AegisMCP — Agentic Traffic Firewall

Real-time security gateway for AI coding agents — block secrets, catch prompt injection, audit every tool call. One config line.

Comment

Inspiration

I've spent 12+ years in cloud and DevOps, where a simple rule holds: no traffic crosses a boundary without inspection. Ingress has firewalls. APIs have gateways. Services have meshes.

Then I watched coding agents get hands. Codex and Copilot agent mode now read files, call APIs, and execute commands through MCP tool servers — and that traffic crosses the most sensitive boundary of all, a developer's machine, with nothing watching. I ran a simple thought experiment: an agent reads a README, the README contains hidden instructions, the agent obeys them with my credentials and my permissions. Nobody would ever know. Every other class of traffic earned its firewall decades ago. Agentic traffic hasn't — yet. That gap is AegisMCP.

What it does

AegisMCP is a firewall for agentic AI traffic. It sits inline between any MCP client (Codex CLI, Copilot, Claude Code) and its tool servers — integration is one config line, no changes to the agent, model, or tools.

Every tool call and every tool result passes through a YAML policy engine and Tier-0 detectors (credentials, PII, prompt injection), which enforce a verdict: allow, redact (PII masked in transit), block (the agent gets a structured JSON-RPC error, never the payload), or freeze for human approval on a live dashboard — failing closed on timeout — with an operator kill switch for compromised sessions.

The differentiator is response-path inspection: by correlating request IDs, AegisMCP scans tool output, so a prompt-injection payload hidden inside a file is blocked before it ever enters the agent's context. Every verdict lands in a masked, append-only audit log tagged with OWASP LLM Top 10 and MITRE ATLAS technique IDs, streamed to a zero-dependency single-file dashboard with ~[X] ms p95 inspection overhead.

How we built it

Spec-first, then agent-driven. I wrote an HLD, an LLD (down to regex tables, SQLite DDL, and error codes), and a gated milestone plan — then drove Codex + GPT 5.6 through it one milestone at a time: transparent stdio proxy → policy engine + detectors → audit + dashboard → demo kit → hardening. Each milestone closed only when its pytest suite went green; gates were never waived retroactively.

Two workflow choices paid off. First, brownfield reuse: I had earlier prototype code (a basic stdio proxy and regex detector), so Codex's first task was a gap report comparing it against the LLD before writing a line — adaptation, not rewrite. Second, tests as the contract: reused code got zero credit until it passed the new suites.

The stack is deliberately boring and auditable — Python asyncio, SQLite (WAL) as both audit store and coordination plane, pure-regex detection, and a single-file vanilla-JS MVC dashboard whose zero-external-dependency claim is enforced by a strict CSP header. A security tool should be readable by the team that trusts it.

Challenges we ran into

  • Inspecting responses, not just requests. The dangerous payloads live in tool output. Correlating request IDs across an async bidirectional stdio relay — without ever corrupting framing for traffic we don't inspect — was the hardest piece of the proxy.
  • Freezing one call without freezing the agent. Human approval means holding a JSON-RPC request mid-flight while other traffic keeps flowing, then failing closed on timeout — and the timeout had to land under the MCP client's own ~60 s tool-call timeout so the agent gets our structured denial, not a client-side error.
  • Not logging what we catch. A security tool that stores the secrets it intercepts is itself a breach. Masking is enforced by a test that greps the entire database for raw fixture secrets — trusted nothing.
  • Keeping the agent disciplined. Codex loves to "improve" passing code while adding features. Explicit rules — no opportunistic refactoring, stop at every gate, ask before new dependencies — turned it from a wildcard into a reliable pair.

Accomplishments that we're proud of

Blocking a prompt injection before the agent ever sees it — live, on the response path — with the attack visible as a single red tick on the traffic pulse. Single-digit-millisecond inspection overhead on the happy path. A dashboard that loads instantly with zero external requests, proven by CSP rather than promised. And a fully scripted, reproducible demo (run_demo.sh) that produces every verdict end-to-end on a clean machine.

What we learned

That the future of AI security is protocol-level and inline — guardrails inside the app or the model miss the traffic layer entirely, and the traffic layer is where exfiltration actually happens. That agentic engineering works best like classical engineering: specs in, gated milestones, tests as contracts — the agent multiplies you only as much as your process deserves. And that in security UX, legibility is a feature: a verdict a human can read in one second is worth more than a smarter detector nobody understands.

What's next for AegisMCP — Agentic Traffic Firewall

  • Monitor mode — log-only rollout so teams tune policies against real traffic before enforcing (how real security products ship).
  • Detection depth — entropy scanning, session-level exfiltration-chain detection (a secret read in one call, leaving in another), and LLM-as-judge triage for low-confidence flags, measured against a labeled eval corpus.
  • Control plane — centralized policy, SSO, GitHub Enterprise sync for org-wide Copilot/Codex governance, and SIEM export — the open-core paid tier on top of a free gateway.
  • Design partners — teams already running agents in anger, to make detection quality the product it needs to be.

Built With

Share this project:

Updates