# Aegis

> Runtime policy enforcement for AI agents. Cryptographic audit trail, human-in-the-loop approvals, kill switch. Zero code changes.

- **Type:** MCP server
- **Install:** `agentstack add mcp-justin0504-aegis`
- **Verified:** Pending review
- **Seller:** [Justin0504](https://agentstack.voostack.com/s/justin0504)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Justin0504](https://github.com/Justin0504)
- **Source:** https://github.com/Justin0504/Aegis

## Install

```sh
agentstack add mcp-justin0504-aegis
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# AEGIS

### The firewall for AI agents.

**Every tool call. Intercepted. Classified. Blocked — before it executes.**

[](https://github.com/Justin0504/Aegis/releases/latest)
[](https://github.com/Justin0504/Aegis/releases)
[](https://github.com/Justin0504/Aegis/stargazers)
[](https://opensource.org/licenses/MIT)
[](https://pypi.org/project/agentguard-aegis/)
[](https://www.npmjs.com/package/@justinnn/agentguard)
[](https://github.com/Justin0504/Aegis/pkgs/container/aegis-gateway)
[](https://github.com/Justin0504/Aegis/actions)

[**Download** →](https://github.com/Justin0504/Aegis/releases/latest) ·
[**Roadmap** →](./ROADMAP.md) ·
[**Security** →](./SECURITY.md) ·
[**Commercial** →](./COMMERCIAL.md) ·
[**Contributing** →](./CONTRIBUTING.md)

## Download AEGIS

### 🍎 macOS

[](https://github.com/Justin0504/Aegis/releases/latest)

`AEGIS_0.1.0_aarch64.dmg` · 164 MBmacOS 11+ · Apple Silicon

### 🪟 Windows

`AEGIS_Setup.exe`Windows 10+ · use WSL2 today

### 🐧 Linux

[](https://aegistraces.com/install)

`.deb` · `.AppImage` · `.tar.gz`Ubuntu 22.04+ · Debian 12+ · RHEL 9+

**Or one line in any terminal:**

```bash
curl -fsSL https://aegistraces.com/install | sh
```

Detects your OS + arch, downloads the verified release, drops the binary in `/usr/local/bin`, ready to run. No git clone. No Docker. No `npm install`.

---

> Your agent just called `DROP TABLE users` because the prompt said "clean up old records."
> Your agent just exfiltrated 2 GB because "the user asked for a report."
> Your agent just ran `rm -rf /` because the model hallucinated a tool name.
>
> **Not hypotheticals.** Every agent framework lets AI decide which tools to call, with what arguments, at machine speed. There is no human in the loop. There is no undo.
>
> AEGIS is the missing layer: a **pre-execution firewall** that sits between your agent and its tools, classifies every call in real time, enforces policies, blocks violations, and writes a tamper-evident audit trail — with **one line of code and zero agent changes.**

The AEGIS Compliance Cockpit — real-time monitoring across all your agents.

---

## See it run

**A real Claude-powered research assistant, fully integrated with AEGIS.**
Watch it trace tool calls, block SQL injection, detect PII, and pause for human approval — live.

**The Compliance Cockpit: traces, policies, cost tracking, sessions, approvals.**

---

## Deploy in 30 seconds

  
    
   
  
    
   
  
    

  Prefer Fly.io? fly launch from the repo root — fly.toml ships in-tree. Or use Helm: helm install aegis ./charts/aegis.

Each button reads the platform-specific config we ship (render.yaml, railway.json, .do/app.yaml) and stands up a public gateway + cockpit on the host's free tier in ~30 seconds. No CLI needed.

## Or run it locally (one command)

```bash
curl -fsSL https://raw.githubusercontent.com/Justin0504/Aegis/main/scripts/install.sh | bash
```

The installer clones the repo into ./aegis, writes .env, runs docker compose up -d, waits for the gateway to become healthy, and prints your dashboard URL + bootstrap API key. Set AEGIS_DIR, AEGIS_BRANCH, or AEGIS_NO_START=1 to customize.

Or do it manually:

```bash
git clone https://github.com/Justin0504/Aegis
cd Aegis
docker compose up -d
```

| Service | URL | What it does |
|---------|-----|--------------|
| **Compliance Cockpit** | [localhost:3000](http://localhost:3000) (Docker) · [localhost:13003](http://localhost:13003) (dev) | Dashboard — traces, policies, approvals, costs |
| **Gateway API** | [localhost:8080](http://localhost:8080) | Policy engine — classifies, checks, blocks |

Then add **one line** to your agent:

```python
import agentguard
agentguard.auto("http://localhost:8080", agent_id="my-agent")

# Your existing code — completely unchanged
import anthropic
client = anthropic.Anthropic()
response = client.messages.create(model="claude-sonnet-4-20250514", tools=[...], messages=[...])
```

For supported Python integrations, importing `agentguard` once is enough to enable auto-instrumentation:

```bash
python -c "import agentguard; agentguard.auto('http://localhost:8080', agent_id='my-agent')"
```

That's it. Every tool call is now classified, policy-checked, and recorded in a tamper-evident audit trail **before** execution.

---

## Recently shipped (last batch)

| Capability | Endpoint / file | What it solves |
|---|---|---|
| **Agent registry + identity** | `POST /api/v1/agents` · [agent-registry.ts](packages/gateway-mcp/src/services/agent-registry.ts) | `agent_id` was a free-form string anyone could pass. Now it's first-class identity with status (active/suspended/deprecated/unregistered), declared tool scope, per-agent budget, optional Ed25519 / shared-secret authentication. |
| **AEGIS Agent Threat Ontology v1** | `GET /api/v1/ontology` · [agent-threats.ts](packages/core-schema/src/ontology/agent-threats.ts) | 10 tactics × 40 techniques (AAT-T*) — a published, versioned taxonomy of agent-specific threats. Coverage at `GET /coverage` shows which nodes this deployment defends against; tenant detectors automatically extend it. |
| **Detector plugin contract** | [`Detector` interface](packages/core-schema/src/detector.ts) | Customer security teams or 3rd parties register a `Detector` against the live registry — same signal type, same decision merger, same audit / sink / transparency-log fan-out as built-ins. |
| **LLM egress proxy** | `/api/v1/llm-proxy/{openai,anthropic}/*` · [proxy/](packages/gateway-mcp/src/proxy/) | Customer changes one env var (`OPENAI_BASE_URL=…aegis…/openai/v1`) — every LLM call now flows through the detector chain, audit, transparency log, and sinks. Works for any language / any closed-source agent platform. |
| **Universal SIEM sinks** | `tenant_config.sinks[]` · [sinks/](packages/gateway-mcp/src/sinks/) | Declarative `http` / `syslog` / `stdout` sinks for Splunk HEC, Datadog Logs, Sumo, QRadar, Graylog — customer integrates by config write, not code release. Bounded DLQ + retry + field-mapping templates. |
| **RFC 6962 transparency log** | `GET /api/v1/transparency-log/proof/:idx` · [transparency-log.ts](packages/gateway-mcp/src/services/transparency-log.ts) | Append-only Merkle tree over audit + evidence-pack events. Signed roots + inclusion proofs let customers verify "this audit row existed at this date" offline — defeats the "you control the key" objection. |
| **Per-framework compliance bundles** | `POST /api/v1/compliance/bundle/:fw` · [compliance-bundle.ts](packages/gateway-mcp/src/services/compliance-bundle.ts) | One POST → signed JSON bundle mapping SOC 2, ISO 27001, NIST AI RMF, EU AI Act controls to live AEGIS evidence. Hands the auditor a verifiable artifact, not screenshots. |
| **Budget guard** | `tenant_config.budget` · [budget-guard.ts](packages/gateway-mcp/src/services/budget-guard.ts) | Daily / monthly / per-agent / per-session USD limits with warn / block actions. Coverage of AAT-T8002. |
| **OTLP trace export** | `tenant_config.observability.otlp` · [otlp-exporter.ts](packages/gateway-mcp/src/services/otlp-exporter.ts) | Per-tenant push to any OTLP/HTTP backend (Datadog, Honeycomb, Grafana Tempo, New Relic). Customers see AEGIS spans alongside their non-LLM infra traces. |
| **Cross-agent + IPI + memory-poison + sensitive-exfil detectors** | [detectors/built-in/](packages/gateway-mcp/src/detectors/built-in/) | Coverage of AAT-T10001 (trust abuse), T1001 (indirect prompt injection), T6001 (memory poisoning), T5001 (sensitive-context exfiltration). |
| **Ed25519-signed release artifacts** | [tools/release-sign/](tools/release-sign/) + [.well-known/aegis-release-pubkey.pem](.well-known/aegis-release-pubkey.pem) | Every npm tarball + PyPI wheel ships with a signature manifest verifiable offline against the AEGIS-pinned public key. Defeats mirror tampering / in-transit forgery. |

Ontology coverage at the time of this batch: **28/40 (70%)** across the 10 tactics. See live status at `GET /api/v1/ontology/coverage` or in the Cockpit's `/coverage` page.

---

## Why AEGIS?

The agent-guardrail category is consolidating around two camps: closed
enterprise platforms (Cisco AI Defense, Palo Alto Prisma AIRS), and
narrow open-source libraries (LlamaFirewall, NeMo, Guardrails AI).
AEGIS is the open-source platform that ships the full vertical —
gateway, cascade, DSL, dashboard, audit trail, approvals — in one repo.

|  | Lakera Guard | NeMo Guardrails | Cisco AI Defense | Guardrails AI | **AEGIS** |
|--|--------------|------------------|------------------|---------------|-----------|
| Open source / self-hostable | paid tier | ✅ | ❌ | ✅ | ✅ |
| Pre-execution blocking | ✅ | ✅ | ✅ | ✅ | ✅ |
| **Agent identity + registration + secret rotation** | ❌ | ❌ | ❌ | ❌ | ✅ |
| **Per-agent declared tool scope enforcement** | ❌ | ❌ | ❌ | ❌ | ✅ |
| **Per-agent / per-tenant budget guard** | ❌ | ❌ | ❌ | ❌ | ✅ |
| **AEGIS Agent Threat Ontology + coverage map** | ❌ | ❌ | ❌ | ❌ | ✅ |
| **Detector plugin contract (3rd-party / customer)** | ❌ | partial | ❌ | partial | ✅ |
| **Per-tenant Policy DSL (fail-safe)** | ❌ | Colang | ❌ | ❌ | ✅ |
| **RFC 6962 transparency log (offline-verifiable)** | ❌ | ❌ | ❌ | ❌ | ✅ |
| **Per-framework signed compliance bundles** | ❌ | ❌ | ❌ | partial | ✅ |
| **Universal SIEM sinks (http / syslog / stdout)** | partial | ❌ | ✅ | ❌ | ✅ |
| **OTLP trace export (Datadog/Honeycomb/Tempo/…)** | ❌ | ❌ | partial | ❌ | ✅ |
| **LLM egress proxy (zero-code, any-language)** | ❌ | ❌ | ✅ | partial | ✅ |
| **Cross-agent compromise correlator** | ❌ | ❌ | ❌ | ❌ | ✅ |
| **Sensitive-context taint tracking (PII → exfil)** | ❌ | ❌ | ❌ | ❌ | ✅ |
| **Memory-poison & indirect-prompt-injection detectors** | partial | partial | partial | ❌ | ✅ |
| **Ed25519-signed release artifacts (npm + PyPI)** | ❌ | ❌ | ❌ | ❌ | ✅ |
| Behavioral anomaly detection (IsolationForest + PPM) | ❌ | ❌ | ❌ | ❌ | ✅ |
| Cost-aware L1→L2→L3 cascade | ❌ | ❌ | partial | ❌ | ✅ |
| Human-in-the-loop approval flow | ❌ | ❌ | ❌ | ❌ | ✅ |
| Multi-framework SDK | API only | NVIDIA-centric | partial | ✅ | 14 frameworks |
| Kill switch + admin audit log (SOC 2 prep) | ❌ | ❌ | ❌ | ❌ | ✅ |

> If your point of comparison is *observability* (LangFuse, Helicone,
> Arize) — those tell you **what happened**. AEGIS **prevents it from
> happening** by sitting on the execution path itself.

---

## How it works

```
  Your agent calls a tool
          │
          ▼  SDK / HTTP Proxy / MCP Proxy intercepts
  ┌────────────────────────────────────────────────┐
  │  AEGIS Gateway                                 │
  │                                                │
  │  ① Classify   (SQL? file? network? shell?)     │
  │  ② Anomaly    (baseline deviation? spike?)     │
  │  ③ Evaluate   AJV policies (injection? exfil?) │
  │  ④ Match DSL  per-tenant rules (fail-safe)     │
  │  ⑤ Decide     strictest(allow / pending / block)│
  └──────────┬─────────────────────────────────────┘
             │
      ┌──────┴──────────────┐
      │                     │
   allow                 pending ──► Human reviews in Cockpit
      │                     │               │
      ▼                     └──── allow ────┘
  Tool executes                        │
      │                             block
      ▼                                │
  Optional signing                    ▼
  SHA-256 hash-chained       AgentGuardBlockedError
  Stored in Cockpit          (agent gets the reason)
```

**Zero-config classification** — works on any tool name, any argument shape:

| Your tool call | AEGIS detects | How |
|----------------|---------------|-----|
| `run_query(sql="SELECT...")` | `database` | SQL keyword in args |
| `my_tool(path="/etc/passwd")` | `file` | Sensitive path pattern |
| `do_thing(url="http://...")` | `network` | URL in args |
| `helper(cmd="rm -rf /")` | `shell` | Command injection signal |
| `custom_fn(prompt="ignore previous...")` | `prompt-injection` | Known attack pattern |
| `exec(cmd="npm publish")` | `supply-chain` | Publish/deploy command |

---

## Key Features

### Pre-Execution Blocking

AEGIS doesn't just log — it **stops dangerous tool calls before they execute**.

```python
agentguard.auto(
    "http://localhost:8080",
    blocking_mode=True,             # pause HIGH/CRITICAL calls for human review
    human_approval_timeout_s=300,   # auto-block after 5 min with no decision
)
```

**SQL injection — blocked instantly**

**High-risk action — awaiting human approval**

The agent pauses. You open the Cockpit, inspect the exact arguments, and click **Allow** or **Block**. The agent resumes in under a second.

```python
from agentguard import AgentGuardBlockedError

try:
    response = client.messages.create(...)
except AgentGuardBlockedError as e:
    print(f"Blocked: {e.tool_name} — {e.reason} ({e.risk_level})")
```

### Policy Engine

Seven AJV policies ship by default. Create more in plain English — the AI
assistant generates the JSON schema for you.

| Policy | Risk | What it catches |
|--------|------|-----------------|
| SQL Injection Prevention | HIGH | `DROP`, `DELETE`, `TRUNCATE` in database tools |
| File Access Control | MEDIUM | Path traversal (`../`), `/etc/`, `/root/` |
| Network Access Control | MEDIUM | HTTP (non-HTTPS) requests |
| Prompt Injection Detection | CRITICAL | "ignore previous instructions" patterns |
| Data Exfiltration Prevention | HIGH | Large payloads to external endpoints |
| Source Map Leak Prevention | HIGH | `npm publish` when `.map` files present |
| Supply Chain Security | HIGH | Package publish, container push, deployment ops |

> *"Block all file deletions outside the /tmp directory"* → Describe button → policy created instantly.

### Per-Tenant Policy DSL

Each tenant gets a YAML/JSON Policy DSL that runs **on top of** the
defaults. The DSL can:

- Route specific tool categories to human review
- Escalate decisions on anomaly score, agent identity, or deployment mode
- Add new block rules for tenant-specific patterns
- Flip ambiguous calls from *allow* → *pending*

**Fail-safe semantics.** A DSL rule can only *tighten* a decision —
`allow` from the DSL can never override an AJV or anomaly `block`. This
is enforced structurally: the final decision is always
`strictest(AJV, anomaly, DSL)`.

```yaml
version: 1
rules:
  - name: escalate-high-anomaly
    when: { anomaly.score: { ">": 0.7 } }
    then: { decision: pending, reason: "anomaly score above 0.7" }

  - name: block-shell-in-financial
    when:
      all:
        - classifier.category: shell
        - tenant.deploymentMode: financial
    then: { decision: block }
```

Edit in the Cockpit Monaco editor (`/dsl`), test with the **Dry Run**
panel, save → live for new tool calls (hot-reload, no restart).

### Deployment Mode

Five ready-made templates — one click to apply on the Settings page or
via `POST /api/v1/config/apply-template`:

| Template | L1 | L2 | L3 | Retention | Best for |
|----------|----|----|----|-----------|----------|
| `dev` | ✅ | ❌ | ❌ | 7 d | Local development, minimal cost |
| `standard` | ✅ | ✅ | escalate | 90 d | Default |
| `strict` | ✅ | ✅ | all | 180 d | High-sensitivity workloads |
| `financial` | ✅ | ✅ | all | 7 yr (SOX) | Banking / fintech |
| `healthcare` | ✅ | ✅ | all | 6 yr (HIPAA) | PHI handling |

Per-tenant config is stored in `organizations.settings`, hot-reloads via
an in-process ConfigBus, and every change is recorded in the admin audit
log.

### Agent Alignment Auditor

For agents whose chain-of-thought you can see (LangChain / ReAct, CrewAI),
AEGIS audits each proposed action against the **declared goal** of the
current run. If the agent silently grew a hidden sub-task (`scope-expansion`)
or its reasoning no longer matches the user's request (`drift`), the verdict
shows up in the Cockpit's Alignment tab *and* feeds straight into the
Policy DSL:

```yaml
rules:
  - name: pause-on-drift
    when:
      any:
        - alignment.score: { "

**Forensic trace detail**

**Policy management**

**Token cost tracking**

**Session gr

…

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Justin0504](https://github.com/Justin0504)
- **Source:** [Justin0504/Aegis](https://github.com/Justin0504/Aegis)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** yes
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: flagged — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-justin0504-aegis
- Seller: https://agentstack.voostack.com/s/justin0504
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.