Documentation

Aegis

A two-way security shield for agentic trading on Robinhood Chain. A prompt-injection firewall guards what your agent reads; Aegis Scan guards what your agent signs. Every verdict is deterministic code — no LLM in the decision path.

Introduction

An AI agent that both reads untrusted data and signs transactions has two attack surfaces. Aegis closes both with auditable gates:

  • Way in — the firewall scans every MCP tool response for prompt injection before your agent reads it.
  • Way out — Aegis Scan checks a token contract and the proposed trade before your agent signs.

Both return a verdict with the evidence behind it: GO / CAUTION / NO for trades, allow / flag / block for tool responses.

Quickstart

Install the token-scanning skill from PyPI — one line:

pip install aegis-scan

Scan a contract straight from your terminal:

aegis scan 0x6b175474e89094c44da98b954eedeac495271d0f --chain ethereum
# → verdict: GO   risk score: 3

Add the firewall to a Node/MCP project:

npm i @aegis/firewall

Core concepts

The verdict is a weighted sum of independent signals. Each check contributes risk points by severity (OK 0 · INFO 1 · WARN 3 · DANGER 10-weighted). Any single DANGER finding forces NO. Thresholds decide the rest — the same input always yields the same verdict, so it is reproducible and auditable.

CLI usage

# scan a token before you buy
aegis scan <TOKEN_ADDRESS> --chain ethereum --amount 1000

# JSON output for scripting (exit code: 0=GO, 1=CAUTION, 2=NO)
aegis scan <TOKEN_ADDRESS> --chain base --json

# check RPC connectivity
aegis doctor --chain robinhood

MCP server

Expose Aegis Scan as a tool any MCP-compatible agent can call (Claude Desktop/Code, Cursor, Cline, or a custom SDK agent):

pip install "aegis-scan[mcp]"
aegis-mcp        # stdio transport

The agent gets the same verdict the CLI would — scan_token, check_rpc, and list_chains tools, read-only. It never signs, holds funds, or trades.

The check battery

21 deterministic checks across six families:

  • Contract — code exists, ownership renounced, supply sanity.
  • Honeypot — simulated transfer() / approve() via read-only eth_call.
  • Concentration — self-held supply, burned float.
  • Pool — pool exists, pair integrity, in-range liquidity.
  • Reputation — GoPlus: honeypot, tax, mint, pausable, blacklist, owner-can-rewrite-balance.
  • Market / execution — liquidity, 24h volume, trade-size-vs-depth, tokenized-stock (RIF) divergence.

Supported networks

The web scanner reads live GoPlus reputation and DexScreener market data for Ethereum, Base, BNB Chain, Arbitrum, Polygon, Optimism and Avalanche. For Robinhood Chain, run the CLI with an RPC endpoint for the full on-chain simulation.

Prompt-injection firewall

Scan a single tool response before your agent reads it:

import { scanText } from "@aegis/firewall";

const r = scanText(toolResponse, { source: { server: "dexscreener", tool: "get_token_info" } });
if (r.decision === "block") throw new Error(r.signals[0].title);

It decodes base64 / hex / unicode-escape layers, strips zero-width cloaking, then runs heuristics for instruction-override, role hijack, exfiltration, tool-call injection and embedded-transaction directives — returning allow / flag / block plus a sanitized copy of the text.

Action guard

Inspect the transaction the agent is about to sign:

import { guardAction } from "@aegis/firewall";

const signals = guardAction(
  { kind: "approve", to: spender, amount },
  { allowlist: [knownRouter] },
);
if (signals.length) blockAndConfirm(signals);

Flags unlimited approvals, recipients off the operator allow-list, and single-call drains.

On-chain receipts

Any verdict can be anchored to AegisRegistry on Robinhood Chain — a hash of the verdict, score and full report. A third party can then verify the agent acted on a real, unmodified decision, and repos/agents can point a safety badge at their latest receipt.

FAQ

What does “0 LLM” mean?

No large language model participates in the verdict. The decision is pure deterministic code, so it cannot be jailbroken by a prompt injection, cannot hallucinate, and returns the identical result for the identical input. A model may optionally explain the findings, but it never overrides the gate.

Does Aegis ever move funds?

No. It is strictly read-only — it inspects and reports. You (or your agent) decide.

Is it open source?

Yes, MIT. Source: github.com/aegisagentdev/aegis.

MIT · Aegis · aegismcp.io