Aegis

# Aegis

> Aegis is an open-source desktop app for local AI-agent monitoring, file reviews and selected-action policy checks. Monitoring combines polling with event-based file watchers; coverage and attribution have documented limits.

Current source also provides opt-in exact-action execution policies and explicitly configured MCP action routes. Default monitoring does not intercept commands or isolate agents. A separate opt-in Windows Job route can bound the lifetime of ordinary descendants of one selected action after confirmed cleanup; it does not restrict file or network access. The separate AppContainer confirmation CLI verifies a zero-capability Windows token and Job for one bounded action in a new retained workspace. Installed builds contain only the features at their release tag.

## Documentation

- [README](https://github.com/antropos17/Aegis/blob/master/README.md)
- [Documentation index](https://github.com/antropos17/Aegis/blob/master/docs/README.md)
- [Guided desktop workflows](https://github.com/antropos17/Aegis/blob/master/docs/OBSERVATORY-GUIDED-WORKFLOWS.md)
- [Security Policy](https://github.com/antropos17/Aegis/blob/master/SECURITY.md)
- [Contributing Guide](https://github.com/antropos17/Aegis/blob/master/CONTRIBUTING.md)
- [Code of Conduct](https://github.com/antropos17/Aegis/blob/master/CODE_OF_CONDUCT.md)

## Key Features

- Process monitoring with 112 known AI agents (265 process-name signatures) and parent-child tree resolution
- File system watching for sensitive directories (.ssh, .aws, .gnupg, .env, cloud configs)
- Network activity logging with per-agent PID tracking and reverse DNS
- Behavioral analysis with 73 detection rules across 8 categories
- Trust scoring with grades A+ through F using time-decay algorithms
- Local LLM detection (Ollama, LM Studio, vLLM, llama.cpp)
- Export to JSON, CSV, HTML reports and ZIP archives
- YAML rulesets with JSON Schema validation; edits to existing files hot-reload in unpacked runs
- Explicit policy-controlled direct child execution, with optional fresh terminal confirmation for one launch attempt
- Selected-action MCP catalogs of up to eight fixed argument-free action tools, with revision binding and optional terminal review per call
- Nonexecuting route/catalog configuration checks and read-only current-MCP-connection counters; neither grants execution permission nor proves outside-route coverage
- Node-only MCP client configuration generation for selected-action, catalog or relay routes; emits an `mcpServers.aegis` entry for explicit client loading, without reading selected files or installing settings
- Observatory Action control workspace: main-owned native file selection and nonexecuting route/catalog checks; captured results do not establish a connected agent or verified blocking
- Opt-in --observe endpoint for selected/catalog MCP owners: separate read-only desktop observation, bounded counters, self-reported client label/version and sticky coverage loss; no independently verified provider identity or blocking
- Local security workspace: selected project/profile static reviews, bounded inventory, saved snapshot comparison and offline report import, with explicit coverage limits
- Guided Observatory navigation with distinct local SVG icons, task search, result-first review screens and optional technical details; English and Brazilian Portuguese

Local monitoring has no telemetry; endpoint naming uses DNS queries. Optional AI analysis sends activity metadata to Anthropic on request; update actions contact GitHub. AEGIS does not automatically enforce OS-level restrictions.

Direct and Job-only execution retain caller file/network privileges. The explicit AppContainer confirmation route adds OS access checks, zero capabilities and Job cleanup, with separate receipts for isolation, retained workspace and temporary-profile cleanup. Installed agents and ordinary launches do not enter it automatically. Private action previews can expose secrets in terminal scrollback; a TTY does not authenticate human presence. No client settings are changed automatically.

Generated client configuration intentionally includes local executable and selected-file paths. Keep it private; generation does not verify those files or a client's compatibility.

## Technical Details

- **Stack**: Electron, Svelte 5, Vite; CommonJS JavaScript in main, TypeScript in the renderer and shared types. Exact versions: package.json
- **Tests**: Vitest; run `npm test` for current pass/skip and file counts
- **License**: MIT
- **Version**: 0.17.0-alpha <!-- x-release-please-version -->
- **Platform**: Windows primary; macOS/Linux experimental

## Links

- Repository: https://github.com/antropos17/Aegis
- Local demo instructions: https://github.com/antropos17/Aegis#try-without-ai-agents
- Documentation: https://github.com/antropos17/Aegis/blob/master/docs/README.md
- Download prereleases: https://github.com/antropos17/Aegis/releases
- Privacy and external requests: https://github.com/antropos17/Aegis/blob/master/SECURITY.md#privacy-architecture
- Windows AppContainer launch: https://github.com/antropos17/Aegis/blob/master/docs/ACTION-APPCONTAINER.md
- Exact execution contract: https://github.com/antropos17/Aegis/blob/master/docs/ACTION-EXECUTION.md
- MCP catalog and review: https://github.com/antropos17/Aegis/blob/master/docs/ACTION-MCP-CATALOG.md
- Nonexecuting checks: https://github.com/antropos17/Aegis/blob/master/docs/ACTION-ROUTE-CHECK.md
- Connection status: https://github.com/antropos17/Aegis/blob/master/docs/ACTION-MCP-STATUS.md
- Explicit MCP client configuration: https://github.com/antropos17/Aegis/blob/master/docs/ACTION-MCP-CONFIG.md