aegis

Local AI-agent monitoring, security reviews and explicitly configured action controls.

Install · Use AEGIS · FAQ · Current development · Documentation · Contribute

Windows beta: see published releases and installers. Verify the installer · Beta readiness

Current source version: 0.21.0-beta Later source work is described below. Installed builds contain the features at their release tag.

What AEGIS does

Area	Coverage
Processes	112 agents (265 process-name signatures), process trees, IDE-host and extension detection; Windows primary, macOS/Linux experimental
Files	Changes in configured sensitive directories and agent config paths; Windows open-handle and Restart Manager observations
Network	TCP endpoints for detected agent PIDs, endpoint names and allowlisted / unknown / flagged verdicts
Behavior	73 sensitive-path detection rules across 8 categories, rolling 10-session baselines, anomaly scoring and sequence evidence
Resources and usage	CPU/RAM charts, local LLM probes, Claude Code token subtotals and estimated costs
Runtime inventory	Running WSL distribution names and local Docker/Linux-native Podman candidates; explicit freshness, no guest process inspection
Local review	Project, skill and profile inventory; static findings, saved snapshot comparison and offline report import
Investigation	Agent instances, file/network views, alerts, audit history, statistics and JSON/CSV/HTML/ZIP exports

Monitoring requires no agent plugin or subscription. Default monitoring observes and logs; it does not automatically block commands or contain agents. Kill, suspend and resume are manual actions. See the full capability guide.

Install

Windows

Download the installer, manifest.json and manifest.json.sig from the same GitHub release, then follow offline verification. Release notes describe that installer's features.

Install the first beta manually after verification: the published 0.17.0-alpha updater cannot discover beta releases. When upgrading from 0.14.1-alpha or older, install 0.15.0-alpha or newer manually before using signed in-app updates.

From source

Requires Node.js 24.16.0 or later in the 24.x line. Source uses Electron 45 and 64-bit platforms; macOS requires version 13 or later. Windows 10/11 is primary; macOS/Linux remain experimental.

git clone https://github.com/antropos17/Aegis.git
cd Aegis
npm ci
npm start

On Windows, run npm run build:sidecar after npm ci for native Job/MCP routes and native-helper tests. Linux process actions additionally require Python 3.9+ at /usr/bin/python3 and kernel pidfd support; see Linux process control. The development workflow covers helper builds and checks.

Browser preview

npm run dev
# open http://127.0.0.1:8770

The preview shares desktop components and uses simulated data with an isolated host. It disables native exports and provider requests. npm run frontend:build:preview builds that preview; npm run build:renderer builds the desktop renderer.

Use AEGIS

Source opens Advanced navigation by default. Simple interface in Settings offers investigation, file checks and settings; a saved Simple choice is retained.

Task	Start here
See agents and their activity	Monitoring, then an agent's processes, files or connections
Review a sensitive-file alert	Alerts, then inspect the captured evidence
Inspect a Windows file read	Events → Folder to monitor → Start file read monitoring; setup and limits
Review a project, skill or profile	Local security
Check a selected action against a policy	Action control
Configure selected-action MCP tools	Terminal setup
Find other tools	Start here or Commands (Ctrl K); workspace guide

Monitoring	Local security

These are simulated source UI captures from 11 October 2026. All screenshots and provenance.

Windows x64 packages include experimental Kernel-File reads. In Events, choose a local folder and explicitly start capture with manual UAC consent. It stays off on startup and stops on Stop, monitoring pause, suspend or quit. Events can display a read, its verified issuing agent and Potential sensitive read from path rules. Paths remain candidates, and the label does not establish malicious intent or change risk scores.

Monitoring data stays local, with no usage telemetry or cloud sync. Endpoint naming uses DNS; update checks contact GitHub. Optional Anthropic analysis sends activity metadata on request using your own API key and incurs that service's charges. See privacy and key handling.

Selected action controls

These routes require explicit setup and cover selected actions only. They do not intercept other agent tools, arbitrary MCP traffic or activity outside the route.

Route	Scope
Exact execution policy and terminal review	One selected CLI action; policy deny and failed preparation do not launch. Fresh confirmation can be required per attempt
Windows Job lifetime	Confirmed cleanup of ordinary Job-member descendants; caller file/network privileges are retained
Windows AppContainer	One reviewed offline action in a new retained workspace, zero capabilities, private-file access checks and Job cleanup
Selected-action MCP tools	Up to eight fixed argument-free tools, optional review broker, configuration checks and connection status
Validating MCP gateways	Explicit stdio, loopback HTTP and pinned HTTPS; accepted catalogs and bounded grants
Reviewed file deletion	One exact AEGIS-owned file operation with mandatory terminal confirmation

Optional persistent grants, known-secret checks and live route observation have separate contracts. Configuration checks grant no execution permission; observation does not verify provider identity or blocking. Client settings stay under operator control. Terminal previews and generated configurations can contain private paths or secrets, so keep them private. Setup guides.

Experimental protected Windows guests

Administrative repository APIs can create a private Hyper-V VM, hydrate its original disk from a trusted Windows VHDX, and run one bounded executable as a fresh standard guest user. Actual boot, quota refusal, descendant cleanup and VM removal passed on the recorded source.

The guest has no NICs, a private desktop, a 512 MiB allocation quota, a 32-process/512 MiB Job and a 120-second run limit. These require an administrative disposable lab. Ordinary installed-caller launch stays disabled (launchAllowed=false); complete session integration and independent A1–A4 acceptance remain open. Administrative contract · Protection roadmap.

Current development

The immediate target is a usable Windows Claude Guard: install, launch the supported route, allow ordinary work, block declared dangerous attempts and inspect the result. This is an active delivery target; full installed-route acceptance remains open. See the execution order and current evidence and gaps.

The completion plan tracks the current work and its acceptance boundaries. Source changes and the development context identify the active checkout and evidence. Each qualification record names its own tested revision and package; a source change does not update a published installer.

Recent Observatory work improves keyboard navigation, focus, localization and the clarity of observation and settings states in #1127 and #1128. These source changes do not establish installed-application or native-sensor acceptance.

The following is a historical snapshot from 18 October 2026, through #975 at 96b63b16.

Area	Merged work
Development context	#960 aligns context and skills; #962 adds Windows fixture CI. Contributor workflow
Packaged monitoring	#963 checks the built window and Start/Query/Stop; #964 fixes startup freshness. Evidence boundary
File and TCP sensors	#965 refreshes TCP observations after settings changes and checks owned file/socket activity. Packaged journey
Diagnostic ETW	#966–#973 test scoped reads and recovery after helper, main and custodian loss. Recovery limits
Genuine agent read	#975 verifies installed Claude Code reading a synthetic .env after a preparatory README read, with a visible read, issuer and potential risk. Live record

#974 was closed without merging. Its preflight did not establish an actual Windows restart and post-restart capture; see the current Windows recovery admission.

#976 prepares detected threads