Aegotrax

Aegotrax has not yet set a traffic cap on sensitive data reads, and slow in-scope data exfiltration remains an unresolved gap.

Aegotrax v0.2.4 moves session intent entirely to the server side, preventing clients from forging the user_intent parameter during the verify phase.

Aegotrax v0.2.4 introduces a hostname allowlist and explicitly does not perform substring-matching bypass.

Aegotrax v0.2.4 adds SSRF/IMDS protection at both the engine and gateway layers.

Aegotrax v0.2.4 adds schema pinning and drift detection for MCP to defend against supply-chain attacks that tamper with the runtime schema.

In the previous version of Aegotrax, REQUIRE_APPROVAL was merely a log entry that marked an operation as requiring approval but did not actually block it.

Aegotrax v0.2.4 implements a complete approval workflow: generating an approval_id and a one-time token, making decisions via POST /approval/decide, and performing a single resumption for the same tool+args combination.

Aegotrax v0.2.4 adds session TTL, per-session rate limiting, and audit log desensitization features.

Aegotrax currently relies on heuristic rules plus threshold judgments rather than truly understanding user intent.

Aegotrax is an open-source pilot security project that provides protection by intercepting tool calls just before execution, inspecting intent, data sources, and policies, returning ALLOW/BLOCK decisions, and writing to an audit log.

Aegotrax provides an optional MCP gateway accessed via stdio, supporting deployment through Docker or pip.

Aegotrax is not a production-grade/enterprise-grade security product; the author self-describes it as an open pilot prototype.

Aegotrax's open-source code is hosted at github.com/aegotrax-dev/aegotrax and can be run locally via docker compose or pip installation.

Aegotrax provides a Python SDK with two integration methods: the verify_tool_call method and a decorator.

Aegotrax supports one-click startup via Docker Compose, or installation via pip.

Aegotrax currently implements simple data provenance tracing; the author candidly acknowledges that this capability is incomplete and relies more on policy rules and intent heuristics to compensate.

The author explicitly positions Aegotrax as an open pilot, stating that it is not a prompt filter, not a production-grade or enterprise-grade security product, and not a solution capable of transparently proxying all existing enterprise agents.

The Aegotrax project code is hosted on the GitHub repository github.com/aegotrax-dev/aegotrax, and the project emphasizes running only in a local sandbox environment.

Aegotrax's policies are heuristic-based, require manual tuning, cannot cover all attack scenarios, and may produce false positives on legitimate calls or be bypassed by carefully crafted attacks.

Aegotrax places its defense at the critical point of tool execution, intercepting tool calls before they are actually executed, and issues an ALLOW or BLOCK verdict by examining intent, data provenance tracing, and policy rules.