Dingdawg Shield

io.github.dingdawgPublished by GitHub account dingdawgv1.0.4Updated Oct 24, 2026

AI security scanning and trust scoring. Stack-specific threat models. Free local scan.

VerifiedSTDIODesktop onlySecurity & MonitoringAI & ML

Overview

AI-generated overview

A local npm MCP server that adds AI security scanning, stack-specific threat models, and agent trust scoring to an assistant.

What you can do
Dingdawg Shield is a local stdio MCP server distributed as the npm package dingdawg-shield. Its description covers AI security scanning and trust scoring, stack-specific threat models, and a free local scan. The README also describes governance receipts for agent actions, compliance classification, regulation lookup, and agent trust scores with a live stream, backed by governed-agent packages.
When to use it
Consider it when you want an assistant to run security scans or threat models against a project, or to check agent trust scores and compliance classifications. It is aimed at teams that need evidence of governed agent behavior.
Requirements
Runs locally over stdio via the npm package dingdawg-shield, so Node.js and npm/npx are needed. The DINGDAWG_API_KEY environment variable is required for paid tier access; the README says a free key can be obtained by developer signup. Network access to the provider's API is implied by the documented endpoints.
Before you install
The server asks for the secret DINGDAWG_API_KEY, which the README says is shown once at signup and is used to authenticate calls to the provider's API. The README lists billing and Stripe checkout endpoints, so paid usage and metering may apply. Governed execution routes agent calls through the provider's service, meaning prompts and actions may be sent to a third party and logged in an audit trail. Review the security model before installing.

Installation

In SourceWeft

  1. Open Dingdawg Shield in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

DingDawg Agent 1

[License: MIT] [Python 3.11+]

Governance receipts for AI agents.

Every action a governed agent takes generates a cryptographically-signed receipt: what it decided, why, which model, which version, at what time. Built toward EU AI Act Art. 12, Colorado AI Act (SB 24-205), and NIST AI RMF requirements.

The receipt is what turns a policy document into evidence.

What's live today

CapabilityEndpoint
Developer signup — issues a scoped API keyPOST /v1/developers/signup
Governed execution — routes agent calls through metering + auditPOST /v1/govern/execute
Compliance classificationPOST /api/v1/compliance/classify
Regulation lookupGET /api/v1/compliance/regulations
Agent trust score + live streamGET /api/v1/agents/{id}/trust, WS .../trust/stream
Billing (Stripe)POST /api/v1/payments/create-checkout-session

Backed by 10 governed-agent npm packages (compliance, legal, healthcare, finance, devops, marketing, sales, support, code-review, planning).

Quickstart

bash
curl -X POST https://api.dingdawg.com/v1/developers/signup \  -H "Content-Type: application/json" \  -d '{"email":"[email protected]","name":"Your Name","role":"consumer"}'# -> {"api_key": "dd_...", ...}  store it — shown once
bash
export DINGDAWG_API_KEY=dd_your_keynpx dingdawg-compliance quick-check

Architecture

Client (npm package / your agent) --auth: DINGDAWG_API_KEY-->  api.dingdawg.com (FastAPI, Railway)    -> Tier isolation + rate limiting    -> Governance gate (score, log, decide)    -> Audit trail (signed receipt)    -> Stripe metering / billing  -> Response (governed, scored, receipted)

Documentation

Contributing

See CONTRIBUTING.md for contribution guidelines.

Security

See SECURITY.md for our responsible disclosure policy.

License

MIT License. See LICENSE for details.

Innovative Systems Global. The name is not aspirational. It is a statement of fact.

Source: README.md at commit 0489d0b

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.4LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts