Aegis

Aegis

[CI] [npm version] [Docker] [License]

Stop putting API keys where AI agents can read them.

Aegis is a local-first credential isolation proxy for AI agents. It sits between your agent and the APIs it calls — injecting secrets at the network boundary so the agent never sees, stores, or transmits real credentials.

[Aegis demo]

How It Works

[How Aegis works — agent sends request through Gate, credentials injected at the network boundary]

Why?

AI agents (Claude, GPT, Cursor, custom bots) increasingly call real APIs — Slack, GitHub, Stripe, databases. The current pattern is dangerous:

1. Agents see raw API keys — one prompt injection exfiltrates them
2. No domain guard — a compromised agent can send your Slack token to evil.com
3. No audit trail — you can't see what an agent did with your credentials
4. No access control — every agent can use every credential

Aegis solves all four. Your agent makes HTTP calls through a local proxy. Aegis handles authentication, enforces domain restrictions, and logs everything.

Quick Start

# Installnpm install -g @getaegis/cli
# Initialize (stores master key in OS keychain by default)aegis init
# Add a credentialaegis vault add \  --name slack-bot \  --service slack \  --secret "xoxb-your-token-here" \  --domains slack.com
# Start the proxyaegis gate --no-agent-auth
# Test it — Aegis injects the token, forwards to Slack, logs the request# X-Target-Host tells Gate which upstream server to forward to (optional if credential has one domain)curl http://localhost:3100/slack/api/auth.test \  -H "X-Target-Host: slack.com"

Production Setup (with agent auth)

# Create an agent identityaegis agent add --name "my-agent"# Save the printed token — it's shown once only
# Grant it access to specific credentialsaegis agent grant --agent "my-agent" --credential "slack-bot"
# Start Gate (agent auth is on by default)aegis gate
# Agent must include its tokencurl http://localhost:3100/slack/api/auth.test \  -H "X-Target-Host: slack.com" \  -H "X-Aegis-Agent: aegis_a1b2c3d4..."

MCP Integration

Aegis is a first-class MCP server. Any MCP-compatible AI agent can use it natively — no HTTP calls needed.

Before (plaintext key in config):

{  "mcpServers": {    "slack": {      "command": "node",      "args": ["slack-mcp-server"],      "env": { "SLACK_TOKEN": "xoxb-1234-real-token-here" }    }  }}

After (Aegis — no key visible):

{  "mcpServers": {    "aegis": {      "command": "npx",      "args": ["-y", "@getaegis/cli", "mcp", "serve"]    }  }}

Generate the config for your AI host:

aegis mcp config claude   # Claude Desktopaegis mcp config cursor   # Cursoraegis mcp config vscode   # VS Codeaegis mcp config cline    # Clineaegis mcp config windsurf # Windsurf

The MCP server exposes three tools:

The MCP server replicates the full Gate security pipeline: domain guard, agent auth, body inspection, rate limiting, audit logging.

Setup Guides

• Claude Desktop
• Cursor
• VS Code
• Windsurf
• Cline
• OpenClaw — personal AI assistant (HTTP proxy + skill)

Features

Example Integrations

Step-by-step guides with config files and policies included:

• Slack Bot — Protect your Slack bot token with domain-restricted proxy access
• GitHub Integration — Secure GitHub PAT with per-agent grants and read-only policies
• Stripe Backend — Isolate Stripe API keys with body inspection and rate limiting
• OpenClaw Skill — Aegis skill for OpenClaw personal AI assistant

Security

• Published STRIDE threat model — 28 threats analysed, 0 critical/high unmitigated findings
• Full security architecture documentation (trust boundaries, crypto pipeline, data flow)
• AES-256-GCM + ChaCha20-Poly1305 encryption at rest
• Domain guard enforced on every request — no bypass
• Agent tokens stored as SHA-256 hashes — cannot be recovered, only regenerated
• Request body inspection for credential pattern detection
• Open source (Apache 2.0) — read the code

How Aegis Compares

See full comparison for detailed breakdowns against each approach.

Documentation

Install

# npmnpm install -g @getaegis/cli
# Homebrewbrew tap getaegis/aegis && brew install aegis
# Dockerdocker run ghcr.io/getaegis/aegis --help

Requires Node.js ≥ 20 — check with node -v

Development

git clone https://github.com/getaegis/aegis.gitcd aegisyarn installyarn buildyarn test

See CONTRIBUTING.md for code style, PR process, and architecture overview.

License

Apache 2.0