Aegis
Aegis is a local-first credential isolation proxy that allows AI agents to make authenticated API calls without ever seeing, storing, or transmitting real credentials. It injects secrets at the network boundary and enforces security policies.
Make authenticated API calls (
aegis_proxy_request): Send HTTP requests (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS) to registered services (e.g., Slack, GitHub, Stripe) by specifying a service name and API path — Aegis automatically injects credentials without exposing them. Supports custom headers, request bodies, and optional host overrides (within the credential's allowed domain list).List available services (
aegis_list_services): Retrieve all registered services, including their names, authentication types, and allowed domains — without revealing actual secrets.Check server health (
aegis_health): Verify the proxy is running and healthy, including counts of registered credentials and agents.Enforce security policies: Domain restrictions prevent unauthorized data exfiltration, and body inspection blocks credential patterns from leaking through requests.
Maintain audit trails: All requests — both allowed and blocked — are logged with full context for security monitoring.
Integrate natively with MCP-compatible AI agents like Claude, Cursor, VS Code, Windsurf, and Cline.
Enables AI agents to make authenticated calls to GitHub APIs via a local proxy that handles credential injection and enforces domain-restricted access policies.
Provides a secure proxy for AI agents to interact with Slack APIs, injecting bot tokens at the network boundary to ensure agents never see the raw credentials.
Facilitates secure interaction with Stripe APIs by injecting API keys at the proxy level, allowing AI agents to perform operations while maintaining credential isolation.
Aegis
Stop putting API keys where AI agents can read them.
Aegis is a local-first credential isolation proxy for AI agents. It sits between your agent and the APIs it calls — injecting secrets at the network boundary so the agent never sees, stores, or transmits real credentials.
How It Works
Related MCP server: agent-sudo-mcp
Why?
AI agents (Claude, GPT, Cursor, custom bots) increasingly call real APIs — Slack, GitHub, Stripe, databases. The current pattern is dangerous:
Agents see raw API keys — one prompt injection exfiltrates them
No domain guard — a compromised agent can send your Slack token to
evil.comNo audit trail — you can't see what an agent did with your credentials
No access control — every agent can use every credential
Aegis solves all four. Your agent makes HTTP calls through a local proxy. Aegis handles authentication, enforces domain restrictions, and logs everything.
Quick Start
# Install
npm install -g @getaegis/cli
# Initialize (stores master key in OS keychain by default)
aegis init
# Add a credential
aegis vault add \
--name slack-bot \
--service slack \
--secret "xoxb-your-token-here" \
--domains slack.com
# Start the proxy
aegis gate --no-agent-auth
# Test it — Aegis injects the token, forwards to Slack, logs the request
# X-Target-Host tells Gate which upstream server to forward to (optional if credential has one domain)
curl http://localhost:3100/slack/api/auth.test \
-H "X-Target-Host: slack.com"Production Setup (with agent auth)
# Create an agent identity
aegis agent add --name "my-agent"
# Save the printed token — it's shown once only
# Grant it access to specific credentials
aegis agent grant --agent "my-agent" --credential "slack-bot"
# Start Gate (agent auth is on by default)
aegis gate
# Agent must include its token
curl http://localhost:3100/slack/api/auth.test \
-H "X-Target-Host: slack.com" \
-H "X-Aegis-Agent: aegis_a1b2c3d4..."MCP Integration
Aegis is a first-class MCP server. Any MCP-compatible AI agent can use it natively — no HTTP calls needed.
Before (plaintext key in config):
{
"mcpServers": {
"slack": {
"command": "node",
"args": ["slack-mcp-server"],
"env": { "SLACK_TOKEN": "xoxb-1234-real-token-here" }
}
}
}After (Aegis — no key visible):
{
"mcpServers": {
"aegis": {
"command": "npx",
"args": ["-y", "@getaegis/cli", "mcp", "serve"]
}
}
}Generate the config for your AI host:
aegis mcp config claude # Claude Desktop
aegis mcp config cursor # Cursor
aegis mcp config vscode # VS Code
aegis mcp config cline # Cline
aegis mcp config windsurf # WindsurfThe MCP server exposes three tools:
Tool | Description |
| Make an authenticated API call (provide service + path, Aegis injects credentials) |
| List available services (names only, never secrets) |
| Check Aegis status |
The MCP server replicates the full Gate security pipeline: domain guard, agent auth, body inspection, rate limiting, audit logging.
Setup Guides
Features
Feature | Description |
Encrypted Vault | AES-256-GCM encrypted credential storage with PBKDF2 key derivation |
HTTP Proxy (Gate) | Transparent credential injection — agent hits |
Domain Guard | Every outbound request checked against credential allowlists. No bypass |
Audit Ledger | Every request (allowed and blocked) logged with full context |
Agent Identity | Per-agent tokens, credential scoping, and rate limits |
Policy Engine | Declarative YAML policies — method, path, rate-limit, time-of-day restrictions |
Body Inspector | Outbound request bodies scanned for credential-like patterns |
MCP Server | Native Model Context Protocol for Claude, Cursor, VS Code, Windsurf, Cline |
Web Dashboard | Real-time monitoring UI with WebSocket live feed |
Prometheus Metrics |
|
Webhook Alerts | HMAC-signed notifications for blocked requests, expiring credentials |
RBAC | Admin, operator, viewer roles with 16 granular permissions |
Multi-Vault | Separate vaults for dev/staging/prod with isolated encryption keys |
Shamir's Secret Sharing | M-of-N key splitting for team master key management |
Cross-Platform Key Storage | OS keychain by default (macOS, Windows, Linux) with file fallback |
TLS Support | Optional HTTPS on Gate with cert/key configuration |
Configuration File |
|
Example Integrations
Step-by-step guides with config files and policies included:
Slack Bot — Protect your Slack bot token with domain-restricted proxy access
GitHub Integration — Secure GitHub PAT with per-agent grants and read-only policies
Stripe Backend — Isolate Stripe API keys with body inspection and rate limiting
OpenClaw Skill — Aegis skill for OpenClaw personal AI assistant
Security
Published STRIDE threat model — 28 threats analysed, 0 critical/high unmitigated findings
Full security architecture documentation (trust boundaries, crypto pipeline, data flow)
AES-256-GCM + ChaCha20-Poly1305 encryption at rest
Domain guard enforced on every request — no bypass
Agent tokens stored as SHA-256 hashes — cannot be recovered, only regenerated
Request body inspection for credential pattern detection
Open source (Apache 2.0) — read the code
How Aegis Compares
| Vault/Doppler | Infisical | Aegis | |
Agent sees raw key | Yes | Yes (after fetch) | Yes (after fetch) | No — never |
Domain restrictions | No | No | No | Yes |
MCP-native | No | No | Adding | Yes |
Local-first | Yes | No | No | Yes |
Setup | 10 sec | 30+ min | 15+ min | ~2 min |
See full comparison for detailed breakdowns against each approach.
Documentation
Document | Description |
Full reference: CLI commands, configuration, RBAC, policies, webhooks, troubleshooting | |
Trust boundaries, crypto pipeline, data flow diagrams | |
STRIDE analysis — 28 threats, mitigations, residual risks | |
Detailed comparison with .env, Vault, Doppler, Infisical | |
Common questions and objections | |
Feature roadmap | |
Code style, PR process, architecture overview |
Install
# npm
npm install -g @getaegis/cli
# Homebrew
brew tap getaegis/aegis && brew install aegis
# Docker
docker run ghcr.io/getaegis/aegis --helpRequires Node.js ≥ 20 — check with node -v
Development
git clone https://github.com/getaegis/aegis.git
cd aegis
yarn install
yarn build
yarn testSee CONTRIBUTING.md for code style, PR process, and architecture overview.
License
Available Tools
3 toolsaegis_healthAegis Health CheckB
Check the health status of Aegis, including credential and agent counts.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions what is checked ('credential and agent counts') but lacks details on permissions, rate limits, response format, or whether this is a read-only operation. For a health check tool with zero annotation coverage, this leaves significant gaps in understanding how it behaves.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the core purpose ('Check the health status of Aegis') and adds specific details ('including credential and agent counts') without waste. Every word earns its place, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (0 parameters, no output schema) and lack of annotations, the description is adequate but has clear gaps. It covers the purpose and scope but misses behavioral aspects like response format or usage context. Without annotations or output schema, more detail on what the health check returns would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters, and schema description coverage is 100%, so there are no parameters to document. The description doesn't need to add parameter semantics beyond what the schema provides. A baseline of 4 is appropriate as it avoids redundancy while being complete for a parameterless tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('Check') and resource ('health status of Aegis'), including what aspects are covered ('credential and agent counts'). It distinguishes itself from siblings like 'aegis_list_services' and 'aegis_proxy_request' by focusing on health monitoring rather than listing or proxying. However, it doesn't explicitly contrast with siblings beyond the implied scope difference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites, frequency, or scenarios where health checks are appropriate compared to 'aegis_list_services' (which might list services without health details) or 'aegis_proxy_request' (which might involve active requests). Usage is implied by the purpose but not explicitly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aegis_list_servicesAegis List ServicesA
List all available services registered in Aegis. Returns service names, auth types, and allowed domains — never secrets.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes the tool's behavior: it's a read-only operation (implied by 'List'), returns specific non-sensitive data, and explicitly states what is never returned (secrets). It could improve by mentioning potential limitations like rate limits or authentication requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is perfectly concise with two clear sentences: one stating the action and resource, another detailing the return values and important exclusion. Every word earns its place with zero wasted text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read tool with no output schema, the description provides good context about what data is returned and what isn't. It could be more complete by describing the return format (e.g., list structure) or any behavioral constraints, but it adequately covers the essential information given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters with 100% schema description coverage, so the schema already fully documents the lack of inputs. The description appropriately doesn't add parameter information, maintaining focus on the tool's purpose and output behavior.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('List all available services') and resource ('services registered in Aegis'), distinguishing it from siblings like health checks or proxy requests. It specifies what information is returned (service names, auth types, allowed domains) and explicitly excludes secrets.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context by stating it returns service metadata, suggesting it's for discovery or auditing purposes. However, it doesn't explicitly state when to use this tool versus alternatives or provide any exclusion criteria, leaving some guidance gaps.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aegis_proxy_requestAegis Proxy RequestB
Make an authenticated API call through Aegis. Credentials are injected automatically — you never see them. Provide the service name and API path; Aegis handles authentication.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | Request body (for POST/PUT/PATCH) | |
| path | Yes | The API path to call (e.g. "/v1/chat/completions") | |
| method | No | HTTP method (default: GET) | GET |
| headers | No | Additional request headers (auth headers are injected automatically) | |
| service | Yes | The service name (must match a registered credential in Aegis) | |
| targetHost | No | Override the target domain (must be in the credential's allowlist). Defaults to the credential's primary domain. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It adds useful context: authentication is handled automatically, credentials are not visible, and it specifies the required inputs (service name and API path). However, it lacks details on error handling, rate limits, response formats, or other behavioral traits like whether it's idempotent or has side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded, with two sentences that directly state the tool's function and key behavior. Every sentence adds value: the first defines the purpose, and the second clarifies authentication handling. There is no wasted text, though it could be slightly more structured for clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (6 parameters, no annotations, no output schema), the description is moderately complete. It covers the core purpose and authentication mechanism but lacks details on response handling, error scenarios, or advanced usage. Without annotations or output schema, the agent must rely on the schema for parameter details, leaving gaps in behavioral understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters thoroughly. The description adds minimal semantic value beyond the schema, only mentioning that credentials are injected and specifying the required inputs. It does not elaborate on parameter interactions or usage nuances, meeting the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Make an authenticated API call through Aegis.' It specifies the verb ('Make'), resource ('API call'), and mechanism ('through Aegis'), but does not explicitly differentiate it from its siblings (aegis_health and aegis_list_services), which likely serve different purposes like health checks or listing services.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context by mentioning 'authenticated API call' and 'credentials are injected automatically,' suggesting it's for making requests to services registered with Aegis. However, it does not provide explicit guidance on when to use this tool versus its siblings or other alternatives, leaving the agent to infer based on the tool names and descriptions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
3 tool updates
v1.0.0- First observed
aegis_health - First observed
aegis_list_services - First observed
aegis_proxy_request
TDQS
Each tool has a clearly distinct purpose: health monitoring, service listing, and proxying requests. There is no overlap in functionality, and an agent can easily differentiate between them based on their specific roles.
All tool names follow a consistent 'aegis_' prefix with descriptive snake_case suffixes (health, list_services, proxy_request). This pattern is uniform across all tools, making them predictable and easy to understand.
With only 3 tools, the server feels minimal for a service management system like Aegis. While the tools cover basic operations, the scope might be too thin, potentially lacking advanced management features like service registration or configuration updates.
The tools provide core functionality for health checks, service listing, and proxying requests, but there are notable gaps. For example, there are no tools for managing services (e.g., adding or removing services) or handling authentication configurations, which could limit agent workflows in a service management context.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
- FullmaktOAuthai.fullmakt
Credential broker for AI agents: scoped, revocable API access with policy enforcement and audit.
Give your AI hands. Identity, credential vault, and API gateway for autonomous agents.
Security gateway for AI agents: policy, approval, and audited execution, no secrets shared.
Zero-trust gateway for AI agents: score tool calls, verify agent cards, enforce policy, audit.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceSelf-hosted credential store and API proxy for AI agents. One Bearer token, all your services. Handles OAuth refresh, encrypted storage, audit logging, and per-agent permissioning.71MIT
- AlicenseAqualityAmaintenanceLocal zero-trust permission gateway for AI agents. Enforces policy-based tool authorization, human approvals, scoped permissions, and cryptographically verifiable audit logs.45Apache 2.0
- AlicenseNot gradedqualityDmaintenanceZero-knowledge credential injection for AI agents. Your agent authenticates to websites and APIs without ever seeing a password, TOTP code, or API key.61MIT
- AlicenseNot gradedqualityCmaintenanceEnables AI agents to securely access authenticated services (HTTP, SSH, SMTP) without exposing secrets, by acting as a server-side proxy that injects authentication.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/getaegis/aegis'
If you have feedback or need assistance with the MCP directory API, please join our Discord server