Skip to content

AI Shield v0.1.0 — Public Alpha

Choose a tag to compare

View all tags
@BetabotOC BetabotOC released this 07 Aug 16:39
· 12 commits to main since this release
v0.1.0
3c73ce2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

AI Shield v0.1.0 — public alpha

AI Shield is a local, deterministic trust scanner for AI-built and downloaded software. This first public release focuses on evidence-first checks before you run or ship a project.

Initial scope

  • Node and TypeScript projects
  • Package lifecycle and install scripts
  • Docker and Compose configuration
  • MCP servers and tool repositories
  • Agent instruction files such as AGENTS.md, CLAUDE.md, and editor rules
  • Obvious secret exposure and risky client-key patterns
  • High-signal route, shell, evaluation, and filesystem heuristics

Install from source

git clone --branch v0.1.0 https://github.com/BlockhouseSoftware/ai-shield.git
cd ai-shield
python3 -m aishield scan ./tests/fixtures/clean-project

AI Shield v0.1.0 is distributed through this repository and GitHub release source archives only. No official PyPI package exists yet; do not install similarly named PyPI packages unless a future AI Shield release explicitly links to one.

Verification

  • 47 unit tests passed
  • CI passed on Python 3.11, 3.12, 3.13, and 3.14
  • Repository-boundary check passed
  • Release-profile self-scan returned NO CRITICAL RISKS FOUND with zero findings and zero capabilities
  • Full public-history Gitleaks scan returned zero findings
  • Fresh wheel build/install and clean/risky CLI smoke tests passed
  • CodeQL passed for Python and GitHub Actions

Important limitations

AI Shield v0.1.0 is an alpha deterministic scanner. It does not prove that a project is safe, replace a full security audit, or detect every logic, dependency, obfuscation, generated-code, or runtime-only risk. Treat findings as evidence for review and DO NOT RUN as a stop-and-review signal.

Licensed under the GNU Affero General Public License v3.0 only (AGPL-3.0-only).

Assets 2
Loading