AEGIS: agent security gateway
AEGIS
A policy gateway for AI agents: it checks tool calls before they run, holds risky ones for approval and writes an audit trail
- 523 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- The gateway sees the arguments of every agent call, including passwords and personal data
- Blocking mode can stop the agent until a person approves
- The install script is downloaded from the network and starts containers
Install
- Works in
Manual install
curl -fsSL https://aegistraces.com/install | shDownloads and installs a binary to /usr/local/bin: read the script first. Other routes: docker compose up -d from the cloned repository, or pip install agentguard-aegis for the agent side.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The gateway sees the arguments of every agent call, including passwords and personal data
- Blocking mode can stop the agent until a person approves
- The install script is downloaded from the network and starts containers
This is third-party code. Review the repository files before installing.
What it does
AEGIS sits between an agent and its tools and checks every call before it runs. The gateway classifies a call (database, file, network, shell, prompt injection, supply chain), matches it against policies and detectors and decides: allow, hold for human approval or block. Every allowed call lands in a log with a hash chain and a signature. Setup is built for minimal changes. For Python, `agentguard.auto(...)` at the start of the program is enough, and for Claude Code there is `agentguard claude-code setup --blocking`: Read, Write, Bash and Edit calls are checked and recorded, and dangerous ones wait for approval in the Compliance Cockpit. Any MCP server can be wrapped in the `agentguard mcp-proxy` proxy, which checks calls and pins tool descriptions so that a changed description after approval does not pass unnoticed (OWASP MCP03). A separate MCP server answers Claude's questions about the log, violations and policies. The cockpit shows an activity overview, approvals, violations and coverage across ten attack types. There is an agent registry with tool limits, a budget guard, SIEM export and an emergency agent shutdown.
Who it is for. Security teams and agent developers who run Claude Code or their own agents with access to databases, files and the network and want dangerous calls blocked.
Good fit when
- An agent with shell access needs a log and blocking of dangerous commands before they run
- Every Claude Code call (Read, Write, Bash, Edit) must be checked, with dangerous ones waiting for human approval
- A third-party MCP server is attached so that a tool description changed after approval is noticed
- An audit needs a signed log with proof it was not altered
- Agent spending must be capped per day and per session
Not a fit when
- You need protection from dangerous shell commands in a single agent: a local hook like destructive-command-guard is simpler
- You need protection with no misses: the author names attack classes detection cannot see
- The agent must run fully autonomously with no pauses: checks and approvals slow it down
- You only need static analysis of agent code: agent-audit in the catalog does that
Example request
Connect AEGIS to Claude Code in blocking mode and show which calls will need my approval in the cockpitLimitations
The author states the price of protection: on AgentDojo clean-task utility fell from 69.1% to 38.1% with no reviewer and to 56.7% with an auditor, and some harmless two-step calls are held for approval. It misses attacks that stay inside the requested tool and change nothing a value check can see, and cases where the user delegates a task to a document. The gateway needs Docker or your own Node run, the cockpit and an API key; Windows is supported through WSL2. Commercial terms are in `COMMERCIAL.md`.
How to disable. Undo the changes made by `agentguard claude-code setup` in Claude Code's settings (look in `~/.claude/settings.json`) and restart it. In the MCP configuration restore the original command in place of the proxy and stop the gateway with `docker compose down` in the `aegis` folder.
FAQ
How do I connect AEGIS to Claude Code?
Install the package with `pip install agentguard-aegis`, configure the gateway with `agentguard configure --url <address> --bootstrap` and run `agentguard claude-code setup --blocking`. After a restart Read, Write, Bash and Edit calls are checked and high and critical risk calls wait for approval in the cockpit.
What is MCP tool pinning?
The proxy remembers each tool's name, description and schema at first sight. If the server later changes the description or it reads like an injected instruction, the call is stopped. Pinning needs an `AEGIS_API_KEY`.
How much latency does a check add?
The author measured a 0.44 ms median per call and 2,300–3,000 checks a second per gateway process. With 128 concurrent clients p99 was 84–93 ms.
What happens to a blocked call?
The agent gets a refusal with the reason in the conversation and the tool never runs. A call that needs a person pauses the agent until a decision in the cockpit.
Where do the logs go?
To the gateway log with a hash chain and an RFC 6962 Merkle tree. They can be sent to Splunk, Datadog, Sumo, QRadar and Graylog, and traces exported to OTLP backends.
Discussion
No questions or reviews yet.
Related
CLI toolsAgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
A CLI that scans your machine for skills and MCP configs, finds poisoned tool descriptions and runs a system prompt through 225 attacks
A local security gateway for Claude Code and Codex: checks tool calls against a policy, catches secrets and keeps an audit trail
An AI security verification CLI: scans models and code, probes live endpoints and MCP servers, and analyzes recorded agent runs
HOL Guard checks an AI agent's shell commands, secret reads, MCP calls and package installs before they run and holds risky actions until you decide
A CLI with policies that intercepts dangerous AI agent commands like rm -rf, force push or reading .env before they run
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| AEGIS: agent security gateway (this card) | no | 523 | |
| Agent Audit | no | 244 | a static scanner of agent code, while AEGIS sits on the call path at run time |
| MCP Audit | no | 165 | a scanner of MCP configs for leaks and risky access |
| Destructive Command Guard | no | 6,259 | a command-check hook for one agent, without an approval cockpit or a signed log |
README in short
The description opens with installer links and a one-line launch, then shows three scenarios (allowed, blocked, held), seven cockpit views, deployment, measurements with their cost and a comparison with other guardrails.