Shield360 CLI

The shield360 CLI is a single Go binary that connects your local tooling to a Shield360 instance. Today it ships first-class observability for AI coding agents - Claude Code, Cursor, and Codex - by wiring into each vendor’s hook system, normalizing events onto OpenTelemetry’s gen_ai.* and Shield360’s coding_agent.* semantic conventions, and exporting them via OTLP to your collector.

It talks only to your Shield360 endpoint. There is no managed cloud - your telemetry stays on your infrastructure.

Note

The CLI is the future control plane for Shield360. It’s built so new command groups can plug in over time - prompts, traces, eval, and migrate are already reserved in the codebase and will light up in subsequent releases without breaking the coding-agent integration. Today, the CLI is focused on coding-agent observability.

What you can do today

Report AI usage from every machine

shield360 collector enrols a machine with your install key and reports AI usage, spend and application time to Shield360. No proxy and no certificate.

Observe coding agents

Wire Claude Code, Cursor, or Codex into Shield360 with one idempotent command per vendor - no SDK, no code changes in your repos.

Configure once

Set your OTLP endpoint, API key, environment, and content-capture mode in a single config file or via environment variables.

Launch agents instrumented

shield360 coding launch bootstraps the plugin and execs your agent in one step - telemetry on from the first turn.

Diagnose your setup

shield360 doctor prints the resolved config, dials your OTLP endpoint, and lists installed plugins so you can confirm everything is wired up.

Command groups

Command	Purpose
shield360 collector	Enrol this machine and report AI usage, application time and (by policy) browsing and network activity
shield360 coding	Install, launch, and manage coding-agent telemetry (Claude Code, Cursor, Codex)
shield360 configure	Write persistent settings to ~/.config/shield360/config.env
shield360 doctor	Diagnose config, OTLP reachability, and installed plugins
shield360 version	Print the CLI version and build commit

How it works

Coding agent (Claude Code / Cursor / Codex)
    +-- fires hook events (SessionStart, PreToolUse, Stop, ...)
            |
            v
shield360 coding hook --vendor=<v> --event=<name>   (invoked by the host plugin manifest)
    +-- normalizes to gen_ai.* / coding_agent.* semantic conventions
    +-- tier-1 secret redaction
    +-- 5s hard timeout, always exits 0 (never blocks the developer)
            |
            v
OTLP/HTTP --> your Shield360 collector --> /agents page

The hook is the CLI’s hot path - invoked once per agent event. It is crash-isolated: a 5-second hard timeout with ~3 seconds reserved for OTLP flush, and it always exits 0 even when telemetry fails, so a broken pipeline never blocks your coding session.

Get started

Install the CLI

macOS, Linux, Windows, Docker, or build from source

Configuration

Endpoint, API key, content capture, and precedence rules

Command reference

Every command, subcommand, and flag

Coding agents setup

The end-to-end guide to wiring each vendor