aegis-mcp

Inspiration

We are starting to use AI agents like ChatGPT, Claude, and Cursor for everyday tasks: ordering items, booking flights, managing calendars, and writing code.

The big problem today is privacy. If you want an agent to buy you a fan or book a flight, you usually have to hand it your raw credit card number, your exact home address, and your passport. If the agent gets prompt-injected or compromised, all your private info leaks.

We built AegisMCP to solve this. We wanted a personal firewall where you can tell an AI agent to go buy something or book travel, while making sure the AI never sees your credit card number, your home address, or your bank balance. ## What it does

AegisMCP sits between AI models (like ChatGPT or Cursor) and your personal data vaults over the Model Context Protocol (MCP) and Cloudflare:

1. Ordering without leaking addresses: You can tell the AI to buy an item (like a desk fan from Walmart). Aegis handles the payment and sends a shielded shipping token (aegis_ship_...). The AI never sees your real street address or credit card.
2. Booking flights with zero passport exposure: The AI can book a flight for you. Aegis injects your legal name and passport directly from your vault into the airline checkout without showing your passport number or birthdate to the AI.
3. Checking affordability without leaking your balance: Instead of giving the AI your bank statements, Aegis checks your balance inside a private clean room and returns a simple yes/no (can_afford: true), while keeping your exact balance blocked.
4. Central vault for developer API keys: Instead of copy-pasting your OpenAI, Anthropic, AWS, or database keys into every project or .env file, Aegis provides safe proxy tokens (aegis_fk_...). Your real production keys stay safe in the vault.
5. Real-time consent dashboard: Whenever the agent tries to spend money or read sensitive data, execution pauses. A live consent card pops up on your dashboard, and you approve it using Touch ID / Face ID (Passkeys) or a Web3 wallet.
6. Hard daily spending limits: You set a daily spending cap (e.g. $500). If an agent tries to buy something over your limit, Aegis blocks it on the spot.

## How we built it

We built AegisMCP from scratch in Rust across modular crates:

• Rust Backend: Fast, memory-safe server handling tool execution, regex redaction, and policy enforcement. • Model Context Protocol (MCP) & Cloudflare: We exposed our native MCP endpoint (/mcp) over a live Cloudflare tunnel so ChatGPT and Cursor can talk to it seamlessly. • Data Clean Room: Computes affordability checks in coarse buckets (e.g., $500 chunks) so malicious prompts cannot binary-search your exact balance down to the dollar. • Passkeys (WebAuthn) & SIWE: Passwordless login and approval using Touch ID/Face ID and Ethereum wallets. • Stripe Integration: Real test-mode charges through an isolated credential broker (aegis-broker), creating real Stripe payment intents without showing keys to the AI. • Cryptographic Ledger & Base Sepolia: Every approved action and denied prompt injection is recorded on an Ed25519-signed ledger and anchored to the Base Sepolia blockchain.

## Challenges we ran into

1. Pausing the AI while waiting for human approval: MCP expects fast responses. We had to build an asynchronous channel that holds the connection open while waiting for the user to tap "Approve" on their phone or dashboard, with safe timeouts if they don't.
2. AI safety disclaimers: When our tool description initially mentioned "test mode," ChatGPT refused to run it, saying it couldn't make purchases. We rephrased the schemas into clean, authoritative actions (order_item, book_flight) so ChatGPT executed them without hesitation.
3. Persistent dashboard history: At first, refreshing the browser cleared the live diff cards ("RAW REQUESTED vs RELEASED TO AGENT"). We added local storage syncing and ledger reconstruction so your transaction history stays on screen even after refreshing.

## Accomplishments that we're proud of

• True zero-leak commerce: We proved that ChatGPT can order a real item and book a real flight without ever seeing the user's credit card or physical address. • Universal compatibility: The same Aegis firewall works simultaneously with ChatGPT (via Custom GPT / MCP) and Cursor Agent (cursor-agent). • Live Stripe & Base Sepolia integration: Real payments go through Stripe, and cryptographic proofs are anchored on-chain. • 100% green test suite: All 11 workspace crates compile cleanly with passing tests.

## What we learned

• AI doesn't need your raw data: An agent doesn't need to know you have $14,250 in your checking account; it only needs to know that you can afford a $20 purchase. Switching from sending raw data to sending verified yes/no answers makes agents safe. • Human-in-the-loop can be fast and clean: Gating transactions with a simple 1-click Passkey card makes autonomous agents practical and safe for everyday use.

## What's next for aegis-mcp

• Mobile push approvals: Send instant push notifications to your iPhone or Android with Face ID so you can approve agent purchases on the go. • Browser extension & Apple Pay support: Allow Aegis to auto-fill one-time virtual cards and privacy-shielded addresses directly on any merchant checkout page. • Multi-agent team permissions: Let families or company teams share spending limits with custom approval rules for junior agents.

Built With

• openai
• rust
• stripe
• supabase