Project Aegis — Cyber-Physical Zero-Trust Guardian

A zero-trust cyber-physical MCP server for Alexa+ that cross-correlates Ring perimeter events with router telemetry to neutralize stealth wardriving attacks.

Comment

Inspiration

Today’s smart homes are protected by digital and physical security devices operating in complete silos: The physical domain: A Ring Video Doorbell or floodlight camera spots a vehicle idling near the curb for several minutes. To the camera, it is classified as ordinary street activity. The digital domain: A Wi-Fi gateway or eero router logs an unknown MAC address failing WPA3/WPA2 authentication handshakes with a weak edge-of-property signal ( RSSI ≤ − 80 dBm RSSI≤−80 dBm ). To the router, it looks like ambient background noise or an accidental connection attempt from a passing pedestrian. Individually, neither signal raises an alarm. Correlated in time and physical space, however, they reveal a stealthy wardriving exploit: an attacker sitting in an idling vehicle near the property perimeter, capturing handshake packets or probing for open IoT ports. Amazon uniquely bridges both the front door (Ring) and the ambient home AI (Alexa+). We built Project Aegis to shatter these security silos by turning Alexa+ into an autonomous, cyber-physical zero-trust guardian using the Model Context Protocol (MCP).

What it does

Project Aegis actively bridges physical sensor feeds with digital telemetry to detect, evaluate, and neutralize complex cross-domain threats: Continuous Contextual Ingestion: Exposes real-time router authentication probe streams and Ring camera perimeter event logs via standardized, read-only MCP Resources (aegis://telemetry/...). Cross-Domain Threat Correlation: The core engine evaluates physical proximity alongside network anomalies. When an idling vehicle matches edge authentication retries within a tight temporal window, Aegis calculates a composite threat confidence score C threat C threat ​

: C

threat

min ⁡ ( 0.98 , C sensor × 0.90 + 0.08 ) for Δ t ≤ Δ t threshold C threat ​ =min(0.98,C sensor ​ ×0.90+0.08)for Δt≤Δt threshold ​

where C sensor C sensor ​

is the computer vision detection confidence ( 0.95 0.95 ) and Δ t

threshold

600 s Δt threshold ​ =600 s ( 10 minutes 10 minutes ). Conversational Zero-Trust Workflow: Through the MCP Prompt analyze_cyber_physical_threat, Alexa+ evaluates both telemetry feeds, explains the wardriving pattern in plain language, and seeks explicit confirmation before mitigating the issue. Deceptive Containment (Honeypot Sandbox): Instead of terminating the attacker’s connection (which alerts them to move on to another vector), Aegis exposes the deploy_honeypot_vlan tool. This silently reroutes the rogue MAC address to an isolated sandbox (VLAN 99), giving the attacker fake gateway responses while isolating the true household network. Clean-Room 3D WebGL Dashboard: Aegis delivers a daylight, glassmorphic 3D topological visualization over the render_aegis_dashboard_light MCP-UI tool. Trusted household nodes orbit a central translucent gateway core in calm blue, while rogue actors appear in pulsing amber, smoothly encapsulated by an animated frosted-glass quarantine container upon isolation.

How we built it

Aegis is architected around a unified domain layer that strictly complies with the Model Context Protocol (spec 2025-11-25+) over Streamable HTTP for Alexa+ cloud connectivity and stdio for local host inspection. ┌──────────────────────┐ ┌────────────────────────┐ │ Physical: Ring Feed │ │ Digital: Wi-Fi Gateway │ └──────────┬───────────┘ └───────────┬────────────┘ │ │ ▼ ▼ PerimeterAdapter NetworkAdapter (Idling/Loitering) (RSSI, Auth Logs) │ │ └───────────────┬───────────────────┘ ▼ CorrelationEngine (Wardriving Threat Scoring) │ ┌────────────────────────┴────────────────────────┐ │ │ ▼ ▼ aegis_server.py aegis_server_stdio.py (FastMCP / Streamable HTTP) (Base MCP SDK / stdio) │ │ ▼ ▼ Amazon Alexa+ Claude for Desktop / Cloud Agents Local MCP Inspector

  1. The Core Primitives MCP Resources: aegis://telemetry/network/latest: Returns real-time JSON arrays of failed Wi-Fi handshakes, MAC addresses, and signal strengths ( dBm dBm ). aegis://telemetry/perimeter/front-door: Returns camera vision metadata (event classification, duration, and detection confidence). aegis://telemetry/honeypot/log & aegis://telemetry/devices: Audit logs of active, sandboxed, and trusted devices. MCP Prompts: analyze_cyber_physical_threat: A zero-trust reasoning template that instructs the LLM to inspect both the digital and physical resource URIs simultaneously, cross-reference temporal offsets, and verify correlations before taking action. MCP Tools: analyze_threat_vectors: Returns the mathematical correlation verdict (cross_domain_threat_detected) with confidence scores and auto-generated natural language narratives. deploy_honeypot_vlan & engage_honeypot_sandbox: Automates dynamic network rerouting to sandbox VLAN 99. render_aegis_dashboard_light: Serves the complete, zero-dependency 3D WebGL canvas as an inline text/html MCP-UI resource payload.
  2. Signal Attenuation & Correlation Heuristics The correlation engine models the radio-frequency boundary of the home. Free-space path loss ( F S P L FSPL ) models how signal attenuates over distance d d : F S P L ( dB ) = 20 log ⁡ 10 ( d ) + 20 log ⁡ 10 ( f ) − 27.55 FSPL(dB)=20log 10 ​ (d)+20log 10 ​ (f)−27.55 When a device transmits at frequency f = 2.4 GHz f=2.4 GHz or 5 GHz 5 GHz , an observed RSSI of: RSSI ≤ − 75 dBm RSSI≤−75 dBm indicates that the device is transmitting from outside the physical building envelope. When this physical-layer threshold coincides with a physical perimeter alert ( event = "vehicle_idling" event="vehicle_idling" ), the correlation engine flags the device: Flag ( d e v ) ⟺ ( RSSI d e v ≤ − 75 dBm ) ∧ ( Trust d e v = "unverified" ) ∧ ∃ e v ∈ Events perim s.t. ∣ t d e v − t e v ∣ ≤ 600 s Flag(dev)⟺(RSSI dev ​ ≤−75 dBm)∧(Trust dev ​ ="unverified")∧∃ev∈Events perim ​ s.t. ∣t dev ​ −t ev ​ ∣≤600 s

Challenges we ran into

The Transport Divide (Streamable HTTP vs. stdio): Developing for Alexa+ requires a publicly reachable Streamable HTTP server that supports JSON-RPC 2.0 streaming. However, local developer tooling (like Claude for Desktop and the MCP Inspector) operates strictly over stdio subprocess streams. Initially, we faced the dilemma of building two divergent codebases. We solved this by isolating all business logic into a single module (aegis_domain.py) and providing dual transport entry points: aegis_server.py for cloud-based Alexa+ endpoints and aegis_server_stdio.py for local testing. Stdio Protocol Corruption from Diagnostic Logging: During local development, standard Python print() statements caused the stdio transport to fail silently. In stdio mode, stdout acts as the raw JSON-RPC protocol wire; any unstructured text immediately causes JSON parse errors. We resolved this by configuring our logging pipeline to output strictly to sys.stderr: code Python logging.basicConfig(stream=sys.stderr, level=logging.INFO) Packaging a Rich 3D UI within an MCP Resource: We wanted the 3D topology map to render seamlessly without requiring external server dependencies or third-party webview hosting. We embedded the complete Three.js scene, camera controls, and glassmorphic shader logic into self-contained HTML templates. When Alexa+ or a client calls render_aegis_dashboard_light, the server dynamically interpolates live device states and returns the payload as an inline MCP-UI text resource.

Accomplishments that we're proud of

True Cross-Domain Zero-Trust: We built an actual multi-domain security system that synthesizes IoT camera feeds and low-level router telemetry rather than just wrapping simple API calls. Full MCP Spec Compliance: We implemented all three MCP primitives—Resources, Prompts, and Tools—adhering strictly to the official Model Context Protocol specifications (FastMCP & MCP SDK v2). "Clean-Room" Aesthetic Pivot: We replaced standard dark "hacker movie" UI tropes with a daylight, corporate glassmorphic dashboard inspired by modern enterprise clean-rooms. Dual-Transport Architecture: Aegis can be deployed to the cloud for live Alexa+ voice interactions while remaining fully inspectable locally via the MCP Inspector and Claude for Desktop. Open-Source Contribution: We released the entire repository under the permissive MIT License, providing a standardized blueprint for cyber-physical agent integrations.

What we learned

The Utility of MCP Prompts: Pre-structuring workflows with @mcp.prompt() ensures that agentic LLMs follow strict zero-trust evaluation orders (investigate → → correlate → → propose containment → → execute) rather than aggressively taking write actions without user consent. Deception Beats Blocking: In cybersecurity, outright blocking an unknown device provides immediate reconnaissance feedback to the intruder. Honeypot sandboxing provides a better defensive posture by maintaining the illusion of access while containing the blast radius. Agentic Streaming Protocol Nuances: Working with FastMCP and SSE/Streamable HTTP highlighted how conversational AI is evolving from rigid slot-and-intent designs toward autonomous, tool-driven reasoning.

What's next for Project Aegis — Cyber-Physical Zero-Trust Guardian

Direct Hardware Integrations: Replace simulated telemetry adapters with live production APIs: Ring Protect API: Direct webhook ingestion for Ring motion, doorbell press, and package delivery events. eero Open API / OpenWrt: Real-time extraction of live station tables, roaming logs, and client RSSI telemetry. Echo Show Multi-Modal UI Interactions: Enable bi-directional postMessage event bridging so that tapping "Isolate Threat" on an Echo Show screen triggers deploy_honeypot_vlan back across the active Alexa+ session. Dynamic Honeypot Emulation: Expand Sandbox VLAN 99 into an adaptive containerized honeypot (using low-interaction services like Cowrie or Dionaea) to log and capture unauthorized payload attempts. Neighborhood Fleet Intelligence: Securely share anonymized physical-digital indicators of compromise (IoCs) between neighboring homes to warn communities about roving wardriving attacks before they reach the next driveway.

Built With

Share this project:

Updates

Submission history