Aegis

AEGIS

The firewall for AI agents.

Every tool call. Intercepted. Classified. Blocked — before it executes.

[](https://github.com/Justin0504/Aegis/releases/latest) [](https://github.com/Justin0504/Aegis/releases) [](https://github.com/Justin0504/Aegis/stargazers) [](https://opensource.org/licenses/MIT) [](https://pypi.org/project/agentguard-aegis/) [](https://www.npmjs.com/package/@justinnn/agentguard) [](https://github.com/Justin0504/Aegis/pkgs/container/aegis-gateway) [](https://github.com/Justin0504/Aegis/actions)

Download → · [Roadmap →](./ROADMAP.md) · [Security →](./SECURITY.md) · [Commercial →](./COMMERCIAL.md) · [Contributing →](./CONTRIBUTING.md)

Download AEGIS

🍎 macOS

[](https://github.com/Justin0504/Aegis/releases/latest)

AEGIS_0.1.0_aarch64.dmg · 164 MBmacOS 11+ · Apple Silicon

🪟 Windows

AEGIS_Setup.exeWindows 10+ · use WSL2 today

🐧 Linux

[](https://aegistraces.com/install)

.deb · .AppImage · .tar.gzUbuntu 22.04+ · Debian 12+ · RHEL 9+

Or one line in any terminal:

curl -fsSL https://aegistraces.com/install | sh

Detects your OS + arch, downloads the verified release, drops the binary in /usr/local/bin, ready to run. No git clone. No Docker. No npm install.

---

> Your agent just called DROP TABLE users because the prompt said "clean up old records." > Your agent just exfiltrated 2 GB because "the user asked for a report." > Your agent just ran rm -rf / because the model hallucinated a tool name. > > Not hypotheticals. Every agent framework lets AI decide which tools to call, with what arguments, at machine speed. There is no human in the loop. There is no undo. > > AEGIS is the missing layer: a pre-execution firewall that sits between your agent and its tools, classifies every call in real time, enforces policies, blocks violations, and writes a tamper-evident audit trail — with one line of code and zero agent changes.

The AEGIS Compliance Cockpit — real-time monitoring across all your agents.

---

See it run

A real Claude-powered research assistant, fully integrated with AEGIS. Watch it trace tool calls, block SQL injection, detect PII, and pause for human approval — live.

The Compliance Cockpit: traces, policies, cost tracking, sessions, approvals.

---

Deploy in 30 seconds

 

 

Prefer Fly.io? fly launch from the repo root — fly.toml ships in-tree. Or use Helm: helm install aegis ./charts/aegis.

Each button reads the platform-specific config we ship (render.yaml, railway.json, .do/app.yaml) and stands up a public gateway + cockpit on the host's free tier in ~30 seconds. No CLI needed.

Or run it locally (one command)

curl -fsSL https://raw.githubusercontent.com/Justin0504/Aegis/main/scripts/install.sh | bash

The installer clones the repo into ./aegis, writes .env, runs docker compose up -d, waits for the gateway to become healthy, and prints your dashboard URL + bootstrap API key. Set AEGISDIR, AEGISBRANCH, or AEGISNOSTART=1 to customize.

Or do it manually:

git clone https://github.com/Justin0504/Aegis
cd Aegis
docker compose up -d

| Service | URL | What it does | |---------|-----|--------------| | Compliance Cockpit | localhost:3000 (Docker) · localhost:13003 (dev) | Dashboard — traces, policies, approvals, costs | | Gateway API | localhost:8080 | Policy engine — classifies, checks, blocks |

Then add one line to your agent:

import agentguard
agentguard.auto("http://localhost:8080", agent_id="my-agent")

# Your existing code — completely unchanged
import anthropic
client = anthropic.Anthropic()
response = client.messages.create(model="claude-sonnet-4-20250514", tools=[...], messages=[...])

For supported Python integrations, importing agentguard once is enough to enable auto-instrumentation:

python -c "import agentguard; agentguard.auto('http://localhost:8080', agent_id='my-agent')"

That's it. Every tool call is now classified, policy-checked, and recorded in a tamper-evident audit trail before execution.

---

Recently shipped (last batch)

| Capability | Endpoint / file | What it solves | |---|---|---| | Agent registry + identity | POST /api/v1/agents · [agent-registry.ts](packages/gateway-mcp/src/services/agent-registry.ts) | agent_id was a free-form string anyone could pass. Now it's first-class identity with status (active/suspended/deprecated/unregistered), declared tool scope, per-agent budget, optional Ed25519 / shared-secret authentication. | | AEGIS Agent Threat Ontology v1 | GET /api/v1/ontology · [agent-threats.ts](packages/core-schema/src/ontology/agent-threats.ts) | 10 tactics × 40 techniques (AAT-T*) — a published, versioned taxonomy of agent-specific threats. Coverage at GET /coverage shows which nodes this deployment defends against; tenant detectors automatically extend it. | | Detector plugin contract | [Detector interface](packages/core-schema/src/detector.ts) | Customer security teams or 3rd parties register a Detector against the live registry — same signal type, same decision merger, same audit / sink / transparency-log fan-out as built-ins. | | LLM egress proxy | /api/v1/llm-proxy/{openai,anthropic}/* · [proxy/](packages/gateway-mcp/src/proxy/) | Customer changes one env var (OPENAI_BASE_URL=…aegis…/openai/v1) — every LLM call now flows through the detector chain, audit, transparency log, and sinks. Works for any language / any closed-source agent platform. | | Universal SIEM sinks | tenant_config.sinks[] · [sinks/](packages/gateway-mcp/src/sinks/) | Declarative http / syslog / stdout sinks for Splunk HEC, Datadog Logs, Sumo, QRadar, Graylog — customer integrates by config write, not code release. Bounded DLQ + retry + field-mapping templates. | | RFC 6962 transparency log | GET /api/v1/transparency-log/proof/:idx · [transparency-log.ts](packages/gateway-mcp/src/services/transparency-log.ts) | Append-only Merkle tree over audit + evidence-pack events. Signed roots + inclusion proofs let customers verify "this audit row existed at this date" offline — defeats the "you control the key" objection. | | Per-framework compliance bundles | POST /api/v1/compliance/bundle/:fw · [compliance-bundle.ts](packages/gateway-mcp/src/services/compliance-bundle.ts) | One POST → signed JSON bundle mapping SOC 2, ISO 27001, NIST AI RMF, EU AI Act controls to live AEGIS evidence. Hands the auditor a verifiable artifact, not screenshots. | | Budget guard | tenant_config.budget · [budget-guard.ts](packages/gateway-mcp/src/services/budget-guard.ts) | Daily / monthly / per-agent / per-session USD limits with warn / block actions. Coverage of AAT-T8002. | | OTLP trace export | tenant_config.observability.otlp · [otlp-exporter.ts](packages/gateway-mcp/src/services/otlp-exporter.ts) | Per-tenant push to any OTLP/HTTP backend (Datadog, Honeycomb, Grafana Tempo, New Relic). Customers see AEGIS spans alongside their non-LLM infra traces. | | Cross-agent + IPI + memory-poison + sensitive-exfil detectors | [detectors/built-in/](packages/gateway-mcp/src/detectors/built-in/) | Coverage of AAT-T10001 (trust abuse), T1001 (indirect prompt injection), T6001 (memory poisoning), T5001 (sensitive-context exfiltration). | | Ed25519-signed release artifacts | [tools/release-sign/](tools/release-sign/) + [.well-known/aegis-release-pubkey.pem](.well-known/aegis-release-pubkey.pem) | Every npm tarball + PyPI wheel ships with a signature manifest verifiable offline against the AEGIS-pinned public key. Defeats mirror tampering / in-transit forgery. |

Ontology coverage at the time of this batch: 28/40 (70%) across the 10 tactics. See live status at GET /api/v1/ontology/coverage or in the Cockpit's /coverage page.

---

Why AEGIS?

The agent-guardrail category is consolidating around two camps: closed enterprise platforms (Cisco AI Defense, Palo Alto Prisma AIRS), and narrow open-source libraries (LlamaFirewall, NeMo, Guardrails AI). AEGIS is the open-source platform that ships the full vertical — gateway, cascade, DSL, dashboard, audit trail, approvals — in one repo.

| | Lakera Guard | NeMo Guardrails | Cisco AI Defense | Guardrails AI | AEGIS | |--|--------------|------------------|------------------|---------------|-----------| | Open source / self-hostable | paid tier | ✅ | ❌ | ✅ | ✅ | | Pre-execution blocking | ✅ | ✅ | ✅ | ✅ | ✅ | | Agent identity + registration + secret rotation | ❌ | ❌ | ❌ | ❌ | ✅ | | Per-agent declared tool scope enforcement | ❌ | ❌ | ❌ | ❌ | ✅ | | Per-agent / per-tenant budget guard | ❌ | ❌ | ❌ | ❌ | ✅ | | AEGIS Agent Threat Ontology + coverage map | ❌ | ❌ | ❌ | ❌ | ✅ | | Detector plugin contract (3rd-party / customer) | ❌ | partial | ❌ | partial | ✅ | | Per-tenant Policy DSL (fail-safe) | ❌ | Colang | ❌ | ❌ | ✅ | | RFC 6962 transparency log (offline-verifiable) | ❌ | ❌ | ❌ | ❌ | ✅ | | Per-framework signed compliance bundles | ❌ | ❌ | ❌ | partial | ✅ | | Universal SIEM sinks (http / syslog / stdout) | partial | ❌ | ✅ | ❌ | ✅ | | OTLP trace export (Datadog/Honeycomb/Tempo/…) | ❌ | ❌ | partial | ❌ | ✅ | | LLM egress proxy (zero-code, any-language) | ❌ | ❌ | ✅ | partial | ✅ | | Cross-agent compromise correlator | ❌ | ❌ | ❌ | ❌ | ✅ | | Sensitive-context taint tracking (PII → exfil) | ❌ | ❌ | ❌ | ❌ | ✅ | | Memory-poison & indirect-prompt-injection detectors | partial | partial | partial | ❌ | ✅ | | Ed25519-signed release artifacts (npm + PyPI) | ❌ | ❌ | ❌ | ❌ | ✅ | | Behavioral anomaly detection (IsolationForest + PPM) | ❌ | ❌ | ❌ | ❌ | ✅ | | Cost-aware L1→L2→L3 cascade | ❌ | ❌ | partial | ❌ | ✅ | | Human-in-the-loop approval flow | ❌ | ❌ | ❌ | ❌ | ✅ | | Multi-framework SDK | API only | NVIDIA-centric | partial | ✅ | 14 frameworks | | Kill switch + admin audit log (SOC 2 prep) | ❌ | ❌ | ❌ | ❌ | ✅ |

> If your point of comparison is observability (LangFuse, Helicone, > Arize) — those tell you what happened. AEGIS prevents it from > happening by sitting on the execution path itself.

---

How it works

  Your agent calls a tool
          │
          ▼  SDK / HTTP Proxy / MCP Proxy intercepts
  ┌────────────────────────────────────────────────┐
  │  AEGIS Gateway                                 │
  │                                                │
  │  ① Classify   (SQL? file? network? shell?)     │
  │  ② Anomaly    (baseline deviation? spike?)     │
  │  ③ Evaluate   AJV policies (injection? exfil?) │
  │  ④ Match DSL  per-tenant rules (fail-safe)     │
  │  ⑤ Decide     strictest(allow / pending / block)│
  └──────────┬─────────────────────────────────────┘
             │
      ┌──────┴──────────────┐
      │                     │
   allow                 pending ──► Human reviews in Cockpit
      │                     │               │
      ▼                     └──── allow ────┘
  Tool executes                        │
      │                             block
      ▼                                │
  Optional signing                    ▼
  SHA-256 hash-chained       AgentGuardBlockedError
  Stored in Cockpit          (agent gets the reason)

Zero-config classification — works on any tool name, any argument shape:

| Your tool call | AEGIS detects | How | |----------------|---------------|-----| | run_query(sql="SELECT...") | database | SQL keyword in args | | my_tool(path="/etc/passwd") | file | Sensitive path pattern | | do_thing(url="http://...") | network | URL in args | | helper(cmd="rm -rf /") | shell | Command injection signal | | custom_fn(prompt="ignore previous...") | prompt-injection | Known attack pattern | | exec(cmd="npm publish") | supply-chain | Publish/deploy command |

---

Key Features

Pre-Execution Blocking

AEGIS doesn't just log — it stops dangerous tool calls before they execute.

agentguard.auto(
    "http://localhost:8080",
    blocking_mode=True,             # pause HIGH/CRITICAL calls for human review
    human_approval_timeout_s=300,   # auto-block after 5 min with no decision
)

SQL injection — blocked instantly

High-risk action — awaiting human approval

The agent pauses. You open the Cockpit, inspect the exact arguments, and click Allow or Block. The agent resumes in under a second.

from agentguard import AgentGuardBlockedError

try:
    response = client.messages.create(...)
except AgentGuardBlockedError as e:
    print(f"Blocked: {e.tool_name} — {e.reason} ({e.risk_level})")

Policy Engine

Seven AJV policies ship by default. Create more in plain English — the AI assistant generates the JSON schema for you.

| Policy | Risk | What it catches | |--------|------|-----------------| | SQL Injection Prevention | HIGH | DROP, DELETE, TRUNCATE in database tools | | File Access Control | MEDIUM | Path traversal (../), /etc/, /root/ | | Network Access Control | MEDIUM | HTTP (non-HTTPS) requests | | Prompt Injection Detection | CRITICAL | "ignore previous instructions" patterns | | Data Exfiltration Prevention | HIGH | Large payloads to external endpoints | | Source Map Leak Prevention | HIGH | npm publish when .map files present | | Supply Chain Security | HIGH | Package publish, container push, deployment ops |

> "Block all file deletions outside the /tmp directory" → Describe button → policy created instantly.

Per-Tenant Policy DSL

Each tenant gets a YAML/JSON Policy DSL that runs on top of the defaults. The DSL can:

• Route specific tool categories to human review
• Escalate decisions on anomaly score, agent identity, or deployment mode
• Add new block rules for tenant-specific patterns
• Flip ambiguous calls from allow → pending

Fail-safe semantics. A DSL rule can only tighten a decision — allow from the DSL can never override an AJV or anomaly block. This is enforced structurally: the final decision is always strictest(AJV, anomaly, DSL).

version: 1
rules:
  - name: escalate-high-anomaly
    when: { anomaly.score: { ">": 0.7 } }
    then: { decision: pending, reason: "anomaly score above 0.7" }

  - name: block-shell-in-financial
    when:
      all:
        - classifier.category: shell
        - tenant.deploymentMode: financial
    then: { decision: block }

Edit in the Cockpit Monaco editor (/dsl), test with the Dry Run panel, save → live for new tool calls (hot-reload, no restart).

Deployment Mode

Five ready-made templates — one click to apply on the Settings page or via POST /api/v1/config/apply-template:

| Template | L1 | L2 | L3 | Retention | Best for | |----------|----|----|----|-----------|----------| | dev | ✅ | ❌ | ❌ | 7 d | Local development, minimal cost | | standard | ✅ | ✅ | escalate | 90 d | Default | | strict | ✅ | ✅ | all | 180 d | High-sensitivity workloads | | financial | ✅ | ✅ | all | 7 yr (SOX) | Banking / fintech | | healthcare | ✅ | ✅ | all | 6 yr (HIPAA) | PHI handling |

Per-tenant config is stored in organizations.settings, hot-reloads via an in-process ConfigBus, and every change is recorded in the admin audit log.

Agent Alignment Auditor

For agents whose chain-of-thought you can see (LangChain / ReAct, CrewAI), AEGIS audits each proposed action against the declared goal of the current run. If the agent silently grew a hidden sub-task (scope-expansion) or its reasoning no longer matches the user's request (drift), the verdict shows up in the Cockpit's Alignment tab and feeds straight into the Policy DSL:

rules:
  - name: pause-on-drift
    when:
      any:
        - alignment.score: { "

**Forensic trace detail**

**Policy management**

**Token cost tracking**

**Session gr

…

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Justin0504](https://github.com/Justin0504)
- **Source:** [Justin0504/Aegis](https://github.com/Justin0504/Aegis)
- **License:** MIT

Install and usage instructions live in the source repository linked above.