Security in your AI editor.
The Nemesis Shield MCP server gives your coding agent 16 tools to secure what it builds, from inside Cursor, Claude Code, Claude Desktop, or Windsurf. Install the one-line SDK, learn the app's behavior, approve routes, flip to enforce, put a domain behind Edge, guard an LLM, and score transactions with Omniguard, without leaving the editor. It runs locally, so your key never leaves your machine.
Install in two minutes
Cursor
One click above, or add to ~/.cursor/mcp.json.
npx -y @nemesis-shield-autogon/mcpClaude Code
One command:
claude mcp add nemesis-shield \
-- npx -y @nemesis-shield-autogon/mcpWindsurf / Claude Desktop
Add to the MCP config JSON, and set your key to unlock the management tools:
{
"mcpServers": {
"nemesis-shield": {
"command": "npx",
"args": ["-y", "@nemesis-shield-autogon/mcp"],
"env": { "NEMESIS_API_KEY": "dak_your_developer_key" }
}
}
}The developer key
Free discovery tools work with no account. To create and manage protection, mint a dak_ key in the console (Settings, API keys) and set it as NEMESIS_API_KEY. It is scoped to your account and stays on your machine.
16 tools, one server
nemesis_protect— the exact one-line SDK for any stacknemesis_scan— fingerprint a site + real CVEsnemesis_explain— how Shield covers an attacknemesis_list_frameworks— every supported stack
create_app/list_apps/set_moderun_learn/approve_routes— learn then enforceprotect_llm— OWASP LLM Top 10 guardprovision_edge/edge_status— Cloudflare-like edgecreate_omniguard/omniguard_score— business-logic rulesserver_agent— protect a whole server
The loop it drives
scan → protect (any stack) → create_app → run_learn →
approve_routes → set_mode "enforce"
+ provision_edge + protect_llm
+ create_omniguard → omniguard_score (allow / review / block)
+ server_agent (Ubuntu box → auto-discovers every app)Every tool is annotated, so your agent auto-runs the read-only ones and asks before the ones that change state, like flipping an app to enforce.
Questions
What is the Nemesis MCP server?
A Model Context Protocol server that gives AI coding agents (Cursor, Claude Code, Claude Desktop, Windsurf) tools to add Nemesis Shield security while they build: install the one-line SDK, run Nemesis Learn, approve routes, flip to enforce, put a domain behind Nemesis Edge, guard an LLM feature, and create + score Omniguard business-logic rules. It runs locally over stdio and calls the Nemesis Shield API.
How do I install it in Cursor / Claude Code / Windsurf?
Cursor: use the one-click Add to Cursor button, or add npx -y @nemesis-shield-autogon/mcp to your MCP config. Claude Code: run 'claude mcp add nemesis-shield -- npx -y @nemesis-shield-autogon/mcp'. Windsurf / Claude Desktop: add the same command to the MCP config JSON. The free tools work immediately; set NEMESIS_API_KEY to unlock the management tools.
Is it safe to let an AI agent use it?
Yes. The server runs locally, so your key never leaves your machine; the developer API key is read only from an environment variable, never a tool argument, and all output is scrubbed of anything token-shaped. Every tool is annotated so your client auto-runs the read-only ones and asks for confirmation before state-changing ones (like flipping an app to enforce).
Do I need an account?
No account is needed for the discovery tools (scan a site, get the SDK snippet, explain coverage). To create and manage apps, edge, LLM guard, and Omniguard, mint a free developer key in the Shield console and set it as NEMESIS_API_KEY.
Source (MIT): github.com/eobi/nemesis_shield_sdks/mcp · Learn about Nemesis Shield.