HomeSecurity › aegis

aegis

Credential isolation for AI agents. Inject secrets at the network boundary.

TypeScript Local macOSWindowsLinux
★ 14 stars Last pushed 2026-08-06 License: Apache-2.0

Topics: Security

Connect

Review any command before running it. Package names and URLs come from the server's own registry entry.

Package (npm 1.0.5)

npx -y @getaegis/cli@1.0.5

Or add to your MCP client config:

{
  "mcpServers": {
    "aegis": {
      "command": "npx",
      "args": [
        "-y",
        "@getaegis/cli@1.0.5"
      ],
      "env": {
        "AEGIS_MASTER_KEY": "<YOUR_VALUE>",
        "AEGIS_SALT": "<YOUR_VALUE>",
        "AEGIS_DATA_DIR": "<YOUR_VALUE>",
        "AEGIS_PORT": "<YOUR_VALUE>",
        "AEGIS_LOG_LEVEL": "<YOUR_VALUE>",
        "AEGIS_LOG_FORMAT": "<YOUR_VALUE>",
        "AEGIS_VAULT": "<YOUR_VALUE>",
        "AEGIS_REQUIRE_AGENT_AUTH": "<YOUR_VALUE>",
        "AEGIS_POLICY_MODE": "<YOUR_VALUE>",
        "AEGIS_POLICIES_DIR": "<YOUR_VALUE>",
        "AEGIS_METRICS": "<YOUR_VALUE>"
      }
    }
  }
}
  • AEGIS_MASTER_KEY required secret — Master encryption key for the credential vault
  • AEGIS_SALT required secret — Hex-encoded 32-byte salt for key derivation (generated by aegis init)
  • AEGIS_DATA_DIR — Directory for vault databases and registry (default: .aegis/)
  • AEGIS_PORT — Gate proxy port (default: 3100)
  • AEGIS_LOG_LEVEL — Log verbosity: debug, info, warn, error (default: info)
  • AEGIS_LOG_FORMAT — Log output format: json or pretty (default: json)
  • AEGIS_VAULT — Named vault to use (default: default)
  • AEGIS_REQUIRE_AGENT_AUTH — Require agent authentication on every request (true/false, default: false)
  • AEGIS_POLICY_MODE — Policy enforcement mode: enforce, dry-run, or off (default: enforce)
  • AEGIS_POLICIES_DIR — Directory containing YAML policy files
  • AEGIS_METRICS — Enable Prometheus metrics endpoint (true/false, default: true)

Related servers

Listed in punkpeye/awesome-mcp-servers (MIT)

Data from the Official MCP Registry