# AegisAgent

> Zero-trust API firewall and security integrity layer for autonomous AI agents & Model Context Protocol (MCP) tool execution. Secure, TOCTOU-proof, fail-closed.

- **Type:** MCP server
- **Install:** `agentstack add mcp-lavkushry-aegisagent`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [lavkushry](https://agentstack.voostack.com/s/lavkushry)
- **Installs:** 0
- **Category:** [Integrations](https://agentstack.voostack.com/c/integrations)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [lavkushry](https://github.com/lavkushry)
- **Source:** https://github.com/lavkushry/AegisAgent
- **Website:** https://lavkushry.github.io/AegisAgent/

## Install

```sh
agentstack add mcp-lavkushry-aegisagent
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

AegisAgent
  Bare-metal integrity, guardrails, SIEM, and SOC for autonomous AI agents.

[](https://github.com/lavkushry/AegisAgent/actions/workflows/ci.yml)
[](https://github.com/lavkushry/AegisAgent/actions/workflows/sast.yml)
[](LICENSE)
[](Cargo.toml)

AegisAgent is not another prompt wrapper or generic API proxy. It is the enforcement and evidence layer between autonomous agents and consequential tools: cloud APIs, code repositories, MCP servers, databases, filesystems, networks, and credentials.

The current system already binds approval to the exact canonical action, gates on deterministic source provenance with Cedar, fails closed in Python/TypeScript/Go SDKs, and emits hash-chained receipts. The target data plane replaces JSON-heavy, row-oriented telemetry processing with pinned Rust reactors, bounded SPSC rings, Hybrid Columnar Merge Trees, compiled guardrails, kernel containment, and an Arrow/WASM/WebGL console.

> **Performance status:** `=1,000,000 events/s/node` telemetry ingestion, ` Gateway[gRPC + REST compatibility]
    Gateway --> Reactor[Pinned CoreReactor]
    Reactor --> Cedar[Cedar + immutable tenant snapshot]
    Cedar -->|protected action| Control[(Transactional ControlStore + receipt)]
    Cedar -->|telemetry descriptor| Ring[SPSC event fabric]
    Ring --> HCMT[(Arrow HCMT)]
    Ring --> Guard[Aho DFA + HNSW/PQ + INT8 ONNX]
    Guard --> Contain[Signed containment / eBPF]
    HCMT --> Query[Vectorized query reactors]
    Query --> UI[Arrow stream → WASM → WebGL2]
```

The architecture separates two correctness domains:

- **Control state:** agents, policies, approvals, replay claims, bans, commands, receipt heads, and protected decisions remain transactional.
- **Event state:** runtime telemetry, SOC projections, time-series data, guardrail candidates, and analytical indexes move to HCMT.

This split is deliberate. A columnar merge tree is excellent for append and scan; it is not a license to weaken atomic approval consumption or receipt durability.

Read the canonical [HLD](ARCHITECTURE.md), [LLD](docs/LLD.md), and [repository-backed migration matrix](MIGRATION_MATRIX.md).

## Performance design

The target node eliminates avoidable coordination in the telemetry path:

- one pinned thread owns each hot reactor; no work-stealing migration;
- one producer and one consumer own each cache-padded ring;
- FlatBuffers are verified and viewed in place inside the reactor arena;
- memtables append into structure-of-arrays buffers and seal into Arrow-compatible segments;
- Gorilla timestamp blocks, zone maps, Bloom filters, and Roaring bitmaps prune before decode;
- Aho-Corasick scans text in `O(n + z)` regardless of pattern count after compilation;
- React owns controls, WASM owns Arrow transforms, and WebGL2 instancing owns points.

On a 32-core 3.2 GHz qualification profile at 70% CPU utilization, one million events/s permits 71,680 cycles/event. At 256 bytes/event, payload bandwidth is about 2.05 Gbit/s before framing/TLS. These budgets are feasible hypotheses; the project accepts them only after 30-minute compaction-active, loss-checked benchmarks with raw HDR histograms.

Authorization compute and protected commit are measured separately. A warm deterministic decision targets `<1 ms p99`; a mutating allow still waits for the configured durable control/receipt commit even when storage takes longer.

## Repository status

| Capability | Current | Target migration |
|---|---|---|
| Authorization | Thin REST/gRPC → `aegis-decision` pipeline (`DecisionRuntime` ports) + Cedar + SQLx | typed service on pinned decision reactors |
| APIs | REST JSON plus partial tonic/protobuf | protobuf-first parity; binary fast path; REST compatibility off benchmark path |
| Control storage | SQLite/PostgreSQL via `StorageBackend` | split transactional `ControlStore`/`ReceiptLog` |
| Telemetry storage | row tables and JSON/TEXT fields | WAL + Arrow-compatible HCMT SSTables |
| Event bus | Tokio bounded MPSC; `current`, unwired `aegis-event` SPSC, safe sealed-page, append-only published-prefix, and failure-atomic single-page volatile admission prototypes with cancelable permits, commit-delayed claims, and explicit clean/faulted termination; no protected evidence or performance claim | `target` NUMA-local SPSC/slab matrix after formal ADR/security review, hosted sanitizer and UBSan evidence, authenticated registry, bounded rotation, WAL durability/replay, epochs/NUMA reclamation, shadow, rollback, and qualification gates |
| Detection | structured scalar rules; optional Qdrant | Aho DFA plus owned HNSW/PQ and isolated INT8 ONNX |
| Host sensor | procfs polling, spool, signed commands | CO-RE eBPF telemetry/containment with truthful fallback |
| Console | React JSON polling and SVG | Arrow IPC worker, Rust WASM, WebGL2 instancing |

The event prototypes are `current` only as isolated, unwired code. The
production fabric remains `target`, neither `shadow` nor `qualified`, carries
no protected evidence, and has no performance claim. No target row in this
table is a shipped claim until its roadmap gate passes.

## Quick start

### Docker Compose

```bash
git clone https://github.com/lavkushry/AegisAgent.git
cd AegisAgent
docker compose up --build -d
```

The development gateway binds to loopback by default and serves REST on `8080` and gRPC on `6334`.

### Build from source

```bash
cargo build --workspace --release
cargo test --workspace -- --test-threads=1
```

Rust `1.88` or newer and `protoc` are required by the current workspace.

### Run the integrity demo

```bash
make doctor
make demo
```

The demo proves that an untrusted mutating action is denied, a swapped post-approval payload fails its `action_hash`, replay is rejected, and the receipt range verifies.

### Python SDK

```bash
python3 -m venv .venv
. .venv/bin/activate
python -m pip install -e "sdk-python[dev]"
python examples/integrity_demo.py
```

SDK implementations:

- [Python](sdk-python/) — async client, decorators, evidence and verification tools;
- [TypeScript](sdk-typescript/) — typed fail-closed wrapper and canonical corpus;
- [Go](sdk-go/) — context-aware client, approval consume, receipt verification.

Every SDK reproduces `aegis-jcs-1` bytes and refuses execution on hash mismatch, expiry, replay, unknown decision, or required-gateway failure.

## Development gates

```bash
cargo fmt --all -- --check
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace -- --test-threads=1
python -m unittest discover -s sdk-python/tests
(cd sdk-typescript && npm test)
(cd sdk-go && go test ./...)
node scripts/validate-docs.mjs
```

Core data-plane changes additionally require ADR review, corpus/differential tests, Loom/Miri/sanitizer coverage for unsafe concurrency, and reproducible p99/allocation/copy/cache-miss evidence. See [CONTRIBUTING.md](CONTRIBUTING.md).

## Documentation

- [High-Level Architecture](ARCHITECTURE.md)
- [Low-Level Design](docs/LLD.md)
- [Migration Matrix](MIGRATION_MATRIX.md)
- [36-Week Roadmap](ROADMAP.md)
- [Action Receipt Specification](docs/action-receipt-spec.md)
- [Security Model](docs/security-model.md)
- [Measured Performance Baseline](docs/performance-baseline.md)
- [Implementation Status](docs/Implementation_Status.md)

## Security

Do not file public issues for vulnerabilities. Follow [SECURITY.md](SECURITY.md) for private disclosure. Never include credentials, raw secrets, unrestricted prompts, production data, or private keys in an issue, benchmark artifact, trace, receipt, or test fixture.

## License

AegisAgent is licensed under the [MIT License](LICENSE).

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [lavkushry](https://github.com/lavkushry)
- **Source:** [lavkushry/AegisAgent](https://github.com/lavkushry/AegisAgent)
- **License:** MIT
- **Homepage:** https://lavkushry.github.io/AegisAgent/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-lavkushry-aegisagent
- Seller: https://agentstack.voostack.com/s/lavkushry
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.