@shield-agent/kya 0.1.16 → 0.1.17

package/.mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.1.16", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.1.17", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/README.md

@@ -79,7 +79,7 @@ MCP Registry entry: `server.json` plus package `mcpName` `io.github.The-Pixel-Bo
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.1.16", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.1.17", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "http://127.0.0.1:8090",
         "KYA_API_KEY": "${KYA_API_KEY}",
@@ -106,7 +106,7 @@ npx @shield-agent/kya reject --id <approval-id>
 
 ```bash
 # Prefer a preinstalled package (no registry auto-install):
-npx --no-install @shield-agent/kya@0.1.16 serve-mcp --stdio
+npx --no-install @shield-agent/kya@0.1.17 serve-mcp --stdio
 # Or after npm i -g / local install:
 kya serve-mcp --stdio
 ```
@@ -117,7 +117,7 @@ Copy `claude/claude_desktop_config.example.json` into Claude Desktop MCP setting
 
 ## OpenAI (Codex / Responses)
 
-**Codex CLI / IDE:** copy `openai/codex.config.example.toml` into `~/.codex/config.toml`. Local stdio uses `npx --no-install @shield-agent/kya@0.1.16 serve-mcp --stdio`. Hosted Codex uses `url = "https://shield-agent.com/mcp"` with `bearer_token_env_var = "KYA_API_KEY"`.
+**Codex CLI / IDE:** copy `openai/codex.config.example.toml` into `~/.codex/config.toml`. Local stdio uses `npx --no-install @shield-agent/kya@0.1.17 serve-mcp --stdio`. Hosted Codex uses `url = "https://shield-agent.com/mcp"` with `bearer_token_env_var = "KYA_API_KEY"`.
 
 **Responses API:** see `openai/responses-mcp.example.json` (`server_url` + `Authorization: Bearer <KYA_API_KEY>`).
 
@@ -125,7 +125,7 @@ Copy `claude/claude_desktop_config.example.json` into Claude Desktop MCP setting
 
 ## Gemini CLI
 
-Merge `gemini/settings.example.json` into `~/.gemini/settings.json` or `.gemini/settings.json`. The `shield-kya` block is stdio. The `shield-kya-hosted` block uses `httpUrl` `https://shield-agent.com/mcp` and a Bearer header.
+Merge `gemini/settings.example.json` (stdio) or `gemini/settings.hosted.example.json` (`httpUrl` + Bearer) into `~/.gemini/settings.json` or `.gemini/settings.json`. Do not enable both at once.
 
 ## Grok
 

package/claude/claude_desktop_config.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.1.16", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.1.17", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/gemini/settings.example.json

@@ -2,20 +2,14 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.1.16", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.1.17", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",
         "KYA_HOST": "ide"
       },
-      "timeout": 30000
-    },
-    "shield-kya-hosted": {
-      "httpUrl": "https://shield-agent.com/mcp",
-      "headers": {
-        "Authorization": "Bearer ${KYA_API_KEY}"
-      },
-      "timeout": 30000
+      "timeout": 30000,
+      "trust": false
     }
   }
 }

package/gemini/settings.hosted.example.json

@@ -0,0 +1,12 @@
+{
+  "mcpServers": {
+    "shield-kya": {
+      "httpUrl": "https://shield-agent.com/mcp",
+      "headers": {
+        "Authorization": "Bearer ${KYA_API_KEY}"
+      },
+      "timeout": 30000,
+      "trust": false
+    }
+  }
+}

package/grok/README.md

@@ -9,36 +9,38 @@ Same three MCP tools as Claude and Codex: `kya.policy_evaluate`, `kya.session_in
 3. Server URL: `https://shield-agent.com/mcp`.
 4. Auth: machine API key as `Authorization: Bearer <KYA_API_KEY>` when the UI offers a request header / API key field. If the UI only offers OAuth or None, stop and use the xAI SDK or Codex/Gemini CLI instead. Do not turn auth off.
 
-Grok rejects `localhost` / private IPs. A tunnel is fine for your own debugging. It is not something we ship or support as a product path.
+Grok rejects `localhost` and private IPs. A tunnel is only for your own debugging and still requires the Bearer key. We do not ship or support unauthenticated public tunnels.
 
 ## Hosted (xAI SDK)
 
+The Shield machine key must travel with the MCP request. Do not register `https://shield-agent.com/mcp` without it.
+
 ```python
 import os
 from xai_sdk import Client
 from xai_sdk.tools import mcp
 
+kya_key = os.environ["KYA_API_KEY"]
 client = Client(api_key=os.environ["XAI_API_KEY"])
 chat = client.chat.create(
     model="grok-4.6",
     tools=[
         mcp(
             server_url="https://shield-agent.com/mcp",
-            # Pass Shield machine key however your SDK build accepts custom headers /
-            # authorization for remote MCP. Prefer Bearer <KYA_API_KEY>.
+            authorization=f"Bearer {kya_key}",
         ),
     ],
 )
 ```
 
-Confirm the current `mcp(...)` kwargs in [xAI remote MCP docs](https://docs.x.ai/docs/developers/tools/remote-mcp). The URL is always `https://shield-agent.com/mcp`.
+`authorization` is sent as the MCP `Authorization` header. Confirm kwargs in [xAI remote MCP docs](https://docs.x.ai/docs/developers/tools/remote-mcp). The URL is always `https://shield-agent.com/mcp`.
 
 ## Local / OSS
 
 There is no grok.com stdio path. For a local agent host use the same stdio launch as Claude:
 
 ```bash
-npx --no-install @shield-agent/kya@0.1.16 serve-mcp --stdio
+npx --no-install @shield-agent/kya@0.1.17 serve-mcp --stdio
 ```
 
 Env: `KYA_BASE_URL`, `KYA_API_KEY`, `KYA_HOST`. Codex and Gemini example configs in this package show the full snippets.

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.3",
   "name": "shield-kya",
   "display_name": "Shield KYA",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "Know Your Agent MCP gate: ALLOW / DENY / REQUIRE_APPROVE. Sole PEP is Shield.",
   "long_description": "Local Claude Desktop extension that runs the packaged `dist/cli.js serve-mcp --stdio` against your Shield control plane (local or https://shield-agent.com). Tools evaluate policy, ingest session risk, and open Hold tickets. They never execute irreversible side effects.",
   "author": {

package/mcp.json

@@ -3,7 +3,7 @@
     "shield-kya": {
       "description": "Know Your Agent local MCP gate: wrap-before-write, named-agent registry, Hold/Clear.",
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.1.16", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.1.17", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "${KYA_BASE_URL}",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/openai/codex.config.example.toml

@@ -4,20 +4,22 @@
 #
 # ChatGPT Apps (chatgpt.com Developer Mode) are deferred: that path wants OAuth.
 # Use Codex here, or the hosted Responses API snippet in responses-mcp.example.json.
+#
+# Do not put API keys in this file. Inherit them from the environment.
 
 # --- Local stdio (OSS) ---
 [mcp_servers.shield-kya]
 command = "npx"
-args = ["--no-install", "@shield-agent/kya@0.1.16", "serve-mcp", "--stdio"]
+args = ["--no-install", "@shield-agent/kya@0.1.17", "serve-mcp", "--stdio"]
 startup_timeout_sec = 20
+env_vars = ["KYA_BASE_URL", "KYA_API_KEY", "KYA_HOST", "KYA_AGENT_ID"]
 
 [mcp_servers.shield-kya.env]
 KYA_BASE_URL = "https://shield-agent.com"
-KYA_API_KEY = "replace-me"
 KYA_HOST = "ide"
-# KYA_AGENT_ID = "optional-after-register"
 
 # --- Hosted Streamable HTTP (same three tools) ---
+# Pick stdio OR hosted, not both.
 # [mcp_servers.shield-kya-hosted]
 # url = "https://shield-agent.com/mcp"
 # bearer_token_env_var = "KYA_API_KEY"

package/openai/responses-mcp.example.json

@@ -1,13 +1,12 @@
 {
-  "comment": "OpenAI Responses API remote MCP — hosted Shield KYA. Replace YOUR_KYA_API_KEY. ChatGPT Apps (chatgpt.com) are deferred until OAuth DCR.",
+  "comment": "OpenAI Responses API remote MCP — hosted Shield KYA. Put the machine key in env, not in git. ChatGPT Apps (chatgpt.com) are deferred until OAuth DCR. Leave OpenAI-side tool confirmation at the API default (do not auto-approve MCP calls).",
   "model": "gpt-5.6",
   "tools": [
     {
       "type": "mcp",
       "server_label": "shield-kya",
       "server_url": "https://shield-agent.com/mcp",
-      "authorization": "Bearer YOUR_KYA_API_KEY",
-      "require_approval": "never"
+      "authorization": "Bearer ${KYA_API_KEY}"
     }
   ],
   "input": "Evaluate whether tool org.sample.data.write should proceed. Use the shield-kya policy tool. Do not invent an approval."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shield-agent/kya",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "Know Your Agent light CLI + local MCP gate (provider-agnostic, zero vertical packs required).",
   "license": "MIT",
   "type": "module",

package/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/The-Pixel-Boys/shield-kya",
     "source": "github"
   },
-  "version": "0.1.16",
+  "version": "0.1.17",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@shield-agent/kya",
-      "version": "0.1.16",
+      "version": "0.1.17",
       "transport": {
         "type": "stdio"
       },