Interactive trust workspace.
Inspect claims, evidence, model provenance, verification, policy, memory, and fix state where code changes happen.
Developers
Put evidence in the development loop.
Aegis currently meets developers in VS Code, GitHub workflows, and the local CLI/API. The user interface changes by surface; the underlying trust model does not.
Pull-request policy gate.
Carry the same security decision model into CI and preserve machine-readable artifacts for review.
Automation without a UI dependency.
Use the same local orchestration backend from terminal-driven and integration workflows.
Current surfaces
One trust model.
Three entry points.
These surfaces reflect the public 0.2.0 product. Hosted collaboration and broader software-agent runtime controls are not presented here as shipped capabilities.
Shipping in 0.2.0
Open Marketplace Evidence lives next to the code that created the question.
Choose a layer in the inspector. The visual is a representative product view built from capabilities documented in the public 0.2.0 release.
SQL injectionHIGH
Untrusted request data reaches a SQL execution sink through string interpolation.
→→
Shipping in 0.2.0
Inspect Action docs Make the merge decision carry its evidence.
The current GitHub Action evaluates changed files without executing repository code and returns ALLOW, REVIEW, or BLOCK with machine-readable artifacts.
ConversationCommitsFiles changedChecks
Aegis / security-change-gateCompleted with policy decision · REVIEW
42sMERGE POLICYREVIEW
1 active high-severity claim requires a human security decision.
Shipping in 0.2.0
Local setup The same policy path, without leaving the terminal.
The FastAPI local backend coordinates task execution, model routes, threat models, validation, fixes, policy, memory, and audit records.
$ aegis trusted-analysis ./fixture/vulnerable_sql.py
plan bound to source revision
evidence semgrep + bandit
primary openai/gpt-oss-20b
verifier mistral-medium-3.5-128b
consensus confirmed · 99%
policy REVIEW · risk 75/100
memory confirmed claim stored
✓ source · plan · audit · artifact manifest verifiedVS CODE CLIcode --install-extension aegis-security.aegis-security
You can also install Aegis directly from the VS Code Marketplace. Local setup, contribution instructions, the security policy, and the current architecture remain visible in the public repository.
Which checks ran?
A security decision should carry the checks and evidence that contributed to it, including missing or incomplete steps.
Was execution authorized?
Analysis does not imply permission to execute. Controlled validation remains separately authorized and constrained.
Did the patch actually verify?
A patch proposal and a post-change verification result are distinct lifecycle states.
Can the decision be inspected later?
Evidence, policy, integrity records, and project security memory are designed to make the reasoning traceable after the immediate run is over.