AgentAegis MCP is an MCP server for cybersecurity operations, with the goal of enabling any AI agent to invoke cybersecurity services on demand and be billed by usage. It wraps multiple open-source scanning engines (nmap, Nuclei, sslyze, Semgrep, trufflehog, trivy) into structured, agent-discoverable tool definitions, with both inputs and outputs as structured data.
Main capabilities: provides 28 tools (23 paid, 5 free), covering compliance checks, vulnerability scanning, code security analysis, threat intelligence, and more. The free tools include help, account_balance, agent_whoami, agent_history, agent_scan_get. Compliance frameworks support SOC 2 Type II (35 controls), ISO 27001:2022 (93 controls), HIPAA Security Rule (43 controls), NIST CSF 2.0 (6 functions), and PCI DSS v4.0 (12 requirements). Real-time pricing is subject to /pricing.
Usage: locally, it can be connected to Claude Desktop via stdio by adding configuration in claude_desktop_config.json; remotely, it supports HTTP transport for connection by any MCP-compatible agent platform. The HTTP API provides two billing methods: first, API Key, where customers receive a key after registration, pay via prepaid balance or invoice, and each tool call is deducted from the monthly budget; second, x402 micropayments, which require no registration, with each call settled on-chain via USDC, where the server returns 402 Payment Required and the payment requirements, and the client retries with an X-PAYMENT header after signing. Deployment is recommended on Railway, where SUPABASE_URL, SUPABASE_SERVICE_KEY, X402_PAYEE_ADDRESS, as well as environment variables such as NVD_API_KEY, ABUSEIPDB_API_KEY, OTX_API_KEY, ABUSECH_API_KEY, and HIBP_API_KEY need to be set in the dashboard, and migrations must be run in the Supabase SQL editor.
Security and limitations: target validation allows only public IPs and registered domains, and blocks private/reserved address ranges; each scan runs in an isolated processand cleans up temporary directories; code repositories are shallow-cloned (depth=1), with a maximum of 500MB, a 5-minute timeout, and no code execution; secret values return only the first and last 4 characters; rate limiting is applied both by API Key and by target, with a maximum of 5 concurrent scans and 10 times per target per hour; all tool calls are logged to usage_log and retained for 90 days; API Keys are stored as SHA-256 hashes. The terms of use require scanning only systems that you own or have explicit written authorization for, and users are responsible for scans initiated through their API Key.
Applicable scenarios: teams and platforms that need to have AI agents automatically perform security assessments, compliance verification, code repository security scanning, or threat intelligence queries. Specific pricing, detailed parameters for each tool, and complete deployment steps are not yet provided.
