Aegis
Stop putting API keys where AI agents can read them.
Aegis is a local-first credential isolation proxy for AI agents. It sits between your agent and the APIs it calls — injecting secrets at the network boundary so the agent never sees, stores, or transmits real credentials.
How It Works
Why?
AI agents (Claude, GPT, Cursor, custom bots) increasingly call real APIs — Slack, GitHub, Stripe, databases. The current pattern is dangerous:
- Agents see raw API keys — one prompt injection exfiltrates them
- No domain guard — a compromised agent can send your Slack token to
evil.com - No audit trail — you can't see what an agent did with your credentials
- No access control — every agent can use every credential
Aegis solves all four. Your agent makes HTTP calls through a local proxy. Aegis handles authentication, enforces domain restrictions, and logs everything.
Quick Start
# Install
npm install -g @getaegis/cli
# Initialize (stores master key in OS keychain by default)
aegis init
# Add a credential
aegis vault add \
--name slack-bot \
--service slack \
--secret "xoxb-your-token-here" \
--domains slack.com
# Start the proxy
aegis gate --no-agent-auth
# Test it — Aegis injects the token, forwards to Slack, logs the request
# X-Target-Host tells Gate which upstream server to forward to (optional if credential has one domain)
curl http://localhost:3100/slack/api/auth.test \
-H "X-Target-Host: slack.com"
