aegis

Aegis is a governance layer for AI agents, positioned as an abstraction layer that unifies the governance primitives of various frameworks. Its core idea is: different agent frameworks each repeatedly implement the same governance primitives in slightly different ways, whereas Aegis lets users write just one Policy that all frameworks can inherit, with no need to separately write guardrails for LangChain, CrewAI, and OpenAI.

[Purpose] To provide runtime governance capabilities for AI agents, including prompt injection interception, PII redaction, toxicity detection, policy enforcement, trust delegation, and tamper-proof auditing. It emphasizes that this is a deterministic governance layer, and no second model needs to be placed in the request path.

[Main Capabilities]

• A unified API covering 12 agent frameworks and 3 protocol-level adapters. auto_instrument() detects installed frameworks and patches only them, with no hard dependencies; custom adapters use the same BaseAdapter interface.
• Default guardrails: deterministic regex, no LLM calls, no network. Each check has a cold start of about 2.65ms, and the hot path is less than 1µs.
• Five entry points: 1) Runtime protection, with one line of code or zero code changes (AEGIS_INSTRUMENT=1 python my_agent.py); 2) Pre-production scanning, supporting --format json|sarif|suggest, --threshold A-F, .aegisscanignore, and inline # aegis: ignore comments, and can be automatically fixed with aegis scan --fix; 3) Policy CI/CD, blocking ungoverned calls at the PR stage; 4) Auditing and compliance, with each call recorded to a tamper-proof Merkle chain, built-in EU AI Act / NIST AI RMF / SOC2 mappings, support for SQLite + JSONL + webhook receivers, and Ed25519 signatures for long-term evidence preservation; 5) Governance server (multi-agent), providing 37 REST endpoints, a WebSocket audit stream, and a web dashboard, where agents can connect via SDK, auto-register, send heartbeats, and query policies over HTTP.
• MCP proxy: govern any MCP server with zero code changes, compatible with Claude Desktop, Cursor, VS Code, and Windsurf, providingSTDIO injection protection, tool poisoning detection, rug-pull detection, parameter sanitization, policy evaluation, and full audit trails.
• The governance server can be driven by aegis-server.yaml configuration, with guardrails, webhooks (Slack/PagerDuty), rate limiting, cost budgets, and authentication all declaratively configurable.
• Research capabilities: providing a formal definition of Tripartite ActionClaim and an empirical study of silent baselines; tool distribution drift analysis based on Shannon entropy of Tau-Bench trajectories. The CLI reads only the tool_name field, not args, CoT, or prompt, so enterprise users can score production trajectories without leaking PII.

[How to Use]

1. Installation: pip install agent-aegis
2. Runtime protection: aegis.auto_instrument(), or set the environment variable AEGIS_INSTRUMENT=1.
3. Pydantic AI native capabilities: no monkey-patching required, with explicit control per agent.
4. Pre-production scanning: use the aegis scan command and the corresponding parameters.
5. Policy CI/CD: integrate into the CI process, or block ungoverned calls at PR time.
6. Auditing and compliance: use SQLite, JSONL, or webhook receivers, together with Ed25519 signatures.
7. Governance server: run Aegis as a governance server and connect via the Python SDK (synchronous or asynchronous).
8. YAML policies: YAML policies can be used for full control.

[Integrated Frameworks and Adaptation Methods]

• For existing native extension points that can block, prefer native extension points: Google ADK's BasePlugin and CrewAI's BeforeToolCallHook can both block, and auto_instrument() only patches to install native objects.
• Pydantic AI and the OpenAI Agents SDK provide native implementations that can be optionally enabled (AbstractCapability, tool_input_guardrail), while retaining the patch path for zero-code scenarios.
• The remaining frameworks use patching because no blocking hooks exist: native The OpenAI/Anthropic SDK and DSPy do not expose blocking hooks, and LlamaIndex's instrumentation dispatcher emits events but swallows handler exceptions, so they can only be observed and cannot be enforced.
• Patching is a fallback rather than the preferred approach, and it is also the part most susceptible to upstream changes. The integration workflow drives each framework's real entry point daily against the current upstream version and asserts that the guardrails trigger.

[Applicable Scenarios]

• Python agent projects using frameworks such as LangChain, CrewAI, OpenAI, Anthropic, LiteLLM, Google ADK, DSPy, LlamaIndex, and Pydantic AI.
• Teams that need to implement policies, approvals, risk assessment, and auditing for agent tool calls.
• Engineering processes that need to intercept ungoverned AI calls at the PR stage.
• Enterprise environments that need centralized governance and compliance mapping for multi-agent systems.
• Scenarios that need zero-code governance for MCP servers.

[Limitations and Notes]

• Primarily aimed at Python.
• LLM Guard was archived in July 2026 (as stated in the source material; note its time annotation).
• Research shows that running aegis scan across 39 public agent repositories gave 92% a score of F; this is a finding about the ecosystem, not about any specific project.
• The official documentation address is acacian.github.io/aegis, and it includes integration guides, policy reference, security features, API stability, architecture descriptions, and an interactive playground.
• The license is MIT, with copyright owned by 2026 구동하 (Dongha Koo, @Acacian). Created on March 21, 2026.
• The source material does not provide specific fee or pricing information.