aegis.runtime

Identity proves who an agent is. Aegis decides what it's allowed to do.

A deterministic capability-enforcement layer for AI agents on the Model Context Protocol. Every tool call is evaluated against a spec before it reaches the server — no LLM anywhere in the enforcement path.

View on GitHub Quick start guide
v0.1.1 — pip-installable, 95 tests, in active testing with a design partner
$ pytest tests/test_enforcement.py -v -s
AEGIS ENFORCEMENT REPORT — capability spec vs. prompt injection
[ALLOW] read_text_file   meeting-notes.txt
[DENY]  read_text_file   project-update.txt
rule=rule-7-value-not-allowed spec_hash=enforcement-test-v1
Agent run terminated by enforcement: value
'project-update.txt' not in capability spec

How a tool call gets evaluated

1
Request
A user or operator describes the task in plain language.
2
Proposer
An LLM reads the request once, upfront, and drafts a minimum-capability spec. It never sees tool output.
3
Spec
The spec is validated and frozen. From here, nothing widens it.
4
Enforcement
Every tool call is checked against the spec by pure, deterministic code.
5
Tool
Allowed calls reach the MCP server. Denied calls never do.

The enforcement path contains no LLM. The proposer runs once, on trusted input, before execution starts. After that, every decision is computed in microseconds and is provable by reading the code.

What it does today

Deterministic enforcement
Every MCP tool call is evaluated against a capability spec before it reaches the server. Literal matching only — no globs, no regex, no inferred scope.
LLM-generated specs
A natural-language request becomes a minimum-capability YAML spec, generated once and validated before use.
Human approval on sensitive calls
Operator-defined intercept rules pause a call for sign-off before it proceeds, through a callback you control.
Response inspection
Deterministic scanning for leaked secrets — SSNs, credit cards, private keys, cloud credentials — before a response reaches the agent.
Forensic audit trail
Every decision is logged with the exact policy version and prompt version that produced it.
OTLP export
Audit events flow into your existing observability stack — Datadog, Jaeger, or anything OTLP-compatible.

Where it sits

Identity vendors answer one question: is this agent allowed in. Aegis answers a different one: what is it allowed to do once it's in. These are separate layers, and Aegis doesn't compete with the first one — it picks up where it leaves off.

Your identity provider — authenticates the agent
↓
Aegis — decides what the authenticated agent may do, per task
↓
MCP server — only sees the calls Aegis allowed through

It works with any identity system, any observability stack, and drops into an existing Pydantic AI agent with one line of code.

Current status

STAGE
Pre-production. v0.1.1 shipped, public, pip-installable. One design partner in active testing.
BUILT FOR
Platform and security engineers running agents with real tool-calling access — especially where "prove what the agent did" is a live requirement.
TALK TO ME
Building agents with real tool access? I'd like to hear what your team is running into. hello@aegisruntime.dev