getaegis/aegis

**Stop putting API keys where AI agents can read them.**
Aegis is a local-first credential isolation proxy for AI agents. It sits between your agent and the APIs it calls — injecting secrets at the network boundary so the agent never sees, stores, or transmits real credentials.
How It Works
Why?
AI agents (Claude, GPT, Cursor, custom bots) increasingly call real APIs — Slack, GitHub, Stripe, databases. The current pattern is dangerous:
1. **Agents see raw API keys** — one prompt injection exfiltrates them
2. **No domain guard** — a compromised agent can send your Slack token to evil.com
3. **No audit trail** — you can't see what an agent did with your credentials
4. **No access control** — every agent can use every credential
Aegis solves all four. Your agent makes HTTP calls through a local proxy. Aegis handles authentication, enforces domain restrictions, and logs everything.
Quick Start
Production Setup (with agent auth)
MCP Integration
Aegis is a first-class MCP server. Any MCP-compatible AI agent can use it natively — no HTTP calls needed.
**Before (plaintext key in config):**
**After (Aegis — no key visible):**
Generate the config for your AI host:
The MCP server exposes three tools:
| Tool | Description |
|------|-------------|
| aegis_proxy_request | Make an authenticated API call (provide service + path, Aegis injects credentials) |
| aegis_list_services | List available services (names only, never secrets) |
| aegis_health | Check Aegis status |
The MCP server replicates the full Gate security pipeline: domain guard, agent auth, body inspection, rate limiting, audit logging.
Setup Guides
- Claude Desktop
- Cursor
- VS Code
- Windsurf
- Cline
- OpenClaw — personal AI assistant (HTTP proxy + skill)
Features
| Feature | Description |
|---------|-------------|
| **Encrypted Vault** | AES-256-GCM encrypted credential storage with PBKDF2 key derivation |
| **HTTP Proxy (Gate)** | Transparent credential injection — agent hits localhost:3100/{service}/path |
| **Domain Guard** | Every outbound request checked against credential allowlists. No bypass |
| **Audit Ledger** | Every request (allowed and blocked) logged with full context |
| **Agent Identity** | Per-agent tokens, credential scoping, and rate limits |
| **Policy Engine** | Declarative YAML policies — method, path, rate-limit, time-of-day restrictions |
| **Body Inspector** | Outbound request bodies scanned for credential-like patterns |
| **MCP Server** | Native Model Context Protocol for Claude, Cursor, VS Code, Windsurf, Cline |
| **Web Dashboard** | Real-time monitoring UI with WebSocket live feed |
| **Prometheus Metrics** | /_aegis/metrics endpoint for Grafana dashboards |
| **Webhook Alerts** | HMAC-signed notifications for blocked requests, expiring credentials |
| **RBAC** | Admin, operator, viewer roles with 16 granular permissions |
| **Multi-Vault** | Separate vaults for dev/staging/prod with isolated encryption keys |
| **Shamir's Secret Sharing** | M-of-N key splitting for team master key management |
| **Cross-Platform Key Storage** | OS keychain by default (macOS, Windows, Linux) with file fallback |