First public release of Aperion Shield

A faithful MCP stdio proxy. Your IDE talks to aperion-shield; Shield spawns the upstream MCP server as a child process and transparently relays every JSON-RPC frame in both directions. The only frames it intercepts are tools/call, which it evaluates against the ruleset before forwarding. No protocol changes from the IDE's perspective — same tools, same names, same schemas.

The default ruleset, baked into the binary, covers:

• SQL — DROP DATABASE, DROP TABLE, TRUNCATE, unscoped UPDATE / DELETE (no WHERE).
• Git — git push --force to main / master / prod / release/*, filter-repo, reset --hard HEAD~, branch -D.
• Filesystem — rm -rf /, rm -rf $HOME, dd to block devices, deletes of /etc / /var / /usr / /opt.
• Cloud — aws s3 rb, DeleteBucket API calls, terraform destroy.

Each rule is tuned for near-zero false positives on Critical and a low false-positive rate on High. The default ruleset is identical to the one shipped with the enterprise Smartflow Shield, so what you tune at the laptop translates directly to production.

Run with --shadow for the first day to surface every would-have-fired rule without breaking your workflow. Once you trust the ruleset, drop the flag — Critical rules block, High rules queue for human approval, Medium passes with a warning. For CI runners and unattended agent loops, --auto-deny-high declines anything queued instead of waiting for a human.

When a High-severity rule fires, Shield prints the rule, ticket id, and the call it caught to stderr (Cursor and Claude Code surface this in the tool-call panel). To approve, write approve <ticket-id> to a file in your project root: Decision propagates instantly; the call resumes. Default 60s timeout; falls back to deny if no decision arrives. There is intentionally no global “disable Shield” switch.

Some patterns — “UPDATE without WHERE” chief among them — cannot be expressed in RE2 regex because they need look-behind. Shield ships SQL-aware predicates (unscoped_update, unscoped_delete) that parse the statement and reject the classic agent failure mode: UPDATE users SET email_verified = true; -- forgot the WHERE. Trailing comments, multi-statement scripts, and weird quoting don't fool them.

Every shield-v* tag fires a release pipeline that builds Linux x86_64 / aarch64, macOS x86_64 / aarch64, and Windows x86_64 archives — plus a multi-arch distroless Docker image (~12 MB) published to ghcr.io/aperionai/shield, plus a Homebrew tap bump. All artefacts are SHA-256 checksummed and attached to the GitHub Release.

Aperion Shield does not phone home. It does not check for updates. It does not send rule hits anywhere. Your code, your SQL, your shell commands, your approval decisions stay on your machine. A future opt-in --telemetry flag for an anonymised public block ticker is reserved and currently stubbed; setting it today prints a notice and exits without sending anything.