IliasAlmerekov

Aegis Shellguard

Name: Aegis Shellguard
Author: IliasAlmerekov

AI community

SOURCE https://github.com/IliasAlmerekov/aegis

Description

Aegis — the shell guard for AI coding agents. Destructive commands from Claude Code, Codex, or Cursor pause for your approval, with a snapshot taken first — so even a "yes" is recoverable.

Installation

This entry records only its repository, not the path inside it, so there is no exact command to give. Open the source below and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

README

Aegis

**Make AI agents ask first. Keep a way back when they don't.** Your AI agent is one `rm -rf` away from ruining your week. Aegis proxies its shell: safe commands run instantly, destructive ones need your approval — and where a provider applies, a Snapshot captures the working state first, so a "yes" can be restored to what was captured. When no provider applies, Aegis says so instead of implying an undo it cannot perform.

[![version](https://img.shields.io/badge/version-0.6.5-60A5FA?style=flat-square)](CHANGELOG.md) [![platform](https://img.shields.io/badge/platform-Linux%20%7C%20macOS%20%7C%20WSL2-22C55E?style=flat-square)](#how-to-install) [![license](https://img.shields.io/badge/license-MIT-A855F7?style=flat-square)](LICENSE) [![built with](https://img.shields.io/badge/built%20with-Rust-F59E0B?style=flat-square)](Cargo.toml)

![How Aegis works: an AI agent's command is screened by Aegis — safe commands run instantly, dangerous ones wait for human approval](src/assets/aegis.gif)

What is Aegis?

Aegis is a Rust CLI that sits between an AI agent and your real shell. Claude Code, Codex, Cursor — any agent that runs shell commands goes through it. Every command is risk-scored before it executes:

Level	What happens
Safe	Runs immediately unless bounded effect-opaque Required recovery degrades
Warn	Pauses and asks for your approval
Danger	Asks first, then attempts configured Snapshots before execution
Block	Refused outright — no prompt

[!NOTE] Aegis decides by heuristics, not by understanding your command. It is not a privilege boundary: it does not stop code that already runs as you. See [`docs/threat-model.md`](docs/threat-model.md) for the full security model.

The **Sandbox** is a write/network guardrail. It is **not a confidentiality boundary** and **not a privilege boundary**: it does not promise