00 AI agent governance platform
Every agent action gets reviewed before it runs. In front of Claude Code, Cursor, Codex, and Devin. No SDK, no migration.
Claude Code
Codex
GitHub CopilotGitHub Copilot
Cursor
Windsurf
+ any MCP agent
| Agent | Tool | semantic_type | Decision |
|---|---|---|---|
| cursor-agent | push_files → main | protected_branch_write | REWRITE |
| claude-code | create_branch | working_commit | ALLOW |
| cursor-agent | terraform_apply | sensitive_path_change | DENY |
| devin | trigger_workflow | large_blast_radius_change | APPROVAL |
| claude-code | push_files | credential_exposure | DENY |
| cursor-agent | commit → aegis_workstation | ephemeral_force_push | ALLOW |
01 The problem
"Claude Code wiped 2.5 years of production data via a Terraform destroy. I watched it happen in real time. There was nothing to catch it."
Production database lost. No approval gate. No undo.
Compromised npm package exfiltrated developer credentials.
Malicious branch names triggered command execution.
02 What Aegis does
An agent pushes straight to main. Instead of blocking it, Aegis creates a branch, pushes there, and opens a PR. The agent never stops. No competitor does this.
Safe reads and writes pass straight through.
Secrets, freeze-window deploys, destroys. Blocked with the reason.
Risky actions pause and ping a human in Slack.
03 Governance in action
Who is pushing, what is failing, whether a release freeze is on. That flips the answer.
18:00 UTCapi-serviceJIRA-4521Release freeze active until 18:00 UTC. Contact @platform-lead for emergency override.
No alert. No interruption. The agent keeps working.
04 Architecture
No model guessing in the decision path. Same input, same answer, every time.
Every tool call is normalized to a canonical action model: push_commit, terraform_apply, execute_migration. Policies become portable across every agent and tool.
A deterministic semantic classifier assembles four contexts before every policy, then outputs semantic_type and blast_radius. Same action, opposite decision depending on context. Microsecond latency.
Retries, idempotency, dead-letter queue, replay. Every step written to an immutable audit trail.
05 Features
Contextual Intelligence
The classifier does not look at the command alone. It pulls four live context structs, then maps the action to a semantic_type and a blast_radius. Deterministic. No LLM in the path.
Audit & compliance
Each action is written immutably with its full context snapshot, the policy that fired, and the decision. Export the whole trail as a SOC 2 evidence pack in one click.
Policy engine
Toggle policies per workspace, schedule release freezes, and keep an org-wide kill switch one click away. Every policy is written against canonical actions, so it works on every connector.
06 Multi-MCP
The canonical action model makes every policy portable. Add a connector, inherit every rule on day one.
07 Go to market
Add Aegis to your agent's MCP config. No code changes. It watches, it does not block.
See what we would have blocked, rewritten, or sent for sign-off, with full context.
Turn on policies one at a time. The first rewrite saves a push to main, and they are sold.
# Cursor / Claude Code / Devin / Windsurf { "mcpServers": { "aegis": { "url": "https://mcp.runaegis.co/v1/<your-room-id>" } } }
08 FAQ
mcp.runaegis.co. Aegis sits in front of the tools the agent already calls.Aegis is the missing layer between your AI agents and the systems they are allowed to touch.