Aegis Proxy — Security skill for Claude Code

Aegis

Aegis is a guardrail proxy that sits between your employees' AI tools and the model providers. Claude Code, pi and any OpenAI- or Anthropic-compatible client change one base URL, and every request then goes through the same pipeline: validate, redact, judge, cache, budget, route, scan the response, ledger. The binary is called `guardrail`.

It exists because coding agents read files. An agent that opens `app.properties` or a board pack sends what it read to the model on the next turn. Aegis tokenizes secrets and PII before they leave, holds confidential text for a human to approve, caps spend per employee, and records every decision without storing the prompt.

One Go binary, CPU only, SQLite. The only outbound calls go to the providers you configure and, when it is enabled, the judge model.

Quickstart

go build -o guardrail ./cmd/guardrail

cp config.example.yaml config.yaml
# edit routes, keys and limits, then sign it
./guardrail sign config.yaml

export OPENAI_API_KEY=sk-...
export GUARDRAIL_ADMIN_TOKEN=$(openssl rand -hex 16)
./guardrail serve -config config.yaml -dev

Point any OpenAI SDK at `http://localhost:8080/v1`, or an Anthropic client at `http://localhost:8080`. The bearer token is the employee's proxy token, never a provider key:

curl -s localhost:8080/v1/chat/completions \
  -H 'Authorization: Bearer emp-alice' \
  -H 'Content-Type: application/json' \
  -d '{"model":"gpt-4o","messages":[{"role":"user","content":"hello"}]}'

The response carries the decision in headers:

X-Guardrail-Action:  pass | redact | block | cache_hit
X-Guardrail-Stage:   validate | redact | judge | cache | budget | route | response-scan
X-Guardrail-Judge:   allow; 812ms | escalate; cached | held | approved | unavailable
X-Guardrail-Ticket:  SEC-1A2B3C4D          (held for review)
X-Guardrail-Cache:   HIT
X-Guardrail-Budget:  exceeded | approaching
X-Guardrail-Request-Id, X-Guardrail-Budget-Remaining-Tokens

`scripts/demo-traffic.sh`