Shield KYA: Local CLI that gates agent tools before write or deploy

I built this because I was tired of losing track of what Cursor and Claude Code actually changed. You install it with: npm i -g @shield-agent/kya@latest && kya start It drops MCP config into the project, opens a local activity receipt, and records Allow / Deny / Hold for tool calls that go through the gate. Writes get a short path summary and a clipped change preview. Shell stays summary-only so we are not dumping full command lines into a file on disk. Default is observe. I did not want another Hold prompt stacked on top of the host. Never-events still deny. If your security team wants a shared queue, there is a hosted desk on shield-agent.com, and KYA_HOLD=1 turns on the org Hold path locally. This is MIT. It will not magically see tools that never call wrap or MCP. That is intentional. Repo: https://github.com/The-Pixel-Boy... Install hub: https://shield-agent.com/install