Aegis

Aegis is a high-performance security scanning tool for DevOps, CI/CD pipelines, and AI systems. It detects secrets, credentials, security vulnerabilities, AI-generated code patterns, and more.

Features

• 677 Detection Patterns across 35 categories
• High Performance - Built in Rust with category-based regex pre-filtering
• CI/CD Integration - GitHub Actions, GitLab CI, Jenkins, Azure DevOps
• MCP Server - Model Context Protocol server for AI tool integration
• Risk Scoring - Intelligent risk assessment and prioritization
• Multiple Output Formats - Human-readable, JSON, and SARIF
• YAML Patterns - Easy contribution via YAML pattern files

Quick Install

Binary releases (no dependencies):

Each archive bundles aegis, aegis-mcp, aegis-daemon, and aegis-bundler.

# Linux x86_64
curl -LO https://github.com/aliasfoxkde/aegis/releases/latest/download/aegis-linux-x86_64.tar.gz
tar -xzf aegis-linux-x86_64.tar.gz
sudo mv aegis /usr/local/bin/

# Linux ARM64
curl -LO https://github.com/aliasfoxkde/aegis/releases/latest/download/aegis-linux-arm64.tar.gz
tar -xzf aegis-linux-arm64.tar.gz
sudo mv aegis /usr/local/bin/

# macOS Intel
curl -LO https://github.com/aliasfoxkde/aegis/releases/latest/download/aegis-darwin-x86_64.tar.gz
tar -xzf aegis-darwin-x86_64.tar.gz
sudo mv aegis /usr/local/bin/

# macOS Apple Silicon
curl -LO https://github.com/aliasfoxkde/aegis/releases/latest/download/aegis-darwin-arm64.tar.gz
tar -xzf aegis-darwin-arm64.tar.gz
sudo mv aegis /usr/local/bin/

# Windows
curl -LO https://github.com/aliasfoxkde/aegis/releases/latest/download/aegis-windows-x86_64.tar.gz
tar -xzf aegis-windows-x86_64.tar.gz

Verify:

aegis --version

For full installation instructions, see Installation Guide.

Quick Start

# Scan a directory
aegis scan .

# Scan with JSON output (--format is a top-level flag, so it precedes
# the subcommand)
aegis --format json scan .

# Scan environment variables
aegis scan --env

# Also report copy-paste code clones (separate output channel; never
# affects the exit code)
aegis scan . --detect-clones

# List all patterns
aegis list

# Report the compiled-in pattern set (patterns ship in the binary;
# this never downloads anything)
aegis update

More examples in the Quick Start Guide.

Pattern Categories

Aegis includes 677 patterns across 35 categories (counts generated from source; see the full catalog for every rule):

Category	Patterns	Description
infrastructure	55	Terraform, IaC security
secrets	41	API keys, tokens, credentials
pii	39	Personal data detection
cloud-native	38	Kubernetes, Docker
web-security	37	XSS, SQLi, CORS, SSRF
supply-chain	35	Dependency vulnerabilities
ai-detection	33	AI-slop and hallucination-artifact markers
compliance	33	GDPR, HIPAA, PCI-DSS
security-hardening	31	Security best practices
frameworks	31	React, Angular, Next.js
accessibility	28	WCAG success criteria
git-hygiene	28	Repo hygiene and artifacts
ai-safety	25	Prompt injection, AI safety
llm-guardrails	25	LLM input/output guardrails
performance	20	Performance anti-patterns
shift-left	20	Early-lifecycle security practices
healthcare	17	Clinical identifiers and PHI-handling hazards
code-quality	15	Language anti-patterns
devops	15	CI/CD pipeline checks
finance	13	Financial identifiers and money-correctness
typescript	13	Typed-JavaScript rules
kubernetes	11	Kubernetes manifest hardening
web-development	11	General web development
cryptography	10	Cryptographic primitive misuse
api-integration	9	HTTP client, webhook mistakes
terraform	7	HashiCorp Terraform
ai-slop	7	LLM prose tells: em dashes, slop lexicon
data-visualization	5	Charting pitfalls
pwa	5	Progressive web app checks
container	4	Container hardening
graphql	4	GraphQL security
metadata	4	Metadata and editor leaks
git-ops	3	GitOps workflows
cloudformation	3	CloudFormation templates
arm	2	Azure Resource Manager

Browse all 677 detection patterns.

Documentation

• Installation - Binary releases, Docker, package managers
• Quick Start - Basic usage and common workflows
• CLI Reference - All available commands
• Configuration - Profiles and options
• CI/CD Integration - GitHub, GitLab, Jenkins, Azure
• MCP Server - AI tool integration

Development

• Building from Source - Contributor setup
• Adding Patterns - Contribute new patterns
• Architecture Overview - System design
• Coding Standards - Rust conventions

CI/CD Integration

GitHub Actions

- name: Install Aegis
  run: |
    curl -LO https://github.com/aliasfoxkde/aegis/releases/latest/download/aegis-linux-x86_64.tar.gz
    tar -xzf aegis-linux-x86_64.tar.gz
    sudo mv aegis /usr/local/bin/

- name: Security Scan
  run: aegis --format sarif scan . --severity-threshold high

GitLab CI

security_scan:
  script:
    - aegis --format json scan . --severity-threshold medium --output-file aegis-results.json
  artifacts:
    paths:
      - aegis-results.json
    when: always

GitHub Actions (Manual)

- name: Install Aegis
  run: |
    curl -LO https://github.com/aliasfoxkde/aegis/releases/latest/download/aegis-linux-x86_64.tar.gz
    tar -xzf aegis-linux-x86_64.tar.gz
    sudo mv aegis /usr/local/bin/

- name: Run Aegis
  run: aegis --format sarif scan . --output-file results.sarif

See the CI/CD Integration Guide for more examples.

MCP Server

Start the MCP server for AI tool integration:

aegis-mcp

Available tools:

• scan_string - Scan in-memory content
• scan_file - Scan a single file
• scan_dir - Scan a directory
• scan_env - Scan environment variables
• list_patterns - List all patterns
• list_categories - List all categories
• update_bundle - Check for pattern bundle updates

See the MCP Guide for details.

Architecture

aegis/
├── crates/
│   ├── aegis-core/       # Core scanning engine
│   ├── aegis-cli/        # CLI application
│   ├── aegis-mcp/        # MCP server
│   ├── aegis-daemon/     # Daemon mode
│   ├── aegis-bundler/    # Pattern bundler
│   ├── aegis-wasm/       # WebAssembly binding
│   └── aegis-patterns/    # 677 pattern definitions
├── config/profiles/       # Configuration profiles
└── docs/                  # Documentation

Contributing Patterns

The 677 shipped patterns live as Rust definitions in crates/aegis-patterns/src/ and are compiled into every binary. For one-off organization rules without a code change, a .aegis.yml / .aegis.yaml at the scan root accepts custom patterns (fail-loud validated: unknown fields, invalid regex, unknown severity, and duplicate names all abort the scan naming the file and pattern).

Standalone pattern sets can also be distributed as bundles: put pattern files — each holding a list of rules — into a directory,

# my-patterns/my-api-key.yaml
- name: my-api-key
  category: secrets
  match: '(?i)myapi[_-]?key\s*[:=]\s*["''][A-Za-z0-9]{16,}'
  enabled: true
  severity: high
  confidence: high
  minEntropy: 3.5
  description: 'Detects MyAPI key patterns'
  tags:
    - secrets
    - api-key

and aegis-bundler packs the directory into a versioned, checksummed bundle:

cargo run -p aegis-bundler -- my-patterns/ my.bundle

See Adding Patterns for contribution guidelines.

License

Apache-2.0