|
| 1 | +{ |
| 2 | + "schema_version": 1, |
| 3 | + "id": "io.pilot.aegis", |
| 4 | + "display_name": "AEGIS", |
| 5 | + "tagline": "Runtime firewall for AI agents — blocks prompt injection before your agent reads it", |
| 6 | + "description_md": "# AEGIS — runtime firewall for AI agents\n\nAEGIS inspects untrusted content reaching your agent — inbox messages, tool results, web fetches, MCP responses, skill files, memory notes — and blocks **prompt injection, jailbreaks, and impersonation** before the agent ever sees it. Genuine status messages pass straight through.\n\n## How it works\n\nTwo layers. **L1** is Aho-Corasick pattern matching in pure Rust — microseconds, ~120 known attack families with homoglyph and leetspeak normalization and a sliding-window scan. **L2** is an optional local Qwen3-1.7B judge via llama.cpp — fully offline, no network. On a held-out labeled set: **90% recall, 95% precision, 92% F1**. An 880 KB binary with an HMAC-chained audit log at `~/.aegis/audit.jsonl`.\n\n## Using it\n\n- `aegis.scan \u003cpath\u003e` — one-shot scan of a file or directory.\n- `aegis.exec {\"args\":[\"scan-cmd\"],\"stdin\":...}` — the PreToolUse blocking gate (exit 0 allow / 2 block).\n- `aegis.exec {\"args\":[\"scan-result\"],\"stdin\":...}` — the PostToolUse non-blocking check (warns).\n- `aegis.status` / `aegis.targets` / `aegis.config` — audit log, protected surfaces, and configuration.\n\nThe L2 judge model (~1.8 GB) is optional — L1 patterns work without it.", |
| 7 | + "vendor": { |
| 8 | + "name": "Pilot Protocol", |
| 9 | + "url": "https://aegis.pilotprotocol.network", |
| 10 | + "contact": "apps@pilotprotocol.network", |
| 11 | + "publisher_pubkey": "ed25519:+nt58BA0gpPYuyaeG2GwfTI79j8IHP+zra5GvRQv0N0=" |
| 12 | + }, |
| 13 | + "homepage": "https://aegis.pilotprotocol.network", |
| 14 | + "source_url": "https://github.com/pilot-protocol/aegis", |
| 15 | + "license": "MIT", |
| 16 | + "categories": [ |
| 17 | + "security", |
| 18 | + "firewall", |
| 19 | + "guardrail" |
| 20 | + ], |
| 21 | + "keywords": [ |
| 22 | + "security", |
| 23 | + "firewall", |
| 24 | + "prompt-injection", |
| 25 | + "jailbreak", |
| 26 | + "guardrail", |
| 27 | + "defense", |
| 28 | + "offline" |
| 29 | + ], |
| 30 | + "size": { |
| 31 | + "bundle_bytes": 5351198, |
| 32 | + "installed_bytes": 9621928 |
| 33 | + }, |
| 34 | + "compat": { |
| 35 | + "min_pilot_version": "1.0.0", |
| 36 | + "runtimes": [ |
| 37 | + "go" |
| 38 | + ] |
| 39 | + }, |
| 40 | + "methods": [ |
| 41 | + { |
| 42 | + "name": "aegis.scan", |
| 43 | + "summary": "One-shot scan of one or more files or directories for prompt injection, jailbreaks, homoglyph/leetspeak obfuscation, and impersonation. Returns the verdict per path. This is `aegis scan \u003cpath\u003e...`." |
| 44 | + }, |
| 45 | + { |
| 46 | + "name": "aegis.status", |
| 47 | + "summary": "Tail the HMAC-chained audit log of recent verdicts. This is `aegis status`." |
| 48 | + }, |
| 49 | + { |
| 50 | + "name": "aegis.targets", |
| 51 | + "summary": "List the agent surfaces AEGIS is protecting (inbox, tool results, skill files, memory, ...). This is `aegis targets`." |
| 52 | + }, |
| 53 | + { |
| 54 | + "name": "aegis.config", |
| 55 | + "summary": "Show the effective AEGIS configuration (rules, thresholds, watch targets). This is `aegis config`." |
| 56 | + }, |
| 57 | + { |
| 58 | + "name": "aegis.version", |
| 59 | + "summary": "Print the AEGIS version. This is `aegis version`." |
| 60 | + }, |
| 61 | + { |
| 62 | + "name": "aegis.exec", |
| 63 | + "summary": "Run any AEGIS subcommand with a verbatim argv — the full surface beyond the curated methods. Payload is {\"args\":[\u003csubcommand\u003e, ...]} with optional {\"stdin\":\"...\"}. This is how you use the blocking gates: the PreToolUse gate {\"args\":[\"scan-cmd\"],\"stdin\":\"{\\\"tool_input\\\":{\\\"command\\\":\\\"...\\\"}}\"} exits 0 (allow) or 2 (block); the PostToolUse gate {\"args\":[\"scan-result\"],\"stdin\":\"{...}\"} warns without blocking. Also reaches init/daemon/install-models/install-hooks." |
| 64 | + }, |
| 65 | + { |
| 66 | + "name": "aegis.help", |
| 67 | + "summary": "Print the AEGIS usage and subcommand list. This is `aegis --help`." |
| 68 | + }, |
| 69 | + { |
| 70 | + "name": "aegis.help", |
| 71 | + "summary": "Discovery: every method with params, kind, and latency class." |
| 72 | + } |
| 73 | + ], |
| 74 | + "changelog": [ |
| 75 | + { |
| 76 | + "version": "0.1.3", |
| 77 | + "notes": [ |
| 78 | + "Released v0.1.3" |
| 79 | + ] |
| 80 | + } |
| 81 | + ], |
| 82 | + "links": [ |
| 83 | + { |
| 84 | + "label": "Source", |
| 85 | + "url": "https://github.com/pilot-protocol/aegis" |
| 86 | + }, |
| 87 | + { |
| 88 | + "label": "Website", |
| 89 | + "url": "https://aegis.pilotprotocol.network" |
| 90 | + } |
| 91 | + ] |
| 92 | +} |
0 commit comments