aegis — Claude Code MCP server: credential isolation proxy
Keeps API credentials away from AI agents by routing calls through a local proxy. Injects auth tokens during transit and restricts destination domains.
claude mcp add --env AEGIS_MASTER_KEY=<AEGIS_MASTER_KEY> --env AEGIS_SALT=<AEGIS_SALT> --env AEGIS_DATA_DIR=<AEGIS_DATA_DIR> --env AEGIS_PORT=<AEGIS_PORT> --env AEGIS_LOG_LEVEL=<AEGIS_LOG_LEVEL> --transport stdio aegis -- npx -y @getaegis/cliWhat aegis does
Aegis creates an intermediary layer between your AI coding assistant and external web APIs. Instead of exposing raw tokens to the model context, the assistant routes calls through aegis_proxy_request or a local endpoint on port 3100. The proxy attaches authentication headers on the fly. The language model never touches the actual keys. This setup blocks prompt injections from stealing sensitive tokens.
The local vault secures credentials with AES-256-GCM encryption and derives keys through PBKDF2. Built-in domain checking blocks requests targeted outside configured hostnames, while body inspection flags accidental key leaks in payloads. Running the MCP component requires AEGIS_MASTER_KEY and AEGIS_SALT environment variables; without them, the server cannot open the vault.
What it helps with
- prevent API credential leaks through prompt injection
- restrict external API requests to verified domain allowlists
- log every outbound call in an audit trail
- isolate access tokens to designated agent identities
Example prompts for the agent
- Use aegis_list_services to see which APIs are configured
- Send an authenticated request to Slack path /api/auth.test via aegis_proxy_request
- Check proxy status using aegis_health
How to install aegis
Platform CLI
claude mcp add --env AEGIS_MASTER_KEY=<AEGIS_MASTER_KEY> --env AEGIS_SALT=<AEGIS_SALT> --env AEGIS_DATA_DIR=<AEGIS_DATA_DIR> --env AEGIS_PORT=<AEGIS_PORT> --env AEGIS_LOG_LEVEL=<AEGIS_LOG_LEVEL> --transport stdio aegis -- npx -y @getaegis/cliReplace <…> with your own values. 6 more environment variables are in the server README
Platform CLI
codex mcp add aegis --env AEGIS_MASTER_KEY=<AEGIS_MASTER_KEY> --env AEGIS_SALT=<AEGIS_SALT> --env AEGIS_DATA_DIR=<AEGIS_DATA_DIR> --env AEGIS_PORT=<AEGIS_PORT> --env AEGIS_LOG_LEVEL=<AEGIS_LOG_LEVEL> -- npx -y @getaegis/cliReplace <…> with your own values. 6 more environment variables are in the server README
Config file
{
"mcpServers": {
"aegis": {
"command": "npx",
"args": [
"-y",
"@getaegis/cli"
],
"env": {
"AEGIS_MASTER_KEY": "<AEGIS_MASTER_KEY>",
"AEGIS_SALT": "<AEGIS_SALT>",
"AEGIS_DATA_DIR": "<AEGIS_DATA_DIR>",
"AEGIS_PORT": "<AEGIS_PORT>",
"AEGIS_LOG_LEVEL": "<AEGIS_LOG_LEVEL>"
}
}
}
}Replace <…> with your own values. 6 more environment variables are in the server README
Config file
{
"servers": {
"aegis": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@getaegis/cli"
],
"env": {
"AEGIS_MASTER_KEY": "<AEGIS_MASTER_KEY>",
"AEGIS_SALT": "<AEGIS_SALT>",
"AEGIS_DATA_DIR": "<AEGIS_DATA_DIR>",
"AEGIS_PORT": "<AEGIS_PORT>",
"AEGIS_LOG_LEVEL": "<AEGIS_LOG_LEVEL>"
}
}
}
}Replace <…> with your own values. 6 more environment variables are in the server README
Platform CLI
gemini mcp add -e AEGIS_MASTER_KEY=<AEGIS_MASTER_KEY> -e AEGIS_SALT=<AEGIS_SALT> -e AEGIS_DATA_DIR=<AEGIS_DATA_DIR> -e AEGIS_PORT=<AEGIS_PORT> -e AEGIS_LOG_LEVEL=<AEGIS_LOG_LEVEL> aegis npx -y @getaegis/cliReplace <…> with your own values. 6 more environment variables are in the server README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about aegis
How to install aegis in Claude Code?
Run claude mcp add aegis -e AEGIS_MASTER_KEY=<AEGIS_MASTER_KEY> -e AEGIS_SALT=<AEGIS_SALT> -- npx -y @getaegis/cli in your terminal.
What tools does aegis expose over MCP?
It provides aegis_proxy_request for executing calls with attached credentials, aegis_list_services to inspect available integrations, and aegis_health to verify proxy connectivity.
What environment variables are required to run aegis?
Starting the MCP server requires AEGIS_MASTER_KEY and AEGIS_SALT to unlock the encrypted credential vault.
