Aegis Guardrails
Installs and manages a git pre-commit hook that runs the same deterministic checks as the MCP server (including forbidden AST patterns) on staged/tracked content, so a violating change makes git commit fail; also diffs the current branch or pull request against its base to scope checks.
Provides CI enforcement through GitHub Actions, running aegis check on pull requests (fetching full history to diff against the base branch) so forbidden AST patterns and rule regressions are blocked outside the local hook.
Aegis Guardrails: Rules, AST Checks & MCP Server for AI Coding Agents
Aegis keeps Claude Code, Codex CLI and Antigravity on your project's rules via a zero-dependency Model Context Protocol (MCP) server (aegis-mcp), AGENTS.md / CLAUDE.md bootstrap, git pre-commit hooks, and CI governance (aegis check). It serves each agent just-in-time rules for the files it is about to edit, then enforces AST and repository invariants before commit and in pull requests.
What is Aegis?
Aegis is a Python package with zero runtime dependencies that provides a CLI (aegis) and an MCP server (aegis-mcp) for AI coding agent governance. Your rules are short markdown files in .aegis/rules/, committed with your code. Before an agent edits a file, the aegis_scan MCP tool hands it only the rules whose target_paths match that file. aegis check then runs deterministic checks — including AST code patterns your rules ban — in a git pre-commit hook and in CI, while a local ledger records how each rule fared.
Related MCP server: SpecLock
Why guardrails for AI coding agents?
An instructions file (AGENTS.md, CLAUDE.md, .cursorrules) is a gentleman's agreement: nothing checks that the agent followed it. Agents break it in three ways:
They skip rules. Under task pressure an agent follows the letter of a rule and misses its point.
They forget. Long sessions compact their context, and every new session starts from zero.
They fail open. A check that crashed, a tool that is missing or a rule that never loaded looks exactly like "no problem found".
In one coding session analyzed step by step, 749 of 1,339 agent steps (55.9%) were rework. The largest items were guessed UI controls (180 steps), the wrong Python environment (110) and a test that polled forever (103), and each became a rule Aegis ships. That is one session by one developer with no second rater; the sources and caveats are in Why Aegis is built this way.
Quick start
Aegis runs a 3-step loop in any git repository with Python 3.9 or newer:
Step 1 — Install & initialize: Install
aegis-guardrails(pipx install aegis-guardrailsorpip install aegis-guardrails) and runaegis initin your repo to write theAGENTS.mdbootstrap, registeraegis-mcpwith your hosts, and install thepre-commithook.Step 2 — Scan before edit: Your coding agent calls
aegis_scanover MCP before editing files to receive just-in-time rules matched to those paths.Step 3 — Block bad commits in Git & CI:
aegis checkruns automatically in thepre-commithook and in CI to block forbidden AST patterns and rule regressions.
pipx install aegis-guardrails # or: pip install aegis-guardrails
cd my-app
aegis init --host claude-code,codex-cli # or --host auto: every supported host found on this machineIf pip stops with externally-managed-environment (PEP 668, as many Linux distributions and Homebrew Python do), run pipx install aegis-guardrails or install into a virtual environment. If your shell then says aegis: command not found, run pipx ensurepath after a pipx install, activate the virtual environment, or run the script by its full path (on Linux ~/.local/bin/aegis after pip install --user); aegis init and aegis doctor print the PATH fix for your shell. Do not fall back to python3 -m aegis_cli inside a repository: -m imports from the current directory first.
aegis init prints its plan and asks before it writes anything. After you confirm, it reports (absolute paths shortened to ~):
✅ .aegis/config.json: created (hosts: codex-cli, claude-code)
✅ .aegis/.gitignore: created
Starter rules (preset=standard) in .aegis/rules/personas/:
✅ providence
✅ destructive-ops
✅ testing
✅ cost-optimization
✅ git-workflow
They apply to no file until you set their target_paths (aegis status lists them).
Active rule in .aegis/rules/invariants/:
✅ no-eval: bans builtin eval() and exec() in **/*.py (method calls like df.eval() and model.eval() are allowed); aegis check and the pre-commit hook enforce it
Next: add a rule for your own code with aegis rule create (aegis rule create --help)
✅ AGENTS.md: created
✅ ~/.aegis/workspaces.json: added
✅ codex-cli: registered (codex mcp add aegis --env AEGIS_CLIENT=codex-cli -- ~/.local/bin/aegis-mcp)
✅ claude-code: registered (claude mcp add --scope user aegis -e AEGIS_CLIENT=claude-code -- ~/.local/bin/aegis-mcp)
🪝 Pre-commit hook installed (~/code/my-app/.git/hooks/pre-commit)init seeds one rule that is active from day one: .aegis/rules/invariants/no-eval.md (leave it out with --rules none-active). Because builtin: true is set on its call predicates, it catches Python's builtin eval() and exec() while allowing method calls like pandas df.eval(), PyTorch model.eval(), and SQLModel session.exec(). Here is what it looks like, as a template for your own (aegis rule create writes one for you):
---
id: no-eval
type: invariant
domain: security
enforcement: gate
hypothesis: Agents reach for eval() to parse input
target_paths:
- "**/*.py"
forbid_ast:
calls:
- name: eval
builtin: true
- name: exec
builtin: true
---
Never call `eval` or `exec` on data. Parse it with `json.loads` or `ast.literal_eval`.An agent that calls aegis_scan before editing app.py gets this rule (aegis scan app.py shows the same thing in a shell). If the change calls eval anyway, the check fails, and so does git commit, because the pre-commit hook runs the same check on the staged content. With no file arguments, aegis check looks only at tracked files: your changes and staged files (on a clean tree, what the branch adds to its base). It skips untracked files, so git add a new file first, or name it: aegis check app.py.
$ git add app.py
$ aegis check
checkpoint: all checks passed
🔴 forbid_ast:no-eval: app.py — Forbidden call 'eval' matched rule forbid_ast.calls
Layer 1: 1/3 FAILED — forbid_ast:no-evalCommit .aegis/ and AGENTS.md; the local ledger in .aegis/state/ is git-ignored. Run aegis doctor to verify your host registrations and enforcement tiers, and add aegis check to CI since git commit --no-verify skips the local hook:
- uses: actions/checkout@v7
with:
fetch-depth: 0 # aegis check diffs the pull request against its base branch
- uses: actions/setup-python@v7
with:
python-version: "3.12"
- run: pip install aegis-guardrails && aegis checkWorks with your agents
Host | How | Instructions the agent reads |
Claude Code ( |
|
|
Codex CLI ( |
|
|
Antigravity ( | an |
|
Kiro ( | an |
|
Gemini CLI | Retired: Google refuses the client for individual Code Assist accounts, and Antigravity is the Gemini-family host. | — |
On every host, rules are advisory through the bootstrap and aegis_scan, the git pre-commit hook is the local floor, and CI is the authority. aegis hook install --host <host> adds a pre-tool hook that stops destructive commands and edits to files nobody scanned first (--scope project writes project hook settings your teammates' hosts will run).
How it works
Bootstrap:
aegis initwrites a compact bootstrap block intoAGENTS.md(no rule text) and registers theaegisMCP server with your hosts.Just-in-time scan: Before editing, the agent calls
aegis_scanwith the files it will change and receives only matching rules, prioritizing gates and invariants within a token budget.Witnessed verification: The agent edits, runs tests, and reports with
aegis_report_outcome.aegis check --record --testssnapshots the exact git tree so only witnessed passes earn rule credit.Pre-commit & CI enforcement:
aegis checkruns Layer 1 (deterministic checks and everyforbid_astban) in the pre-commit hook and in CI;aegis check --full --plan "..." --llm-cmd 'claude -p'adds an optional cross-vendor model review.Evidence-driven promotion: Outcomes append to a local ledger;
aegis synccomputes rule fitness and suggests promotions for human review.
aegis initwrites a 572-byte bootstrap block intoAGENTS.md, and the MCP server repeats the same guidance in itsinitializeinstructions so editing files cannot strip it.aegis_scanreturns at most 3 rules by default (gates and invariants first, capped at 2 slots so advisory rules are not starved) within a 2,000-token default budget (jit.max_tokensorAEGIS_MAX_JIT_TOKENS).An
aegis_report_outcomecall without a matchingaegis check --recordrow for that git tree is recorded asclaimedand earns no rule credit.
The full architecture, with diagrams, is in How Aegis works. Every command, flag and MCP tool schema is in the generated reference.
What's included
A CLI with 15 commands (
init,uninstall,doctor,migrate,check,approve,scan,status,rule,sync,hook,team,skills,benchmark,package) and an MCP server with 5 tools (aegis_scan,aegis_report_outcome,aegis_create_rule,aegis_list_rules,aegis_capture_insight).Host surfaces.
codex-clicovers the Codex CLI, IDE extension and ChatGPT desktop app;claude-codecovers the CLI, IDE extensions and desktop Code tab;antigravitycovers the app, IDE andagy;kiro(experimental) covers the Kiro IDE and CLI.--host autodiscovers hosts via config directories and app bundles as well as CLIs onPATH.12 starter rules: grounding claims in code, dry runs before destructive commands, behavioral tests, TDD, git hygiene and more (
aegis init --rules minimal|standard|fullseeds 2, 5 or all 12; settarget_pathsto activate them).15 skills:
SKILL.mdplaybooks synced byaegis skills sync(oraegis init --skills) into.claude/skills/and.agents/skills/.Multi-language AST checks: Python (in-process), plus packaged drivers for Rust, TypeScript/JavaScript (
node) and Go (go).A Python SDK facade,
aegis_sdk.Governance, for tools that query rules and fitness.
Agent teams
When parallel agents work in separate worktrees (lanes), declare each lane's path scope with aegis team claim docs --paths 'docs/**' README.md. A lease is cooperative conflict input — not a lock, not an identity, and not proof an agent is still running — and overlapping live claims are refused.
Verify containment with aegis check --lane docs: every path changed since the merge base must stay inside the lane's scope, and no Python test may disappear or gain a skip. With a lease or --paths the check is self-attested; with --base-policy it reads .aegis/team.json from the base branch and is witnessed. In CI it is advisory in v4.1. See How Aegis works for lease refs and aegis team metrics.
Rules that earn their place
Evidence-backed promotion (
trap→invariant→gate): Rules start as traps and earn promotion only through CI-witnessed checks and git history replay — never from unwitnessed agent self-reports. Aegis never rewrites a rule file on its own; a human applies promotions withaegis sync --apply,aegis sync --pr, oraegis rule promote.CI weakening & regression gates (
aegis check --ci): Flags any pull request that weakens a gate or invariant relative to the base branch, enforces fail-to-pass regression tests on bug-fix commits, and emits PR-native--format github|sarifoutput.Closed loop from human corrections (
aegis rule insight): Captures recurring developer corrections viaaegis_capture_insightandaegis rule insight(add,review,enable) and clusters them into draft rule proposals in.aegis/proposals/.
aegis sync computes four sample-size states (untestable, insufficient (n=K) with no precision number shown until n >= 25, inconclusive, and decided) over CI-confirmed checks, git detector replay (caught vs leaked), and human-adjudicated labels, weighted by exponential session-count decay (w = 2^(-delta / H)) over heartbeat-alive eligible sessions. Inline # aegis: allow comments record contested overrides (never false positives) and flag rules with high override rates for review. aegis sync --pr opens a human-reviewed PR with up to 3 sampled examples per rule and never auto-merges. For Layer-2 reviews, the arbiter logs falsifiable predictions scored by aegis check --calibration. Full details are in How Aegis works and Why Aegis is built this way.
What Aegis does not do
Aegis does not claim enforcement it lacks. aegis doctor reports these tiers, in these words:
Tier | Mechanism | What gets past it |
Advisory | AGENTS.md bootstrap, MCP instructions, JIT rules | any agent: it is guidance |
Best-effort | per-host pre-tool hooks | everything on a host without |
Local floor | git pre-commit runs aegis check --hook (--no-verify bypasses it) | anyone using |
Authoritative | CI runs aegis check on the exact SHA; a human merges | a pull request that also weakens the rules or the CI workflow it is checked with, unless |
CI is the floor. Agent hooks are guardrails, not a security boundary. Plain aegis check enforces the rules in the pull request itself, so a pull request that deletes a rule and breaks it passes it. Run aegis check --ci as a required pull-request check: it compares gates and invariants against the base branch and passes a governance weakening only with a signed aegis approve commit, while aegis_scan serves mandatory rules from the reviewed base commit.
Tier A (Separation of duties): GitHub branch protection / rulesets require pull-request reviews from a human
CODEOWNERSreviewer and required status checks (aegis check --ci) before merge.Tier B (Solo developer with cryptographic signing): When one developer owns both the repo and the agent,
aegis approvesigns the governance tree hash (Aegis-Approve: <hash>) using your SSH key (git config gpg.format ssh), verified byaegis check --ciagainst.aegis/allowed_signerson the base branch.Tier C (Self-attested): Local hooks and unsigned CI checks;
aegis doctorreports the active tier read-only (aegis doctor --githubinspects branch protection).Hook & sandbox boundaries: Pre-tool hooks block unscanned edits on Claude Code and trusted Codex CLI (
Antigravityrecords only; shell edits pass everywhere;aegis status --compliancemeasures scan-before-edit rates). Aegis does not sandbox processes or make network calls unless you runaegis check --full --llm-cmd.
FAQ
How do I add guardrails to Claude Code? Run aegis init --host claude-code in the repo. It registers the server at user scope and writes the AGENTS.md bootstrap (or adds @AGENTS.md to an existing CLAUDE.md). Run aegis hook install --host claude-code to add the pre-tool hook.
How do I add guardrails to Codex CLI? Run aegis init --host codex-cli. For the pre-tool hook, run aegis hook install --host codex-cli and trust the hook in Codex's /hooks screen.
What is AGENTS.md? A markdown instructions file in the repository root that coding agents (Codex CLI, Antigravity, Claude Code) read at session start. Aegis writes only a small bootstrap block into it; rules stay in .aegis/rules/ and are served just-in-time via aegis_scan.
Does Aegis send my code anywhere? No. The CLI and MCP server make no network calls, and the ledger stays in .aegis/state/ on your machine. Only optional Layer 2 (aegis check --full --llm-cmd ...) pipes the diff to the command you specify.
I used Aegis 3.x. How do I upgrade? Run aegis migrate, then aegis migrate --apply, aegis init --host <your hosts>, and aegis doctor --fix. See the changelog for details.
Documentation, contributing, security, license
How Aegis works: the loop, rules, MCP delivery, checks, the ledger, hosts and enforcement.
Why Aegis is built this way: the evidence, what went wrong in v3, and the v4.3 trust and evidence model.
Reference: every command, flag and MCP tool, generated from the code.
Plan of record (ADR 0005, ADR 0006) and the changelog.
Contributing and privacy.
Security issues: report them privately as described in SECURITY.md.
Apache 2.0. Copyright 2026 Nicholas Seney. See LICENSE and NOTICE.
Available Tools
5 toolsaegis_capture_insightA
Record a user correction as an unconfirmed suggestion in user scope. Agent suggestions never count toward proposals or debits and never appear in aegis_scan; a suggestion upgrades to W2 only when its quote matches a hook-captured prompt in the same session.
| Name | Required | Description | Default |
|---|---|---|---|
| paths | No | Optional workspace-relative file paths this correction applies to. | |
| quote | Yes | Quote of the user's correction (redacted and capped at 300 chars). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare the safety profile (write, non-idempotent, non-destructive), while the description supplies real lifecycle semantics: the record starts unconfirmed, never counts toward proposals or debits, is invisible to aegis_scan, and only upgrades to 'W2' when the quote matches a hook-captured prompt in the same session. That is substantial post-write behavior disclosure, though the undefined 'W2' term and the absence of any return/error behavior keep it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two dense sentences with the core action front-loaded and the state-transition rules packed into the second. Efficient, but the second sentence is jargon-heavy and slightly overloaded for the value it conveys.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter write tool with no output schema, the description covers what the call does and what happens to the record afterward, which is the critical context. Missing are the return value and any failure/validation behavior, but annotations plus schema carry the rest.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both 'quote' and 'paths' are already documented in the schema, and the description adds only the notion that the quote is a user correction. It offers no extra guidance on the optional 'paths' scoping behavior, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Record') and resource ('a user correction as an unconfirmed suggestion in user scope'), and explicitly distinguishes itself from the aegis_scan sibling by noting suggestions 'never appear in aegis_scan'. The core action is unambiguous, though the domain jargon (W2, proposals, debits) is left undefined.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated: the agent must infer it should call this when the user issues a correction that should be captured but not yet counted. It clarifies one exclusion relative to aegis_scan, but never names when to prefer this over aegis_create_rule or aegis_report_outcome, nor what conditions make a suggestion appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aegis_create_ruleARead-onlyIdempotent
Turn a natural language concern into a prompt that drafts a governance rule. It writes nothing: save the drafted rule under .aegis/rules/ yourself.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | Optional domain hint. | |
| rule_type | No | Optional rule type hint. | |
| description | Yes | The concern, in natural language. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true and destructiveHint=false; the description reinforces this with 'It writes nothing', which resolves the tension between the name 'create_rule' and a read-only hint. It also adds genuinely new context: the output is a prompt, not a saved rule, so the caller must persist it. It does not cover return format details beyond that.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, zero filler, with the core transformation stated first and the critical caveat (nothing is written) immediately after. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the burden of explaining the return value, and it does so by saying the result is a prompt for drafting a rule rather than a rule itself. Combined with the manual-save instruction, an agent has enough to call and use it, though the prompt's shape is not further described.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and all three parameters (description, domain, rule_type with its enum) are documented in the schema, so the description adds no parameter-level meaning. Baseline 3 applies when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific transformation (natural language concern -> prompt that drafts a governance rule), which is far more precise than the name 'create_rule' alone would suggest. It does not, however, name or contrast itself against any sibling such as aegis_list_rules or aegis_scan.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It implies the usage context (drafting a rule before saving it manually) and gives a workflow instruction ('save the drafted rule under .aegis/rules/ yourself'), but never states when to prefer this tool over the siblings or any prerequisites. Usage is implied rather than spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aegis_list_rulesARead-onlyIdempotent
List the governance rules as {rules, stale_rules, ignored}: every rule with its type, hypothesis and ledger fitness (a file that cannot be loaded is listed with _error), the rules edited since the last aegis sync, and markdown under .aegis/rules that is not a rule.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Optional response projection: full (default), summary or ids. | |
| rule_type | No | Optional rule type filter. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the safe read profile (readOnlyHint, idempotentHint, destructiveHint=false, openWorldHint=false), so the description's job is to add context beyond that. It does: unloadable files surface with an _error marker rather than failing, and stale_rules are defined relative to the last aegis sync. It does not disclose pagination or size limits, but for a local read this is solid added context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that leads with the tool's action and then unpacks the three output keys in matching order. It is dense with nested parentheticals, but nearly every clause carries information an agent needs to interpret the response.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description must carry the return-value burden, and it does: it defines all three top-level keys and the per-rule fields (type, hypothesis, ledger fitness). It omits ordering, pagination and response size, which keeps it short of a 5 for a tool with no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with both enum parameters fully described in the schema, so the baseline is 3. The description never mentions the view projection or rule_type filter, so it adds nothing to parameter understanding; the schema does all the work.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific verb and resource ('list the governance rules') and immediately specifies the exact response shape ({rules, stale_rules, ignored}) with what each key contains. This is clearly distinguishable from siblings like aegis_create_rule or aegis_scan, which mutate or analyze rather than enumerate rules.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the verb and the described output (inspect rules, find stale ones, spot ignored markdown), but there is no explicit when-to-use statement, no mention of when a filter is preferable to a full listing, and no routing to or away from any sibling tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aegis_report_outcomeAIdempotent
Report whether the rules you were shown helped. The server ties the report to the tree it computes now: with an aegis check --record run of exactly that tree it credits the rules it showed you that match the change (your rules_used is not what is credited), and even then only CI on the landing commit makes it count; without one it records a single unwitnessed claim per session and tree that earns nothing. Reports per session are capped.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Optional response projection: full (default), summary or ids. | |
| files | No | Optional: the files this change edited (workspace-relative). They measure scan-before-edit compliance (aegis status --compliance); they credit no rule. | |
| notes | No | ||
| outcome | Yes | Verification outcome. | |
| rules_used | Yes | Names of the rules this outcome is about, as aegis_scan returned them. | |
| rework_count | No | ||
| tests_passed | No | ||
| idempotency_key | Yes | Unique key for this report. Retrying with the same key never records twice. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnlyHint=false, idempotentHint=true, destructiveHint=false) and the schema covers retry safety, yet the description adds genuinely non-obvious behavior: what actually gets credited, that rules_used is not the credit source, that unwitnessed claims earn nothing, and that reports are capped per session. The only gap is that the cap value and the returned payload are not characterized.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose is front-loaded in sentence one, which is good, but sentence two is a single run-on that packs crediting, tree matching, CI landing-commit requirements, unwitnessed-claim fallback and session caps into one unparsable clause chain. The content is dense with genuine information, yet the structure makes it hard to extract the actionable rule.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 8-parameter mutation with no output schema, the description does cover the hard part — the crediting and capping semantics that an agent could never infer. However, it omits what the call returns, how the different outcome enum values affect crediting, and what the view projection yields, leaving the agent to guess at the result of the call.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 63%, so the schema already documents most parameters (files, rules_used, idempotency_key, view, outcome). The description adds one meaningful clarification — that the rules_used array is not what is credited — but says nothing about outcome values, rework_count, tests_passed, notes, or the view projection, so it neither compensates for the uncovered third nor meaningfully exceeds the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence gives a specific verb and object — report whether the rules you were shown helped — which is enough to place the tool as the feedback/outcome step of the aegis rule loop. It never names a sibling MCP tool (aegis_scan, aegis_create_rule) to sharpen the boundary, and the dense crediting explanation that follows muddies the one-line purpose rather than reinforcing it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It implies the required usage context (report only pays off when an `aegis check --record` ran against exactly the tree the server computes now) and states the fallback when that condition is absent. That is real when/when-not guidance, but it is framed as server-side crediting mechanics rather than as a rule for choosing this tool over its siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aegis_scanARead-onlyIdempotent
Call before editing files: returns the governance rules that apply to them, ranked by ledger fitness and clamped to the JIT token budget. Mandatory rules (gates, invariants) take at most two slots; the others are listed in omitted_mandatory. Gates and invariants are served from the reviewed base commit (rules_base); branch-local edits to them never bind and are listed in unreviewed_rules. stale_rules lists rules edited since the last aegis sync. If any rule file cannot be loaded the scan fails (status FAIL) and names it.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Optional response projection: full (default), summary or ids. | |
| files | No | Workspace-relative files you are about to edit. Defaults to the git diff. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive, and the description goes well beyond them: it discloses token-budget clamping, the two-slot cap on mandatory rules, the existence of omitted_mandatory, that gates/invariants are served from the reviewed base commit and branch-local edits never bind (unreviewed_rules), staleness semantics, and that an unloadable rule file fails the whole scan with status FAIL. This is exactly the extra behavioral context the structured fields do not carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The trigger condition is front-loaded and each subsequent sentence maps to a distinct output field or failure mode, so little is wasted. It is dense and slightly long, but the density is load-bearing given the absent output schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description must carry the return contract, and it does: it defines omitted_mandatory, rules_base, unreviewed_rules, stale_rules, and the FAIL behavior. An agent knows both how to invoke it and how to read the response.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters and the enum values are already documented in the schema. The description references the file set only implicitly ('files you are about to edit'); it adds no format, ordering, or size guidance beyond what the schema states. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb plus resource ('returns the governance rules that apply to them') and a clear scope trigger ('Call before editing files'), which is enough to pick it over a plain rule lister. It never names a sibling tool explicitly (e.g. aegis_list_rules), so the differentiation from siblings is implied rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Call before editing files' is an explicit, actionable when-to-use cue tied to the edit workflow. There is no when-not guidance and no named alternative for the opposite case (e.g. browsing all rules), so it stops short of full operative routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.1.0- First observed
aegis_capture_insight - First observed
aegis_create_rule - First observed
aegis_list_rules - First observed
aegis_report_outcome - First observed
aegis_scan
TDQS
Scored across 5 tools
Each tool has a clearly distinct purpose: capture_insight records corrections, create_rule drafts a rule, list_rules enumerates rules, report_outcome provides feedback, and scan retrieves applicable rules. No two tools perform the same action, so an agent can easily select the right one.
All tools share the aegis_ prefix and follow a verb_noun pattern except aegis_scan, which is verb-only. This minor deviation keeps the set readable and predictable.
Five tools is well within the ideal range and each covers a distinct part of the governance workflow: insight capture, rule creation, rule listing, outcome reporting, and rule scanning. There is no redundancy.
The surface lacks tools to persist, update, or delete rules—create_rule explicitly writes nothing, and there is no edit or delete operation. While listing and scanning provide read access, the lifecycle is incomplete, forcing manual file operations.
Maintenance
Related MCP Connectors
Enforces architectural invariants and code quality rules inside your AI agent's edit loop.
Pre-execution governance for AI agents. Deterministic PASS/FAIL/REVIEW verdicts, replayable proof.
AgentGuard — 20-tool AI safety MCP: policy preflight, risk scoring, audit logging, rate limits.
Zero-install security baseline for AI coding agents — OWASP/CWE-cited rules over MCP.
Related MCP Servers
- AlicenseNot gradedqualityFmaintenanceGovernance kernel for AI agents — policy enforcement, code safety verification, multi-model hallucination detection (CMVK), trust attestation (IATP), and immutable audit trails. Works with Claude Desktop, Cursor, and any MCP client.74MIT
- AlicenseNot gradedqualityAmaintenanceAI Constraint Engine that enforces CLAUDE.md, .cursorrules, and AGENTS.md rules as laws. 51 MCP tools for semantic conflict detection, patch review, drift scoring, pre-commit hooks, and Guardian Mode. Catches euphemisms, temporal evasion, and hidden violations that keyword matching misses.112 npm25MIT
- AlicenseNot gradedqualityDmaintenanceRuntime safety guardrails for AI coding agents. Checks file access, validates shell commands, and scores your repo's AI safety — all via MCP.6 npm8MIT
- AlicenseNot gradedqualityAmaintenanceAn MCP server that enforces repository governance rules for AI coding agents, providing tools to validate plans, diffs, and scan for architectural and safety violations.1MIT