Governing MCP Agents

Give an AI agent a governance gate it calls before it acts — and a hash-chained record of why.

The problem

An AI agent wired to tools makes consequential calls all day: deploy this, refactor that, allocate the resource, send the message. Most of those calls leave no record of why the agent decided to act. When something breaks — or an auditor, customer, or regulator asks — "the agent decided to" is the entire answer you have.

AEGIS gives the agent a gate to call before it acts. The gate returns a structured decision and writes a hash-chained entry you can replay later.

The pattern

The agent proposes an action. AEGIS evaluates it through six gate checks over caller-supplied metrics and returns one of PROCEED / PAUSE / HALT / ESCALATE, with per-gate scores, a confidence value, and rationale. Every authenticated evaluation (not sandbox) appends a SHA-256 hash-chained entry — decision_id, timestamp, gate results, rationale — so the decision log detects tail deletion and entry edits (verifiable against the stored chain; not independently anchored) and can be replayed.

The six gates: Risk, Profit, Novelty, Complexity, Quality, Utility. Each is a check against documented thresholds (Bayesian posteriors, logistic functions, hard floors). All six must pass for PROCEED.

Connect it in one line

The local server installs from PyPI and runs over stdio. Without an API key it uses sandbox mode, which is a call to the hosted service. The hosted service is offline, so evaluation returns an error.

pip install "aegis-governance[mcp]"   # Python >= 3.10
claude mcp add aegis -- aegis-mcp-server

Cursor / Windsurf (.cursor/mcp.json):

{
  "mcpServers": {
    "aegis": { "command": "aegis-mcp-server" }
  }
}

With AEGIS_API_KEY set in the server's environment, the key-required tools (decision history, usage reports, risk checks) are enabled; they also call the hosted service. See the MCP tools reference.

The tools your agent gets

The PyPI package exposes six tools over stdio:

The hosted MCP endpoint (offline) added threshold inspection, scoring guides, proposal records, and crypto-status — ten tools in total.

What an evaluation returns

A PROCEED decision carries its receipts: the status, a confidence value, how many gates passed, the per-gate values against their thresholds, and the rationale. The same call writes the hash-chained audit entry. You can pull any past decision back with aegis_get_decision and verify it against the stored chain.

Honest caveats

• The gate engine runs server-side. The local server and the SDK are thin clients (httpx only); they do not contain the proprietary scoring logic. Sandbox mode is therefore a call to the hosted service, which is offline; nothing evaluates locally.
• When the hosted service runs, sandbox is rate-limited (~10/day per IP).
• AEGIS governs decisions. It does not invoke models, write code, or take the action for you — it tells you whether the action clears the gates, and records that it did.

The Advisor

The AEGIS Advisor is a browser questionnaire that turns your answers into an evaluation request. Its final step calls the hosted API, which is offline, so it does not return a governance decision.