English Français العربية

io.github.stephenballot-ai/legacy-shield

Official registry AI and agents

Zero-knowledge encrypted vault for AI agents. EU-hosted persistent storage.

Source code Documentation

What can you do with io.github.stephenballot-ai/legacy-shield?

  • 🔐 Zero-Knowledge Encryption: Files encrypted in your browser before upload
  • 🚨 Emergency Access: Loved ones can access your vault with unlock phrase (read-only)
  • 🇪🇺 European Data Sovereignty: 100% EU infrastructure (hosted on Hetzner, Germany)
  • 📱 Document Viewer: View PDFs, images, and documents in-browser
  • 🏷️ Smart Organization: Categories, tags, favorites, expiration tracking
  • ✅ GDPR Native: Privacy-first design, compliant by default
  • 🛡️ Powered by BitAtlas: Uses the BitAtlas zero-knowledge encryption layer for all file storage and key management.

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

NPM package @legacy-shield/mcp-server
Claude Code 
claude mcp add legacy-shield -e 'LEGACY_SHIELD_API_KEY=<your legacy_shield_api_key>' -e 'LEGACY_SHIELD_API_URL=<LEGACY_SHIELD_API_URL>' -- npx -y @legacy-shield/mcp-server@1.0.2
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "legacy-shield": {
            "command": "npx",
            "args": [
                "-y",
                "@legacy-shield/mcp-server@1.0.2"
            ],
            "env": {
                "LEGACY_SHIELD_API_KEY": "<your legacy_shield_api_key>",
                "LEGACY_SHIELD_API_URL": "<LEGACY_SHIELD_API_URL>"
            }
        }
    }
}

Environment variables

  • LEGACY_SHIELD_API_KEY required secret Your LegacyShield API key (starts with ls_). Get one at POST https://api.legacyshield.eu/api/v1/auth/agent-register
  • LEGACY_SHIELD_API_URL LegacyShield API base URL

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. Legacy Shield
  2. 🌟 Key Features
  3. 🏗️ Architecture
  4. 🚀 Quick Start
  5. 📚 Development
  6. 🔒 Security
  7. 🇪🇺 European Data Sovereignty
  8. 📖 Documentation
  9. 🧪 Testing
  10. 🚀 Deployment
  11. 🤝 Contributing
  12. 📊 Pricing
  13. 📄 License
  14. 🆘 Support

Legacy Shield

Secure digital vault for critical documents with emergency access. 100% European hosting.

Legacy Shield is a privacy-first document vault designed for storing your most critical files—passports, wills, insurance policies, property deeds—with built-in emergency access for loved ones. Unlike general cloud storage, Legacy Shield uses client-side encryption and European-exclusive infrastructure to ensure maximum privacy and security.

🌟 Key Features

  • 🔐 Zero-Knowledge Encryption: Files encrypted in your browser before upload
  • 🚨 Emergency Access: Loved ones can access your vault with unlock phrase (read-only)
  • 🇪🇺 European Data Sovereignty: 100% EU infrastructure (hosted on Hetzner, Germany)
  • 📱 Document Viewer: View PDFs, images, and documents in-browser
  • 🏷️ Smart Organization: Categories, tags, favorites, expiration tracking
  • ✅ GDPR Native: Privacy-first design, compliant by default
  • 🛡️ Powered by BitAtlas: Uses the BitAtlas zero-knowledge encryption layer for all file storage and key management.

🏗️ Architecture

Monorepo Structure:

legacy-shield/
├── packages/
│   ├── web/          # Next.js frontend (React + TypeScript)
│   ├── api/          # Express backend (Node.js + TypeScript)
│   └── shared/       # Shared types and utilities
├── infrastructure/   # Deployment configs
├── docker-compose.yml
├── product-spec.md   # Product specification
└── architecture-spec.md  # Technical architecture

Tech Stack:

  • Frontend: Next.js 14, TypeScript, TailwindCSS, Web Crypto API
  • Backend: Node.js, Express, Prisma ORM, PostgreSQL
  • Storage: Hetzner Object Storage (S3-compatible)
  • Hosting: Hetzner Cloud (Germany)
  • Payments: Stripe

🚀 Quick Start

Prerequisites
  • Node.js 20+ and npm 10+
  • Docker and Docker Compose
  • Git
1. Clone and Install
cd /Users/stephenballot/Documents/LegacyShield
npm install
2. Start Infrastructure
# Start PostgreSQL, Redis, and MinIO (local S3)
docker compose up -d

# Verify services are running
docker ps

Note: You can also use npm run docker:dev as a shortcut.

3. Configure Environment
# Copy example environment file
cp .env.example .env

# Edit .env with your values (defaults work for local development)
4. Initialize Database
cd packages/api

# Generate Prisma Client
npm run db:generate

# Run database migrations
DATABASE_URL="postgresql://legacyshield:devpassword@localhost:5432/legacyshield_dev" npm run db:migrate

# Optional: seed with test data
npm run db:seed

cd ../..

Note: The DATABASE_URL must be provided because Prisma doesn't automatically read the root .env file. See GETTING_STARTED.md for details.

5. Start Development Servers
# Start both frontend and backend
npm run dev

# Or start individually:
npm run dev:web    # Frontend at http://localhost:3000
npm run dev:api    # Backend at http://localhost:4000
6. Access the Application

📚 Development

Available Scripts
# Development
npm run dev              # Start all services
npm run dev:web          # Start frontend only
npm run dev:api          # Start backend only

# Building
npm run build            # Build all packages
npm run build:web        # Build frontend
npm run build:api        # Build backend

# Testing
npm run test             # Run all tests
npm run lint             # Lint all packages
npm run type-check       # TypeScript type checking

# Database
cd packages/api
npm run db:migrate       # Run migrations
npm run db:seed          # Seed database
npm run db:studio        # Open Prisma Studio
npm run db:reset         # Reset database

# Docker
docker compose up -d     # Start Docker services
docker compose down      # Stop Docker services
docker compose logs -f   # View Docker logs

Tip: For detailed setup instructions, see GETTING_STARTED.md

Project Structure
packages/
├── web/                          # Frontend (Next.js)
│   ├── src/
│   │   ├── app/                  # Next.js App Router
│   │   │   ├── (auth)/           # Auth pages (login, register)
│   │   │   ├── (dashboard)/      # Protected dashboard pages
│   │   │   └── emergency-access/ # Public emergency portal
│   │   ├── components/           # React components
│   │   ├── lib/
│   │   │   ├── crypto/           # Client-side encryption
│   │   │   ├── api/              # API client
│   │   │   └── utils/            # Utilities
│   │   ├── hooks/                # Custom React hooks
│   │   ├── store/                # Zustand stores
│   │   └── types/                # TypeScript types
│   └── package.json
│
├── api/                          # Backend (Express)
│   ├── src/
│   │   ├── routes/               # API routes
│   │   ├── middleware/           # Express middleware
│   │   ├── services/             # Business logic
│   │   ├── models/               # Data models
│   │   ├── jobs/                 # Background jobs
│   │   ├── utils/                # Utilities
│   │   └── server.ts             # Main server file
│   ├── prisma/
│   │   ├── schema.prisma         # Database schema
│   │   └── migrations/           # Database migrations
│   └── package.json
│
└── shared/                       # Shared code
    ├── src/
    │   ├── types/                # Shared TypeScript types
    │   ├── constants/            # Shared constants
    │   └── utils/                # Shared utilities
    └── package.json

🔒 Security

Legacy Shield implements a zero-knowledge architecture:

  1. Client-side encryption: All files encrypted in browser before upload
  2. Key derivation: Master key derived from password using PBKDF2 (100k iterations)
  3. Per-file keys: Each file encrypted with unique AES-256-GCM key
  4. Dual-key system: Files encrypted with both owner key and emergency key
  5. No plaintext storage: Server never sees unencrypted files or keys
  6. 2FA mandatory: Two-factor authentication required for all users
Encryption Flow
Password → PBKDF2 → Master Key → Encrypts file keys → AES-256-GCM → Encrypted file
                                                                           ↓
                                                              Hetzner Object Storage (Germany)

🇪🇺 European Data Sovereignty

All infrastructure is hosted exclusively in the European Union:

  • Compute: Hetzner Cloud (Falkenstein, Germany)
  • Database: Hetzner Managed PostgreSQL (Germany)
  • Storage: Hetzner Object Storage (Germany)
  • Backups: Automated backups to Nuremberg, Germany

Your data never leaves European soil and is protected by:

  • GDPR (General Data Protection Regulation)
  • German BDSG (Federal Data Protection Act)
  • No US CLOUD Act jurisdiction

📖 Documentation

🧪 Testing

# Run all tests
npm run test

# Run tests for specific package
npm run test --workspace=web
npm run test --workspace=api

# Run tests in watch mode
npm run test:watch --workspace=web

# Run e2e tests
npm run test:e2e

🚀 Deployment

Production Deployment (Hetzner Cloud)
  1. Infrastructure Setup: See infrastructure/README.md
  2. Environment Variables: Configure production .env with real credentials
  3. Database Migration: Run migrations on production database
  4. Deploy: Use GitHub Actions or manual deployment
# Build for production
npm run build

# Deploy to Hetzner (manual)
# See infrastructure/deploy.sh
CI/CD

GitHub Actions workflow automatically:

  • Runs tests on every PR
  • Builds and deploys to staging on develop branch
  • Builds and deploys to production on main branch

🤝 Contributing

This is a private project. For the development team:

  1. Create feature branch: git checkout -b feature/your-feature
  2. Make changes and commit: git commit -m "Add your feature"
  3. Push branch: git push origin feature/your-feature
  4. Create Pull Request on GitHub
Code Standards
  • TypeScript: Strict mode enabled
  • Linting: ESLint with Airbnb config
  • Formatting: Prettier (automatic on commit)
  • Commits: Conventional commits format

📊 Pricing

  • Free Tier: 15 documents, 1 emergency contact
  • Pro Tier: $10/month or $500 lifetime
    • 100 documents
    • 5 emergency contacts
    • Advanced features (expiration tracking, sharing, audit logs)

📄 License

Copyright © 2026 Legacy Shield. All rights reserved.

This is proprietary software. Unauthorized copying or distribution is prohibited.

🆘 Support

  • Documentation: See spec files in root directory
  • Issues: GitHub Issues (private repo)
  • Email: support@legacyshield.com

Built with ❤️ in Europe. Your data, your privacy, your legacy.

Frequently asked questions

What is io.github.stephenballot-ai/legacy-shield?

Zero-knowledge encrypted vault for AI agents. EU-hosted persistent storage.

How do I install io.github.stephenballot-ai/legacy-shield?

It runs on your machine. In Claude Code: claude mcp add legacy-shield -e 'LEGACY_SHIELD_API_KEY=<your legacy_shield_api_key>' -e 'LEGACY_SHIELD_API_URL=<LEGACY_SHIELD_API_URL>' -- npx -y @legacy-shield/mcp-server@1.0.2. For other clients, paste the JSON configuration from this page into their MCP settings.

Does io.github.stephenballot-ai/legacy-shield need an API key?

Yes. It expects LEGACY_SHIELD_API_KEY, which you set in its configuration.

Is io.github.stephenballot-ai/legacy-shield open source?

Its code is public on GitHub, but the repository does not declare a standard license.

Who maintains io.github.stephenballot-ai/legacy-shield?

It is published by stephenballot-ai. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.