AgentAegis lets AI agents perform on-demand cybersecurity operations, billed per use. Here's what you can do:
Compliance & Governance
Assess posture against SOC 2, ISO 27001, HIPAA, PCI-DSS, and NIST CSF
Generate evidence collection plans, control gap analyses, audit-ready reports, and tailored security policies
Vulnerability Management
Scan networks (open ports/services), web apps (OWASP Top 10), SSL/TLS configs, and dependencies
Look up CVE details (CVSS, KEV status, patches) and prioritize findings by risk
Code Security
Static analysis (SAST) for Python, JS/TS, Java, Go, Ruby, PHP, C/C++
Detect hardcoded secrets in source code or git history
Audit dependencies (npm, pip, Go, Ruby, Java, Cargo) for known vulnerabilities
Blue Team & Threat Intelligence
Triage security incidents and generate response plans
Look up IOCs (IPs, domains, URLs, file hashes) against threat intel feeds (AbuseIPDB, AlienVault OTX, abuse.ch)
Check DNS security (SPF, DKIM, DMARC, DNSSEC) and audit email security configurations
Identity & Access Management
Audit user access against least-privilege principles
Assess MFA coverage and strength
Check emails/domains against breach databases (Have I Been Pwned)
Agent Safety & Supply Chain Security
Vet external endpoints (TLS/cert health, DNS hygiene, threat intel, domain age) before calling or paying them
Scan MCP plugins and agent skills for exfiltration risks, prompt injection, and dangerous capabilities
Account & History (Free)
Check balance, usage, and tool affordability
List recent scans and retrieve full outputs of prior scans by ID to chain workflows without re-paying
Retrieve persistent agent identity and lifetime usage stats
Provides threat intelligence lookup capabilities by integrating with abuse.ch, allowing AI agents to check indicators of compromise (IOCs) such as IP addresses and domains against known malicious activity databases.
This server has a remotely hosted endpoint. Open its connector listing for connection details, authentication requirements, and setup instructions:
Every cybersecurity service, callable by any AI agent, billed per use.
AgentAegis is an MCP server that lets AI agents perform cybersecurity operations on demand — from compliance checks to vulnerability scans to code security analysis. It wraps best-in-class open-source scanning engines (nmap, Nuclei, sslyze, Semgrep, trufflehog, trivy) in clean, agent-discoverable tool definitions with structured inputs and outputs.
Phase 2 ships: HTTP transport for remote deployment, x402 micropayments, API key auth with monthly limits, Supabase persistence, webhooks, ISO 27001 + HIPAA frameworks, Railway deploy config, and a full test suite.
git clone https://github.com/astafford8488/agentaegis-mcp.git
cd agentaegis-mcp
pnpm install
cp .env.example .env # add API keys
pnpm buildAdd to claude_desktop_config.json:
{
"mcpServers": {
"agentaegis": {
"command": "node",
"args": ["/path/to/agentaegis-mcp/dist/index.js"],
"env": {
"NVD_API_KEY": "...",
"ABUSEIPDB_API_KEY": "...",
"OTX_API_KEY": "...",
"ABUSECH_API_KEY": "...",
"HIBP_API_KEY": "..."
}
}
}
}# Local dev
pnpm dev:http
# Production via Docker
docker compose -f docker/docker-compose.yml up -d
# Production via Railway
railway upConnect from any MCP-aware agent:
POST https://your-host/mcp
Authorization: Bearer aegis_<your-api-key>Related MCP server: SecOps MCP
┌─────────────────────────────────────────────────────────┐
│ AI Agent (Claude, custom MCP client) │
└────────────────┬───────────────────────┬─────────────────┘
│ stdio │ HTTP
│ │
┌────────────────▼───────────┐ ┌────────▼─────────────────┐
│ stdio entry (index.ts) │ │ HTTP entry (http-server)│
└────────────────┬───────────┘ └────────┬─────────────────┘
│ │
│ ┌────────────────┴─────────────┐
│ │ Auth Gate │
│ │ - API key (DB-backed) │
│ │ - x402 micropayment │
│ └─────────────┬────────────────┘
│ │
┌────────────────▼────────────────────▼──────────────────────┐
│ MCP Server (server.ts) │
│ 20 Tool Handlers │
├──────────────────────────┬────────────────────────────────┤
│ Engine Wrappers │ External APIs │
│ nmap, Nuclei, sslyze, │ NVD, AbuseIPDB, AlienVault OTX + abuse.ch, │
│ Semgrep, trufflehog, │ HIBP, Shodan │
│ trivy │ │
├──────────────────────────┴────────────────────────────────┤
│ Sandbox │ Rate Limit │ Target Validation │ Logging │
└────────────────────────────────────────────────────────────┘
│
┌─────────▼──────────┐
│ Supabase │
│ - customers │
│ - api_keys │
│ - scan_jobs │
│ - usage_log │
│ - webhooks │
└────────────────────┘Endpoint | Method | Auth | Description |
| GET | None | Health check |
| GET | None | Tool catalog with prices |
| POST | None | Create customer account |
| POST | None | Issue an API key |
| GET | API key | Usage statistics |
| GET | API key | Async scan job status |
| POST | API key OR x402 | MCP Streamable HTTP transport |
Option 1: API Key — Customer registers, gets a key, pays via prepaid balance or invoice. Each tool call deducts from the monthly budget.
curl -X POST https://api.agentaegis.org/v1/customers \
-H "Content-Type: application/json" \
-d '{"email":"you@company.com","name":"Your Name"}'
curl -X POST https://api.agentaegis.org/v1/customers/<id>/api-keys \
-H "Content-Type: application/json" \
-d '{"name":"production","monthly_limit_usd":100}'Option 2: x402 Micropayment — No signup. Each tool call settles on-chain via USDC. The server returns 402 Payment Required with payment requirements; the client signs and retries with X-PAYMENT header.
Live pricing is always at /pricing.
Tool | Category | Description | Price |
| Compliance | SOC 2, ISO 27001, HIPAA, PCI-DSS, NIST CSF assessment | $2.00 |
| Compliance | Evidence collection plans for audit controls | $1.00 |
| Compliance | Prioritized remediation roadmap | $2.00 |
| Compliance | Audit-ready compliance reports | $5.00 |
| Compliance | Tailored security policy documents | $2.00 |
| Vuln Mgmt | Network port and vulnerability scan | $3.00 |
| Vuln Mgmt | OWASP Top 10 web app scan | $5.00 |
| Vuln Mgmt | Risk-based vulnerability prioritization | $1.00 |
| Vuln Mgmt | CVE details, CVSS, KEV status | $1.00 |
| Vuln Mgmt | SSL/TLS configuration audit | $1.00 |
| Code Security | Static security analysis | $5.00 |
| Code Security | Hardcoded secret detection | $2.00 |
| Code Security | Dependency vulnerability scan | $2.00 |
| Blue Team | Incident classification & response plan | $3.00 |
| Blue Team | IOC reputation lookup | $2.00 |
| Blue Team | DNS security audit | $1.00 |
| Blue Team | Email security configuration audit | $2.00 |
| Identity | Access privilege audit | $1.00 |
| Identity | MFA coverage assessment | $1.00 |
| Offensive | Breach database lookup | $2.00 |
| Trust Layer | Composite PROCEED/CAUTION/BLOCK trust verdict on an endpoint before your agent calls or pays it | $3.00 |
| Trust Layer | Supply-chain scan of an MCP server/plugin before your agent installs or trusts it | $5.00 |
| Trust Layer | Prompt-injection and over-broad-grant scan of an agent skill (SKILL.md) | $5.00 |
Free tools (no charge): help, account_balance, agent_whoami, agent_history, agent_scan_get.
SOC 2 Type II — Full Trust Services Criteria (35 controls)
ISO 27001:2022 — All 4 Annex A control groups (93 controls)
HIPAA Security Rule — Administrative, physical, and technical safeguards (43 controls)
NIST CSF 2.0 — All 6 functions with categories
PCI DSS v4.0 — All 12 requirements with detailed controls (full evaluation logic)
pnpm install # Install dependencies
pnpm dev # stdio mode (for Claude Desktop)
pnpm dev:http # HTTP mode (with Streamable HTTP transport)
pnpm build # Build for production
pnpm test # Run vitest test suite (46 tests)railway login
railway init
railway upRequired env vars (set in Railway dashboard):
SUPABASE_URL, SUPABASE_SERVICE_KEY
X402_PAYEE_ADDRESS (your wallet)
NVD_API_KEY, ABUSEIPDB_API_KEY, OTX_API_KEY, ABUSECH_API_KEY, HIBP_API_KEY
Run the migration in your Supabase SQL editor:
cat supabase/migrations/001_initial_schema.sqlTarget validation: Only public IPs and registered domains. Private/reserved ranges blocked.
Scan isolation: Each scan runs in an isolated process with temp directory cleanup.
Code safety: Repos cloned shallow (depth=1), max 500MB, 5-minute timeout, no execution.
Secret redaction: Full secret values never returned — first 4 and last 4 characters only.
Rate limiting: Per API key AND per target. Max 5 concurrent scans, 10/hour per target.
Audit logging: All tool calls logged to usage_log (90-day retention).
API key hashing: Keys stored as SHA-256 hashes; raw keys never stored.
AgentAegis scanning tools must only be used against systems you own or have explicit written authorization to test. By using this service, you agree that:
You have authorization from the system owner to perform security testing
You will not use these tools for unauthorized access or malicious purposes
You accept responsibility for any scans initiated through your API key
MIT
Audit user access against least-privilege.
Inputs: users (required), admin_roles, previous_scan_id, sensitive_permissions.
Returns the calling API key's prepaid balance, monthly limit, current month usage, and a breakdown of how many of each tool the customer can still afford. Free to call.
Inputs: no named parameters.
Lists your recent scans (scan_id, tool, target, status, time) so you can retrieve or chain from a prior result. Optional limit/tool/target/since filters. Free to call.
Inputs: tool, limit, since, target.
Retrieves one of your prior scans by scan_id, including the stored full output, so you can build on earlier results without re-paying. Free to call.
Inputs: scan_id (required), include_full_output.
Returns your persistent AgentAegis agent identity (agent_id), how you're identified (API key / wallet / anonymous session), and lifetime call count + spend. Free to call.
Inputs: no named parameters.
Generate audit-ready compliance reports.
Inputs: framework (required), report_date (required), report_type (required), organization_name (required), +2 more.
Assess an organization's security posture against a compliance framework (SOC 2, ISO 27001, HIPAA, PCI-DSS, NIST CSF).
Inputs: framework (required), organization_profile (required), previous_scan_id.
Deep-dive analysis of compliance control gaps with remediation roadmap.
Inputs: framework (required), failing_controls (required), previous_scan_id, budget_constraint, +1 more.
Check email/domain in breach databases (HIBP).
Inputs: target (required), check_type (required), previous_scan_id.
Look up CVE details, CVSS scores, and patches.
Inputs: cve_id (required), previous_scan_id.
Audit dependencies for known vulnerabilities (npm, pip, Go, Ruby, Java, Cargo).
Inputs: source (required), previous_scan_id.
Check DNS security (SPF, DKIM, DMARC, DNSSEC).
Inputs: domain (required), previous_scan_id.
Comprehensive email security audit.
Inputs: domain (required), previous_scan_id, include_mx_analysis.
Generate evidence collection plans for compliance controls.
Inputs: framework (required), control_ids (required), integrations, previous_scan_id.
Returns AgentAegis FAQ — authentication, balance/billing, tool catalog, async jobs, error codes, x402, rate limits, security. Optional topic filter. Free to call.
Inputs: topic.
Classify and respond to security incidents.
Inputs: indicators (required), incident_description (required), previous_scan_id, environment_context.
Generate tailored security policy documents.
Inputs: industry (required), frameworks (required), policy_type (required), employee_count (required), +3 more.
Static analysis for security vulnerabilities. Supports Python, JS/TS, Java, Go, Ruby, PHP, C/C++.
Inputs: source (required), previous_scan_id, severity_threshold.
Scan an MCP server (git repo or code) for supply-chain risk BEFORE trusting it — exfiltration (secrets/env to the network), prompt-injection sinks, dangerous capabilities, npm install hooks, obfuscation, plus Semgrep + secret scanning → a PROCEED/CAUTION/BLOCK verdict with findings.
Inputs: source (required), previous_scan_id.
Scan an agent SKILL (git repo or SKILL.md) for supply-chain risk BEFORE trusting it — prompt-injection / hidden-unicode in the instructions (hard block), over-broad allowed-tools grants, plus exfiltration, dangerous capabilities, secrets and obfuscation in bundled scripts → a PROCEED/CAUTION/BLOCK verdict.
Inputs: source (required), previous_scan_id.
Detect hardcoded secrets in source code.
Inputs: source (required), include_history, previous_scan_id.
Audit SSL/TLS configuration for a domain.
Inputs: hostname (required), port, previous_scan_id.
IOC lookup against threat intel feeds.
Inputs: indicator (required), indicator_type (required), previous_scan_id.
Composite trust verdict (PROCEED/CAUTION/BLOCK) for an endpoint an agent is about to call or pay — combines TLS/cert health, DNS hygiene, threat-intel reputation, and domain age into one decision with reasons.
Inputs: endpoint (required), previous_scan_id.
Prioritize vulnerabilities by exploitability and business impact.
Inputs: findings (required), business_context, previous_scan_id.
Scan an IP/domain for open ports, services, and vulnerabilities.
Inputs: target (required), scan_type (required), async, port_range, +1 more.
Scan a web app for OWASP Top 10 vulnerabilities.
Inputs: scan_depth (required), target_url (required), async, exclude_paths, +2 more.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 28 tools
Each tool targets a distinct security or compliance function. There is no ambiguity between similar-sounding tools like vuln_scan_network and vuln_scan_web_app because they clearly differentiate between network and web application scanning.
Most tool names follow a noun_noun or noun_verb pattern in snake_case, but there is inconsistency: some are noun_verb (e.g., incident_triage), some are noun_noun (e.g., cve_lookup), and one is verb_noun (vet_endpoint). The naming is readable but lacks a strict uniform convention.
With 28 tools, the server exceeds the typical upper bound for a well-scoped set. While the domain is broad (security and compliance), the number feels bloated and could be consolidated (e.g., combining related scans or audits).
The tool set covers the full lifecycle of security assessment and compliance: vulnerability scanning, compliance frameworks, audits, evidence collection, policy generation, incident triage, and account management. There are no obvious missing operations for the stated domain.
Agent rental platform: web-vuln scanning, OSINT and red-team tools via subscription.
CVE with EPSS and CISA KEV, package risk, software EOL, domain and IP reports, pay per call
AI-powered threat intelligence, smart contract auditing, and cybersecurity OSINT.
OSINT lookups across breach, people, domain, crypto, and image sources, paid per lookup.
