Aegis — Claude Code MCP server: policy gates for agent calls
An MCP server that sits between an agent and its tools. Each call is matched against YAML rules and then runs, waits for a human yes, or gets blocked.
claude mcp add --env AEGIS_POLICY_PATH=<AEGIS_POLICY_PATH> --transport stdio aegis-ai-agent-governance -- uvx agent-aegisWhat Aegis — AI Agent Governance does
Launch it with uvx agent-aegis over stdio and point AEGIS_POLICY_PATH at the YAML file. A shell command, an HTTP request, an MCP action: all of them arrive as an Action object, and the matching rule returns auto, approve or block.
Tool names are only part of it. Hand-offs between agents carry a trust level that stays level or drops, never climbs. Audit events go into an append-only log chained with Merkle hashes and fan out to SQLite, JSONL and a webhook. Regex detectors cover prompt injection, PII, prompt leakage and toxicity. No second model sits in the request path, so a verdict is deterministic.
Adapters cover LangChain, CrewAI, OpenAI Agents, Google ADK, MCP transport, DSPy, httpx and Playwright, and aegis.auto_instrument() wraps whichever of them are already installed. Your own checks join through GuardrailEngine.add(). The machine needs uv present, otherwise uvx has nothing to run. MIT license.
What it helps with
- keep an agent out of production tables
- hold a destructive shell command until someone approves
- mask customer PII inside tool arguments
- catch a prompt injection before the agent acts
- leave an audit trail that resists quiet edits
Example prompts for the agent
- Which Aegis rules would fire on a
bashcall that deletes a directory? - List the audit events Aegis recorded in this session
- Tighten the policy so every
git pushneeds approval
How to install Aegis — AI Agent Governance
Platform CLI
claude mcp add --env AEGIS_POLICY_PATH=<AEGIS_POLICY_PATH> --transport stdio aegis-ai-agent-governance -- uvx agent-aegisReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from agent-aegis <command>
Platform CLI
codex mcp add aegis-ai-agent-governance --env AEGIS_POLICY_PATH=<AEGIS_POLICY_PATH> -- uvx agent-aegisReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from agent-aegis <command>
Config file
{
"mcpServers": {
"aegis-ai-agent-governance": {
"command": "uvx",
"args": [
"agent-aegis"
],
"env": {
"AEGIS_POLICY_PATH": "<AEGIS_POLICY_PATH>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from agent-aegis <command>
Config file
{
"servers": {
"aegis-ai-agent-governance": {
"type": "stdio",
"command": "uvx",
"args": [
"agent-aegis"
],
"env": {
"AEGIS_POLICY_PATH": "<AEGIS_POLICY_PATH>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from agent-aegis <command>
Platform CLI
gemini mcp add -e AEGIS_POLICY_PATH=<AEGIS_POLICY_PATH> aegis-ai-agent-governance uvx agent-aegisReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from agent-aegis <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Aegis — AI Agent Governance
How do I install Aegis in Claude Code?
Register the server with claude mcp add --env AEGIS_POLICY_PATH=<AEGIS_POLICY_PATH> --transport stdio aegis-ai-agent-governance -- uvx agent-aegis, replacing the placeholder with the real path to your policy file.
What does Aegis actually do?
It reads the tool calls an agent wants to make, applies your declarative rules, and lets the call through, asks for approval, or stops it. The decision lands in a hash-chained log so it can be replayed later.
How does it differ from Guardrails AI or NeMo Guardrails?
Those get wired in by hand at a call site you pick, and mostly judge text. Aegis instruments the frameworks already in the project and judges the calls themselves, including delegation chains and the distance between declared intent and measured impact.
