Aegis Jail MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| aegis_runA | Run a shell command inside the Aegis sandbox on a fresh copy of the project. The command cannot read the home directory or credentials, cannot write outside the copy and has no network unless the profile allows it. Returns exit code, output, changed files and blocked operations. Changes stay in the copy until aegis_apply. |
| aegis_probeB | Test in practice that a profile's boundaries hold (secrets, writes, network, child processes). |
| aegis_runsA | List recent Aegis runs of a project. |
| aegis_diffA | Show the unified diff of the files a run changed in its working copy. |
| aegis_applyA | Copy a run's changes into the real project (refuses if those files changed meanwhile). Only call this after the user has reviewed the diff and agreed. |
| aegis_discardC | Throw away a run's working copy. |
| aegis_scanA | Statically scan a directory (a repo, skill, plugin or MCP server) for prompt injection, hidden Unicode, auto-running hooks/MCP configs, download-and-execute payloads, committed secrets and escaping symlinks. Runs nothing. Use before working in an unfamiliar repo. |
| aegis_profilesB | List the project's Aegis profiles and what each one allows. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 8 tools
Each tool maps to a distinct step of the sandbox lifecycle (run, diff, apply, discard, list, profiles), and descriptions clarify intent well. The one real hazard is aegis_run vs aegis_runs, which differ by a single character and mean very different things (execute vs list), and aegis_probe vs aegis_scan both read as 'security check' at a glance.
Uniform aegis_ prefix plus a short snake_case verb for every tool, with no camelCase or style drift. The pattern is immediately predictable across all eight tools.
Eight tools for a sandboxed-execution server is well scoped; every tool covers a necessary stage (execute, inspect, promote, discard, audit, configure). Nothing appears redundant or missing from the count perspective.
The core lifecycle is fully covered: run in a copy, list runs, diff, then apply or discard, plus profiles and pre-flight scanning. Gaps are minor: profiles are read-only (no create/update a profile) and there is no way to cancel an in-flight run, but neither blocks normal workflows.