aegis-defi
Aegis
자율 DeFi 에이전트를 위한 안전 계층입니다. | 웹사이트 | 문서
온체인에서 거래하는 AI 에이전트는 합법적인 토큰과 허니팟을 구분할 방법이 없습니다. Aegis가 이를 해결합니다. Aegis는 모든 에이전트가 연결할 수 있는 MCP 서버이며, 안전 검사를 강제하는 온체인 컨트랙트를 기반으로 합니다.
에이전트가 스왑을 수행하기 전에 Aegis는 대상 컨트랙트를 스캔하고 트랜잭션을 시뮬레이션한 뒤, 간단한 통과/차단(go/no-go) 결과를 반환합니다. 만약 컨트랙트에 99%의 매도 수수료나 숨겨진 일시 정지 기능이 있다면, 에이전트는 해당 컨트랙트에 절대 접근하지 않습니다.
이 프로젝트가 존재하는 이유
우리는 한 에이전트가 30초도 안 되어 허니팟 토큰에 지갑 전체를 잃는 것을 목격했습니다. 해당 토큰은 겉보기에는 검증된 컨트랙트, 적절한 유동성, 활발한 거래 등 문제가 없어 보였습니다. 하지만 코드 내부에는 99%의 매도 수수료와 가짜 renounceOwnership() 뒤에 숨겨진 소유자 권한이 있었습니다.
기존의 어떤 에이전트 프레임워크도 이를 잡아낼 방법이 없었습니다. 그래서 우리가 직접 만들었습니다.
Related MCP server: pharos-guardskill
작동 원리
Agent -> Aegis (scan + simulate + decide) -> Chain에이전트가 MCP를 통해 Aegis에 연결 (설정 한 줄)
스왑/승인/전송 전, 에이전트가
assess_risk호출Aegis가 컨트랙트 소스를 스캔하고, 트랜잭션을 시뮬레이션하며, 허니팟 패턴을 확인
위험 점수(0-100)와 함께 ALLOW(허용), WARN(경고), BLOCK(차단) 반환
온체인: AegisGateway 컨트랙트가 트랜잭션을 전달하기 전에 증명(attestation)을 강제함
빠른 시작
# Add to Claude Code
claude mcp add aegis npx aegis-defi
# Or clone and try the demo
git clone https://github.com/StanleytheGoat/aegis
cd aegis && npm install
npx tsx demo/catch-honeypot.ts데모는 의도적으로 악의적인 토큰(99% 매도 수수료, 가짜 소유권 포기, 숨겨진 관리자)을 배포하고 Aegis가 모든 위험 신호를 잡아내는 과정을 보여줍니다:
Aegis Risk Assessment
Risk Score: 100/100
Findings:
[CRITICAL] Fake Ownership Renounce
[CRITICAL] Asymmetric Buy/Sell Tax (99% sell)
[CRITICAL] Sell Pause Mechanism
[HIGH] Hidden Max Sell Amount
[HIGH] Hidden Admin Functions
Decision: BLOCK도구
MCP 서버 (TypeScript) - 모든 MCP 호환 에이전트가 사용할 수 있는 6가지 도구:
도구 | 목적 |
| 165가지 알려진 익스플로잇 유형에 대한 패턴 매칭 |
| 포크된 체인에서의 드라이런(Dry-run) |
| 허니팟 방지 검사 (매도 가능 여부, 집중된 보유량) |
| 서명된 증명을 포함한 통합 위험 평가 |
| 모든 내부 호출을 추적하고 각 컨트랙트를 스캔 |
| 5만 개 이상의 실제 감사 결과와 교차 참조 |
스마트 컨트랙트 (Solidity) - Base 메인넷에 배포됨:
컨트랙트 | 주소 | 목적 |
AegisGateway | 모든 DeFi 상호작용을 위한 안전 래퍼. 증명 검증 및 위험 점수 확인. | |
AegisSafetyHook | Uniswap v4 |
문서
에이전트 통합 가이드 - 에이전트 연결 방법
프로젝트 통합 가이드 - Aegis를 제품에 통합하는 방법
Flaunch 통합 - Flaunch 밈코인 거래를 위한 안전 검사
ElizaOS 플러그인 - ElizaOS 에이전트를 위한 네이티브 Aegis 액션
AgentKit 제공자 - Aegis를 위한 Coinbase AgentKit ActionProvider
llms.txt - 에이전트 검색을 위한 기계 판독 가능한 설명
보안
이더리움 보안 모범 사례를 따라 구축되었습니다 (ethskills 참고):
서명: 모든 서명된 메시지에 체인 ID + 컨트랙트 주소 포함 (교차 체인 리플레이 방지). EIP-2 s-값 가변성 검사. address(0)에 대한 ecrecover 검증.
수수료 계산: 나눗셈 전 곱셈 수행. 명시적인 오버플로우 방지. 베이시스 포인트(백분율 아님) 사용.
접근 제어: Gateway에 OZ Ownable + ReentrancyGuard 적용. Hook에 불변(Immutable) 소유자 설정. 불변 수수료 수취인 설정.
배포: Safe Singleton Factory CREATE2 배포자 사용. Basescan에서 소스 검증 완료. 소유권은 Safe 멀티시그로 이전됨.
테스트: 165개 테스트 (컨트랙트 42개 + TypeScript 123개). 실제 Base 메인넷 상태에 대한 포크 테스트 수행.
테스트
npm test # TypeScript unit tests (123)
npm run test:contracts # Solidity contract tests (42)
npm run demo # Honeypot detection demo변경 로그
v0.5.0 (현재)
훅 증명 지원 -
assess_risk가 이제 Uniswap v4 보호 풀을 위한 게이트웨이 및 훅 증명을 모두 반환함EVM 주소 검증 - 모든 MCP 도구 입력값이 올바른 주소 형식을 검증함
잘 알려진 컨트랙트 확장 - Paraswap, Balancer Vault, CoW Protocol, Permit2, Uniswap V4 PoolManager
SDK 내보내기 - attester 및 solodit 모듈을 프로그래밍 방식으로 사용 가능
요청 강화 - response.ok 확인, 모든 외부 요청에 10초 타임아웃 적용
보안 헤더 및 랜딩 페이지용 SEO 파일 추가
v0.4.0
Solodit 통합 -
search_solodit도구가 Cyfrin, Sherlock, Code4rena, Trail of Bits 등에서 제공하는 5만 개 이상의 실제 감사 결과를 쿼리함자동 강화 -
SOLODIT_API_KEY가 설정되면assess_risk가 감지된 패턴을 실제 감사 결과와 교차 참조함옵트인 API 키 모델 - 각 에이전트가 자신의 Solodit 키를 제공하며, 공유 속도 제한 없음
v0.3.0
165가지 익스플로잇 패턴 (25개 카테고리, 기존 22개에서 증가)
트레이스 수준 분석 -
trace_transaction도구가 모든 내부 호출을 추적하고 각 컨트랙트를 스캔함
v0.2.0
22가지 익스플로잇 패턴 (기존 12개에서 증가) - 메타모픽 컨트랙트, 오라클 조작, MEV 샌드위치
에이전트 스킬 - Claude Code용 설치 가능한 스킬 파일
Flaunch SDK 통합 - Uniswap v4 풀에서의 밈코인 출시를 위한 안전 스캔
라이선스
MIT
Available Tools
4 toolsassess_riskA
Comprehensive risk assessment combining contract scanning, transaction simulation, and token checks. This is the recommended all-in-one safety check before any DeFi interaction. Returns a go/no-go recommendation.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Type of action being assessed | |
| targetContract | Yes | The contract being interacted with | |
| chainId | No | Chain ID | |
| from | Yes | The agent's wallet address | |
| transactionData | No | Calldata for the transaction (hex) | |
| value | No | ETH value (in wei) | 0 |
| tokenAddress | No | Token address if this involves a token swap |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden. It discloses the tool's comprehensive nature and returns a 'go/no-go recommendation', but lacks details on permissions, rate limits, or potential side effects. It adequately describes the core behavior but misses deeper operational context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose in the first sentence, uses two efficient sentences total with zero wasted words, and clearly communicates the tool's value proposition and recommendation status without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex 7-parameter tool with no annotations and no output schema, the description is reasonably complete. It explains the tool's integrative nature, when to use it, and the output type ('go/no-go recommendation'), though it could elaborate more on behavioral risks or error handling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds no specific parameter details beyond what the schema provides, but it contextualizes the inputs as part of a 'comprehensive risk assessment' for DeFi safety checks, which slightly enhances understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with specific verbs ('combining contract scanning, transaction simulation, and token checks') and resources ('DeFi interaction'), and distinguishes it from sibling tools by positioning it as the 'recommended all-in-one safety check' that integrates their functions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool ('before any DeFi interaction') and implies alternatives by naming sibling tools (check_token, scan_contract, simulate_transaction) as components it combines, making it the comprehensive choice over piecemeal approaches.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_tokenA
Check if a token is safe to trade. Detects honeypot mechanics (can't sell), concentrated holdings, fake ownership renouncement, and other scam indicators. Use this before swapping into any unfamiliar token.
| Name | Required | Description | Default |
|---|---|---|---|
| tokenAddress | Yes | The token contract address to check | |
| chainId | No | Chain ID (1=Ethereum, 8453=Base) | |
| holderAddress | No | Optional: address to check balance for |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It describes what the tool does (detects scam indicators) and its intended use case, but lacks details on behavioral traits such as rate limits, authentication needs, response format, or error handling. The description is informative but incomplete for operational transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose in the first sentence and follows with specific use guidance. Both sentences are essential, with no wasted words, making it highly efficient and well-structured for quick understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (assessing token safety with scam detection) and lack of annotations and output schema, the description is moderately complete. It covers the purpose and usage well but lacks details on behavioral aspects and output, which are critical for an AI agent to invoke it correctly. It meets minimum viability but has clear gaps in operational context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters (tokenAddress, chainId, holderAddress) with descriptions. The description does not add any parameter-specific semantics beyond what the schema provides, such as explaining the significance of holderAddress in scam detection. Baseline score of 3 is appropriate as the schema handles parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with specific verbs ('check', 'detects') and resources ('token'), identifying scam indicators like honeypot mechanics, concentrated holdings, and fake ownership renouncement. It distinguishes from siblings by focusing on token safety assessment rather than general risk assessment, contract scanning, or transaction simulation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool: 'before swapping into any unfamiliar token.' This provides clear context for usage and implies alternatives (e.g., not using it for familiar tokens or after swapping). While it doesn't name specific sibling tools, the guidance is direct and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scan_contractA
Analyze a smart contract's source code or bytecode for known exploit patterns, honeypot mechanics, rug-pull signals, and security vulnerabilities. Returns a risk score (0-100) and detailed findings. Use this BEFORE interacting with any unfamiliar contract.
| Name | Required | Description | Default |
|---|---|---|---|
| source | No | Solidity source code of the contract to analyze | |
| bytecode | No | Contract bytecode (hex) to analyze if source is unavailable | |
| contractAddress | No | Contract address - if provided, will attempt to fetch source from block explorer | |
| chainId | No | Chain ID (1=Ethereum, 8453=Base, 84532=Base Sepolia) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and does well by disclosing key behaviors: it analyzes for specific exploit patterns, returns a risk score and findings, and has a precautionary use case. However, it lacks details on rate limits, authentication needs, or error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose, followed by usage guidance, all in two efficient sentences with zero wasted words, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (security analysis with 4 parameters) and no output schema, the description is mostly complete, covering purpose, usage, and output types. However, it could benefit from more details on behavioral aspects like performance or limitations to fully compensate for the lack of annotations and output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters well. The description adds no additional parameter semantics beyond implying analysis can be done on source, bytecode, or via address, which is already covered in the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with specific verbs ('analyze', 'returns') and resources ('smart contract's source code or bytecode'), distinguishing it from siblings like 'assess_risk' or 'check_token' by focusing on contract analysis for security patterns.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use this tool ('BEFORE interacting with any unfamiliar contract'), providing clear context and distinguishing it from alternatives like 'simulate_transaction' by focusing on pre-interaction analysis rather than simulation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simulate_transactionA
Simulate a transaction on a forked chain WITHOUT actually executing it. Detects reverts, abnormal gas usage, and other red flags. Use this to preview what will happen before sending a real transaction.
| Name | Required | Description | Default |
|---|---|---|---|
| chainId | No | Chain ID to simulate on | |
| from | Yes | Sender address | |
| to | Yes | Target contract address | |
| data | Yes | Transaction calldata (hex) | |
| value | No | ETH value to send (in wei) | 0 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden and does well by disclosing key behavioral traits: it's a simulation (non-destructive), detects specific issues (reverts, abnormal gas usage, red flags), and operates on a forked chain. It doesn't mention rate limits, authentication needs, or detailed output format, but covers essential safety and scope.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with zero waste: first defines the tool's purpose and key features, second provides usage guidance. Every phrase adds value, and it's front-loaded with the core functionality.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations and no output schema, the description does well by explaining the tool's behavior, safety profile (non-execution), and use case. It could improve by hinting at return values (e.g., simulation results), but for a 5-parameter tool with good schema coverage, it's largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters thoroughly. The description adds no additional parameter semantics beyond implying the simulation context, which aligns with the schema. Baseline 3 is appropriate as the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('simulate a transaction'), the resource ('on a forked chain'), and the key distinction from actual execution ('WITHOUT actually executing it'). It differentiates from siblings like 'assess_risk' or 'scan_contract' by focusing on transaction simulation rather than general risk assessment or contract scanning.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use this tool: 'to preview what will happen before sending a real transaction.' This provides clear context for usage versus alternatives, indicating it's for pre-execution testing rather than live operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v0.1.0- First observed
assess_risk - First observed
check_token - First observed
scan_contract - First observed
simulate_transaction
TDQS
Scored across 4 tools
Each tool has a clearly distinct purpose: assess_risk is a comprehensive all-in-one safety check, check_token focuses on token-specific scams, scan_contract analyzes contract code/bytecode, and simulate_transaction previews transaction outcomes. There is no overlap or ambiguity between these tools.
All tool names follow a consistent verb_noun pattern (assess_risk, check_token, scan_contract, simulate_transaction), using snake_case throughout. The naming is predictable and readable across the entire set.
With 4 tools, this server is well-scoped for DeFi security. Each tool earns its place by covering distinct aspects of safety assessment: holistic risk, token checks, contract analysis, and transaction simulation. This count is appropriate and avoids bloat.
The tool set provides complete coverage for DeFi security workflows: it includes comprehensive risk assessment (assess_risk), targeted checks for tokens and contracts, and transaction simulation. There are no obvious gaps—agents can perform end-to-end safety evaluations before any DeFi interaction.
Maintenance
Related MCP Connectors
DeFi safety layer for AI agents: wallet safety, token risk, tx decode/simulate. 20 tools.
Read-only smart-contract security intelligence for autonomous agents.
Crypto security, honeypot detection, wallet analysis, and token risk scoring across 31 blockchains.
Solana pre-trade safety for agents: rug check, honeypot sell-sim, drainer scan, tx preflight.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenancePre-execution safety layer for autonomous agent wallets. Risk scoring, transaction simulation, and policy enforcement via MCP.MIT
- FlicenseNot gradedqualityDmaintenancePre-transaction security gate for Pharos AI agents that analyzes contract bytecode and on-chain state to assess risks like upgradeability and honeypot controls.-
- AlicenseBqualityDmaintenanceReal-time smart contract security for autonomous AI agents, offering tools for contract verification, wallet monitoring, drain detection, threat reporting, and leaderboards.197 npmMIT
- AlicenseNot gradedqualityCmaintenanceSecurity layer for AI agents that evaluates transaction intents and returns verdicts (ALLOW/WARN/DENY) using deterministic rules, on-chain checks, and simulation.1 npmMIT