ShieldCortex

No. ShieldCortex runs entirely on your machine with no cloud, no account, and no telemetry. An optional free cloud account adds replica sync for memories, graph data, and audit logs across devices, with 500 scans a month included. For fleets, always-on servers, and memory sync at scale, Enterprise adds SSO, dedicated support, and an SLA — contact us to discuss.

Every memory write passes through the defence layers: input sanitisation (strips control characters), pattern detection (regex-based prompt injection firewall), semantic analysis (embedding similarity to a curated attack corpus, on the async deep-scan path), structural validation (JSON integrity, format anomalies, fragmentation attempts), behavioural scoring (entropy analysis, anomaly detection, baseline deviation), and credential leak detection (25+ patterns across 11 providers).

ShieldCortex is strongest as a door on the native brain: it scans writes that go through it, and on Claude Code, OpenClaw and Hermes it can deny a tool call. Codex, Cursor, VS Code and Copilot MCP is a scanner, not a deny. It does not replace OpenClaw, Hermes or Claude memory, and it does not own their recall. v5.9.0 is the current release on the 5.x line (Node 22.14+ or Node 24). Action Guard stays off until you turn it on. Prompt-time recall into Claude Code is not automatic. It needs the UserPromptSubmit hook, which shieldcortex setup adds when you agree to wire Claude Code (npm install does not), and proactiveRecall set to true. A fresh global, non-CI install with no config file may write that flag; local and CI installs do not. An existing config is left alone. When the key is unset, recall is off.

Iron Dome is the behavioural protection layer included free with ShieldCortex. It covers what your AI agent can do, not only what it remembers: injection scanning, action gates, PII protection, an emergency kill switch, and four built-in security profiles (personal, school, enterprise, paranoid). Action Guard stays off until you turn it on. Only Claude Code, OpenClaw and Hermes can deny a tool call; Codex, Cursor, VS Code and Copilot MCP is a scanner, not a deny.

Environment Firewall is the third defence layer (added in v4.10.0). The memory firewall protects what the agent stores; Iron Dome protects what the agent does; the Environment Firewall protects what the agent sees from the outside world. Run shieldcortex env scan <url> against any page and it returns a taint label (trusted, untrusted, suspicious, hostile) with CI-friendly exit codes. It scores provenance, detects hidden content tricks (display:none, visibility:hidden, bidi overrides, same-colour text, HTML comments, ARIA-hidden regions, meta refreshes), and runs injection patterns against visible and hidden text separately — a hit inside hidden content marks the page hostile regardless of the domain, because humans will never see it.

Yes. Enterprise engagements include done-for-you configuration: we analyse your codebase and agent stack, produce a hardened ShieldCortex config, and support rollout across your fleet. Contact sales@drakonsystems.com to discuss.

Claude Code (PreToolUse), OpenClaw (before_tool_call) and Hermes (pre_tool_call) can deny a tool call. On Claude Code and OpenClaw that gate is Action Guard, and it stays off until you turn it on. A bare sudo shieldcortex protect turns it on and pins that posture. Hermes has its own setting: once you run hermes plugins enable shieldcortex and the local API (shieldcortex api) is up, the plugin enforces by default and ignores the enforce-when-ready readiness gate, which applies only to Claude Code and OpenClaw. Hermes has no approval prompt, so a call that needs approval is blocked, not asked about. SHIELDCORTEX_ENFORCE=0 makes ordinary approval-required calls advisory instead; outright block verdicts and self-protection calls (those that touch the guard's own state or config) still block. Codex, Cursor, VS Code and Copilot get an MCP memory server the model may call. That server is a scanner, not a deny. LangChain and the Python SDK scan only if you call scan or save.

Cloud keys are scope-based. Teams can now edit an existing key instead of revoking and recreating it. Typical sync devices use scan and audit. Add verify when you want the Verify workspace to receive LLM verification jobs. Keep keys and admin scopes for humans rather than unattended devices.

Replay is an incident and event reconstruction surface, not a full chat-session movie. It focuses on audit, verify, sync ingest, and synced memory events that matter for investigation, then lets you export reports, scope by device or project, and jump into Review, Capture, or Graph.

v5.9.0 is a minor release on 5.8.0. All four changes are in Action Guard and the session install lease, and they apply only where those features are on. Action Guard stays off until you turn it on. Heredoc data-read relief returns as a strict allow-list for short interpreter heredocs that only read a data file (#713 / PR #732). Read-only global package queries (for example npm list -g | grep -i x) no longer take or refuse the session install lease (#747 / PR #748). A global install with redirection on the package-manager name (for example npm>/dev/null install -g x) keeps install scope again (#752 / PR #753). A script that builds a global install as an argv list now asks for approval when written (#387 follow-up / PR #744). No export, CLI, config key, default, Node floor or Cloud pin changes.