Aegis is a drop-in security layer for MCP agents. A prompt-injection firewall scans every tool response before your agent reads it. Aegis Scan checks the contract before your agent signs. Nothing malicious reaches the agent, nothing malicious leaves it — GO / CAUTION / NO in milliseconds, with on-chain receipts.
Aegis is a pipeline of small, single-purpose agents. Each does one job, emits its own evidence, and hands off to the next. No agent can be talked out of its job by the text it is inspecting — the gate is code, not a prompt.
Peels back base64, hex, percent and unicode-escape layers, strips zero-width splitters and folds homoglyphs so a hidden payload is judged by what it decodes to.
Matches instruction-override, role hijack, exfiltration, tool-call injection and embedded-transaction directives — conservative enough to keep benign docs clean.
Inspects the transaction the agent is about to sign: unlimited approvals, recipients off the operator allow-list, single-call drains.
Simulates transfer/approve via read-only eth_call to catch honeypots, and reads holder concentration, burned supply and pool integrity.
Corroborates on-chain signals with the GoPlus dataset: tax, mint authority, pausable transfers, blacklist, owner-can-rewrite-balance.
Sums weighted findings into a deterministic GO / CAUTION / NO. Any DANGER finding forces NO — the gate a model can never override.
Drop any ERC-20 address and pick a network. Aegis Scan pulls live GoPlus reputation and DexScreener market depth, runs the full deterministic battery, and returns a reproducible GO / CAUTION / NO with every finding — no mock, no LLM.
Real scan over live GoPlus + DexScreener data. Unsupported chains return UNKNOWN.
Paste anything an MCP tool might return — or try a preset attack. This runs the real @aegis/firewall on the server and shows the evidence behind the decision.
The verdict is a weighted sum of independent signals. Below is the real scoring table and a live count of scans run from this page — every figure is a property of the code, not a usage claim.
Every number here is a property of the code in this repository — not a usage claim. Run a scan above and the session counter ticks up.
Aegis Scan ships on PyPI as a self-contained agent skill — a CLI and an MCP server. Install it in one command and scan contracts from your own machine, or wire it into any MCP-compatible agent.
A one-install skill for Claude and any MCP agent: drop it in and your agent scans every contract and every tool response natively, before it acts — no glue code. The CLI and MCP server above are live today; the packaged neural-agent skill lands next.
Every decision can be anchored to AegisRegistry on Robinhood Chain — a hash of the verdict, score and full report. Repos and agents point a safety badge at their latest receipt, so anyone can verify the guard was on and unmodified.