Skip to main content
Glama

Aegis

自主 DeFi 代理的安全层。 | 网站 | 文档

在链上进行交易的 AI 代理无法区分合法代币和蜜罐。Aegis 解决了这个问题。它是一个任何代理都可以接入的 MCP 服务器,并由强制执行安全检查的链上合约提供支持。

在代理进行兑换之前,Aegis 会扫描目标合约、模拟交易,并返回一个简单的“通过/不通过”结果。如果合约有 99% 的卖出税或隐藏的暂停功能,代理将永远不会触碰它。

为什么存在这个项目

我们曾目睹一个代理在不到 30 秒的时间内因蜜罐代币损失了整个钱包的资金。该代币表面上看起来没问题——合约已验证、流动性充足、交易活跃。但代码中隐藏着 99% 的卖出税,以及一个在虚假的 renounceOwnership() 函数背后的隐藏所有者。

没有任何代理框架能够捕捉到这一点。所以我们构建了一个。

Related MCP server: pharos-guardskill

工作原理

Agent -> Aegis (scan + simulate + decide) -> Chain
  1. 代理通过 MCP 连接到 Aegis(一行配置)

  2. 在任何兑换/授权/转账之前,代理调用 assess_risk

  3. Aegis 扫描合约源代码,模拟交易,检查蜜罐模式

  4. 返回 ALLOW(允许)、WARN(警告)或 BLOCK(拦截),并附带风险评分(0-100)

  5. 链上:AegisGateway 合约在转发交易前强制执行证明

快速开始

# Add to Claude Code
claude mcp add aegis npx aegis-defi

# Or clone and try the demo
git clone https://github.com/StanleytheGoat/aegis
cd aegis && npm install
npx tsx demo/catch-honeypot.ts

该演示部署了一个蓄意恶意的代币(99% 卖出税、虚假放弃所有权、隐藏管理员),并观察 Aegis 如何捕捉到每一个危险信号:

Aegis Risk Assessment
  Risk Score: 100/100
  Findings:
    [CRITICAL] Fake Ownership Renounce
    [CRITICAL] Asymmetric Buy/Sell Tax (99% sell)
    [CRITICAL] Sell Pause Mechanism
    [HIGH]     Hidden Max Sell Amount
    [HIGH]     Hidden Admin Functions
  Decision: BLOCK

工具

MCP 服务器 (TypeScript) - 为任何兼容 MCP 的代理提供 6 种工具:

工具

用途

scan_contract

针对 165 种已知漏洞类型的模式匹配

simulate_transaction

在分叉链上进行试运行

check_token

反蜜罐检查(可卖性、持仓集中度)

assess_risk

包含签名证明的一站式风险评估

trace_transaction

追踪每一个内部调用,扫描每个合约

search_solodit

交叉引用 5 万多条真实审计发现

智能合约 (Solidity) - 部署在 Base 主网上:

合约

地址

用途

AegisGateway

0x62c6...0fa3

任何 DeFi 交互的安全包装器。验证证明,检查风险评分。

AegisSafetyHook

0xaEE5...40C0

Uniswap v4 beforeSwap 钩子。拦截没有有效安全证明的兑换。

文档

安全性

遵循以太坊安全最佳实践构建(参考 ethskills):

  • 签名:所有签名消息中包含链 ID + 合约地址(无跨链重放)。EIP-2 s-值延展性检查。针对 address(0) 验证 ecrecover。

  • 费用数学:先乘后除。显式溢出防护。基点(而非百分比)。

  • 访问控制:Gateway 上的 OZ Ownable + ReentrancyGuard。Hook 上的不可变所有者。不可变的费用接收者。

  • 部署:Safe Singleton Factory CREATE2 部署器。源代码在 Basescan 上验证。所有权转移至 Safe 多签钱包。

  • 测试:165 个测试(42 个合约测试 + 123 个 TypeScript 测试)。针对真实 Base 主网状态的分叉测试。

测试

npm test              # TypeScript unit tests (123)
npm run test:contracts # Solidity contract tests (42)
npm run demo          # Honeypot detection demo

更新日志

v0.5.0 (当前版本)

  • Hook 证明支持 - assess_risk 现在为 Uniswap v4 受保护池返回网关和 Hook 证明

  • EVM 地址验证 - 所有 MCP 工具输入均验证正确的地址格式

  • 扩展知名合约 - Paraswap, Balancer Vault, CoW Protocol, Permit2, Uniswap V4 PoolManager

  • SDK 导出 - 证明器和 solodit 模块现可用于编程使用

  • 强化获取 - response.ok 检查,所有外部请求均有 10 秒超时

  • 安全标头和落地页 SEO 文件

v0.4.0

  • Solodit 集成 - search_solodit 工具查询来自 Cyfrin, Sherlock, Code4rena, Trail of Bits 等机构的 5 万多条真实审计发现

  • 自动丰富 - 当设置 SOLODIT_API_KEY 时,assess_risk 会将检测到的模式与真实审计发现进行交叉引用

  • 选择性 API 密钥模型 - 每个代理提供自己的 Solodit 密钥,无共享速率限制

v0.3.0

  • 165 种漏洞模式,涵盖 25 个类别(之前为 22 个)

  • 追踪级分析 - trace_transaction 工具跟踪每一个内部调用并扫描每个合约

v0.2.0

  • 22 种漏洞模式(之前为 12 个) - 变形合约、预言机操纵、MEV 三明治攻击

  • 代理技能 - 可安装的 Claude Code 技能文件

  • Flaunch SDK 集成 - Uniswap v4 池上模因币发布的安全扫描

许可证

MIT

Available Tools

4 tools
assess_riskA

Comprehensive risk assessment combining contract scanning, transaction simulation, and token checks. This is the recommended all-in-one safety check before any DeFi interaction. Returns a go/no-go recommendation.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYesType of action being assessed
targetContractYesThe contract being interacted with
chainIdNoChain ID
fromYesThe agent's wallet address
transactionDataNoCalldata for the transaction (hex)
valueNoETH value (in wei)0
tokenAddressNoToken address if this involves a token swap

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden. It discloses the tool's comprehensive nature and returns a 'go/no-go recommendation', but lacks details on permissions, rate limits, or potential side effects. It adequately describes the core behavior but misses deeper operational context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose in the first sentence, uses two efficient sentences total with zero wasted words, and clearly communicates the tool's value proposition and recommendation status without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex 7-parameter tool with no annotations and no output schema, the description is reasonably complete. It explains the tool's integrative nature, when to use it, and the output type ('go/no-go recommendation'), though it could elaborate more on behavioral risks or error handling.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds no specific parameter details beyond what the schema provides, but it contextualizes the inputs as part of a 'comprehensive risk assessment' for DeFi safety checks, which slightly enhances understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with specific verbs ('combining contract scanning, transaction simulation, and token checks') and resources ('DeFi interaction'), and distinguishes it from sibling tools by positioning it as the 'recommended all-in-one safety check' that integrates their functions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool ('before any DeFi interaction') and implies alternatives by naming sibling tools (check_token, scan_contract, simulate_transaction) as components it combines, making it the comprehensive choice over piecemeal approaches.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_tokenA

Check if a token is safe to trade. Detects honeypot mechanics (can't sell), concentrated holdings, fake ownership renouncement, and other scam indicators. Use this before swapping into any unfamiliar token.

ParametersJSON Schema
NameRequiredDescriptionDefault
tokenAddressYesThe token contract address to check
chainIdNoChain ID (1=Ethereum, 8453=Base)
holderAddressNoOptional: address to check balance for

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It describes what the tool does (detects scam indicators) and its intended use case, but lacks details on behavioral traits such as rate limits, authentication needs, response format, or error handling. The description is informative but incomplete for operational transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose in the first sentence and follows with specific use guidance. Both sentences are essential, with no wasted words, making it highly efficient and well-structured for quick understanding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (assessing token safety with scam detection) and lack of annotations and output schema, the description is moderately complete. It covers the purpose and usage well but lacks details on behavioral aspects and output, which are critical for an AI agent to invoke it correctly. It meets minimum viability but has clear gaps in operational context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters (tokenAddress, chainId, holderAddress) with descriptions. The description does not add any parameter-specific semantics beyond what the schema provides, such as explaining the significance of holderAddress in scam detection. Baseline score of 3 is appropriate as the schema handles parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with specific verbs ('check', 'detects') and resources ('token'), identifying scam indicators like honeypot mechanics, concentrated holdings, and fake ownership renouncement. It distinguishes from siblings by focusing on token safety assessment rather than general risk assessment, contract scanning, or transaction simulation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool: 'before swapping into any unfamiliar token.' This provides clear context for usage and implies alternatives (e.g., not using it for familiar tokens or after swapping). While it doesn't name specific sibling tools, the guidance is direct and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_contractA

Analyze a smart contract's source code or bytecode for known exploit patterns, honeypot mechanics, rug-pull signals, and security vulnerabilities. Returns a risk score (0-100) and detailed findings. Use this BEFORE interacting with any unfamiliar contract.

ParametersJSON Schema
NameRequiredDescriptionDefault
sourceNoSolidity source code of the contract to analyze
bytecodeNoContract bytecode (hex) to analyze if source is unavailable
contractAddressNoContract address - if provided, will attempt to fetch source from block explorer
chainIdNoChain ID (1=Ethereum, 8453=Base, 84532=Base Sepolia)

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and does well by disclosing key behaviors: it analyzes for specific exploit patterns, returns a risk score and findings, and has a precautionary use case. However, it lacks details on rate limits, authentication needs, or error handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, followed by usage guidance, all in two efficient sentences with zero wasted words, making it easy to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (security analysis with 4 parameters) and no output schema, the description is mostly complete, covering purpose, usage, and output types. However, it could benefit from more details on behavioral aspects like performance or limitations to fully compensate for the lack of annotations and output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters well. The description adds no additional parameter semantics beyond implying analysis can be done on source, bytecode, or via address, which is already covered in the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with specific verbs ('analyze', 'returns') and resources ('smart contract's source code or bytecode'), distinguishing it from siblings like 'assess_risk' or 'check_token' by focusing on contract analysis for security patterns.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use this tool ('BEFORE interacting with any unfamiliar contract'), providing clear context and distinguishing it from alternatives like 'simulate_transaction' by focusing on pre-interaction analysis rather than simulation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

simulate_transactionA

Simulate a transaction on a forked chain WITHOUT actually executing it. Detects reverts, abnormal gas usage, and other red flags. Use this to preview what will happen before sending a real transaction.

ParametersJSON Schema
NameRequiredDescriptionDefault
chainIdNoChain ID to simulate on
fromYesSender address
toYesTarget contract address
dataYesTransaction calldata (hex)
valueNoETH value to send (in wei)0

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden and does well by disclosing key behavioral traits: it's a simulation (non-destructive), detects specific issues (reverts, abnormal gas usage, red flags), and operates on a forked chain. It doesn't mention rate limits, authentication needs, or detailed output format, but covers essential safety and scope.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with zero waste: first defines the tool's purpose and key features, second provides usage guidance. Every phrase adds value, and it's front-loaded with the core functionality.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations and no output schema, the description does well by explaining the tool's behavior, safety profile (non-execution), and use case. It could improve by hinting at return values (e.g., simulation results), but for a 5-parameter tool with good schema coverage, it's largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters thoroughly. The description adds no additional parameter semantics beyond implying the simulation context, which aligns with the schema. Baseline 3 is appropriate as the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('simulate a transaction'), the resource ('on a forked chain'), and the key distinction from actual execution ('WITHOUT actually executing it'). It differentiates from siblings like 'assess_risk' or 'scan_contract' by focusing on transaction simulation rather than general risk assessment or contract scanning.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use this tool: 'to preview what will happen before sending a real transaction.' This provides clear context for usage versus alternatives, indicating it's for pre-execution testing rather than live operations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 4 tool updatesv0.1.0
    • First observedassess_risk
    • First observedcheck_token
    • First observedscan_contract
    • First observedsimulate_transaction

TDQS

A4.4/5.0

Scored across 4 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: assess_risk is a comprehensive all-in-one safety check, check_token focuses on token-specific scams, scan_contract analyzes contract code/bytecode, and simulate_transaction previews transaction outcomes. There is no overlap or ambiguity between these tools.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern (assess_risk, check_token, scan_contract, simulate_transaction), using snake_case throughout. The naming is predictable and readable across the entire set.

Tool Count5/5

With 4 tools, this server is well-scoped for DeFi security. Each tool earns its place by covering distinct aspects of safety assessment: holistic risk, token checks, contract analysis, and transaction simulation. This count is appropriate and avoids bloat.

Completeness5/5

The tool set provides complete coverage for DeFi security workflows: it includes comprehensive risk assessment (assess_risk), targeted checks for tokens and contracts, and transaction simulation. There are no obvious gaps—agents can perform end-to-end safety evaluations before any DeFi interaction.

Maintenance

ActivityInactive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    Not graded
    quality
    D
    maintenance
    Pre-transaction security gate for Pharos AI agents that analyzes contract bytecode and on-chain state to assess risks like upgradeability and honeypot controls.
    -
  • A
    license
    B
    quality
    D
    maintenance
    Real-time smart contract security for autonomous AI agents, offering tools for contract verification, wallet monitoring, drain detection, threat reporting, and leaderboards.
    19
    7 npm
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Security layer for AI agents that evaluates transaction intents and returns verdicts (ALLOW/WARN/DENY) using deterministic rules, on-chain checks, and simulation.
    1 npm
    MIT