MCP compliance kernel
A policy layer between your AI agent and your data. It allows, denies, or rewrites every action, then logs it.
No layer in the middle. The credentials and the system are one reach apart.
One change fixes the whole category of problem. The agent no longer talks to systems. It talks to the kernel, and only the kernel holds the keys and can reach the systems.
"The agent holds a request, never a key."
Press the button to watch the credentials move out of the agent's hands and into the kernel.
Every call takes the same path. Pick a verdict and step through it. There are three possible outcomes, not two.
The kernel doesn't dictate a sequence of steps, which would turn the agent back into a rigid script. It enforces conditions instead: "you may promote data to the trusted tier only once it's been validated." The agent works in any order it likes, and the rule holds regardless.
And it can't cheat: the receipt is issued by the kernel, never claimed by the agent.
The live demo
illustrative simulation Scripted client-side. No real systems are touched. This demonstrates the behavior; it isn't a live kernel.
| Plain MCP | Aegis | |
|---|---|---|
| Who the agent connects to | Every system, directly | ✓Only the kernel |
| Where credentials live | In the agent's hands | ✓In the kernel; never exposed to the agent |
| What governs an action | Nothing. The model just acts | ✓A policy check on every call: allow / deny / transform |
| Destructive operations | ✕Possible, even hidden inside a query | ✓Blocked, including DROP and TRUNCATE parsed out of opaque SQL |
| Sensitive data | ✕Flows out as-is | ✓Masked before the agent ever sees it |
| Order and safety guarantees | "Hope the model behaves" | ✓Invariants enforced regardless of order |
| Malicious instruction hidden in the data | ✕Can hijack the agent's actions | ✓Blocked. Enforcement sits below the model |
| Audit | ✕None | ✓Every decision and the rule that fired, logged |
Policy enforcement that supports compliance. Semantic checks, like reading the SQL at the AST level, are defense-in-depth, backed by a default-deny stance so a miss fails safe. Deterministic enforcement that sits below the model, which is why it's injection-resistant by construction.
Not a magic "you're now GDPR-compliant" button. Not a general-purpose MCP gateway. It's a compliance kernel with a point of view, opinionated about what should never happen rather than trying to be everything to everyone.
Aegis holds the keys, checks every call, and writes down what it decided. The agent stays free to work. The guarantees hold no matter what it tries.