Aegis

Windows beta: 0.19.2-beta, published 6 October 2026. Verify the installer · Beta readiness

Current source version: 0.19.2-beta This page includes later source work. Installed builds contain the features at their release tag.

Capabilities at a glance

Observe your agents

Follow agent instances and process trees, sensitive-file events, TCP connections and attribution evidence. Inspect the live radar, CPU/RAM charts, Claude Code token subtotals and estimated costs. WSL and local Docker/Linux Podman metadata have explicit freshness and coverage limits.

Review before use

Check selected projects, skills and agent profiles locally. Inventory components, review static findings, compare snapshots and import offline reports. Follow rules, baselines, anomalies and sequence evidence; search audit history and export JSON, CSV, HTML or diagnostic ZIP reports.

Control selected actions

Configure exact CLI action policies, terminal approval, Windows Job lifetime controls or an offline AppContainer launch. Connect selected-action MCP tools, or configure a validating stdio/HTTP(S) gateway with accepted catalogs, bounded grants and optional known-secret checks.

Entry point	Availability
Observatory desktop	Local monitoring and review; Windows primary, macOS/Linux experimental
CLI / MCP	Explicit setup for selected actions and connections
Hyper-V guest APIs	Experimental administrative lab path; ordinary desktop launch disabled

Monitoring requires no agent plugin. Default monitoring does not automatically intercept or block commands. Full capability guide →

Download

Windows installer

Get the current prerelease from GitHub Releases. A complete Windows download contains the .exe, manifest.json and manifest.json.sig. Download them from the same release and follow offline installer verification. Check that release's notes for the features it contains; this README describes current source, which may be ahead of the installer.

When upgrading from 0.14.1-alpha or older, install 0.15.0-alpha or newer manually before using signed in-app updates. The published 0.17.0-alpha updater cannot discover beta releases: install the first beta manually after verifying its installer. The source updater keeps beta installations on newer beta or stable releases.

From source

Requires Node.js 24.x. Windows 10/11 is the primary platform; macOS/Linux support is experimental.

Linux process actions (pause, resume and terminate) additionally require /usr/bin/python3 3.9+ and kernel pidfd support. The generation is checked against the pinned process handle; unavailable support returns an explicit error. See Linux process control. Source builds use Electron 44, which requires 64-bit platforms and macOS 13 or later. The published 0.19.2-beta Windows installer uses Electron 44.5.1.

git clone https://github.com/antropos17/Aegis.git
cd Aegis
npm ci
npm start

On Windows, run npm run build:sidecar after npm ci when using native Job/MCP routes or native-helper tests. The development workflow describes helper builds and platform-specific verification. Administrative VM qualification has additional disposable-lab prerequisites and changes accounts, services and VM storage; it is separate from ordinary desktop setup.

Try without AI agents

After installing dependencies, build and preview the browser demo:

npm run dev
# open http://127.0.0.1:8770

The preview uses simulated data and an isolated host. It shares the desktop components, never calls the real preload, and disables native exports and provider requests. npm run frontend:build:preview creates a static preview; npm run build:renderer creates the desktop artifact without fixtures.

See GitHub Releases for the full release history and each installer's changes.

Start with a task

Current source opens the full Advanced navigation by default. An optional Simple interface in Settings brings investigation, file checks and settings together; an explicitly saved Simple choice is retained.

What you want to do	Where to start
See running agents and review their activity	Monitoring, then an agent's processes, files or connections
Review a sensitive-file alert	Alerts in Observatory, then inspect the captured evidence
Check a project, skill or agent profile before use	Local security: static review, inventory, comparison and offline report import
Check how a selected action matches a policy	Action control: choose files and review the captured outcome
Connect selected actions to an agent	MCP setup, explicitly configured from a terminal
Explore settings, reports and the other tools	Start here in the sidebar, or Commands (Ctrl K)

The workspace guide explains tasks and captured results. Static file reviews and route/catalog checks do not execute commands or establish safety. The published installer can contain an earlier UI.

These views use simulated preview data. More screenshots.

What AEGIS observes

Layer	Coverage
Processes	112 agents (265 process-name signatures), parent-chain, IDE-host and IDE-extension detection; passive WSL inventory does not inspect guest processes
Files	Changes in configured sensitive directories and agent config paths; Windows open-handle and Restart Manager observations
Network	TCP endpoints for detected agent PIDs, forward-confirmed reverse DNS, and allowlisted / unknown / flagged verdicts
Behavior	73 sensitive-path detection rules across 8 categories, rolling 10-session baselines, anomaly scoring and sequence correlations
Local LLMs	Ollama and LM Studio runtime probes; other supported runtimes detected by process signature
Runtime inventory	Running WSL distribution names; local Docker and Linux-native Podman candidates from image metadata, with selected configuration observations and explicit freshness
Token usage	Claude Code usage from matching local session data, with durable deduplication, incomplete-coverage indicators and estimated dollar amounts

The Observatory workspace provides a live instance radar, separate agent instances, file and network views, rules, custom agent catalog, AI analysis, reports, audit, statistics and settings. Activity can be filtered and grouped, inspected by stamped instance identity, and exported to JSON, CSV, HTML or ZIP. The agent database and contributor guide describe how to extend detection.

Current source adds Liveline-inspired charts to Statistics and agent Resources: short smooth updates, endpoint values, interval buttons and actual-point inspection. Missing readings, coverage, pause and reduced motion remain explicit.

Monitor-first

Default monitoring observes and logs; it does not automatically block or contain agents. Kill, suspend and resume are manual actions. Monitoring presets and endpoint allowlists do not establish that an agent is safe. The opt-in routes below control only selected launches. The Windows Job route bounds the lifetime of its participating descendants. The separate AppContainer CLI route adds Windows access restrictions for one reviewed offline action in a new workspace; other execution routes retain caller privileges.

The sensitive-activity review list is scoped to the current desktop window; marking an alert reviewed does not quarantine its file or grant access.

Monitoring data stays local, with no usage telemetry or cloud sync. Endpoint naming uses DNS queries; update checks contact GitHub. Optional AI analysis sends activity metadata to Anthropic on request using your own API key. See privacy and key handling.

Opt-in action control

Choose the route for your selected action. The setup guides cover policy files, terminal review and client configuration.

An operator can select an exact executable, working directory, arguments and environment, then route that action through AEGIS:

Capability	Implemented scope
Exact execution policy	Explicit CLI launch on allow; ask, deny and preparation failures do not launch
Windows AppContainer launch	Explicit terminal approval for one bounded offline action in a new retained workspace; private-file access checks, zero capabilities and Job cleanup
Windows Job lifetime route	An approved selected Windows action starts inside a private Job; confirmed cleanup ends ordinary Job-member descendants. External brokers and actions outside this route remain outside its control
Terminal confirmation	Review the complete effective action and confirm one launch attempt; policy deny cannot be overridden
Selected-action MCP catalog	Up to eight operator-selected actions with empty tool arguments; optional terminal review broker requires fresh confirmation per eligible call
Route and catalog checks	Inspect selected configuration and current-process prerequisites without executing; a completed check grants no permission
MCP connection status	Read-only counters for the current connection's admitted calls, pending work and cancellation requests
Action control workspace	Native file selection and nonexecuting route/catalog checks in Observatory; shows captured policy outcomes, explicit unverified coverage and a configuration-check link when setup is missing
Live route observation	Opt-in desktop observation of one running MCP owner; self-reported client metadata, bounded counters and coverage loss; blocking and provider identity remain unverified
Validating MCP gateways	Explicit stdio, loopback HTTP and pinned HTTPS routes with accepted catalogs, finite schema checks and exact grants; optional persistent grant binding and known-secret checks
Reviewed file deletion	One exact AEGIS-owned file operation with mandatory terminal confirmation; also available through a dedicated argument-free terminal MCP tool

These routes do not cover other agent tools, arbitrary MCP traffic or activity outside the selected actions. Direct execution and the ordinary Windows Job route retain the caller's account privileges. The separate AppContainer route adds the access restrictions described above. Terminal previews can expose secrets in local scrollback; terminal automation does not establish human identity. Client settings are not changed automatically. The linked contracts explain configuration, limits and verification.

After creating a catalog, generate a client configuration from the source checkout (PowerShell 7 example):

node src/main/main.js --action-mcp-config-json catalog "X:/private/actions/catalog.json" > aegis-mcp.json

The configuration generator prints an mcpServers.aegis entry using the current Node executable and absolute source entry path. Load the generated file explicitly in a client that accepts this configuration format; client setup requirements vary. The output intentionally contains local paths, so keep it private. Generation does not read or validate the catalog, start a server or install settings; run the appropriate route/catalog check separately.

Experimental protected Windows guests

Actual Windows boot and a bounded standard-user agent run passed hosted qualification. These are administrative repository APIs. Ordinary installed-caller launch remains disabled: launchAllowed=false.

The repository's administrative APIs can create a fresh private Hyper-V VM, hydrate its original disk from a trusted Windows VHDX, start it through the retained native owner and run one bounded executable as a fresh ordinary guest user. The guest has no NICs. The agent has a private desktop, explicit environment, an enforced 512 MiB NTFS allocation quota, a 32-process Job and 512 MiB aggregate Job memory limit; its maximum run is 120 seconds. Closure must be verified before the original VM is stopped and removed.

The hosted qualification record links actual native and Windows guest/agent runs, source hashes and receipt hashes. The administrative contract explains trusted image/admin prerequisites, one-use admission and retained unknown operations. There is no ordinary desktop launch or recovery API for unknown VMMS work. These controls do not establish provider integration or production readiness.

Latest source

The latest development includes private VM creation, bounded guest execution and monitoring durability fixes. Browse all capabilities.

Updated 16 October 2026 against master at 6001f2c. These changes follow the published beta. See the release-to-source comparison for the complete diff. Evidence retains the exact tested revision.

Area	Current-source change and evidence
Protected Windows guest and agent	#942 adds trusted offline disk hydration, identity-bound native start/stop and one bounded guest agent operation. Actual Windows boot, a standard token, quota refusal, descendant cleanup and VM removal passed on the recorded source.
Private VM and image creation	#941 creates a fresh Generation 2 VM and private image/disk files, with pending journals, full image hashing and conservative unknown-settlement retention. Provisioning contract.
Registered VM inspection	#931–#937 bind inspection to the original protected registration, disk identity and private storage; parent-backed disks are refused. Inspection contract.
Qualification reliability	#938 recovers from one disappearing scratch child only after a complete fresh traversal; #939 handles bounded stdio startup population growth. Capacity and scratch limits remain enforced.
Monitoring durability	#925 bounds initial watch-worker readiness; #926 excludes discarded writes from durable audit counts.
Observatory and discovery	Instance/resource views, optional Simple navigation, local security reviews and passive WSL/container observations are integrated. See the capability guide and design brief.

Experimental status: the new administrative guest run has native hosted evidence. Ordinary installed-caller authorization, authenticated runtime communication, cancellation/owner-loss supervision and result review still need integration and acceptance for the complete protected session. launchAllowed=false; independent A1–A4 acceptance remains open. The protection roadmap tracks these separate gates.

The evidence graph

The Local security workspace reviews selected project/profile files, commands, scripts and instruction patterns, compares content snapshots, and imports offline Cisco results. It keeps incomplete coverage and unverified claims visible. See the workspace guide for inputs, evidence and limitations.

• Instance identity: Windows uses PID and OS birth time; Linux uses boot identity and kernel process start ticks. Missing witnesses and synthetic discoveries provide weaker identity.
• Attribution: Records distinguish confirmed, inferred and unattributed ownership. Identity or attribution can be null when unknown or not applicable.
• Audit trail: Hash-chained JSONL records rotate daily and have 30-day retention. Chain verification detects edits relative to a trusted chain state; it does not guarantee that no events were lost.

See the architecture, correctness audit and dated measurements for implementation details and evidence.

Known limits

Coverage depends on the agent, sensor and platform. Static findings, scores and unchanged hashes do not establish safety. No overall detection or false-positive rate has been measured.

• Incomplete coverage: Unknown signatures and processes that start and exit between polling ticks can be missed. Default monitoring does not parse MCP traffic or individual tool calls; the explicitly configured MCP routes handle only their published AEGIS tools.
• Platform gaps: macOS lacks a process-generation witness. Linux generation identity depends on accessible /proc data; its fallback has no start-time witness. Missing identity limits process-control guarantees. Measured Claude Code usage requires a process start-time witness and a readable matching session registry/transcript. Windows is the verified primary path; native Linux token collection remains unverified.
• Bounded UI history: Retained event windows can differ from aggregate totals; Statistics shows renderer eviction counters; Audit provides persisted history.
• Sensor and audit gaps: Health status does not prove complete capture. A fully lost file-watch plan gets three fast retries, then recovery probes after a five-minute cooldown; a healthy plan resets the retry budget. Exited watch workers count as lost roots. Terminated workers in a partially live plan get up to three root-local replacement attempts per watch lifetime, with a one-second retry delay and a ten-second readiness deadline. Other partial degradation and exhausted root-local recovery require separate repair. Audit loss markers require a successful flush; process-scan overruns lack a dedicated counter.
• Sensitive metadata: Logs and exports contain paths, agent names and endpoints. Configuration and diagnostic exports omit the configured API key. Local key encryption depends on safeStorage availability. See SECURITY.md.
• Unmeasured claims: No general detection rate, false-positive rate, startup-time guarantee or whole-app overhead figure has been established.
• Token subtotals: Bounded transcript reads can lag a backlog; records above 512 KiB are skipped with a fixed diagnostic. Token history retains all active records and 256 recent exited records; older records become one labeled archive preserving run totals. Compaction freezes during observation gaps. The published 0.19.2-beta uses a run-scoped 128 MiB SQLite index for transcript deduplication. Current source can retry a capacity-failed process with a smaller complete batch, while the remaining usage stays marked incomplete; accepted IDs are not evicted. Issue #637 is closed; long-duration qualification remains incomplete. The earlier two-hour receipt used pre-final harness bytes; #863 records a 15-second smoke of the final harness. See the packaged-module qualification scope and token accounting limits, including incomplete coverage and estimated dollar amounts.

Development and roadmap

Inspect a project's AI component files without starting agents or MCP servers:

node src/main/main.js --inventory-json "X:/path/to/project"
node src/main/main.js --inventory-profile-json codex-user "X:/copied-codex-profile"

This produces a bounded local inventory with fingerprints, not a security verdict. See scope, privacy and exit codes and the AI agent protection plan.

The monitoring engine uses CommonJS JavaScript; the Svelte renderer and shared types use TypeScript. See development setup, the development reference and package.json for the stack and commands.

CI runs build, lint, type checks, tests and dependency auditing. npm run counts:check verifies selected inventory declarations. npm run verify:gate checks identity-witness behavior with fault injection (4 mutants); npm run verify:seq-gate checks sequence behavior. Run npm test for current suite results.

The roadmap tracks Windows ETW experiments and remaining discovery/platform work. Source changes and isolated experiments are not automatically available in released installers.

Contributors

CONTRIBUTING.md · SECURITY.md · CODE_OF_CONDUCT.md

Support and license

Feature requests · Private vulnerability reports · MIT license

Local monitoring requires no account or subscription. Optional Anthropic analysis uses your own API key and is subject to that service's charges.

Navigation icons use a curated Tabler Icons subset under the MIT notice. Pinned source URLs and hashes are recorded in the icon provenance.