Shield KYA is a free MIT CLI that stops coding-agent tool calls before they write files or run deploy commands. Install with `kya start`, restart Cursor or Claude once, and every risky action shows up in a local activity receipt: Allow, Deny, or Hold, with clipped change previews. Default mode is observe. If security wants a shared queue later, there is a hosted Hold desk.