Credential isolation proxy for AI agents.
Aegis
Stop putting API keys where AI agents can read them.
Aegis is a local-first credential isolation proxy for AI agents. It sits between your agent and the APIs it calls — injecting secrets at the network boundary so the agent never sees, stores, or transmits real credentials.
How It Works
Why?
AI agents (Claude, GPT, Cursor, custom bots) increasingly call real APIs — Slack, GitHub, Stripe, databases. The current pattern is dangerous:
- Agents see raw API keys — one prompt injection exfiltrates them
- No domain guard — a compromised agent can send your Slack token to
evil.com - No audit trail — you can't see what an agent did with your credentials
- No access control — every agent can use every credential
Aegis solves all four. Your agent makes HTTP calls through a local proxy. Aegis handles authentication, enforces domain restrictions, and logs everything.
Quick Start
# Install
npm install -g @getaegis/cli
# Initialize (stores master key in OS keychain by default)
aegis init
# Add a credential
aegis vault add \
--name slack-bot \
--service slack \
--secret "xoxb-your-token-here" \
--domains slack.com
# Start the proxy
aegis gate --no-agent-auth
# Test it — Aegis injects the token, forwards to Slack, logs the request
# X-Target-Host tells Gate which upstream server to forward to (optional if credential has one domain)
curl http://localhost:3100/slack/api/auth.test \
-H "X-Target-Host: slack.com"
Production Setup (with agent auth)
# Create an agent identity
aegis agent add --name "my-agent"
# Save the printed token — it's shown once only
# Grant it access to specific credentials
aegis agent grant --agent "my-agent" --credential "slack-bot"
# Start Gate (agent auth is on by default)
aegis gate
# Agent must include its token
curl http://localhost:3100/slack/api/auth.test \
-H "X-Target-Host: slack.com" \
-H "X-Aegis-Agent: aegis_a1b2c3d4..."
MCP Integration
Aegis is a first-class MCP server. Any MCP-compatible AI agent can use it natively — no HTTP calls needed.
Before (plaintext key in config):
{
"mcpServers": {
"slack": {
"command": "node",
"args": ["slack-mcp-server"],
"env": { "SLACK_TOKEN": "xoxb-1234-real-token-here" }
}
}
}
After (Aegis — no key visible):
{
"mcpServers": {
"aegis": {
"command": "npx",
"args": ["-y", "@getaegis/cli", "mcp", "serve"]
}
}
}
Generate the config for your AI host:
aegis mcp config claude # Claude Desktop
aegis mcp config cursor # Cursor
aegis mcp config vscode # VS Code
aegis mcp config cline # Cline
aegis mcp config windsurf # Windsurf
The MCP server exposes three tools:
| Tool | Description |
|---|---|
aegis_proxy_request |
Make an authenticated API call (provide service + path, Aegis injects credentials) |
aegis_list_services |
List available services (names only, never secrets) |
aegis_health |
Check Aegis status |
The MCP server replicates the full Gate security pipeline: domain guard, agent auth, body inspection, rate limiting, audit logging.
Setup Guides
Features
| Feature | Description |
|---|---|
| Encrypted Vault | AES-256-GCM encrypted credential storage with PBKDF2 key derivation |
| HTTP Proxy (Gate) | Transparent credential injection — agent hits localhost:3100/{service}/path |
| Domain Guard | Every outbound request checked against credential allowlists. No bypass |
| Audit Ledger | Every request (allowed and blocked) logged with full context |
| Agent Identity | Per-agent tokens, credential scoping, and rate limits |
| Policy Engine | Declarative YAML policies — method, path, rate-limit, time-of-day restrictions |
| Body Inspector | Outbound request bodies scanned for credential-like patterns |
| MCP Server | Native Model Context Protocol for Claude, Cursor, VS |
Tools (3)
aegis_proxy_requestMake an authenticated API call (provide service + path, Aegis injects credentials)aegis_list_servicesList available services (names only, never secrets)aegis_healthCheck Aegis statusConfiguration
{"mcpServers": {"aegis": {"command": "npx", "args": ["-y", "@getaegis/cli", "mcp", "serve"]}}}