AEGIS Governed MCP: Verify Before Execution

A real Streamable HTTP MCP simulator that verifies policy integrity and denies unapproved agent actions, with inspectable replay evidence.

Comment

Inspiration

Tool discovery is not authorization. A conversational agent may discover a powerful action, but discovering it should never silently grant the right to execute it. AEGIS demonstrates an auditable Model Context Protocol (MCP) interaction where a consequential request fails closed when execution identity is unavailable.

What it does

AEGIS Governed MCP provides a real, locally running Streamable HTTP MCP server and browser simulator. The browser initializes an MCP session, discovers the tools, reads the existing policy file and its SHA-256 digest, then attempts a governed consequential tool call. The server returns a structured denial (IDENTITY_UNAVAILABLE, NOT_EXECUTED) rather than issuing the underlying action. The browser verifies the response IDs, session headers, policy bytes and denial, and exports a replay trace.

A separate, static AEGIS MCP Evidence Lab at https://aegisomega.com/labs/mcp/ displays recorded protocol evidence with original-byte verification and a tamper-rejection demonstration. It is not a publicly hosted live MCP endpoint.

How it is built

  • Node.js 22, TypeScript and the open-source @modelcontextprotocol/sdk implement both the preserved stdio interface and a new loopback-only Streamable HTTP endpoint.
  • Browser JavaScript implements the actual JSON-RPC lifecycle: initialize, notifications/initialized, tools/list, tools/call for aegis_authority_policy, and tools/call for aegis_governed_claude_call.
  • Existing Automaton-3 authority rules stay intact. A transport token is not an approval or verified execution identity.
  • Server protections include Host/Origin restrictions, no CORS, bounded sessions and request sizes, restrictive CSP and no public listener.
  • Source-bound tests exercise the real SDK, HTTP exchange, local Chromium desktop/mobile browser flows and the unchanged stdio regressions.

Reproduce the working demo

Clone the existing public GitHub branch containing the hackathon contribution:

git clone --branch product/alexa-mcp-lane-v1 --single-branch https://github.com/Aegis-Omega/AEGIS-OMEGA.git
cd AEGIS-OMEGA/sovereign-omega-v2/mcp-server
npm ci --ignore-scripts --no-audit --no-fund
npm run build
npm run start:http

Open http://127.0.0.1:7891, run Run verified sequence, inspect the policy digest and denied action, and export the evidence. For full replay with installed Chromium, run npm run verify:alexa.

Code and contribution: https://github.com/Aegis-Omega/AEGIS-OMEGA/pull/716 Exact source: https://github.com/Aegis-Omega/AEGIS-OMEGA/tree/897fa55556a639a04a67d25481b7a432af007d04/sovereign-omega-v2/mcp-server License: GNU AGPL-3.0 at repository root.

What changed during this hackathon

The existing AEGIS MCP server gained a shared registry, loopback-only Streamable HTTP transport, a local browser simulator for the real JSON-RPC protocol exchange, policy-digest inspection, strict unbound-identity denial, and reproducible browser/security tests. The static Evidence Lab was developed separately to replay and verify the captured HTTP evidence. These are additions to an existing AEGIS project, not a claim that the entire AEGIS architecture was created during the event.

Testing and findings

An isolated source-bound GitHub witness replay for PR #716 ran the TypeScript build, 13 browser-client tests, 18 HTTP/security tests, preserved stdio regressions, and real desktop/mobile Chromium flows successfully. The output contains recorded exchanges and independently checked source/evidence hashes. These are scoped tests, not general production admission.

Important limitations

The demo is an Alexa+ track self-hosted MCP / simulated web experience, not access to the gated Alexa+ runtime or SDK. The project does not perform an Alexa voice interaction, AWS call, external model call or an approved consequential execution through the HTTP route. The intentional denial illustrates safety properties of the protocol and authority boundary.

Built With

Share this project:

Updates