{
  "markdown": "# Nemesis Shield - SDKs\n\n[![Protected by Nemesis](https://nemesislabs.xyz/api/badge)](https://nemesislabs.xyz/shield)\n\nOfficial, open-source SDKs for [**Nemesis Shield**](https://shield.nemesislabs.xyz) - the unified\nruntime security platform (application/API/LLM shield, telemetry correlation, network/DNS, response,\nand compliance). Drop one into your app and Nemesis **learns your app's normal behavior**, then\nflags - and, in enforce mode, blocks - anything that deviates. It's a positive-security (allow-list)\nmodel: instead of guessing at generic attack signatures, it enforces *\"this app only ever behaves\nin these ways.\"*\n\n> **Building with an AI assistant?** Two ways to make your agent add Nemesis Shield **as it builds**:\n> 1. **[MCP server](mcp/)** - gives Cursor, Claude Code/Desktop and Windsurf 17 callable tools\n>    (`nemesis_protect`, `nemesis_scan`, `nemesis_explain`, plus Omniguard fraud scoring and standalone\n>    identity/AML screening via `nemesis_omniguard_verify`) so the agent adds security, scans a site,\n>    screens identities, and explains coverage without leaving the editor.\n> 2. **[AI editor rule pack](ai-rules/)** (AGENTS.md, Cursor, Windsurf, Claude Code) - drop-in rules\n>    that tell the agent to add the one-line SDK by default.\n>\n> Both are one line per stack, safe by default (observe mode). Full verified reference:\n> [`ai-rules/AGENTS.md`](ai-rules/AGENTS.md).\n\n**Privacy by design:** the SDKs ship only behavioral *metadata* - HTTP method, the *shape* of the\npath (`/orders/123` → `/orders/{int}`), status code, and whether the caller was authenticated. They\nnever send your request bodies, responses, secrets, or source code. Every SDK is **fail-open**: if\nNemesis is unreachable, your app is completely unaffected.\n\n> **New app? Finish learning in minutes with [Nemesis Learn](learn/).** Drop in an SDK (observe mode),\n> then run one command and the agent exercises every route of your app in dev/staging - endpoints,\n> forms, uploads, CRUD flows - so the baseline completes without waiting on real traffic. It's\n> language- and framework-agnostic (drives your app over HTTP), runs offline, can read your repo to\n> find routes, and reports coverage back so the console shows exactly when you're ready to enforce.\n> ```bash\n> npx @nemesis-shield-autogon/learn --target http://localhost:3000 --app-token nsk_… --repo .\n> ```\n\n| Language | Package | Integration |\n|---|---|---|\n| **Node.js** | `@nemesis-shield-autogon/sentinel` | One-line Express/Connect middleware → [`node/`](node/) |\n| **Python** | `nemesis-shield` | ASGI/WSGI middleware (FastAPI/Starlette/Flask) → [`python/`](python/) |\n| **Go** | `github.com/eobi/nemesis_shield_sdks/go` | `net/http` middleware → [`go/`](go/) |\n| **Ruby** | `nemesis_shield.rb` | Rack middleware (Rails/Sinatra) → [`ruby/`](ruby/) |\n| **PHP** | `composer require nemesislabs/sentinel` | Laravel auto-discovery / `register_shutdown_function` → [`php/`](php/) |\n| **WordPress** | drop-in plugin | Behavioral firewall (front end, REST & admin-ajax) **+ brute-force lockout, malware / file-integrity scan & vulnerability alerts** → [`wordpress/`](wordpress/) |\n| **Java** | `io.github.eobi:sentinel` | Servlet filter / Spring Boot (JDK 11+) → [`java/`](java/) |\n| **.NET / C#** | `dotnet add package NemesisShield` | ASP.NET Core middleware (net8.0 + netstandard2.0) → [`dotnet/`](dotnet/) |\n| **Rust** | `cargo add nemesis-shield` | axum (tower) / actix-web middleware → [`rust/`](rust/) |\n| **Edge / Supabase** (Deno TS) | `@nemesis-shield-autogon/edge` (npm) · `@nemesis-shield/edge` (JSR) | `withShield()` for Supabase Edge / Deno / CF Workers / Vercel Edge / Next.js → [`edge/`](edge/) |\n| **Supabase direct DB API** | Cloudflare Worker | reverse-proxy that guards `supabase.from()` (PostgREST) - off-baseline table/verb/auth blocked before your DB → [`cloudflare-supabase-proxy/`](cloudflare-supabase-proxy/) |\n\n### Front-end (browser)\n\nThe back-end SDKs above protect the server. The **browser SDK** protects the *other* half - the\nclient-side attacks a WAF and a backend never see. Built **checkout-grade** for payment / e-commerce\npages: it blocks card-skimming **data exfiltration across every channel** (fetch, XHR, beacon, image\nbeacons, WebSocket, EventSource), **Magecart/injected scripts**, and **form-jacking**; detects inline\ntampering, field injection, and **clickjacking**; and maps directly to **PCI DSS 4.0.1 §6.4.3 &\n§11.6.1** (script inventory, authorization, tamper alerting). A learned CSP you approve in the console.\n\n| Front-end | Package | Integration |\n|---|---|---|\n| **React · Angular · Vue · jQuery · plain JS** | `@nemesis-shield-autogon/browser` | one `<script data-token>` tag, or `NemesisShield.init({token})` → [`browser/`](browser/) |\n\nOne SDK covers every framework - they all share the same browser primitives.\n\n> **Using TypeScript?** There's no separate TS SDK - TypeScript is these same runtimes. Node backends\n> use [`@nemesis-shield-autogon/sentinel`](node/) (ships `.d.ts`), Supabase Edge / Deno / Workers use\n> [`edge/`](edge/), and TS front-ends use [`@nemesis-shield-autogon/browser`](browser/) (ships `.d.ts`).\n\n## Get a token\n\n1. Sign up at **[shield.nemesislabs.xyz](https://shield.nemesislabs.xyz)** (free, no card).\n2. **Protect an app** - you'll get a one-time install token (`nsk_…`).\n3. Add the SDK below, set the token, deploy. Traffic starts building a per-app baseline immediately;\n   review learned behaviors and approve/block them in the console.\n\n## Quick start\n\n**Node.js**\n```bash\nnpm install @nemesis-shield-autogon/sentinel\n```\n```js\nimport { sentinel } from \"@nemesis-shield-autogon/sentinel/express\";\napp.use(sentinel({ token: process.env.NEMESIS_TOKEN })); // one line, zero route changes\n```\n\n**Python**\n```bash\npip install nemesis-shield\n```\n```python\nfrom nemesis_shield.asgi import SentinelMiddleware\napp.add_middleware(SentinelMiddleware, token=os.environ[\"NEMESIS_TOKEN\"])\n```\n\n**Go**\n```go\nhandler := nemesis.Middleware(os.Getenv(\"NEMESIS_TOKEN\"))(mux)\nhttp.ListenAndServe(\":8080\", handler)\n```\n\n**Ruby** (Rack)\n```ruby\nuse NemesisShield::Middleware, token: ENV[\"NEMESIS_TOKEN\"]\n```\n\n**PHP** - `composer require nemesislabs/sentinel` (Laravel auto-discovers the middleware; raw PHP:)\n```php\nNemesisShield::guard(getenv('NEMESIS_TOKEN'));                                        // block off-baseline\nregister_shutdown_function(fn() => NemesisShield::observe(getenv('NEMESIS_TOKEN'))); // learn\n```\n\n**WordPress** - a full security plugin: the AI behavioral firewall plus brute-force login lockout, malware / file-integrity scanning, and vulnerability alerts. Drop the [`wordpress/nemesis-shield/`](wordpress/) plugin into `wp-content/plugins/`, activate, and set the token:\n```php\n// wp-config.php\ndefine('NEMESIS_SHIELD_TOKEN', 'nsk_your_site_token');\n```\n\n**Java** - `io.github.eobi:sentinel` on Maven Central (Spring Boot filter, or raw:)\n```java\nimport io.github.eobi.sentinel.NemesisShield;\nvar nemesis = new NemesisShield(System.getenv(\"NEMESIS_TOKEN\"));\nif (nemesis.guard(method, path, authed, exchange)) return;   // block off-baseline (403)\nnemesis.observe(method, path, authed, status);               // learn\n```\n\n**.NET / C#** - `dotnet add package NemesisShield` (net8.0 + netstandard2.0 / .NET Framework 4.6.1+)\n```csharp\n// Program.cs - register FIRST (before UseRouting) so it inspects every request, incl. unmatched paths\napp.UseMiddleware<NemesisShield.SentinelMiddleware>();   // set NEMESIS_TOKEN in env\n```\n\n**Rust** (axum / actix - see [`rust/`](rust/) for the middleware)\n```rust\nlet shield = nemesis_shield::Client::new(std::env::var(\"NEMESIS_TOKEN\").unwrap_or_default());\n// .layer(middleware::from_fn_with_state(shield.clone(), shield_mw))\n```\n\n**Edge** (Deno / Cloudflare Workers / Vercel Edge / Supabase / Next.js middleware) - `npm i @nemesis-shield-autogon/edge` or `deno add jsr:@nemesis-shield/edge`\n```ts\nimport { withShield } from \"@nemesis-shield-autogon/edge\";\n// wraps any Web-standard (Request) => Response; same line on every edge runtime:\nDeno.serve(withShield(handler, { token: Deno.env.get(\"NEMESIS_TOKEN\") }));   // Supabase/Deno\n// Cloudflare: export default { fetch: (req, env) => withShield(handler, { token: env.NEMESIS_TOKEN })(req) };\n```\n\n## How enforcement works (all SDKs)\n\nEvery SDK is **native**: it computes the privacy-preserving request *shape* locally, caches the\ncompiled policy, and makes the block decision **in-process, before your handler runs** - no proxy,\nno sidecar, no per-request round-trip.\n\n1. **Observe** (default) - the SDK records the shape of each request and builds a per-app baseline.\n2. **Approve** - review learned behaviors in the console; approve the legitimate ones (auto-approved\n   during the learning window).\n3. **Enforce** - flip the app to enforce in the console. Requests whose shape isn't in the approved\n   baseline are blocked with `403 blocked_by_nemesis_shield` and reported as findings. **No redeploy**\n   - a background poller picks up the mode change (PHP refreshes a short-TTL policy cache instead).\n\nVerified end-to-end (learn → enforce → attack, real blocking) across **8 languages / ~20 frameworks**:\nPython (FastAPI/Flask/Django), Node (Express/Fastify/Koa), Go (net/http/Chi/Gin/Echo), Ruby\n(Rails/Sinatra/Rack), PHP (raw/Laravel/Symfony), Java (Servlet/Spring Boot), .NET (ASP.NET Core),\nRust (axum/actix). Legit traffic passes; auth bypass, BOLA, path traversal and scanner probes blocked.\n\n## LLM protection\n\nThe Node and Python SDKs also report LLM exchanges for OWASP-LLM-Top-10 behavioral protection\n(prompt injection, jailbreak, system-prompt leak, unauthorized tool calls, sensitive output). Only\ndetection labels and shapes are stored - never raw prompts or responses.\n\n```js\nimport { reportLLM } from \"@nemesis-shield-autogon/sentinel\";\nawait reportLLM(token, { prompt, system, response, tools, allowedTools: [\"search\"] });\n```\n\n---\n\n# Repository guide (for maintainers)\n\nEverything above is for developers **consuming** the SDKs. This section is for developers **working\non this repo** after the transfer. Each language SDK is self-contained and hand-written to be\nbyte-identical in behavior (same request shape, same policy model, same embedded LLM-Guard weights),\nso there is no shared build step across languages: you develop, test and publish each one from its\nown directory using that ecosystem's native tooling.\n\n## Repository layout\n\n```\nnode/        Node/JS SDK  -> npm  @nemesis-shield-autogon/sentinel  (Express/Fastify/Koa + /llm)\npython/      Python SDK   -> PyPI nemesis-shield                    (ASGI/WSGI + provider wrappers)\ngo/          Go SDK       -> go   github.com/eobi/nemesis_shield_sdks/go\nruby/        Ruby SDK     -> gem  nemesis-shield\nphp/         PHP SDK      -> Packagist nemesislabs/sentinel         (Laravel auto-discovery)\njava/        Java SDK     -> Maven Central io.github.eobi:sentinel\ndotnet/      .NET SDK     -> NuGet NemesisShield\nrust/        Rust SDK     -> crates.io nemesis-shield\nedge/        Edge/Deno TS -> npm @nemesis-shield-autogon/edge · JSR @nemesis-shield/edge\nbrowser/     Browser SDK  -> npm @nemesis-shield-autogon/browser   (Page Shield / anti-Magecart)\nwordpress/   WordPress plugin (drop-in)\ncloudflare-supabase-proxy/  Worker that guards supabase.from() / PostgREST\n\nmcp/         MCP server (17 tools: nemesis_protect, nemesis_scan, nemesis_omniguard_verify, ...)\nlearn/       @nemesis-shield-autogon/learn - the baseline traffic driver\nai-rules/    Editor rule packs (AGENTS.md, Cursor, Windsurf, Claude Code)\ncreate-nemesis-app/  scaffolder\ndemo/ examples/       runnable samples\ne2e/         live over-the-wire tests (learn -> enforce -> attack) across every language\n```\n\nEach language directory has its **own README** with framework-specific setup. Start there for any\none SDK.\n\n## Prerequisites\n\nOnly install the toolchain for the SDK you are touching: Node 18+ (node/edge/browser/mcp/learn),\nPython 3.9+ (python), Go 1.21+ (go), Ruby 2.7+ (ruby), PHP 7.2+ and Composer (php), JDK 11+ and\nMaven (java), .NET 8 SDK (dotnet), Rust stable (rust).\n\n## Develop, test, publish\n\nWork inside the SDK's directory with its native commands. The common shape:\n\n| SDK | Install / build | Test | Publish |\n|---|---|---|---|\n| Node · Edge · Browser | `npm install` | `npm test` | `npm publish --access public` |\n| Python | `python -m build` | `pytest` | `twine upload dist/*` |\n| Go | `go build ./...` | `go test ./...` | `git tag` (module is consumed by tag) |\n| Ruby | `gem build *.gemspec` | `rake test` | `gem push *.gem` |\n| PHP | `composer install` | `composer test` | tag -> Packagist auto-syncs |\n| Java | `mvn package` | `mvn test` | `mvn deploy` (Central) |\n| .NET | `dotnet build` | `dotnet test` | `dotnet pack` + `dotnet nuget push` |\n| Rust | `cargo build` | `cargo test` | `cargo publish` |\n\nPublishing is credentialed. Get the registry tokens (npm, PyPI, Maven Central, NuGet, crates.io,\nRubyGems) from the team secrets store, never from this repo. The `mcp/` server has its own publish\nflow (npm + the MCP registry + Smithery); see `mcp/README.md`.\n\n## Cross-language contract (do not drift)\n\nAny change to behavior must land in **every** SDK identically. The invariants:\n\n- Default ingest: `POST https://shield.nemesislabs.xyz/api/v1/sketches` (LLM: `/api/v1/llm`),\n  overridable via `NEMESIS_ENDPOINT` / an `endpoint` option.\n- Auth: `Authorization: Bearer nsk_…`.\n- Modes: `observe` (default) -> `enforce`, flipped in the console; the SDK background-refreshes the\n  compiled policy with no redeploy.\n- Blocked request: HTTP `403` with `{\"error\":\"blocked_by_nemesis_shield\", ...}`.\n- Break-glass allow-list (never blocked): `/login /signin /sign-in /auth /oauth /session\n  /wp-login.php /wp-admin`, overridable via `NEMESIS_SHIELD_BOOTSTRAP`.\n- Request shape only: method, normalized path (`/orders/123` -> `/orders/{int}`), query-param\n  structure (names + kinds, never values), auth flag, status. Never bodies or secrets.\n- LLM-Guard weights (`ml_weights.json`) are embedded byte-identically and Ed25519-signed;\n  hot-swappable via `refreshModel()` against the pinned public key.\n\nEvery SDK is **fail-open**: if the service is unreachable, the app is unaffected. Keep it that way.\n\n## After you change any SDK\n\nRun the language's tests, then the relevant `e2e/` scenario (real learn -> enforce -> attack over\nthe wire). Do not ship an SDK that has not passed its e2e run.\n\n## License\n\n[MIT](LICENSE) © Autogon Inc. - use them freely, in any project.\n\n## Coverage & safe-unlock (all SDKs)\n\nEvery backend SDK is mounted **outermost** so it sees *every* route (attacks come from any path, not just your API), and the request **shape now includes query-param structure** - names + kinds, never values - so param tampering, injected params, and type anomalies on a *known* route are caught, not just unknown paths. Path-traversal segments normalize to `{traversal}`.\n\nEnforcement covers **every route with a break-glass**: the login/auth path is never blocked, so a still-learning baseline can't lock you out. Defaults: `/login /signin /sign-in /auth /oauth /session /wp-login.php /wp-admin`. Override per app:\n\n```bash\nexport NEMESIS_SHIELD_BOOTSTRAP=\"/login,/admin,/healthz\"\n```\n\nVerified across every SDK with live over-the-wire tests: legit traffic (incl. same-route value variation and param-order swaps) passes; unknown paths, injected/mutated params, method and auth anomalies, and 100+ CVE-pattern probes (path traversal, LFI/RFI, Log4Shell, Spring4Shell, Actuator, PHPUnit/Ignition RCE, ViewState, PostgREST table-enum, prototype pollution, NoSQL, SSTI…) are blocked.\n",
  "bytes": 15619,
  "sha": "243d1ca38ea0ef6000e3cd0d98ed75bd2284a77dec5801f439c42baf691b69de",
  "repo_slug": "eobi/nemesis_shield_sdks",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_eobi_nemesis_shield_05df9606/readme"
}