Skip to main content
Glama

Aegis Guardrails: Rules, AST Checks & MCP Server for AI Coding Agents

PyPI Python License: Apache 2.0 Runtime dependencies: 0 CI

Aegis keeps Claude Code, Codex CLI and Antigravity on your project's rules via a zero-dependency Model Context Protocol (MCP) server (aegis-mcp), AGENTS.md / CLAUDE.md bootstrap, git pre-commit hooks, and CI governance (aegis check). It serves each agent just-in-time rules for the files it is about to edit, then enforces AST and repository invariants before commit and in pull requests.

What is Aegis?

Aegis is a Python package with zero runtime dependencies that provides a CLI (aegis) and an MCP server (aegis-mcp) for AI coding agent governance. Your rules are short markdown files in .aegis/rules/, committed with your code. Before an agent edits a file, the aegis_scan MCP tool hands it only the rules whose target_paths match that file. aegis check then runs deterministic checks — including AST code patterns your rules ban — in a git pre-commit hook and in CI, while a local ledger records how each rule fared.

Related MCP server: SpecLock

Why guardrails for AI coding agents?

An instructions file (AGENTS.md, CLAUDE.md, .cursorrules) is a gentleman's agreement: nothing checks that the agent followed it. Agents break it in three ways:

  • They skip rules. Under task pressure an agent follows the letter of a rule and misses its point.

  • They forget. Long sessions compact their context, and every new session starts from zero.

  • They fail open. A check that crashed, a tool that is missing or a rule that never loaded looks exactly like "no problem found".

In one coding session analyzed step by step, 749 of 1,339 agent steps (55.9%) were rework. The largest items were guessed UI controls (180 steps), the wrong Python environment (110) and a test that polled forever (103), and each became a rule Aegis ships. That is one session by one developer with no second rater; the sources and caveats are in Why Aegis is built this way.

Quick start

Aegis runs a 3-step loop in any git repository with Python 3.9 or newer:

  1. Step 1 — Install & initialize: Install aegis-guardrails (pipx install aegis-guardrails or pip install aegis-guardrails) and run aegis init in your repo to write the AGENTS.md bootstrap, register aegis-mcp with your hosts, and install the pre-commit hook.

  2. Step 2 — Scan before edit: Your coding agent calls aegis_scan over MCP before editing files to receive just-in-time rules matched to those paths.

  3. Step 3 — Block bad commits in Git & CI: aegis check runs automatically in the pre-commit hook and in CI to block forbidden AST patterns and rule regressions.

pipx install aegis-guardrails            # or: pip install aegis-guardrails
cd my-app
aegis init --host claude-code,codex-cli   # or --host auto: every supported host found on this machine

If pip stops with externally-managed-environment (PEP 668, as many Linux distributions and Homebrew Python do), run pipx install aegis-guardrails or install into a virtual environment. If your shell then says aegis: command not found, run pipx ensurepath after a pipx install, activate the virtual environment, or run the script by its full path (on Linux ~/.local/bin/aegis after pip install --user); aegis init and aegis doctor print the PATH fix for your shell. Do not fall back to python3 -m aegis_cli inside a repository: -m imports from the current directory first.

aegis init prints its plan and asks before it writes anything. After you confirm, it reports (absolute paths shortened to ~):

  ✅ .aegis/config.json: created (hosts: codex-cli, claude-code)
  ✅ .aegis/.gitignore: created
  Starter rules (preset=standard) in .aegis/rules/personas/:
    ✅ providence
    ✅ destructive-ops
    ✅ testing
    ✅ cost-optimization
    ✅ git-workflow
    They apply to no file until you set their target_paths (aegis status lists them).
  Active rule in .aegis/rules/invariants/:
    ✅ no-eval: bans builtin eval() and exec() in **/*.py (method calls like df.eval() and model.eval() are allowed); aegis check and the pre-commit hook enforce it
    Next: add a rule for your own code with aegis rule create (aegis rule create --help)
  ✅ AGENTS.md: created
  ✅ ~/.aegis/workspaces.json: added
  ✅ codex-cli: registered (codex mcp add aegis --env AEGIS_CLIENT=codex-cli -- ~/.local/bin/aegis-mcp)
  ✅ claude-code: registered (claude mcp add --scope user aegis -e AEGIS_CLIENT=claude-code -- ~/.local/bin/aegis-mcp)
    🪝 Pre-commit hook installed (~/code/my-app/.git/hooks/pre-commit)

init seeds one rule that is active from day one: .aegis/rules/invariants/no-eval.md (leave it out with --rules none-active). Because builtin: true is set on its call predicates, it catches Python's builtin eval() and exec() while allowing method calls like pandas df.eval(), PyTorch model.eval(), and SQLModel session.exec(). Here is what it looks like, as a template for your own (aegis rule create writes one for you):

---
id: no-eval
type: invariant
domain: security
enforcement: gate
hypothesis: Agents reach for eval() to parse input
target_paths:
  - "**/*.py"
forbid_ast:
  calls:
    - name: eval
      builtin: true
    - name: exec
      builtin: true
---
Never call `eval` or `exec` on data. Parse it with `json.loads` or `ast.literal_eval`.

An agent that calls aegis_scan before editing app.py gets this rule (aegis scan app.py shows the same thing in a shell). If the change calls eval anyway, the check fails, and so does git commit, because the pre-commit hook runs the same check on the staged content. With no file arguments, aegis check looks only at tracked files: your changes and staged files (on a clean tree, what the branch adds to its base). It skips untracked files, so git add a new file first, or name it: aegis check app.py.

$ git add app.py
$ aegis check
checkpoint: all checks passed
🔴 forbid_ast:no-eval: app.py — Forbidden call 'eval' matched rule forbid_ast.calls
Layer 1: 1/3 FAILED — forbid_ast:no-eval

Commit .aegis/ and AGENTS.md; the local ledger in .aegis/state/ is git-ignored. Run aegis doctor to verify your host registrations and enforcement tiers, and add aegis check to CI since git commit --no-verify skips the local hook:

- uses: actions/checkout@v7
  with:
    fetch-depth: 0          # aegis check diffs the pull request against its base branch
- uses: actions/setup-python@v7
  with:
    python-version: "3.12"
- run: pip install aegis-guardrails && aegis check

Works with your agents

Host

How aegis init --host wires it

Instructions the agent reads

Claude Code (claude-code)

claude mcp add --scope user aegis

AGENTS.md, but only when there is no CLAUDE.md. If the repo has one, init adds an @AGENTS.md block to it; it never creates one.

Codex CLI (codex-cli)

codex mcp add aegis

AGENTS.md (Codex truncates it past 32 KiB)

Antigravity (antigravity: app, IDE and agy)

an aegis entry in ~/.gemini/config/mcp_config.json

AGENTS.md (24,000 bytes per file). Antigravity tells the server no workspace, so run aegis init once per repo on each machine.

Kiro (kiro, experimental: IDE and CLI)

an aegis entry in ~/.kiro/settings/mcp.json

AGENTS.md

Gemini CLI

Retired: Google refuses the client for individual Code Assist accounts, and Antigravity is the Gemini-family host. aegis init --host gemini-cli exits with status 2 and points you to --host antigravity.

—

On every host, rules are advisory through the bootstrap and aegis_scan, the git pre-commit hook is the local floor, and CI is the authority. aegis hook install --host <host> adds a pre-tool hook that stops destructive commands and edits to files nobody scanned first (--scope project writes project hook settings your teammates' hosts will run).

How it works

  1. Bootstrap: aegis init writes a compact bootstrap block into AGENTS.md (no rule text) and registers the aegis MCP server with your hosts.

  2. Just-in-time scan: Before editing, the agent calls aegis_scan with the files it will change and receives only matching rules, prioritizing gates and invariants within a token budget.

  3. Witnessed verification: The agent edits, runs tests, and reports with aegis_report_outcome. aegis check --record --tests snapshots the exact git tree so only witnessed passes earn rule credit.

  4. Pre-commit & CI enforcement: aegis check runs Layer 1 (deterministic checks and every forbid_ast ban) in the pre-commit hook and in CI; aegis check --full --plan "..." --llm-cmd 'claude -p' adds an optional cross-vendor model review.

  5. Evidence-driven promotion: Outcomes append to a local ledger; aegis sync computes rule fitness and suggests promotions for human review.

  • aegis init writes a 572-byte bootstrap block into AGENTS.md, and the MCP server repeats the same guidance in its initialize instructions so editing files cannot strip it.

  • aegis_scan returns at most 3 rules by default (gates and invariants first, capped at 2 slots so advisory rules are not starved) within a 2,000-token default budget (jit.max_tokens or AEGIS_MAX_JIT_TOKENS).

  • An aegis_report_outcome call without a matching aegis check --record row for that git tree is recorded as claimed and earns no rule credit.

The full architecture, with diagrams, is in How Aegis works. Every command, flag and MCP tool schema is in the generated reference.

What's included

  • A CLI with 15 commands (init, uninstall, doctor, migrate, check, approve, scan, status, rule, sync, hook, team, skills, benchmark, package) and an MCP server with 5 tools (aegis_scan, aegis_report_outcome, aegis_create_rule, aegis_list_rules, aegis_capture_insight).

  • Host surfaces. codex-cli covers the Codex CLI, IDE extension and ChatGPT desktop app; claude-code covers the CLI, IDE extensions and desktop Code tab; antigravity covers the app, IDE and agy; kiro (experimental) covers the Kiro IDE and CLI. --host auto discovers hosts via config directories and app bundles as well as CLIs on PATH.

  • 12 starter rules: grounding claims in code, dry runs before destructive commands, behavioral tests, TDD, git hygiene and more (aegis init --rules minimal|standard|full seeds 2, 5 or all 12; set target_paths to activate them).

  • 15 skills: SKILL.md playbooks synced by aegis skills sync (or aegis init --skills) into .claude/skills/ and .agents/skills/.

  • Multi-language AST checks: Python (in-process), plus packaged drivers for Rust, TypeScript/JavaScript (node) and Go (go).

  • A Python SDK facade, aegis_sdk.Governance, for tools that query rules and fitness.

Agent teams

When parallel agents work in separate worktrees (lanes), declare each lane's path scope with aegis team claim docs --paths 'docs/**' README.md. A lease is cooperative conflict input — not a lock, not an identity, and not proof an agent is still running — and overlapping live claims are refused.

Verify containment with aegis check --lane docs: every path changed since the merge base must stay inside the lane's scope, and no Python test may disappear or gain a skip. With a lease or --paths the check is self-attested; with --base-policy it reads .aegis/team.json from the base branch and is witnessed. In CI it is advisory in v4.1. See How Aegis works for lease refs and aegis team metrics.

Rules that earn their place

  • Evidence-backed promotion (trap → invariant → gate): Rules start as traps and earn promotion only through CI-witnessed checks and git history replay — never from unwitnessed agent self-reports. Aegis never rewrites a rule file on its own; a human applies promotions with aegis sync --apply, aegis sync --pr, or aegis rule promote.

  • CI weakening & regression gates (aegis check --ci): Flags any pull request that weakens a gate or invariant relative to the base branch, enforces fail-to-pass regression tests on bug-fix commits, and emits PR-native --format github|sarif output.

  • Closed loop from human corrections (aegis rule insight): Captures recurring developer corrections via aegis_capture_insight and aegis rule insight (add, review, enable) and clusters them into draft rule proposals in .aegis/proposals/.

aegis sync computes four sample-size states (untestable, insufficient (n=K) with no precision number shown until n >= 25, inconclusive, and decided) over CI-confirmed checks, git detector replay (caught vs leaked), and human-adjudicated labels, weighted by exponential session-count decay (w = 2^(-delta / H)) over heartbeat-alive eligible sessions. Inline # aegis: allow comments record contested overrides (never false positives) and flag rules with high override rates for review. aegis sync --pr opens a human-reviewed PR with up to 3 sampled examples per rule and never auto-merges. For Layer-2 reviews, the arbiter logs falsifiable predictions scored by aegis check --calibration. Full details are in How Aegis works and Why Aegis is built this way.

What Aegis does not do

Aegis does not claim enforcement it lacks. aegis doctor reports these tiers, in these words:

Tier

Mechanism

What gets past it

Advisory

AGENTS.md bootstrap, MCP instructions, JIT rules

any agent: it is guidance

Best-effort

per-host pre-tool hooks

everything on a host without aegis hook install --host, a Codex hook you have not trusted in /hooks, edits made through shell commands, and any call when Aegis itself errors: the hooks fail open. Installed, aegis doctor reports Claude Code: blocking (documented; fails open on error) [DOC] (exit 2, documented by Anthropic); Codex CLI: blocking once trusted in /hooks (documented; fails open) [DOC] (exit 2, documented by OpenAI); Antigravity: blocks destructive commands (live); scan gate records only [LIVE] (exit 1, verified live). Antigravity hooks are unavailable on Windows

Local floor

git pre-commit runs aegis check --hook (--no-verify bypasses it)

anyone using git commit --no-verify

Authoritative

CI runs aegis check on the exact SHA; a human merges

a pull request that also weakens the rules or the CI workflow it is checked with, unless aegis check --ci runs as a required check and a person reviews or signs (aegis approve) those changes. aegis doctor prints the trust tier (A, B or C) GitHub actually enforces

CI is the floor. Agent hooks are guardrails, not a security boundary. Plain aegis check enforces the rules in the pull request itself, so a pull request that deletes a rule and breaks it passes it. Run aegis check --ci as a required pull-request check: it compares gates and invariants against the base branch and passes a governance weakening only with a signed aegis approve commit, while aegis_scan serves mandatory rules from the reviewed base commit.

  • Tier A (Separation of duties): GitHub branch protection / rulesets require pull-request reviews from a human CODEOWNERS reviewer and required status checks (aegis check --ci) before merge.

  • Tier B (Solo developer with cryptographic signing): When one developer owns both the repo and the agent, aegis approve signs the governance tree hash (Aegis-Approve: <hash>) using your SSH key (git config gpg.format ssh), verified by aegis check --ci against .aegis/allowed_signers on the base branch.

  • Tier C (Self-attested): Local hooks and unsigned CI checks; aegis doctor reports the active tier read-only (aegis doctor --github inspects branch protection).

  • Hook & sandbox boundaries: Pre-tool hooks block unscanned edits on Claude Code and trusted Codex CLI (Antigravity records only; shell edits pass everywhere; aegis status --compliance measures scan-before-edit rates). Aegis does not sandbox processes or make network calls unless you run aegis check --full --llm-cmd.

FAQ

How do I add guardrails to Claude Code? Run aegis init --host claude-code in the repo. It registers the server at user scope and writes the AGENTS.md bootstrap (or adds @AGENTS.md to an existing CLAUDE.md). Run aegis hook install --host claude-code to add the pre-tool hook.

How do I add guardrails to Codex CLI? Run aegis init --host codex-cli. For the pre-tool hook, run aegis hook install --host codex-cli and trust the hook in Codex's /hooks screen.

What is AGENTS.md? A markdown instructions file in the repository root that coding agents (Codex CLI, Antigravity, Claude Code) read at session start. Aegis writes only a small bootstrap block into it; rules stay in .aegis/rules/ and are served just-in-time via aegis_scan.

Does Aegis send my code anywhere? No. The CLI and MCP server make no network calls, and the ledger stays in .aegis/state/ on your machine. Only optional Layer 2 (aegis check --full --llm-cmd ...) pipes the diff to the command you specify.

I used Aegis 3.x. How do I upgrade? Run aegis migrate, then aegis migrate --apply, aegis init --host <your hosts>, and aegis doctor --fix. See the changelog for details.

Documentation, contributing, security, license

Apache 2.0. Copyright 2026 Nicholas Seney. See LICENSE and NOTICE.

Available Tools

5 tools
aegis_capture_insightA

Record a user correction as an unconfirmed suggestion in user scope. Agent suggestions never count toward proposals or debits and never appear in aegis_scan; a suggestion upgrades to W2 only when its quote matches a hook-captured prompt in the same session.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathsNoOptional workspace-relative file paths this correction applies to.
quoteYesQuote of the user's correction (redacted and capped at 300 chars).

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare the safety profile (write, non-idempotent, non-destructive), while the description supplies real lifecycle semantics: the record starts unconfirmed, never counts toward proposals or debits, is invisible to aegis_scan, and only upgrades to 'W2' when the quote matches a hook-captured prompt in the same session. That is substantial post-write behavior disclosure, though the undefined 'W2' term and the absence of any return/error behavior keep it short of a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two dense sentences with the core action front-loaded and the state-transition rules packed into the second. Efficient, but the second sentence is jargon-heavy and slightly overloaded for the value it conveys.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter write tool with no output schema, the description covers what the call does and what happens to the record afterward, which is the critical context. Missing are the return value and any failure/validation behavior, but annotations plus schema carry the rest.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both 'quote' and 'paths' are already documented in the schema, and the description adds only the notion that the quote is a user correction. It offers no extra guidance on the optional 'paths' scoping behavior, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Record') and resource ('a user correction as an unconfirmed suggestion in user scope'), and explicitly distinguishes itself from the aegis_scan sibling by noting suggestions 'never appear in aegis_scan'. The core action is unambiguous, though the domain jargon (W2, proposals, debits) is left undefined.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: the agent must infer it should call this when the user issues a correction that should be captured but not yet counted. It clarifies one exclusion relative to aegis_scan, but never names when to prefer this over aegis_create_rule or aegis_report_outcome, nor what conditions make a suggestion appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

aegis_create_ruleA
Read-onlyIdempotent

Turn a natural language concern into a prompt that drafts a governance rule. It writes nothing: save the drafted rule under .aegis/rules/ yourself.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainNoOptional domain hint.
rule_typeNoOptional rule type hint.
descriptionYesThe concern, in natural language.

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true and destructiveHint=false; the description reinforces this with 'It writes nothing', which resolves the tension between the name 'create_rule' and a read-only hint. It also adds genuinely new context: the output is a prompt, not a saved rule, so the caller must persist it. It does not cover return format details beyond that.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, zero filler, with the core transformation stated first and the critical caveat (nothing is written) immediately after. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the burden of explaining the return value, and it does so by saying the result is a prompt for drafting a rule rather than a rule itself. Combined with the manual-save instruction, an agent has enough to call and use it, though the prompt's shape is not further described.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and all three parameters (description, domain, rule_type with its enum) are documented in the schema, so the description adds no parameter-level meaning. Baseline 3 applies when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific transformation (natural language concern -> prompt that drafts a governance rule), which is far more precise than the name 'create_rule' alone would suggest. It does not, however, name or contrast itself against any sibling such as aegis_list_rules or aegis_scan.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It implies the usage context (drafting a rule before saving it manually) and gives a workflow instruction ('save the drafted rule under .aegis/rules/ yourself'), but never states when to prefer this tool over the siblings or any prerequisites. Usage is implied rather than spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

aegis_list_rulesA
Read-onlyIdempotent

List the governance rules as {rules, stale_rules, ignored}: every rule with its type, hypothesis and ledger fitness (a file that cannot be loaded is listed with _error), the rules edited since the last aegis sync, and markdown under .aegis/rules that is not a rule.

ParametersJSON Schema
NameRequiredDescriptionDefault
viewNoOptional response projection: full (default), summary or ids.
rule_typeNoOptional rule type filter.

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the safe read profile (readOnlyHint, idempotentHint, destructiveHint=false, openWorldHint=false), so the description's job is to add context beyond that. It does: unloadable files surface with an _error marker rather than failing, and stale_rules are defined relative to the last aegis sync. It does not disclose pagination or size limits, but for a local read this is solid added context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence that leads with the tool's action and then unpacks the three output keys in matching order. It is dense with nested parentheticals, but nearly every clause carries information an agent needs to interpret the response.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description must carry the return-value burden, and it does: it defines all three top-level keys and the per-rule fields (type, hypothesis, ledger fitness). It omits ordering, pagination and response size, which keeps it short of a 5 for a tool with no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with both enum parameters fully described in the schema, so the baseline is 3. The description never mentions the view projection or rule_type filter, so it adds nothing to parameter understanding; the schema does all the work.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb and resource ('list the governance rules') and immediately specifies the exact response shape ({rules, stale_rules, ignored}) with what each key contains. This is clearly distinguishable from siblings like aegis_create_rule or aegis_scan, which mutate or analyze rather than enumerate rules.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the verb and the described output (inspect rules, find stale ones, spot ignored markdown), but there is no explicit when-to-use statement, no mention of when a filter is preferable to a full listing, and no routing to or away from any sibling tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

aegis_report_outcomeA
Idempotent

Report whether the rules you were shown helped. The server ties the report to the tree it computes now: with an aegis check --record run of exactly that tree it credits the rules it showed you that match the change (your rules_used is not what is credited), and even then only CI on the landing commit makes it count; without one it records a single unwitnessed claim per session and tree that earns nothing. Reports per session are capped.

ParametersJSON Schema
NameRequiredDescriptionDefault
viewNoOptional response projection: full (default), summary or ids.
filesNoOptional: the files this change edited (workspace-relative). They measure scan-before-edit compliance (aegis status --compliance); they credit no rule.
notesNo
outcomeYesVerification outcome.
rules_usedYesNames of the rules this outcome is about, as aegis_scan returned them.
rework_countNo
tests_passedNo
idempotency_keyYesUnique key for this report. Retrying with the same key never records twice.

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations cover the safety profile (readOnlyHint=false, idempotentHint=true, destructiveHint=false) and the schema covers retry safety, yet the description adds genuinely non-obvious behavior: what actually gets credited, that rules_used is not the credit source, that unwitnessed claims earn nothing, and that reports are capped per session. The only gap is that the cap value and the returned payload are not characterized.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded in sentence one, which is good, but sentence two is a single run-on that packs crediting, tree matching, CI landing-commit requirements, unwitnessed-claim fallback and session caps into one unparsable clause chain. The content is dense with genuine information, yet the structure makes it hard to extract the actionable rule.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-parameter mutation with no output schema, the description does cover the hard part — the crediting and capping semantics that an agent could never infer. However, it omits what the call returns, how the different outcome enum values affect crediting, and what the view projection yields, leaving the agent to guess at the result of the call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 63%, so the schema already documents most parameters (files, rules_used, idempotency_key, view, outcome). The description adds one meaningful clarification — that the rules_used array is not what is credited — but says nothing about outcome values, rework_count, tests_passed, notes, or the view projection, so it neither compensates for the uncovered third nor meaningfully exceeds the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence gives a specific verb and object — report whether the rules you were shown helped — which is enough to place the tool as the feedback/outcome step of the aegis rule loop. It never names a sibling MCP tool (aegis_scan, aegis_create_rule) to sharpen the boundary, and the dense crediting explanation that follows muddies the one-line purpose rather than reinforcing it.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It implies the required usage context (report only pays off when an `aegis check --record` ran against exactly the tree the server computes now) and states the fallback when that condition is absent. That is real when/when-not guidance, but it is framed as server-side crediting mechanics rather than as a rule for choosing this tool over its siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

aegis_scanA
Read-onlyIdempotent

Call before editing files: returns the governance rules that apply to them, ranked by ledger fitness and clamped to the JIT token budget. Mandatory rules (gates, invariants) take at most two slots; the others are listed in omitted_mandatory. Gates and invariants are served from the reviewed base commit (rules_base); branch-local edits to them never bind and are listed in unreviewed_rules. stale_rules lists rules edited since the last aegis sync. If any rule file cannot be loaded the scan fails (status FAIL) and names it.

ParametersJSON Schema
NameRequiredDescriptionDefault
viewNoOptional response projection: full (default), summary or ids.
filesNoWorkspace-relative files you are about to edit. Defaults to the git diff.

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, and the description goes well beyond them: it discloses token-budget clamping, the two-slot cap on mandatory rules, the existence of omitted_mandatory, that gates/invariants are served from the reviewed base commit and branch-local edits never bind (unreviewed_rules), staleness semantics, and that an unloadable rule file fails the whole scan with status FAIL. This is exactly the extra behavioral context the structured fields do not carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The trigger condition is front-loaded and each subsequent sentence maps to a distinct output field or failure mode, so little is wasted. It is dense and slightly long, but the density is load-bearing given the absent output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description must carry the return contract, and it does: it defines omitted_mandatory, rules_base, unreviewed_rules, stale_rules, and the FAIL behavior. An agent knows both how to invoke it and how to read the response.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so both parameters and the enum values are already documented in the schema. The description references the file set only implicitly ('files you are about to edit'); it adds no format, ordering, or size guidance beyond what the schema states. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb plus resource ('returns the governance rules that apply to them') and a clear scope trigger ('Call before editing files'), which is enough to pick it over a plain rule lister. It never names a sibling tool explicitly (e.g. aegis_list_rules), so the differentiation from siblings is implied rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Call before editing files' is an explicit, actionable when-to-use cue tied to the edit workflow. There is no when-not guidance and no named alternative for the opposite case (e.g. browsing all rules), so it stops short of full operative routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 5 tool updatesv0.1.0
    • First observedaegis_capture_insight
    • First observedaegis_create_rule
    • First observedaegis_list_rules
    • First observedaegis_report_outcome
    • First observedaegis_scan

TDQS

A3.9/5.0

Scored across 5 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: capture_insight records corrections, create_rule drafts a rule, list_rules enumerates rules, report_outcome provides feedback, and scan retrieves applicable rules. No two tools perform the same action, so an agent can easily select the right one.

Naming Consistency4/5

All tools share the aegis_ prefix and follow a verb_noun pattern except aegis_scan, which is verb-only. This minor deviation keeps the set readable and predictable.

Tool Count5/5

Five tools is well within the ideal range and each covers a distinct part of the governance workflow: insight capture, rule creation, rule listing, outcome reporting, and rule scanning. There is no redundancy.

Completeness3/5

The surface lacks tools to persist, update, or delete rules—create_rule explicitly writes nothing, and there is no edit or delete operation. While listing and scanning provide read access, the lifecycle is incomplete, forcing manual file operations.

Maintenance

ActivityMaintained
ResponsivenessWithin a week

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    F
    maintenance
    Governance kernel for AI agents — policy enforcement, code safety verification, multi-model hallucination detection (CMVK), trust attestation (IATP), and immutable audit trails. Works with Claude Desktop, Cursor, and any MCP client.
    74
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    AI Constraint Engine that enforces CLAUDE.md, .cursorrules, and AGENTS.md rules as laws. 51 MCP tools for semantic conflict detection, patch review, drift scoring, pre-commit hooks, and Guardian Mode. Catches euphemisms, temporal evasion, and hidden violations that keyword matching misses.
    112 npm
    25
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    An MCP server that enforces repository governance rules for AI coding agents, providing tools to validate plans, diffs, and scan for architectural and safety violations.
    1
    MIT