Constrain the
architecture, not
the prompt.
A hosted API that scores an agent's proposed tool call before it executes: rules, an online pattern model, and an LLM judge, over one HTTP request. Call it from any language, any framework.
The problem
Agent safety is mostly enforced by asking the model nicely.
A system prompt saying “never delete customer records” is advisory. It is a string in a context window competing with every other string in that context window, including any text the agent happens to read from a support ticket. Meanwhile the tools are real: they send email, issue refunds, and drop rows.
Nothing structural stands between a hijacked agent and the database. AegisAI is that structure. It does not ask the agent to behave. It removes the code path where misbehaving was possible.
Clone it, run it. No key required yet.
Falls back to a mock judge and SQLite automatically, so this works with nothing set. Docs at /docs once it's up.
$ git clone https://github.com/Navneet-Scaler/AegisAI$ cd AegisAI$ docker compose up
Mint a key, score a call.
No signup. The response comes back with a verdict, the three layer scores, and the judge's reasoning, before anything executes.
# no signup, returned once$ curl -X POST localhost:8000/v1/keys -d "{}"$ curl -X POST localhost:8000/v1/guard \-H "Authorization: Bearer $KEY" \-d '{"tool": "delete_customer", "args": {"customer_id": "8842"}}'
How a call is scored
Three independent signals. One score.
The reasoning stays attached. Any layer can escalate, none can silently wave a call through.
Static rules
Hard policy that holds regardless of what the model decides. Destructive verbs, spend thresholds, PII access, recipient allowlists. A rule can force a verdict outright.
Behavioural pattern model
An online classifier over call features. Argument shapes this agent has never used before score higher. Every human decision updates the weights immediately.
LLM judge
A second model asks whether the proposed call actually follows from what the user asked. This is the layer that catches hijacked intent, which name matching alone cannot.
score = 0.35 * rule + 0.30 * pattern + 0.35 * judge score >= 0.75 -> block 0.40 <= score < 0.75 -> hold for human approval score < 0.40 -> allow any forcing rule -> that verdict wins
Case study
A prompt injection, caught.
A support ticket carries “ignore all previous instructions” embedded in the customer's own message, asking for a $300 credit framed as routine goodwill. No rule was ever written for this exact shape, and none should have to be: the judge reads the call's justification against the actual conversation, holds it, and a human reviewing that reasoning blocks it.
What it does
Interception
- One chokepoint every tool call must pass through
- Three way verdict: allow, hold for a human, or block
- Blocked calls return a structured refusal the agent can adapt to
- Framework agnostic, wraps existing tool calling code
Scoring
- Three independent signals combined into one explainable score
- Per layer sub scores persisted on every call
- Every dependency fails toward hold, never toward allow
- Editable policy rules, no redeploy needed
Learning and audit
- Online weight updates on every approve or reject
- Full audit trail of calls, scores, reasoning, and outcomes
- Block rate and drift tracked over time
- Per tool and per agent risk breakdown
Operations
- Atomic approvals: two concurrent decisions on one call, exactly one wins
- A crash mid execution can't leave the audit trail understating what ran
- /health checks the database and judge credentials, not a hardcoded ok
- Audit export neutralizes formula injection in exported fields
Score the call.
Before it runs.