Metadata-Version: 2.4
Name: nexus-shield-cli
Version: 0.1.0
Summary: Local OpenAI-compatible PII guardrail proxy for Ollama, OpenAI, and LiteLLM.
Author-email: Nexus Shield Team <dev@nexusshield.ai>
License: MIT
Project-URL: Homepage, https://github.com/baturhantasdelen-sudo/core-ai-firewall
Project-URL: Documentation, https://api.nexusshield.ai
Project-URL: Repository, https://github.com/baturhantasdelen-sudo/core-ai-firewall
Project-URL: Bug Tracker, https://github.com/baturhantasdelen-sudo/core-ai-firewall/issues
Keywords: llm,pii,guardrails,proxy,ollama,openai,cli
Classifier: Programming Language :: Python :: 3
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: OS Independent
Classifier: Topic :: Security
Classifier: Environment :: Console
Classifier: Typing :: Typed
Requires-Python: >=3.10
Description-Content-Type: text/markdown
Requires-Dist: fastapi>=0.110.0
Requires-Dist: httpx>=0.27.0
Requires-Dist: uvicorn[standard]>=0.27.0

# Nexus Shield CLI

Local OpenAI-compatible proxy with sub-10ms in-RAM PII redaction. Point your app at `http://127.0.0.1:8080/v1` and keep sending requests to Ollama, OpenAI, or LiteLLM — Nexus Shield sanitizes prompts before they leave your machine.

## Point your application to the local proxy

Change your local environment variable or base URL:

```bash
# Before: pointing directly to OpenAI / Ollama
OPENAI_BASE_URL="https://api.openai.com/v1"

# After: pointing to Nexus Shield local proxy
OPENAI_BASE_URL="http://127.0.0.1:8080/v1"
```

For Ollama with the OpenAI-compatible API:

```bash
OPENAI_BASE_URL="http://127.0.0.1:8080/v1"
# Nexus Shield forwards to Ollama at http://127.0.0.1:11434/v1 by default
```

## Install

```bash
pip install nexus-shield-cli
```

Or from this repository:

```bash
pip install ./packages/cli
```

## CLI options

```bash
nexus-shield proxy [options]
```

| Option | Default | Description |
| :--- | :--- | :--- |
| `-p`, `--port` | `8080` | Local proxy port |
| `-t`, `--target` | `http://127.0.0.1:11434/v1` | Upstream LLM base URL (Ollama default) |
| `--host` | `127.0.0.1` | Bind address |
| `--mask-all` | off | Redact TCKN, credit cards, emails, phone numbers, and API keys |

### Examples

```bash
# Ollama (default upstream)
nexus-shield proxy

# OpenAI upstream
nexus-shield proxy --target https://api.openai.com/v1

# Custom port with full PII masking
nexus-shield proxy -p 9090 --mask-all
```

## How it works

1. Your SDK sends `POST /v1/chat/completions` to `http://127.0.0.1:8080/v1`.
2. Nexus Shield redacts PII in `messages`, `prompt`, and `input` fields in memory.
3. The sanitized payload is forwarded to the upstream LLM server.
4. The upstream response is streamed back unchanged.

Masked fields appear in the `X-Nexus-Shield-Masked` response header when PII is detected.

## License

MIT © Nexus Shield Team
