Aegis

What Acacian/aegis MCP server does

Acacian/aegis MCP server provides a governance layer for agent actions, including MCP calls, tool invocations, model requests, and HTTP activity. Its policy model represents each operation as an Action and can evaluate declarative rules that match an action, assess risk, and choose an auto, approve, or block outcome.

The project combines several governance primitives rather than limiting checks to generated text. These include prompt-injection, PII, prompt-leak, and toxicity checks; role-based access control; rate limits; cost budgets; anomaly and drift detection; delegation-chain validation; selection auditing; and justification-gap scoring. The README describes these as deterministic controls, with optional semantic or model-based detectors able to be added to the guardrail engine.

How it works

For MCP, Acacian/aegis MCP server operates as a transport-layer proxy for servers using stdio or HTTP. This allows governance to sit between the agent and the MCP server without patching the MCP server itself. For supported agent frameworks, the runtime detects installed integrations and instruments only those that are present.

The common contract includes declared, assessed, and delegation-chain claims. A policy can compare an agent's stated impact with Aegis's independent assessment, while delegation rules enforce a non-increasing trust constraint across hand-offs. Audit events are appended to a Merkle-chained log, with SQLite, JSONL, webhook, and Ed25519-signed audit options described in the project materials.

Supported adapters cover Google ADK, CrewAI, Pydantic AI, OpenAI Agents SDK, LangChain, OpenAI API, Anthropic API, LiteLLM, Google GenAI, LlamaIndex, Instructor, and DSPy. Additional wrappers cover raw HTTP through httpx and browser activity through Playwright. Custom integrations can use the BaseAdapter interface.

Setup and configuration

Install the Python package with pip install agent-aegis, then initialize instrumentation with aegis.auto_instrument(). The automatic setup looks for installed frameworks and applies the relevant adapters; the README states that these integrations do not require hard dependencies for every framework.

For an MCP deployment, use the project as a proxy for an MCP server over stdio or HTTP. The supplied material identifies the proxy mode but does not provide a complete proxy command, configuration file schema, or MCP client-specific setup example. YAML policies are the main configuration mechanism, defining action matching, risk handling, and approval behavior.

Tools and capabilities

Acacian/aegis MCP server supports:

• YAML policy evaluation with automatic approval, human approval, or blocking outcomes.
• Deterministic checks for prompt injection, PII, prompt leakage, and toxicity.
• Trust-aware delegation chains for multi-agent workflows.
• Risk scoring based on six-dimensional impact claims and assessments.
• Selection audits that examine excluded options as well as selected tools.
• Rate limits, cost budgets, anomaly scoring, drift detection, cascade guards, and kill switches through composed primitives.
• Append-only, tamper-evident audit records with Merkle chaining.
• SQLite, JSONL, webhook, and cryptographically signed audit outputs.

Limitations and notes

The README lists broad framework coverage, but adapter behavior differs: some integrations use native hooks, some patch framework methods, and MCP uses a proxy rather than patching. The provided material does not specify a standalone MCP executable, client configuration examples, environment variables, or hosted endpoint. It also does not identify Claude Desktop, Cursor, Windsurf, or Cline as compatible clients.