@aegis.org/mcp — Aegis AI governance as an MCP server

One policy decision point. Every agent. No per-agent code.

Aegis governs whether an AI action is safe — PII redaction, attack/intent detection, regulatory policy, and multi-step agent-trajectory verification (Ring 12). This package exposes that governance over the Model Context Protocol, the protocol Claude Code, Codex, Cursor, Antigravity, and other hosts all speak. Install it once and every MCP host routes through the same hosted backend — the policy decision point (PDP).

 Claude Code ┐
 Codex CLI   ├─► aegis-mcp (stdio) ─► Aegis backend (PDP) ─► ALLOW / WARN / KILL
 Cursor      ┘                         one brain, many hosts

Tools

| Tool | Purpose | |---|---| | aegis_analyze | Govern a single query → response. Returns decision (ALLOW/BLOCK/SUPPORT/HITL), category, risk_score, reason, PII-redacted safe_query. | | aegis_begin_session | Open a Ring 12 trajectory session against an agent goal. Returns a session_id. | | aegis_evaluate | Evaluate one agent step before executing it. Returns ALLOW / WARN / KILL_SESSION, hard_block, and the five drift signals. | | aegis_end_session | Close a trajectory session; returns the drift rollup. |

A backend that can't be reached returns an MCP tool error — the server fails closed (an unreachable governor never looks like an ALLOW).

Configuration

The server reads its backend target from the environment:

| Var | Default | Notes | |---|---|---| | AEGIS_BASE_URL | http://localhost:8000 | Hosted PDP URL. Non-loopback hosts must be https:// (PII in transit). | | AEGIS_API_KEY | (none) | Sent as X-API-Key. Required against a multi-tenant backend (POSTGRES_URL set) — a missing key is a hard 401. | | AEGIS_TENANT_ID | demo | Tenant scope for trajectory sessions. |

Install & run

npm i -g @aegis.org/mcp        # or: npx -y @aegis.org/mcp
aegis-mcp                      # serves over stdio

Register with a host

Claude Code (~/.claude/settings.json or project .mcp.json):

{
  "mcpServers": {
    "aegis": {
      "command": "npx",
      "args": ["-y", "@aegis.org/mcp"],
      "env": {
        "AEGIS_BASE_URL": "https://api.aegis.dev",
        "AEGIS_API_KEY": "aeg_xxx"
      }
    }
  }
}

Codex / Cursor / Antigravity / any MCP host — same shape; point the host's MCP config at the aegis server above. The block is identical because the governance lives in the backend, not the adapter.

Programmatic use

import { buildServer, AegisHttpClient } from '@aegis.org/mcp';
const server = buildServer(new AegisHttpClient({ baseUrl: 'https://api.aegis.dev', apiKey: 'aeg_xxx' }));
// attach your own transport, or just run the `aegis-mcp` bin.

Develop

npm install
npm run typecheck
npm run build
npm test           # node:test via tsx — client + in-memory MCP server tests

MIT · part of Aegis AI — Chakravyuha.