Aegis is a blast-radius auditor for AI agents that detects toxic capability combinations and data exfiltration paths deterministically, all without using LLM tokens for detection.
Connect tools: Use connect_tool to attach tools (Gmail, Dropbox, Postgres, Slack, Filesystem, Calendar) to an agent, granting it their capabilities.
Visualize capabilities: get_capability_graph returns a graph with nodes, edges (danger flags in red), attack paths, and an overall risk score.
Detect attack paths: detect_attack_paths runs a deterministic engine that identifies dangerous combinations (e.g., READ_PRIVATE_DATA + SEND_EXTERNAL for exfiltration, READ_PRIVATE_DATA + WRITE_PUBLIC for public leak, DELETE_DATA + EXECUTE for destructive automation) and reports severity and affected tools.
Automatically remediate: apply_policy_fix disconnects the tool providing the dangerous sink capability, neutralizing the attack path and resetting the risk score.
Explain findings: explain_attack_path provides plain-English explanations via an LLM (Groq), which is only invoked on rule matches and cached.
Access policies: Retrieve the full set of toxic-combination rules in JSON from the aegis://policies resource.
Connects Dropbox to an AI agent and audits its permissions for risky capability combinations such as reading private data and writing to public locations.
Connects Gmail to an AI agent and audits its permissions for dangerous combinations like reading private data and sending it externally.
Connects Slack to an AI agent and audits its permissions for attack paths like exfiltration of private data through Slack messages.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Aegis check my connected MCP tools for dangerous combinations"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A Blast-Radius Auditor for AI Agents Track 03: Enterprise AI & Workplace Automation ā NitroStack Hackathon
Aegis is a Model Context Protocol (MCP) server built on NitroStack that audits the combined effective permissions of an AI agent across all connected tools. It deterministically detects toxic capability combinations and data-exfiltration vectors before deployment ā at zero LLM token cost.
š“ Live server: https://aegis-6a6d76ee-teamx-srmist.app.nitrocloud.ai/mcp ā connect it to Claude, ChatGPT, or NitroStack Studio and try the walkthrough below for real.
Related MCP server: AgentWard
Enterprises connect AI agents to dozens of tools ā Gmail, Dropbox, Postgres databases, Slack, filesystem execution. Each integration gets approved individually on its own merits, but nobody audits what the agent can do when tools are combined.
āāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāā
ā Dropbox MCP ā ā Gmail MCP ā
ā (Read Private) ā ā (Send External)ā
āāāāāāāāā¬āāāāāāāāā āāāāāāāāā¬āāāāāāāāā
ā ā
āāāāāāāāāāāāā¬āāāāāāāāāāāāāā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāā
ā Support Agent ā
āāāāāāāāāāāāāā¬āāāāāāāāāāāāā
ā¼
šØ TOXIC COMBINATION: DATA EXFILTRATION PATHREAD_PRIVATE_DATA (Dropbox) + SEND_EXTERNAL (Gmail) = š“ Data Exfiltration Path
READ_PRIVATE_DATA (Postgres) + WRITE_PUBLIC (Slack) = š Public Leak Path
DELETE_DATA (Postgres) + EXECUTE (Filesystem) = š Destructive Automation Vector
This isn't hypothetical ā it's how the Supabase MCP leak happened (an agent with legitimate database read access was steered via prompt injection into exfiltrating private records through an external channel), how the postmark-mcp supply-chain compromise turned an ordinary "send email" tool into a covert BCC-to-attacker exfiltration path, and the exact mechanism behind documented tool-poisoning attacks, where malicious instructions hidden in a tool's own description hijack agent behavior without ever calling an obviously malicious endpoint. Individually-reasonable permissions become dangerous the moment they're combined, and nothing in the stack today computes that union before it's exploited.
Real, live-rendered screenshots ā the actual widgets, fed the actual output of get_capability_graph / detect_attack_paths after connecting gmail + dropbox to one agent.
The graph ā dangerous capability paths render in red:
The alert ā severity, affected tools, and one-click remediation:
After clicking Fix, apply_policy_fix disconnects every tool supplying the sink capability and the graph goes back to riskScore: 0 ā no attack paths, clean state.
flowchart TD
subgraph Host["Chat Host / Client"]
Client["User / AI Agent Host\n(NitroStudio, ChatGPT, Claude)"]
end
subgraph MCP["Aegis MCP Server (NitroStack)"]
Tools["Governance Tools Controller\n(connect_tool, get_capability_graph,\ndetect_attack_paths, apply_policy_fix)"]
Guard["OAuthGuard\n(scaffolded, opt-in via OAUTH_REQUIRED ā\nopen by default for the hackathon build)"]
Resources["Resource Server\n(aegis://policies)"]
Prompts["Prompt Controller\n(explain_attack_path)"]
Guard -. wraps connect_tool only .-> Tools
end
subgraph Engine["Deterministic Engine ā 0 Tokens"]
Registry["Tool Capability Registry\n(gmail, dropbox, postgres, slack,\nfilesystem, calendar)"]
Store["Per-Agent Connected-Tool Store\n(in-memory)"]
Union["Effective Capability Union\n(getEffectiveCapabilities)"]
Detector["Policy Rule Matcher\n(detectAttackPaths)"]
Registry --> Store --> Union --> Detector
end
subgraph UI["NitroStack Widgets"]
GraphWidget["capability-graph\n(live risk graph)"]
AlertWidget["attack-path-alert\n(severity + one-click Fix)"]
end
subgraph LLM["Groq Explanation Layer ā only LLM spend"]
Groq["Llama 3.1 8B Instant\ncached by SHA-256(ruleId + sorted(viaTools))"]
end
Client -->|STDIO / HTTP JSON-RPC| Tools
Tools --> Engine
Detector -->|risk score + danger edges| GraphWidget
Detector -->|threat path list| AlertWidget
Prompts -->|only on a detected path, cache miss| Groq
Groq -->|plain-English finding| Client
AlertWidget -->|Fix click| Toolsflowchart LR
A["1. Connect Gmail"] -->|connect_tool| B["READ_PRIVATE_DATA + SEND_EXTERNAL"]
B --> C["š¢ SAFE ā riskScore 0"]
C --> D["2. Connect Dropbox"]
D -->|connect_tool| E["+ WRITE_DATA"]
E --> F["Detector checks policy table"]
F -->|source+sink both present| G["šØ exfiltration DETECTED"]
G --> H["3. Render widgets"]
H -->|get_capability_graph| I["Graph edge turns RED ā riskScore 1"]
H -->|explain_attack_path| J["Groq: plain-English summary"]
I --> K["4. Remediate"]
K -->|apply_policy_fix| L["Every tool supplying the sink\ncapability is disconnected"]
L --> M["Status cleared ā riskScore 0"]Tool | Tool ID | Granted Capabilities | Risk Profile |
š§ |
|
| š High |
š¦ |
|
| š High |
šļø |
|
| š“ Critical |
š¬ |
|
| š” Medium |
š» |
|
| š“ Critical |
š |
|
| š¢ Low |
Rule ID | Source | Sink | Severity | Violation |
|
|
| š“ Critical | Agent can read private data AND transmit it externally. |
|
|
| š High | Agent can read private records AND post them publicly. |
|
|
| š High | Agent can delete data AND execute unvalidated actions. |
Both tables are just data (TOOL_REGISTRY and POLICY_RULES) ā adding a 7th tool or a 4th rule is a one-line change, not new logic.
Tools
connect_tool ā connects a tool (gmail, dropbox, postgres, slack, filesystem, calendar) to an agent. Wrapped in OAuthGuard (scaffolded ā enforced only if OAUTH_REQUIRED=true is set; open by default for local/demo use).
get_capability_graph ā @Widget('capability-graph'). Returns nodes, danger edges, active attack paths, and risk score.
detect_attack_paths ā @Widget('attack-path-alert'). Runs the deterministic rule engine.
apply_policy_fix ā disconnects every tool supplying a detected rule's sink capability.
Resource
aegis://policies ā the toxic-combination policy table as JSON.
Prompt
explain_attack_path ā takes agentId + ruleId, returns a plain-English explanation via Groq (llama-3.1-8b-instant). Only fires on an already-detected path, cached by SHA-256(ruleId + sorted(viaTools)) ā this is the only step in the entire system that spends a token.
flowchart LR
Agent(("š”ļø Aegis"))
Agent --> T1["š§ connect_tool"]
Agent --> T2["š§ get_capability_graph"]
Agent --> T3["š§ detect_attack_paths"]
Agent --> T4["š§ apply_policy_fix"]
Agent --> R1["š aegis://policies"]
Agent --> P1["š¬ explain_attack_path"]
T2 -.renders.-> W1["šØ capability-graph widget"]
T3 -.renders.-> W2["šØ attack-path-alert widget"]Every step below works against the live server ā no local setup needed. Connect https://aegis-6a6d76ee-teamx-srmist.app.nitrocloud.ai/mcp to Claude (Settings ā Connectors ā Add custom connector) or ChatGPT (Developer Mode ā Plugins ā Add), or point NitroStack Studio at this repo locally, then walk through the same scenario the screenshots above were taken from:
Connect a tool. "Connect gmail to demo-agent." ā connect_tool fires. One tool, nothing alarming yet.
Connect a second tool. "Now connect dropbox to demo-agent." ā the agent can now both read private data and send it externally.
See the risk. "Show me its capability graph." ā get_capability_graph renders ā the exfiltration edge is red. This step is pure deterministic rule matching: zero LLM tokens spent to catch it.
Get a plain-English explanation. "What does this mean?" ā explain_attack_path fires ā the only step in the whole system that calls an LLM, and only because a rule already matched.
Fix it. "Fix it." ā apply_policy_fix disconnects every tool supplying the dangerous capability. The graph goes back to riskScore: 0.
Use any agentId you like ā it's just an in-memory key, not a real account.
git clone https://github.com/prince-rai88/aegis-mcp.git
cd aegis-mcp
npm install
cp .env.example .env # add GROQ_API_KEY ā free at console.groq.com
npm run devVerify without any GUI:
bash scripts/test-mcp.shOr connect NitroStack Studio ā Add Server ā Nitro Project ā select this folder, then run through the walkthrough above against your local server instead of the live one.
Why deterministic rules instead of having the model decide what's risky?
Because then the audit trail is "the model thought so." Detection here is a fixed rule table (source capability ā sink capability), so every flag is reproducible and explainable without re-running an LLM.
Does this scale beyond 6 tools and 3 rules?
TOOL_REGISTRY and the policy rules are both just data ā adding a 7th tool or a 4th rule is a one-line addition, not new logic.
What does the LLM actually do, then?
Only explain_attack_path, only after a rule has already fired, cached by SHA-256(ruleId + sorted(viaTools)) so the same finding is never re-explained twice.
aegis-mcp/
āāā src/
ā āāā app.module.ts # NitroStack root module
ā āāā index.ts # Server bootstrap
ā āāā modules/governance/ # Security governance engine
ā ā āāā capability.ts # Capability model + TOOL_REGISTRY
ā ā āāā detector.ts # 0-token deterministic detector
ā ā āāā policies.ts # Toxic-combination policy rules
ā ā āāā oauth.guard.ts # Scaffolded OAuth guard
ā ā āāā governance.tools.ts # The 4 MCP tools
ā ā āāā governance.resources.ts # aegis://policies
ā ā āāā governance.prompts.ts # Groq explanation prompt
ā ā āāā governance.module.ts
ā āāā widgets/app/
ā āāā capability-graph/ # Capability graph widget
ā āāā attack-path-alert/ # Attack path alert widget
āāā docs/screenshots/ # Real rendered widget screenshots
āāā scripts/
ā āāā test-mcp.sh # Stdio JSON-RPC smoke test
ā āāā preview-widgets.html # Local widget preview, no Studio needed
āāā README.mdRemediate a detected attack path by disconnecting the tool that supplies its riskier (sink) capability from the agent, then return the refreshed capability graph.
| Name | Required | Description | Default |
|---|---|---|---|
| ruleId | Yes | ID of the detected policy rule to remediate (e.g. 'exfiltration') | |
| agentId | Yes | ID of the agent to fix |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses the mutating effect (disconnecting a tool) and the return value (refreshed capability graph). This is transparent, though it doesn't discuss reversibility or failure modes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that is direct and well-structured, using 'then' to indicate sequence. No redundant words, front-loaded with the main action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity and lack of output schema, the description covers the essential behavior and return. It could mention prerequisites or error states, but these are not necessary for basic invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with clear parameter descriptions. The tool description adds no extra parameter-specific meaning beyond what the schema already states, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly specifies the action: 'Remediate a detected attack path' with a precise mechanism ('disconnecting the tool that supplies its riskier capability'). It also mentions returning the refreshed graph, distinguishing it from siblings like connect_tool and get_capability_graph.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage after an attack path is detected, providing clear context. It does not explicitly exclude alternatives, but the purpose is distinct enough to guide selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Connect a third-party tool (gmail, dropbox, postgres, slack, filesystem, calendar) to an agent, granting it that tool's capabilities. Returns the agent's updated effective capability set.
| Name | Required | Description | Default |
|---|---|---|---|
| toolId | Yes | Tool to connect. One of: gmail, dropbox, postgres, slack, filesystem, calendar | |
| agentId | Yes | ID of the agent to connect the tool to |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of disclosing behavior. It states the effect (grants capabilities) and the return value (updated capability set), which is helpful. However, it omits details about side effects, reversibility, prerequisites, or what happens if the tool is already connected, leaving some transparency gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the verb and resource, and zero waste. The description is concise while covering purpose, effect, and return value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with two well-documented parameters and no output schema, the description adequately explains the operation and explicitly notes the return value. It provides enough context for correct use without needing further detail.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema descriptions cover 100% of the parameters, with toolId already listing the exact allowed values and agentId being clearly explained. The description adds no extra parameter semantics beyond what the schema provides, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: connecting a third-party tool to an agent and granting its capabilities. It lists specific example tools and explicitly distinguishes this tool from the sibling tools (capability graph, attack paths, policy fix) by focusing on the connection action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context on what the tool does and its effect (grants capabilities), making it obvious when to use it over siblings. However, it does not explicitly mention when not to use it or what alternatives exist, but the context is sufficient for basic selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run the deterministic toxic-capability-combination detector for an agent and return any detected attack paths with severity and an overall risk score.
| Name | Required | Description | Default |
|---|---|---|---|
| agentId | Yes | ID of the agent to inspect |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses that the tool is deterministic and returns severity and risk score, which adds behavioral context. However, it does not explicitly state side effects (e.g., read-only nature), permissions, or potential impacts, leaving some ambiguity for a detection tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the action and output. Every word adds value, and there is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (one parameter, no output schema), the description adequately covers what it returns. It does not explain prerequisites or integration with sibling tools, but for a straightforward detection operation with clear output, it is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with agentId described as 'ID of the agent to inspect.' The description's 'for an agent' reiterates this but adds no additional parameter-level detail, so it meets the baseline without exceeding it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: running a deterministic toxic-capability-combination detector for a given agent and returning attack paths with severity and an overall risk score. This specific verb-resource pairing and output details distinguish it from sibling tools like get_capability_graph or apply_policy_fix.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool: when you need to detect attack paths for an agent. It does not explicitly mention alternatives or exclusions, but the context is clear enough to infer its purpose relative to siblings. No contradicting usage guidance is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Return the agent's capability graph: nodes (agent/tool/capability), edges (danger=true when part of a detected attack path), detected attack paths, and an overall risk score.
| Name | Required | Description | Default |
|---|---|---|---|
| agentId | Yes | ID of the agent to inspect |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. It clearly describes the return payload (nodes, edges with danger flag, attack paths, risk score), which provides useful transparency. However, it does not disclose potential side effects, prerequisites such as agent existence, or performance/caching behavior, leaving some gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that front-loads the intent and packs all key return elements into a compact list. Every word contributes useful information, with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple one-parameter schema and absence of an output schema, the description provides a reasonably complete picture of what the tool returns. It covers the main output components and overall risk score, though it could mention error behavior or valid agent ID requirements for full completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides 100% coverage for the single parameter agentId with the description 'ID of the agent to inspect'. The tool description adds no additional parameter-level detail, so the baseline of 3 applies since the schema fully documents the parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the primary action ('Return') and the specific resource ('the agent's capability graph'), enumerating its key components (nodes, edges, attack paths, risk score). This differentiates it from siblings like detect_attack_paths and apply_policy_fix, which suggest different operations (detection and modification).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool is for retrieving graph-based attack-path and risk information for a given agent, but it does not explicitly state when to choose this over sibling tools like detect_attack_paths. No exclusions or alternative tool references are provided, so usage guidance is only implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.0.0apply_policy_fixconnect_tooldetect_attack_pathsget_capability_graphScored across 4 tools
Each tool has a clearly distinct purpose: connect_tool adds capabilities, get_capability_graph inspects state, detect_attack_paths analyzes for risks, and apply_policy_fix remediates. There is no overlap or ambiguity.
All tool names follow a consistent verb_noun pattern with underscore separation: connect_tool, get_capability_graph, detect_attack_paths, apply_policy_fix. The style is uniform and predictable.
Four tools is well-scoped for a focused security/capability management server. Each tool covers a necessary step and none feel extraneous.
The set covers the core lifecycle: connect, inspect, detect, and remediate. The only minor gap is the lack of a direct 'disconnect_tool' independent of attack-path remediation, but apply_policy_fix effectively serves that purpose.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.
Security gateway for AI agents: policy, approval, and audited execution, no secrets shared.
Fail-closed policy guardrails for AI agents running kubectl, terraform, helm, and argocd.
Identity, authorization, audit trails, and revocable permissions for AI agents accessing MCP tools.
