Skip to main content
Glama
getaegis
by getaegis

Aegis

CI npm version Docker License

Stop putting API keys where AI agents can read them.

Aegis is a local-first credential isolation proxy for AI agents. It sits between your agent and the APIs it calls — injecting secrets at the network boundary so the agent never sees, stores, or transmits real credentials.

How It Works

Related MCP server: agent-sudo-mcp

Why?

AI agents (Claude, GPT, Cursor, custom bots) increasingly call real APIs — Slack, GitHub, Stripe, databases. The current pattern is dangerous:

  1. Agents see raw API keys — one prompt injection exfiltrates them

  2. No domain guard — a compromised agent can send your Slack token to evil.com

  3. No audit trail — you can't see what an agent did with your credentials

  4. No access control — every agent can use every credential

Aegis solves all four. Your agent makes HTTP calls through a local proxy. Aegis handles authentication, enforces domain restrictions, and logs everything.

Quick Start

# Install
npm install -g @getaegis/cli

# Initialize (stores master key in OS keychain by default)
aegis init

# Add a credential
aegis vault add \
  --name slack-bot \
  --service slack \
  --secret "xoxb-your-token-here" \
  --domains slack.com

# Start the proxy
aegis gate --no-agent-auth

# Test it — Aegis injects the token, forwards to Slack, logs the request
# X-Target-Host tells Gate which upstream server to forward to (optional if credential has one domain)
curl http://localhost:3100/slack/api/auth.test \
  -H "X-Target-Host: slack.com"

Production Setup (with agent auth)

# Create an agent identity
aegis agent add --name "my-agent"
# Save the printed token — it's shown once only

# Grant it access to specific credentials
aegis agent grant --agent "my-agent" --credential "slack-bot"

# Start Gate (agent auth is on by default)
aegis gate

# Agent must include its token
curl http://localhost:3100/slack/api/auth.test \
  -H "X-Target-Host: slack.com" \
  -H "X-Aegis-Agent: aegis_a1b2c3d4..."

MCP Integration

Aegis is a first-class MCP server. Any MCP-compatible AI agent can use it natively — no HTTP calls needed.

Before (plaintext key in config):

{
  "mcpServers": {
    "slack": {
      "command": "node",
      "args": ["slack-mcp-server"],
      "env": { "SLACK_TOKEN": "xoxb-1234-real-token-here" }
    }
  }
}

After (Aegis — no key visible):

{
  "mcpServers": {
    "aegis": {
      "command": "npx",
      "args": ["-y", "@getaegis/cli", "mcp", "serve"]
    }
  }
}

Generate the config for your AI host:

aegis mcp config claude   # Claude Desktop
aegis mcp config cursor   # Cursor
aegis mcp config vscode   # VS Code
aegis mcp config cline    # Cline
aegis mcp config windsurf # Windsurf

The MCP server exposes three tools:

Tool

Description

aegis_proxy_request

Make an authenticated API call (provide service + path, Aegis injects credentials)

aegis_list_services

List available services (names only, never secrets)

aegis_health

Check Aegis status

The MCP server replicates the full Gate security pipeline: domain guard, agent auth, body inspection, rate limiting, audit logging.

Setup Guides

Features

Feature

Description

Encrypted Vault

AES-256-GCM encrypted credential storage with PBKDF2 key derivation

HTTP Proxy (Gate)

Transparent credential injection — agent hits localhost:3100/{service}/path

Domain Guard

Every outbound request checked against credential allowlists. No bypass

Audit Ledger

Every request (allowed and blocked) logged with full context

Agent Identity

Per-agent tokens, credential scoping, and rate limits

Policy Engine

Declarative YAML policies — method, path, rate-limit, time-of-day restrictions

Body Inspector

Outbound request bodies scanned for credential-like patterns

MCP Server

Native Model Context Protocol for Claude, Cursor, VS Code, Windsurf, Cline

Web Dashboard

Real-time monitoring UI with WebSocket live feed

Prometheus Metrics

/_aegis/metrics endpoint for Grafana dashboards

Webhook Alerts

HMAC-signed notifications for blocked requests, expiring credentials

RBAC

Admin, operator, viewer roles with 16 granular permissions

Multi-Vault

Separate vaults for dev/staging/prod with isolated encryption keys

Shamir's Secret Sharing

M-of-N key splitting for team master key management

Cross-Platform Key Storage

OS keychain by default (macOS, Windows, Linux) with file fallback

TLS Support

Optional HTTPS on Gate with cert/key configuration

Configuration File

aegis.config.yaml with env var overrides and CLI flag overrides

Example Integrations

Step-by-step guides with config files and policies included:

  • Slack Bot — Protect your Slack bot token with domain-restricted proxy access

  • GitHub Integration — Secure GitHub PAT with per-agent grants and read-only policies

  • Stripe Backend — Isolate Stripe API keys with body inspection and rate limiting

  • OpenClaw Skill — Aegis skill for OpenClaw personal AI assistant

Security

  • Published STRIDE threat model — 28 threats analysed, 0 critical/high unmitigated findings

  • Full security architecture documentation (trust boundaries, crypto pipeline, data flow)

  • AES-256-GCM + ChaCha20-Poly1305 encryption at rest

  • Domain guard enforced on every request — no bypass

  • Agent tokens stored as SHA-256 hashes — cannot be recovered, only regenerated

  • Request body inspection for credential pattern detection

  • Open source (Apache 2.0) — read the code

How Aegis Compares

.env files

Vault/Doppler

Infisical

Aegis

Agent sees raw key

Yes

Yes (after fetch)

Yes (after fetch)

No — never

Domain restrictions

No

No

No

Yes

MCP-native

No

No

Adding

Yes

Local-first

Yes

No

No

Yes

Setup

10 sec

30+ min

15+ min

~2 min

See full comparison for detailed breakdowns against each approach.

Documentation

Document

Description

Usage Guide

Full reference: CLI commands, configuration, RBAC, policies, webhooks, troubleshooting

Security Architecture

Trust boundaries, crypto pipeline, data flow diagrams

Threat Model

STRIDE analysis — 28 threats, mitigations, residual risks

Comparison

Detailed comparison with .env, Vault, Doppler, Infisical

FAQ

Common questions and objections

Roadmap

Feature roadmap

Contributing

Code style, PR process, architecture overview

Install

# npm
npm install -g @getaegis/cli

# Homebrew
brew tap getaegis/aegis && brew install aegis

# Docker
docker run ghcr.io/getaegis/aegis --help

Requires Node.js ≥ 20 — check with node -v

Development

git clone https://github.com/getaegis/aegis.git
cd aegis
yarn install
yarn build
yarn test

See CONTRIBUTING.md for code style, PR process, and architecture overview.

License

Apache 2.0

Available Tools

3 tools
aegis_healthAegis Health CheckB

Check the health status of Aegis, including credential and agent counts.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions what is checked ('credential and agent counts') but lacks details on permissions, rate limits, response format, or whether this is a read-only operation. For a health check tool with zero annotation coverage, this leaves significant gaps in understanding how it behaves.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that front-loads the core purpose ('Check the health status of Aegis') and adds specific details ('including credential and agent counts') without waste. Every word earns its place, making it highly concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's low complexity (0 parameters, no output schema) and lack of annotations, the description is adequate but has clear gaps. It covers the purpose and scope but misses behavioral aspects like response format or usage context. Without annotations or output schema, more detail on what the health check returns would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has 0 parameters, and schema description coverage is 100%, so there are no parameters to document. The description doesn't need to add parameter semantics beyond what the schema provides. A baseline of 4 is appropriate as it avoids redundancy while being complete for a parameterless tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with a specific verb ('Check') and resource ('health status of Aegis'), including what aspects are covered ('credential and agent counts'). It distinguishes itself from siblings like 'aegis_list_services' and 'aegis_proxy_request' by focusing on health monitoring rather than listing or proxying. However, it doesn't explicitly contrast with siblings beyond the implied scope difference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites, frequency, or scenarios where health checks are appropriate compared to 'aegis_list_services' (which might list services without health details) or 'aegis_proxy_request' (which might involve active requests). Usage is implied by the purpose but not explicitly stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

aegis_list_servicesAegis List ServicesA

List all available services registered in Aegis. Returns service names, auth types, and allowed domains — never secrets.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes the tool's behavior: it's a read-only operation (implied by 'List'), returns specific non-sensitive data, and explicitly states what is never returned (secrets). It could improve by mentioning potential limitations like rate limits or authentication requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is perfectly concise with two clear sentences: one stating the action and resource, another detailing the return values and important exclusion. Every word earns its place with zero wasted text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter read tool with no output schema, the description provides good context about what data is returned and what isn't. It could be more complete by describing the return format (e.g., list structure) or any behavioral constraints, but it adequately covers the essential information given the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has 0 parameters with 100% schema description coverage, so the schema already fully documents the lack of inputs. The description appropriately doesn't add parameter information, maintaining focus on the tool's purpose and output behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('List all available services') and resource ('services registered in Aegis'), distinguishing it from siblings like health checks or proxy requests. It specifies what information is returned (service names, auth types, allowed domains) and explicitly excludes secrets.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context by stating it returns service metadata, suggesting it's for discovery or auditing purposes. However, it doesn't explicitly state when to use this tool versus alternatives or provide any exclusion criteria, leaving some guidance gaps.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

aegis_proxy_requestAegis Proxy RequestB

Make an authenticated API call through Aegis. Credentials are injected automatically — you never see them. Provide the service name and API path; Aegis handles authentication.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyNoRequest body (for POST/PUT/PATCH)
pathYesThe API path to call (e.g. "/v1/chat/completions")
methodNoHTTP method (default: GET)GET
headersNoAdditional request headers (auth headers are injected automatically)
serviceYesThe service name (must match a registered credential in Aegis)
targetHostNoOverride the target domain (must be in the credential's allowlist). Defaults to the credential's primary domain.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It adds useful context: authentication is handled automatically, credentials are not visible, and it specifies the required inputs (service name and API path). However, it lacks details on error handling, rate limits, response formats, or other behavioral traits like whether it's idempotent or has side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded, with two sentences that directly state the tool's function and key behavior. Every sentence adds value: the first defines the purpose, and the second clarifies authentication handling. There is no wasted text, though it could be slightly more structured for clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (6 parameters, no annotations, no output schema), the description is moderately complete. It covers the core purpose and authentication mechanism but lacks details on response handling, error scenarios, or advanced usage. Without annotations or output schema, the agent must rely on the schema for parameter details, leaving gaps in behavioral understanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters thoroughly. The description adds minimal semantic value beyond the schema, only mentioning that credentials are injected and specifying the required inputs. It does not elaborate on parameter interactions or usage nuances, meeting the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Make an authenticated API call through Aegis.' It specifies the verb ('Make'), resource ('API call'), and mechanism ('through Aegis'), but does not explicitly differentiate it from its siblings (aegis_health and aegis_list_services), which likely serve different purposes like health checks or listing services.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context by mentioning 'authenticated API call' and 'credentials are injected automatically,' suggesting it's for making requests to services registered with Aegis. However, it does not provide explicit guidance on when to use this tool versus its siblings or other alternatives, leaving the agent to infer based on the tool names and descriptions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 3 tool updatesv1.0.0
    • First observedaegis_health
    • First observedaegis_list_services
    • First observedaegis_proxy_request

TDQS

A3.6/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose: health monitoring, service listing, and proxying requests. There is no overlap in functionality, and an agent can easily differentiate between them based on their specific roles.

Naming Consistency5/5

All tool names follow a consistent 'aegis_' prefix with descriptive snake_case suffixes (health, list_services, proxy_request). This pattern is uniform across all tools, making them predictable and easy to understand.

Tool Count3/5

With only 3 tools, the server feels minimal for a service management system like Aegis. While the tools cover basic operations, the scope might be too thin, potentially lacking advanced management features like service registration or configuration updates.

Completeness3/5

The tools provide core functionality for health checks, service listing, and proxying requests, but there are notable gaps. For example, there are no tools for managing services (e.g., adding or removing services) or handling authentication configurations, which could limit agent workflows in a service management context.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    Self-hosted credential store and API proxy for AI agents. One Bearer token, all your services. Handles OAuth refresh, encrypted storage, audit logging, and per-agent permissioning.
    71
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    Local zero-trust permission gateway for AI agents. Enforces policy-based tool authorization, human approvals, scoped permissions, and cryptographically verifiable audit logs.
    4
    5
    Apache 2.0
  • A
    license
    Not graded
    quality
    D
    maintenance
    Zero-knowledge credential injection for AI agents. Your agent authenticates to websites and APIs without ever seeing a password, TOTP code, or API key.
    6
    1
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI agents to securely access authenticated services (HTTP, SSH, SMTP) without exposing secrets, by acting as a server-side proxy that injects authentication.
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/getaegis/aegis'

If you have feedback or need assistance with the MCP directory API, please join our Discord server