A deterministic capability-enforcement layer for AI agents on the Model Context Protocol. Every tool call is evaluated against a spec before it reaches the server, with no LLM anywhere in the enforcement path.
The enforcement path contains no LLM. The proposer runs once, on trusted input, before execution starts. After that, every decision is computed in microseconds and is provable by reading the code.
A Python package that wraps any Pydantic AI toolset in one line. Evaluates every tool call against a capability spec, intercepts sensitive ones for human approval, scans responses for leaked secrets, and writes a local audit log.
pip install and nothing else. Works standalone.
A self-hosted backend that aggregates audit records across agents and makes them queryable. Reconstruct any run, find every refused call, prove which policy version made each decision.
Self-hosted, docker compose up. Never in the enforcement path — if it's unreachable, tool calls are still evaluated and decisions are still correct.
Identity vendors answer one question: is this agent allowed in. Aegis answers a different one: what is it allowed to do once it's in. These are separate layers, and Aegis doesn't compete with the first one. It picks up where that one leaves off.
It works with any identity system, any observability stack, and drops into an existing Pydantic AI agent with one line of code.