affaan-m/agentshield

What it is

AgentShield ships on npm as ecc-agentshield (not "agentshield") — a detail the summary omits and you need to install it. It's part of the "Everything Claude Code" (ECC) ecosystem, built at the Cerebral Valley × Anthropic Claude Code Hackathon (Feb 2026). It auto-discovers ~/.claude/, scans config files, and prints a graded report.

What to do

Run with no install:

npx ecc-agentshield scan

Or globally:

npm install -g ecc-agentshield
agentshield scan

Useful flags:

agentshield scan --path /path/to/.claude
agentshield scan --fix                       # replaces hardcoded secrets with env var refs
agentshield scan --format json               # CI
agentshield scan --format html > report.html
agentshield scan --evidence-pack ./agentshield-evidence
agentshield scan --supply-chain              # MCP + package-lock provenance, offline
agentshield scan --supply-chain-online       # queries npm: downloads, maintainers, postinstall, age
agentshield scan --opus --stream             # three-agent Opus adversarial pass, needs ANTHROPIC_API_KEY
agentshield init                             # emit a secure baseline config

How the score works (matters if you gate CI on it)

Each of the 15 categories starts at 100; only findings deduct — critical −25, high −15, medium −5, low −2, info 0. Defenses (deny/ask lists, sandbox settings, blocking PreToolUse hooks, read-only agent tool lists, Codex sandbox_mode, Hermes manual approvals) are listed under "Recognized Defenses" for visibility but add zero points — so you cannot inflate the grade with decorative deny rules, and guard-pattern findings are hard-pinned to zero deduction in src/reporter/score.ts. Practical consequence: a passing grade reflects absence of findings, not presence of controls.

Preconditions / notable behavior

• Discovery deliberately skips node_modules, build output, and .dmux worktree mirrors, so transient copies don't duplicate findings.
• --supply-chain-online and --opus reach out to npm and the Anthropic API respectively; the rest is local.
• JSON reports expose findings[].runtimeConfidence to distinguish active runtime config from templates, example inventories, plugin caches, and manifest-resolved non-shell hooks — useful for suppressing false positives on installed plugins.
• Package-manager hardening checks flag that npm has no native release-age cooldown; it points you to pnpm minimumReleaseAge, Yarn npmMinimalAgeGate, or an external policy wrapper instead.

Caveats

The page's threat framing — "12% of a skill marketplace malicious (341/2,857)," a "CVSS 8.8 CVE exposing 17,500+ instances," the "Moltbook breach (1.5M tokens, 770,000 agents)" — is asserted without citation and should be treated as marketing until independently verified. It also promotes "Itô" as a suggested compute sponsor; ECC states it only links to Itô's dashboard and does not provision compute, and managed inference there "is not live yet." Neither claim affects the scanner's local operation.