Is this you?
Five ways an ungoverned agent turns into an incident, and the specific Aegis mechanism that closes each one.
Your LangChain agent holds a standing database credential.
Aegis strips any credential the agent tries to use and injects a scoped, ephemeral one at call time. The agent never holds a long-lived secret to begin with.
An MCP server proxies tools nobody vetted.
Every outgoing MCP call, across stdio, SSE, and HTTP transports, is authorized against policy before it leaves the agent.
A CLI agent can run arbitrary shell commands.
Pre-execution callbacks inspect or veto shell commands before they run, not after the damage is done.
An agent starts doing something it shouldn't, mid-task.
Suspend or revoke the agent's access in seconds. A reversible pause or a hard revoke, no waiting on a deploy.
Auditors want proof, not a policy document.
Every access decision is written to a hash-chained log. No incident can be hidden or disputed after the fact.
One control plane. Every workload enforced.
The Policy Server is the single signing authority for the fleet. The Aegis SDK runs in-process at every workload, with no sidecar and no network hop for policy evaluation, gating REST, Shell, and MCP calls at the trust boundary before anything leaves.
Swipe to pan →
Three surfaces. One policy interface.
REST, Shell, and MCP all speak different dialects. Aegis intercepts all three with a single policy engine.
REST / HTTP
requests · httpx · aiohttp
What it sees
A CallContext (method, host, path, tool, and arguments) built for every outbound HTTP call.
Policy decides
Re-authorized on the same OPA schema. A call to an unapproved host is denied before it is sent.
Shell
tool-type aware
What it sees
Execution type classified as HTTP, shell, or MCP; shell commands registered straight from policy.
Policy decides
Pre-execution callbacks can inspect or veto before any command runs.
MCP
client-session wrap
What it sees
Tool name, schema, and arguments on every outgoing MCP call, across stdio, SSE, and HTTP transports.
Policy decides
Each call authorized before it leaves the agent, closing the gap to un-vetted MCP servers.
Aegis controls secrets, not the app.
Tokens are injected at call time, configuration is encrypted at rest, and your enterprise vault stays the source of truth.
Credential broker · platform-controlled, per call
App makes an outbound call. Any Authorization header it set is stripped.
The interceptor fetches the credential scoped to (host, path, method, tool).
The platform token is injected, decrypted in memory via a per-agent HKDF key.
The agent never holds a long-lived API token.
Fronts your enterprise vaults
Framework adapters
Aegis ships adapters for all major AI agent frameworks. One SDK call instruments your entire agent for policy enforcement and audit.
Four weeks. One agent fleet. Real policy, enforcing.
A bounded pilot with one sponsor and no infrastructure lift. Walk away with identity, attestation, and a real authorization layer in production.
WK 0
Setup
Control Panel in your environment. Trust root provisioned. SPIRE Agent rolled to one fleet. No app changes yet.
WK 1
Identity
One initialize() in the pilot agent. Two-layer attestation working end-to-end. Shadow mode: observe only.
WK 2
Policy
Interception live across REST, Shell, MCP. Allow/deny enforced. Audit log streaming. Slack alerts on blocks.
WK 3
Callback
Pre-execution callbacks wired in. App-specific rules enforced. Joint readout + rollout plan for the next two teams.