Install Aegis
Install Aegis from the VS Code Marketplace. No web signup is required to start with Community.
Trust infrastructure for software and AI agents
Security claims
need proof.
Trust cannot be another model output.
Today, Aegis independently verifies security-sensitive software changes: what was claimed, what evidence supports it, what was authorized, and whether the resulting change actually held.
code --install-extension aegis-security.aegis-security 
Real Aegis product capture · Attack Graph / Data SentinelVS Code
START HERE
Aegis lives in VS Code.
Install the extension, open your code, and run a scan. Community works without creating a website account.
Scan your code
Open a file, select code, and run Fast Scan. Workspace and dependency scans broaden coverage when you need them.
Understand the evidence
Aegis connects findings to evidence, attack paths, threat reasoning, and verification state so you can see why a claim should be trusted.
Go deeper when needed
Paid and provider-backed analysis is optional. GitHub sign-in on this website is used only to link billing identity and paid access.
Website account?
There is no separate Aegis username and password account to create. The working product stays in VS Code.
The trust problem
Software can act.
Trust cannot be assumed.
AI can propose changes and software can increasingly act without a human writing every line. That makes a security answer less important than the chain behind it: evidence, authorization, independent verification, and an explicit decision.
A finding is not a verdict.
Security conclusions stay distinct from the evidence that supports them.
A patch is not proof.
A proposed change does not get to certify that it solved the problem it addressed.
Missing proof stays missing.
Uncertainty remains visible instead of being flattened into a clean-looking answer.
How Aegis works
Claim → evidence → authorization → verification → decision.
Security-sensitive behavior identified.
Aegis keeps the security claim separate from the evidence used to support it. A finding does not become a verdict just because a scanner or model produced it.
source boundscope explicitprovenance retained
Aegis Snapshot
Drop one file.
See the review surface.
A browser-local preview for the first thirty seconds of evaluation. Source stays in this tab. Snapshot surfaces deterministic review signals; it does not issue a security verdict or replace full Aegis verification.
Browser-localNo uploadNo executionPreview only
OR
PREVIEW / WAITING
Nothing is called safe before evidence exists.
Add one source file. Snapshot will map a small set of deterministic review signals locally, then hand the full-repository decision back to Aegis.
INPUTOne inert text source
NETWORKNone
EXECUTIONNone
OUTPUTReview signals, not a verdict
AEGIS SNAPSHOT / LOCAL
PREVIEW ONLY Review surface materialized.
Review signals0
High-attention0
ScopeONE FILE
ProofUNRESOLVED
PROOF GAP A signal is where the investigation starts.
Snapshot can point at code. It cannot establish the repository-level security claim.
- Reachability
- UNKNOWN
- Exploitability
- NOT ESTABLISHED
- Attack path
- NOT TRACED
- Safe reproduction
- NOT RUN
- Remediation
- NOT PROVEN
- Regression proof
- NOT VERIFIED
TRUTH BOUNDARY Snapshot does not issue VERIFIED.
Lexical signals can prioritize review. Full evidence, authorization, and verification remain product work.
Need the repository, attack graph, remediation, and proof? Snapshot stops before authority begins.
Product proof
From security signal
to a decision you can defend.
Aegis does not compress the workflow into a green badge. It keeps mapping, reasoning, remediation, verification, decision, and control inspectable as separate stages.
01MAP 02REASON 03FIX 04PROVE 05DECIDE 06CONTROL
01 / MAP Start with the materialized attack path.
See the path and its evidence before deciding what deserves deeper verification.
01 / MAP
See the path before the verdict.
Attack Graph / Data Sentinel materializes the source-to-sink path, trust crossings, evidence, and proven sensitive flows before Aegis asks you to trust a security conclusion.
source → sinktrust crossingsevidence
02 / REASON
Reason in repository context.
Threat Model connects assets, trust boundaries, code locations, evidence, and exploitability without silently promoting confidence into proof.
assetsboundariesevidence
03 / FIX
Review the exact change before mutation.
A generated patch is a proposal. Aegis keeps remediation review separate from the evidence required to trust what happens afterward.
bounded changepreflightexplicit review
04 / PROVE
Fix it. Then prove what held.
Target re-verification, regression verification, dynamic replay, rollback state, and the final decision remain distinct. NOT RUN never becomes PASSED.
targetregressionreplaydecision
05 / DECIDE
Incomplete evidence stays incomplete.
Trusted Analysis keeps executed tasks, policy, project state, audit evidence, and integrity visible without substituting planned work for executed proof.
policyauditintegrity
06 / CONTROL
Plan first. Execute only through authorization.
Security Task Plan exposes dependencies, gates, expected artifacts, and execution order without pretending that a plan has already run.
dependenciesgatesauthorization
The Aegis moment
We refuse to call
incomplete proof complete.
This is a condensed trace from the verified launch demo. The stronger conclusion is withheld when a required proof step did not run.
01 / CLAIMSecurity-sensitive changeSUPPORTED
02 / PREFLIGHTFirst candidate introduced a deterministic regressionREJECTED
03 / REPAIRVerifier-guided bounded repair1 / 1
04 / TARGETOriginal target re-verifiedPASSED
05 / REGRESSIONNew deterministic findings introduced0
06 / DYNAMIC REPLAYRuntime replay evidenceNOT RUN
FINAL DECISIONPARTIAL
Target and regression checks passed. Dynamic replay did not run, so Aegis did not present the result as VERIFIED.
The system proposing the change does not get to become its sole certification authority.
Developer surfaces
One trust system.
Where software ships.
VS Code, the signed managed runtime, and the public developer surface preserve the same separation between analysis, evidence, authorization, verification, and decision.
01 / VS CODE
Inspect next to the code.
Review security findings, evidence, verification, policy, and remediation state inside the development loop.
Install Aegis → 02 / PUBLIC SURFACEInspect the developer contract.
Use the public repository for documentation, signed runtime releases, integration contracts, security guidance, and developer-facing artifacts.
Open GitHub → 03 / SIGNED RUNTIMEKeep the workflow local-first.
The extension provisions the signed managed runtime on supported x64 platforms and verifies release metadata before readiness.
Runtime details →Built for trust
Confidence should come from boundaries, not branding.
Aegis separates analysis from permission, a proposed fix from post-change verification, and a billing redirect from actual paid authorization.
Security at Aegis →Local-first developer path
Supported deterministic analysis, evidence, policy, and security state can remain on the developer machine by default.
Explicit authorization
Security-sensitive execution and mutation are treated as separate capabilities rather than implied by analysis.
Independent verification
A proposed result is not trusted merely because the component that created it says it is correct.
Server-authoritative paid access
Founding Pro authorization comes from signed, server-side billing state rather than a client-controlled success screen.
01 / LOCALLoopback managed runtime
02 / RELEASESigned runtime authority
03 / ACTIONExplicit authorization boundaries
04 / PROOFIndependent verification
05 / ACCESSServer-authoritative entitlement
Today and direction
Start with software security.
Build toward accountable autonomy.
The product and the long-term thesis are related, but they are not presented as the same thing.
TODAY
Shipping product · 0.2.5Independent security verification for software changes.
Aegis gives developers an inspectable path from security claim and evidence through authorized validation, remediation, and independent verification.
DIRECTION
Long-term product directionTrust infrastructure for increasingly autonomous software and AI agents.
As software takes more actions on its own, Aegis is being built toward the same core questions at a wider scope: what happened, was it authorized, what proves the result, and should it be trusted?
Start here
One product.
Two obvious ways in.
Use Community to get into the product. Use Founding Pro when you want the paid verification and remediation path.
COMMUNITY$0
Install. Open a project. Inspect the evidence.
- 01Install Aegis from the VS Code Marketplace.
- 02Open a project you are authorized to inspect.
- 03Run Aegis and review the security record.
FOUNDING PRO$19 / month
Identity. Checkout. Server-side activation. Back to Aegis.
- 01Start Founding Pro and establish your GitHub identity.
- 02Complete the secure Paddle checkout.
- 03Aegis waits for authoritative server entitlement before showing paid access.
- 04Open Aegis in VS Code with the entitled identity.
Pricing
Start free.
Scale the verification boundary.
Start with Community. Founding Pro is $19/month. Team is $49 per active contributor with direct setup, and Enterprise is scoped with the organization.
Community · available
$0
For individual developers using the local-first Aegis workflow.
- VS Code extension
- CLI + local runtime
- Local evidence workflow
- Core local verification
$19 / month
For professional developers who want the shipped paid verification and remediation capabilities.
- Attack-surface and threat-model analysis
- Task planning and deeper trusted analysis
- Authorized dynamic validation
- Secure-fix and Fix & Prove workflows
$49 / active contributor
For engineering teams that want Aegis across a shared development workflow. Team is $49 per active contributor, with setup handled directly by Aegis at launch.
- Everything in Pro
- Team onboarding and provisioning
- Shared verification workflow setup
- Pull-request and policy scope agreed before enablement
Custom
For organizations evaluating private deployment, governance, and deeper security integrations.
- Private or hybrid deployment discussion
- Organization policy and governance scope
- Security and data-boundary review
- Integration scope defined before enablement
GitHub identityPaddle checkoutServer-side entitlementOpen Aegis in VS Code
AEGIS
Security claims
need proof.
Install Aegis, open a project, and inspect the evidence yourself.