Aegis Invariant Kernel Documentation

Aegis is an in-process, deterministic safety clearance gateway for AI Agent tool calls. It intercepts tool invocations before execution, verifying AST invariants, numerical bounds, and schema contracts in <2ms with 0 network egress.

Quickstart

1. Node.js & TypeScript

npm install @aegis-kernel/core
npx aegis init

2. Python 3.9+ (zero dependencies)

pip install aegis-kernel

from aegis_kernel import aegis_guard

@aegis_guard(tool_name="database_exec")
def execute_sql(query: str):
    # Automatically blocked if query contains mass DELETE without WHERE or DROP TABLE
    return db.execute(query)

Model Context Protocol (MCP) Middleware

Aegis provides drop-in JSON-RPC middleware for MCP servers with runtime schema pinning and output redaction:

import { AegisMCPMiddleware } from '@aegis-kernel/mcp';

const mcpGuard = new AegisMCPMiddleware({
  mode: 'enforce',
  packs: ['@aegis/sql-guard', '@aegis/data-guard']
});

server.setRequestHandler(CallToolRequestSchema, async (request) => {
  const clearance = await mcpGuard.interceptCall(request);
  if (!clearance.allowed) {
    return clearance.errorResponse; // Returns self-healing suggestedFix to agent
  }
  return executeTool(request);
});

Framework Middleware: CrewAI, AutoGen & Semantic Kernel

Turn-key, drop-in middleware packages — duck-typed against each framework's public contract, so none of them pin the framework as a dependency. Blocked calls return structured AEGIS_BLOCKED feedback the agent self-corrects against.

CrewAI — pip install aegis-kernel-crewai

from aegis_kernel_crewai import guard_crew

crew = Crew(agents=[analyst, dba], tasks=[task])
guard_crew(crew)   # every tool of every agent is now Aegis-guarded
crew.kickoff()

Also available: guard_tool, guard_agent, and the @aegis_crewai_tool decorator for function tools.

AutoGen / AG2 — pip install aegis-kernel-autogen

from aegis_kernel_autogen import guard_function

agent = AssistantAgent(name="dba", model_client=client,
                       tools=[guard_function(execute_sql)])

Legacy two-agent pattern: guard_function_map(user_proxy). Modern FunctionTool objects: guard_tool(tool).

Microsoft Semantic Kernel

from aegis_kernel_autogen import add_aegis_filter

kernel = Kernel()
add_aegis_filter(kernel)   # deterministic clearance on every function invocation

Browser Guard: Browser-Use & OpenManus

pip install aegis-kernel-browser-guard — deterministic clearance for the three riskiest browser-agent surfaces: navigation (dangerous schemes, IP literals, punycode homographs, zero-width URL smuggling, domain allow/deny lists), typed input (API keys, credit cards, SSNs), and file transfer (executable downloads, sensitive-path uploads).

from aegis_kernel_browser_guard import (
    guard_browser_use_controller, AegisBrowserGuard, BrowserPolicy
)

controller = Controller()
guard_browser_use_controller(controller, AegisBrowserGuard(
    BrowserPolicy(allowed_domains=["wikipedia.org", "arxiv.org"])
))
agent = Agent(task="Research AST parsers", llm=llm, controller=controller)

OpenManus: guard_openmanus_tool(BrowserUseTool()). Staged rollout: AegisBrowserGuard(mode="monitor") records violations without blocking.

Enterprise Compliance Rule Packs

Cryptographic SHA-256 ProofHash

Every tool evaluation produces an immutable proof hash binding the tool call to the policy commitment:

ProofHash = SHA256(ToolName + CanonicalJSON(Params) + PolicyHash + Timestamp)