No dashboard. Just run it. Free (5 scans/month) · Pro for teams.

Multi-layer security scanner for AI-generated code and MCP servers. Detects API keys, PII, prompt injection, and insecure configs in 2 minutes.

Multi-layer security scans for AI-generated code and MCP servers. Detects leaked API keys, PII, prompt injection, and insecure configs. Pro doesn't sell scans — it sells client-ready proof . PDF reports, Evidence Packs, verified badges. AI-generated code ships fast — but security doesn't keep up. MCP servers introduce an entirely new class of vulnerabilities. One layer misses. The next catches. Each vulnerability goes through 2–3 independent detection methods. Known vulnerability signatures — regex patterns for API keys (AWS, Stripe, OpenAI…), PII formats, injection keywords, and MCP misconfigurations. Mathematical verification — Shannon entropy analysis catches unknown key formats. Luhn…from shield.codemeant.dev

• 
  MCP-Shield – Detect security issues in MCP servers2025 · github.com · ▲134

  I noticed the growing security concerns around MCP (https://news.ycombinator.com/item?id=43600192) and built an open source tool that can detect several patterns of tool poisoning attacks, exfiltration channels and cross-origin manipulations. MCP-Shield scans your installed servers (Cursor, Claude Desktop, etc.) and shows what each tool is trying to do at the instruction level, beyond just the API surface. It catches hidden instructions that try to read sensitive files, shadow other tools' behavior, or exfiltrate data. Example of what it detects: - Hidden instructions…

• 
  Secure MCP Framework by Arcade.devNov 2025 · arcade.dev · ▲272

  Skip migration and launch MCP with built-in Auth

• 
  MCP Defender2025 · mcpdefender.com · ▲152

  Hi HN, MCP Defender is an open source desktop app that automatically proxies your MCP traffic in AI apps like Cursor, Claude, Windsurf and VSCode. It then scans all requests and responses between the apps and the MCP tools they call. If it detects anything malicious, it alerts you and lets you allow or block the tool call. While the threat landscape of MCP is still being actively researched, there are dangerous things that MCP Defender can block today. For example, a developer asks Cursor to fix a Github issue with an attached crash log. However, the Github issue was created by an attacker…

• 
  Project Shield2022 · projectshield.withgoogle.com · ▲95

  Protecting free expression from digital attacks

• 
  GitGuardian Shield2020 · github.com · ▲80

  Open sourced application to detect security vulnerabilities.

• FL
  Free local security checks for AI coding in VSCode, Cursor and Windsurf2025 · ▲43

  Hi HN! We just launched Codacy Guardrails, an IDE extension with a CLI for code analysis and MCP server that enforces security & quality rules on AI-generated code in real-time. It hooks into AI coding assistants (like VS Code Agent Mode, Cursor, Windsurf), silently scanning and fixing AI-suggested code that has vulnerabilities or violates your coding standards, while the code it’s being generated. We built this because coding agents can be a double-edged sword. They do boost productivity, but can easily introduce insecure or non-compliant code. One recent research team at NYU found that 40%…

• 
  Spira Maxima▲578

  Video model that turns script into viral social media videos

  AI · 17d ago · spira.ai

• 
  Rill Browser▲540

  The browser where Claude Code and Codex work beside you

  AI · 17d ago · rill.love

• 
  Germany's new sovereign AI model Kolibri▲424

  Kolibri is Aleph Alpha

  AI · 19d ago · tej.as

• 
  Giving Opus 5.5 a simulated paint canvas▲392

  Paintings by AI models: programs run through a simulation of oil paint.

  AI · 20d ago · stillwet.art

• 
  PixVerse R2▲381

  A real-time world model you can explore and change

  AI · 29d ago · world.pixverse.video

• 
  Hemory▲381

  Keep listening. Searchable memory for your AI agents.

  AI · 30d ago · hemory.com

• 
  Rork Max▲1,428

  Best AI for iOS apps. Website that replaces Xcode

  Life & fun · Feb 2026 · rork.com

• 
  happycapy▲1,365

  The agent-native computer, for the rest of us

  AI · Feb 2026 · happycapy.ai

• 
  SuperX▲897

  All-in-one growth OS for serious 𝕏 creators

  AI · Feb 2026 · superx.so

• 
  KiloClaw▲868

  Hosted OpenClaw. No Mac mini required.

  Dev tools · Feb 2026 · kilo.ai

• 
  Lovon AI Therapy▲801

  Feel closer and have more fun with your partner every day!

  AI · Feb 2026 · lovon.app

• 
  I spent 3 years reverse-engineering a 40 yo stock market sim from 1986▲721

  Hello my name is Ben Ward for the past 3 years I have been remastering the financial game Wall Street Raider created by Michael Jenkins originally on DOS in 1986. It has been a rough journey but I finally see the light at the end of the tunnel. I just recently redid the website and thought maybe the full story of how this project came to be would interest you all. Thank you for reading.

  Work · Feb 2026 · wallstreetraider.com