Justin0504/Aegis

What is AEGIS?

AEGIS is an open-source security firewall for AI agents — the software layer that sits between an AI agent (like a Claude-powered assistant) and the tools it can call (databases, file systems, shell commands, network requests).

The problem it solves: AI agents are given the power to execute real actions — running SQL queries, deleting files, sending network requests — based on what a model decides to do. If the model is tricked (via prompt injection), hallucinates a tool name, or misinterprets a request, it can cause real damage (dropping database tables, exfiltrating data, deleting files) with no human in the loop. AEGIS intercepts every tool call before it executes, classifies what kind of action it is, checks it against security policies, and either allows it, blocks it, or pauses it for human approval.

Key components

• Gateway API — the policy engine that classifies and checks every tool call through a 5-stage pipeline (classify → anomaly detection → policy evaluation → DSL rule matching → decision).
• Compliance Cockpit — a web dashboard showing real-time agent activity, blocked violations, threat coverage, and an approval queue for human-in-the-loop decisions.
• SDK instrumentation — one line of code (import agentguard; agentguard.auto(...)) wraps your existing agent code so all tool calls route through the gateway, with no changes to your agent logic.
• Policy engine — seven built-in policies (SQL injection prevention, file access control, prompt injection detection, data exfiltration prevention, etc.) plus a per-tenant policy DSL for custom rules.
• Agent registry — tracks agent identity, declared tool scope, budgets, and status (active/suspended/deprecated).
• Transparency log — an RFC 6962 Merkle-tree audit trail so security teams can cryptographically verify audit records offline.
• Threat ontology — a published taxonomy of 40 agent-specific attack techniques (MITRE-ATLAS style) with live coverage tracking (currently 28/40 = 70%).

How it works

When an agent calls a tool, the call goes to the AEGIS gateway first. The gateway classifies the call type (database, file, shell, network, etc.), checks for anomalies against the agent's history, evaluates policies, and decides: allow (tool executes, call is logged), pending (human reviews in the dashboard), or block (tool never runs, agent gets an error with the reason).

Deployment

One-command install via curl script, Docker Compose, or one-click deploy to Render/Railway/DigitalOcean. Works with Python, TypeScript, and Go agent SDKs, and includes an LLM egress proxy so even closed-source agent platforms can route their LLM calls through the detector chain.

Notable differentiators vs. alternatives

Unlike closed enterprise platforms (Cisco AI Defense, Palo Alto Prisma AIRS) or narrow guardrail libraries (LlamaFirewall, Guardrails AI), AEGIS ships the full vertical stack — gateway, policy DSL, dashboard, audit trail, human approval flow, and agent identity management — all open source and self-hostable. It also supports reversible actions (compensator + saga pattern) and cross-agent compromise correlation, which competitors lack.