AI SECURITY SIDECAR
Aegis
Point your agent at Aegis. Unsafe tool calls return HTTP 403 before they execute. On an Aegis Node, the same intent is enforced at the syscall.
HOW IT WORKS
Classifiers score text. Aegis binds the tool call.
A Rust data plane sits in-line with LLM traffic. A Python control plane owns policy, Crucible, and compliance — never the hot path. Laptop eval proves userspace 403. Kernel EPERM is Ubuntu 24.04 only — not Docker Desktop.
Sidecar 403
Allowlist, RBAC, sequence, intent, signatures, HITL, and flow/taint. Deny is HTTP 403 — the request is never forwarded.
Attach wrapper
attach.bat / attach.sh launches the existing process. Vendor keys stay with you. No SDK rewrite for supported clients.
Signed evidence
Ed25519 decision records you can export. Not a marketing score.
Kernel EPERM
On Aegis Node, an LSM grant ticket refuses open / exec / connect outside what the tool call declared.
Flow / taint
PCI, PII, and secret-shaped reads cannot sink via HTTP, email, or shell.
Command Deck
Protect the agent, fire a canary, copy the last 20 signed decisions. Forge and SOC stay in the command palette.
“My sharpest finding on the sidecar was the bypass: raw urllib returned 200 and hit the sink because it did not go through a patched SDK constructor. At the kernel that argument disappears — the deny is at the syscall, so the language, the library, a subprocess or a compiled binary are all irrelevant.”
FOR / NOT FOR
Two proofs. Do not mix them.
Laptop (any OS)
- OpenAI-compatible, Anthropic, or Gemini SDK pointed at the sidecar
- attach wrapper — prompts stay on your network
- Docker Desktop for HTTP 403s
- Signed decision export after the in-Deck canary
Aegis Node (Linux)
- Ubuntu 24.04 VM for kernel EPERM — not Docker Desktop WSL
- Stops urllib / subprocess / compiled binaries that skip the proxy
- Not FedRAMP / ATO / FIPS 140 / HA multi-region
- Not a classifier — it binds the tool call, not a content score
SETUP
First HTTP 403 without rewriting the agent.
Download & start
Same zip for every plan. No account required to run.
# Windows AEGIS Suite.bat # macOS / Linux ./start.sh
Attach the existing process
The wrapper keeps your vendor key and sets OPENAI_BASE_URL. Constructor snippets are a fallback if the SDK ignores env.
Windows: attach.bat support-bot -- python your_agent.py macOS/Linux: ./attach.sh support-bot -- python your_agent.py
Fire the canary in Command Deck
Protect → Fire canary. You should see HTTP 403 (paid/trial) or WOULD_BLOCK (audit) and a signed row you can copy.
Kernel proof (optional)
Ubuntu 24.04 only. Multipass, a cloud image, or book the 48-hour containment audit if you are on Windows.
./appliance/multipass-launch.sh # or ./start-node.sh
PRICING
Three plans. Same zip. 14-day trial on every tier.
List prices match the Stripe catalog. Cloud-commit buyers use a marketplace private offer (floor $25k) — that is not self-serve checkout.
$19/mo · billed $190/yr
- ✓14-day trial, card on file
- ✓Live HTTP 403 on this node
- ✓Kernel EPERM on Ubuntu 24.04 (not Docker Desktop)
- ✓Command Deck + attach wrapper
- ✓Ed25519 decision records
$79/mo · billed $790/yr
- ✓Everything in Builder
- ✓5 licensed nodes
- ✓RBAC + sequence + intent
- ✓Crucible canary forge
- ✓Flow / taint (PCI, PII)
$199/mo · billed $1,990/yr
- ✓Everything in Standard
- ✓25 licensed nodes
- ✓Air-gapped signed intel + CRL
- ✓Guided 30-day POC via sales
- ✓Business-hours support (support@aegiscruc.io)
KERNEL PROOF ON WINDOWS
48-hour AI agent containment audit
We run your agent graph on an isolated Ubuntu Node, test userspace bypasses (urllib / subprocess), and film kernel EPERM. $4,500 flat — credited toward an Enterprise license if you sign within 30 days. Laptop 403s stay free to prove yourself.
Request containment audit →Payments by Stripe. Aegis never stores cards. Air-gapped zip ships on every plan. Same download — node cap differs. Terms · Privacy · support@aegiscruc.io