scan_mcp_schema is the tool most setups are missing: a compromised server can hide instructions in a tool description, and nothing else in the chain looks there. Session correlation is the other half — a manipulation spread across several polite turns is invisible to per-message checks and is exactly what the L9 state is for.
A governance layer an agent calls on both sides of every action. Fourteen tools scan inbound content before it is acted on and outbound content before it is delivered, covering prompt injection, jailbreaks, data leakage, PII exposure and multi-turn manipulation, with session correlation across turns.
- scan_prompt and scan_response — user and system prompts before the model processes them, and model output before it reaches the user, catching leaked keys or a system prompt in the answer
- scan_sql_query, scan_command and scan_file_write — a query before it hits the database, a shell command before it executes, and a path and its content before a write, catching tautology injection, reverse shells, path traversal and secrets landing in a .env
- scan_web_search — a search query before it leaves for an external service, catching PII on its way out
- scan_a2a_message and scan_agent_card — messages from an upstream agent, and AgentCard metadata before you trust a peer that may be lying about what it is
- scan_mcp_schema — one MCP tool definition checked for injection hidden in its description or input schema, which is the tool-poisoning class
- scan_declare_scope — declare a task-scoped agent's allowed and forbidden tools and expiry, enforced on every later scan under that identity
- check_approval — poll a pending human approval or submit the decision for a flagged action
- session_status and reset_session — read the session's correlation state and risk score, and clear the turn history after resolving a flagged pattern
- report_bypass — report something the scanners missed, which feeds the adaptive learning behind them
Nothing to start: clients run npx -y shrike-mcp over stdio and anonymous use gets the pattern-based layers. A free key in SHRIKE_API_KEY, from shrikesecurity.com/signup with no card, unlocks the model-powered semantic analysis layers. Node.js 18.0.0 or newer.
One command — npx shrike-mcp