Agent authority · Cursor install path

Give AI agents power without giving them unlimited authority.

Shield stops secret reads, dangerous tools, and out-of-bounds actions before they run — then proves what happened with signed evidence. Cursor is the fastest install path, not the product category.

Before an agent gets a consequential tool, the call is bounded, confirmable, stoppable, and provable.

Cursor allowlist is a menu. Promptfoo is evals. This page denies before the tool runs, then leaves a receipt.

Secret exfil · credential files

resources/read on .env

Need
Block reads of credential-bearing paths before bytes leave the repo.
Obstacle
IDE trust prompts train users to approve; allowlists rarely enumerate every secret path variant.
Gap
No DENY with policy name and signed receipt in the bridge output.
Run DENY demo

Tool sprawl · shadow MCP

Unvetted servers in dev

Need
Normalize JSON-RPC, enforce org policy packs per agent id, STEP_UP on writes.
Obstacle
Each developer adds MCP servers locally; security discovers them after a incident.
Gap
No central PDP between host and server — only per-IDE menus.
Install Shield

Eval vs enforce

Promptfoo / red-team lanes

Need
Production enforcement at the wire, not a offline score after the fact.
Obstacle
Eval suites prove model weakness; they do not intercept tools/call on the wire.
Gap
No runtime ALLOW / DENY / STEP_UP tied to the live MCP session.
Boundary eval

Audit · SecOps

Prove what the agent tried

Need
Forensic receipt per decision for IR and vendor questionnaires.
Obstacle
Chat logs redact tool args; no tamper-evident hash chain on blocked calls.
Gap
No POST /v1/boundary-eval/verify path from the IDE install flow.
SARIF export
Cursor
  ↓
"Read .env"
  ↓
SHIELD BLOCKED

Why: Credential-bearing file
Policy: Safe Coding
Evidence: Signed receipt

Protect this repo Team security SARIF for GitHub

Under the hood: identity, authority, runtime enforcement, and verifiable evidence for AI agents. MCP is one transport. Secret protection is one killer use case.

Install completion checklist

  1. DENY demo returns SHIELD BLOCKED on .env read.
  2. npx @noetfield/shield-cursor init --yes then shield-cursor prove in repo root.
  3. Set agent id and protection pack below; copy install command.
  4. Restart IDE; trigger MCP tool — DENY shows policy + reason in bridge output.
  5. Optional: SARIF export after Agent Guard scan with share.

Install (recommended)

npx @noetfield/shield-cursor init --yes
shield-cursor prove

Install in Cursor (manual)

Pick your organization policy. Shield governs MCP before any tool runs. No Shield internals required.


      
Run in your project root, restart Cursor, then use MCP as usual. DENY decisions show the reason in the bridge output.

    

    

      
Try MCP proxy (hostile env read)

      
Simulates resources/read on file:///home/user/.env. Expect DENY.