Upgrading from 4.x? 5.x needs Node 22.14+ or 24+; Node 20 and 23 are unsupported. On Node 20, npm warns and still installs unless engine-strict is set; the database engine will not load. Read the guide.
Security for AI agents
Your agent remembers.
Make sure it remembers safely.
ShieldCortex scans memory writes that go through it. On Claude Code, OpenClaw, and Hermes the tool gate stays off until you turn it on. Fetched pages are scored when you ask.
After install: shieldcortex scan "ignore previous instructions"
Runs on your machine
Your agent's memory lives on your host.
No account. No ShieldCortex cloud required.
For teams that have to keep data in-house — banks, healthcare, the public sector, offline and OT sites. The defence pipeline, memory store, recall, Action Guard and dashboard all run locally. Memories and scanned content are not sent to ShieldCortex servers unless you turn Cloud on.
No account
Every local feature is on the free tier. No sign-up and no API key to install, scan, store or recall.
Stays on localhost
Memories live in a SQLite file on the host. The API and dashboard listen on 127.0.0.1 only by default.
Works offline
Tested with the network removed: scan, memory write, recall, doctor and the dashboard all ran.
Local models
Detection and recall run on local rules and a local embedding model. No hosted model is needed.
Air-gapped hosts
Semantic recall uses an embedding model of about 90 MB that downloads once from Hugging Face on first use. On a host with no internet, copy it into ~/.cache/shieldcortex/models/ from a connected machine. Without it, recall falls back to keyword search and the semantic detection layer is skipped; the pattern scanner, Action Guard and dashboard still work.
Cloud is opt-in
Cloud is off until you enable it and add an API key. It adds cross-machine audit, memory sync and team management. When it is on, memories classified CONFIDENTIAL or higher are excluded from memory sync by default.
Other outbound connections, so you can plan for them: the dashboard asks the npm registry whether a newer
version exists (it fails harmlessly offline), and CLI commands can trigger npm's own update notifier
(NPM_CONFIG_UPDATE_NOTIFIER=false turns it off). Optional
auto-memory capture sends conversation excerpts to the LLM provider your agent already uses; it is on by
default for OpenClaw after a fresh global install, and shieldcortex config --openclaw-auto-memory false
turns it off. Data residency details →
The problem
Most memory tools help agents remember more.
None of that matters if what they remember is a lie.
The moment an agent gets persistent memory, tool access, and a web connection, it exposes three attack surfaces — and a single poisoned write, hijacked tool call, or injected page can quietly become permanent, trusted context.
Hostile content written into memory today is recalled as truth in every future session. The agent doesn't just make a mistake — it learns one.
Prompt injection can steer an agent into running commands it was never asked to run. Guardrails on what it remembers mean nothing without guardrails on what it does.
Every fetched web page and tool result is untrusted input. Hidden instructions in the outside world become inside instructions the moment the model reads them.
The product
Three surfaces, one shield
01 · Stores
Memory Firewall
Writes that go through ShieldCortex run a six-layer defence pipeline. Recognised injection and leaked credentials are quarantined or blocked before they stick. It does not replace OpenClaw, Hermes, or Claude memory.
Memory docs →02 · Does
Iron Dome
On Claude Code, OpenClaw, and Hermes, once Action Guard is on, a catastrophic command is a hard stop and a risky call needs approval. The guard stays off until sudo shieldcortex protect. A broken Claude Code hook can also stop a routine recursive delete.
03 · Sees
Environment Firewall
Scores a URL when you run env scan or scanUrl(). Advisory by default: flagged content still passes. Enforce mode is opt-in. It does not wrap Cursor or Codex fetch. X-Ray inspects packages and files.
Proof, not promises
60-second scripted walkthrough
A re-enactment of a prompt injection and a privilege escalation. One minute, no signup. Reproduce the catch locally with the command under the feed.
Known-malicious packages
shieldcortex audit --deps checks ./node_modules against a known-malicious list that includes plain-crypto-js and color-diff-napi. X-Ray scans a project directory: try shieldcortex xray .
27 injection patterns
Eight attack categories. They run when a write goes through ShieldCortex, or when the tool gate is on. Up to 50 custom patterns, free.
Every decision logged
A full audit trail of what was stored, recalled, blocked, and why — exportable, reviewable, replayable session by session.
Quickstart
Install, then turn the guard on
OpenClaw
Restart the gateway to load the hook. Action Guard stays off until you enable it.
Node.js / CLI
setup asks before wiring. Codex and MCP get a memory scanner, not a deny hook. Node 22.14+ or 24.
Python
For a local scan, run shieldcortex api and call it over REST. Python docs →
Node.js 22.14+ or Node 24 (not Node 20, not Node 23) or Python 3.9+ · macOS, Linux & Windows · free and open source
Start protecting your agents
Full protection is free and open source. Enterprise adds fleet management, memory sync at scale, and SSO for teams and servers.
Running a team or a fleet? Talk to us about Enterprise