Home › Security › getaegis/aegis

getaegis/aegis

Credential isolation for AI agents. Inject secrets at the network boundary.

TypeScript Local macOSWindowsLinux

★ 16 stars Last pushed 2026-08-06 License: Apache-2.0

View repository →

Connect

Review any command before running it. Package names and URLs come from the server's own registry entry.

Package (npm 1.0.5)

npx -y @getaegis/[email protected]

Or add to your MCP client config:

{
  "mcpServers": {
    "aegis": {
      "command": "npx",
      "args": [
        "-y",
        "@getaegis/[email protected]"
      ],
      "env": {
        "AEGIS_MASTER_KEY": "<YOUR_VALUE>",
        "AEGIS_SALT": "<YOUR_VALUE>"
      }
    }
  }
}

AEGIS_MASTER_KEY required secret — Master encryption key for the credential vault
AEGIS_SALT required secret — Hex-encoded 32-byte salt for key derivation (generated by aegis init)
AEGIS_DATA_DIR — Directory for vault databases and registry (default: .aegis/)
AEGIS_PORT — Gate proxy port (default: 3100)
AEGIS_LOG_LEVEL — Log verbosity: debug, info, warn, error (default: info)
AEGIS_LOG_FORMAT — Log output format: json or pretty (default: json)
AEGIS_VAULT — Named vault to use (default: default)
AEGIS_REQUIRE_AGENT_AUTH — Require agent authentication on every request (true/false, default: false)
AEGIS_POLICY_MODE — Policy enforcement mode: enforce, dry-run, or off (default: enforce)
AEGIS_POLICIES_DIR — Directory containing YAML policy files
AEGIS_METRICS — Enable Prometheus metrics endpoint (true/false, default: true)