AgentAegis
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| NVD_API_KEY | No | API key for the National Vulnerability Database (NVD). | |
| OTX_API_KEY | No | API key for AlienVault OTX. | |
| HIBP_API_KEY | No | API key for Have I Been Pwned (HIBP). | |
| SUPABASE_URL | No | Supabase project URL (required for HTTP mode). | |
| ABUSECH_API_KEY | No | API key for abuse.ch. | |
| ABUSEIPDB_API_KEY | No | API key for AbuseIPDB. | |
| X402_PAYEE_ADDRESS | No | Wallet address for x402 micropayments (required for HTTP mode). | |
| SUPABASE_SERVICE_KEY | No | Supabase service role key (required for HTTP mode). |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| compliance_framework_checkC | Assess an organization's security posture against a compliance framework (SOC 2, ISO 27001, HIPAA, PCI-DSS, NIST CSF). |
| evidence_collectC | Generate evidence collection plans for compliance controls. |
| control_gap_analysisC | Deep-dive analysis of compliance control gaps with remediation roadmap. |
| audit_report_generateD | Generate audit-ready compliance reports. |
| policy_generateC | Generate tailored security policy documents. |
| vuln_scan_networkC | Scan an IP/domain for open ports, services, and vulnerabilities. |
| vuln_scan_web_appC | Scan a web app for OWASP Top 10 vulnerabilities. |
| vuln_prioritizeC | Prioritize vulnerabilities by exploitability and business impact. |
| cve_lookupC | Look up CVE details, CVSS scores, and patches. |
| ssl_tls_auditC | Audit SSL/TLS configuration for a domain. |
| sast_scanC | Static analysis for security vulnerabilities. Supports Python, JS/TS, Java, Go, Ruby, PHP, C/C++. |
| secret_scanC | Detect hardcoded secrets in source code. |
| dependency_auditC | Audit dependencies for known vulnerabilities (npm, pip, Go, Ruby, Java, Cargo). |
| incident_triageD | Classify and respond to security incidents. |
| threat_intel_lookupC | IOC lookup against threat intel feeds. |
| dns_security_checkB | Check DNS security (SPF, DKIM, DMARC, DNSSEC). |
| email_security_auditC | Comprehensive email security audit. |
| access_reviewC | Audit user access against least-privilege. |
| mfa_auditC | Assess MFA coverage and strength. |
| credential_checkC | Check email/domain in breach databases (HIBP). |
| vet_endpointA | Composite trust verdict (PROCEED/CAUTION/BLOCK) for an endpoint an agent is about to call or pay — combines TLS/cert health, DNS hygiene, threat-intel reputation, and domain age into one decision with reasons. |
| scan_mcp_pluginA | Scan an MCP server (git repo or code) for supply-chain risk BEFORE trusting it — exfiltration (secrets/env to the network), prompt-injection sinks, dangerous capabilities, npm install hooks, obfuscation, plus Semgrep + secret scanning → a PROCEED/CAUTION/BLOCK verdict with findings. |
| scan_skillA | Scan an agent SKILL (git repo or SKILL.md) for supply-chain risk BEFORE trusting it — prompt-injection / hidden-unicode in the instructions (hard block), over-broad allowed-tools grants, plus exfiltration, dangerous capabilities, secrets and obfuscation in bundled scripts → a PROCEED/CAUTION/BLOCK verdict. |
| account_balanceA | Returns the calling API key's prepaid balance, monthly limit, current month usage, and a breakdown of how many of each tool the customer can still afford. Free to call. |
| helpA | Returns AgentAegis FAQ — authentication, balance/billing, tool catalog, async jobs, error codes, x402, rate limits, security. Optional topic filter. Free to call. |
| agent_whoamiA | Returns your persistent AgentAegis agent identity (agent_id), how you're identified (API key / wallet / anonymous session), and lifetime call count + spend. Free to call. |
| agent_historyA | Lists your recent scans (scan_id, tool, target, status, time) so you can retrieve or chain from a prior result. Optional limit/tool/target/since filters. Free to call. |
| agent_scan_getA | Retrieves one of your prior scans by scan_id, including the stored full output, so you can build on earlier results without re-paying. Free to call. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 28 tools
Each tool targets a distinct security or compliance function. There is no ambiguity between similar-sounding tools like vuln_scan_network and vuln_scan_web_app because they clearly differentiate between network and web application scanning.
Most tool names follow a noun_noun or noun_verb pattern in snake_case, but there is inconsistency: some are noun_verb (e.g., incident_triage), some are noun_noun (e.g., cve_lookup), and one is verb_noun (vet_endpoint). The naming is readable but lacks a strict uniform convention.
With 28 tools, the server exceeds the typical upper bound for a well-scoped set. While the domain is broad (security and compliance), the number feels bloated and could be consolidated (e.g., combining related scans or audits).
The tool set covers the full lifecycle of security assessment and compliance: vulnerability scanning, compliance frameworks, audits, evidence collection, policy generation, incident triage, and account management. There are no obvious missing operations for the stated domain.