AEGIS FAQ

AEGIS is an open-source pre-execution firewall for LLM tool calls. It sits between the model's decision to call a tool and the tool's execution, applying a cost-aware three-layer cascade (rules → XGBoost → LLM judge) to decide allow / block / pending. Peer-reviewed cascade in arXiv:2603.12621; MIT-licensed engine at github.com/Justin0504/Aegis.

Between the model's decision to call a tool and the tool's execution, most agent stacks have no enforcement layer. A single hallucinated or prompt-injected tool call — DELETE, wire_transfer, send_email, exec_shell — can cause irreversible damage before any human is aware. AEGIS is that missing enforcement layer.

Guardrails (NeMo, Guardrails AI, Llama Guard) filter or repair text. A runtime firewall (AEGIS) filters actions — tool calls that would otherwise cause side effects. Both are useful; most production stacks use both because they defend at different points.

Observability platforms (Langfuse, Helicone, Arize) record what happened after the fact. AEGIS decides what will happen before it happens. Deploy alongside each other: AEGIS gates, Langfuse ingests the trace.

14 frameworks: Anthropic, OpenAI, LangChain, CrewAI, Gemini, Bedrock, Mistral, LlamaIndex, smolagents (Python); Anthropic SDK, OpenAI SDK, LangChain, Vercel AI SDK (JavaScript / TypeScript); Go. Integration is a one-line agentguard.auto() call that patches every detected SDK at import time. Existing agent code is unchanged.

Two lines of code and about five minutes. Import agentguard, call agentguard.auto(). The SDK monkey-patches supported frameworks on import; no framework-specific configuration is required for the default policy.

No. LangChain graphs, CrewAI flows, Anthropic tool_use blocks, and OpenAI function calls all run unchanged. Only the two-line initialiser is added.

Yes. AEGIS treats MCP tool definitions as first-class tools. Every tool_use routed through an MCP server flows through the same gateway policy, with the mcp_server_id captured in the audit trail.

Yes. The two-line auto() covers detected SDKs; for a custom framework, wrap your tool invocation in agentguard.check(tool_name, arguments) — a synchronous call that returns allow / block / pending. About 5 lines of glue per tool binding.

The full three-layer cascade achieves 1.06 ms P50 latency (P95 2.99 ms, P99 7.4 ms) on the 5,525-record ToolGuard-Bench. L1 rules run in ~0.7 ms; L2 XGBoost adds ~0.3 ms; the L3 LLM judge is only invoked for the small (< 0.3%) ambiguous residual, and can be swapped between Claude Haiku, GPT-4o-mini, or a local model.

99.9% block rate on ToolGuard-Bench (3,413 malicious + 2,112 benign tool calls from InjecAgent + ToolEmu + OWASP LLM Top-10 + curated). For context: rules-only defences catch 1.2%, Llama-Guard 3-8B catches 67.1%, pure LLM judges (Claude Haiku / GPT-4o-mini) catch 96.6% / 98.8% at 2,211 / 1,204 ms P50 respectively.

Under 10 obfuscation transforms (base64 wrap, hex encoding, Unicode homoglyphs, paraphrase, URL encode, whitespace pad, case flip, comment split, double-encode) applied to 3,413 malicious records each, the cascade's block rate never drops below 97.5%. Full table in arXiv:2603.12621 Appendix D.

ToolGuard-Bench is our unified benchmark for tool-call safety: 5,525 records drawn from InjecAgent (3,340 malicious prompt-injection cases), ToolEmu (144 emulated tool executions), OWASP LLM Top-10 (20 payloads), and the AEGIS in-distribution curated suite (57). Available under research/benchmark/data/aegis-bench.jsonl in the repo; distribution and evaluation harness are open-source.

Trained on a labelled subset of ToolGuard-Bench using 15 structural features (argument count, depth, character-distribution ratios, Shannon entropy, base64/hex-like scores, URL count, IP literals, path separators). 300 trees, depth 6, standard cross-validated hyperparameter tuning. Full feature list in arXiv:2603.12621 §2.2.

Yes — this is the default deployment. AEGIS ships as a single binary plus optional Postgres. Docker Compose, Helm chart, macOS Apple Silicon .dmg, Windows x64 .msi, and Linux .deb all shipping in the v0.2.0 release.

Yes. The engine requires no outbound network for enforcement. The Ed25519-signed audit chain can be verified offline with a 245-line Node stdlib script (tools/verify-log). Used by regulated deployments in fintech, healthcare, and government.

A single VM or container (2 vCPU, 1 GB RAM is comfortable for < 100k calls/day) and optional Postgres for the audit chain. SQLite works for solo / dev. The gateway binary is ~85 MB unpacked.

Yes. Helm chart at charts/aegis in the repo. Ships NetworkPolicy for network isolation and a PodDisruptionBudget for HA. Vanilla HPA scales on request rate.

For the desktop app: Tauri auto-updater checks the GitHub releases feed and applies the update on next launch. For self-hosted server: pull the latest container tag or install the new .deb. Policies and audit logs are preserved across upgrades.

The Enterprise tier ships the SOC 2 Type II report as part of the evidence pack. The core engine's primitives (Ed25519 + SHA-256 hash chain) map to SOC 2 CC6.1 / CC7.2 / CC8.1 without additional infrastructure.

SOC 2 Type II (Enterprise), PCI-DSS v4.0 Req 8 + 10, HIPAA §164.312 (all 5 implementation specs mapped), EU AI Act Articles 12–15 (signed evidence pack), GDPR Article 22 (automated decision-making transparency).

Every trace is signed with a per-agent Ed25519 key and hash-chained with SHA-256 to its predecessor (RFC 6962 style, same standard browsers use for SSL certificate transparency). Post-hoc modification of any entry invalidates the chain and can be detected by an offline verifier. Auditors can verify the log without trusting AEGIS.

A signed JSON export aligned to EU AI Act Articles 12 (record-keeping), 13 (transparency), 14 (human oversight), and 15 (accuracy + robustness). Provides the "how-was-this-decided" and "who-decided-this" evidence that Article 14 requires for high-risk AI systems.

Plain database logs are trivially editable by anyone with DB access — they fail covered-entity review under HIPAA §164.312(b) and EU AI Act Article 12 because post-hoc modification cannot be detected. A cryptographic hash chain makes any modification detectable by third parties without trusting the operator.

The MIT-licensed core is free forever with unlimited self-host. Paid tiers: Pro at $29/mo (100k checks, LLM-judge, DSL editor, OIDC SSO), Team at $99/mo (1M checks, cryptographic audit unlock, SAML, self-host EE license, custom detectors), Enterprise custom (BYOC, on-prem airgap, SOC 2 evidence, 24/7 SLA).

MIT license — permissive, no restrictions on commercial use, no copyleft. Paid tiers layer additional features via a license key; the engine keeps running with the free tier even if the paid license is not renewed. Documentation and blog content are CC-BY-4.0.

One POST to /api/v1/check — the gateway endpoint the SDK hits before every tool invocation. One user prompt to an agent typically produces 3–10 checks depending on how many tools the agent chains. Free tier (1k/mo) covers a solo developer; Pro (100k/mo) covers small production deployments; Team (1M/mo) covers most mid-market usage.

The engine is free forever — no trial required. Paid tiers are subscription-based via Stripe with instant upgrade / downgrade. No credit card required to start using the engine.

AEGIS is an MIT-licensed self-hostable runtime firewall with a cryptographic audit chain and peer-reviewed cascade. Lakera Guard is a mature commercial API with a broad multi-lingual content-safety detector catalogue. Full deltas at /vs/lakera-guard.

AEGIS gates tool-call execution. NeMo Guardrails uses the Colang DSL to shape dialog flow. Different points of intervention; many teams deploy both. Full deltas at /vs/nemo-guardrails.

AEGIS mediates tool calls at runtime; Langfuse records traces post-execution. Deploy alongside each other — AEGIS gates the call, Langfuse ingests the trace. Full deltas at /vs/langfuse.

It depends on scope. For tool-call enforcement + audit, yes. For conversational flow rails (dialog shaping), consider NeMo Guardrails alongside. For structured-output validation with a validator marketplace, consider Guardrails AI. Full multi-tool catalogue at /tools.