One door to every tool. Agents never hold the key.
AEGIS Connect is the integration and execution layer. It is designed so that tools, APIs, MCP servers and enterprise systems are reached through a single gateway, and credentials stay on the server side.
Follow the credential
Where does the secret go?
Agent and model
The agent sees the tool name and schema. Prompts, model providers and traces never receive the secret.
Tool definition
A tool declares what it can do to the world.
Schemas tell the model how to call something. AEGIS also needs to know what happens if the call is repeated, how sensitive the data is, and how large a response is acceptable.
| Field | Example | Why it matters |
|---|---|---|
| Schema | vendor_id, amount, currency | Validates the proposed call |
| Side effect | writes_money | Feeds approval policy |
| Retry class | non_idempotent | Sets the runtime's failure behavior |
| Data classes | finance | Limits who can see results |
| Schema digest | 3fa91c0e… | A change forces another review |
MCP connectivity
A connection grants nothing.
Model Context Protocol is a practical way to reach tools, and an MCP client is planned for Phase 2. AEGIS is designed to treat every MCP server as untrusted.
- Discovered tools are not usable until someone reviews them and grants them to an agent.
- The schema is pinned. If a server changes it, the tool returns to review.
- Every call passes Guard like any other, and responses are marked untrusted.
- For HTTP servers, Connect is designed to follow the specification's OAuth 2.1 authorization approach.
Designed against the MCP specification dated 2026-07-28. Not yet implemented.
Example workflow
Connect a tool safely.
Register
Add an OpenAPI file, a schema by hand, or an MCP server.
Classify
Declare the side effect, retry class and data classes.
Attach a credential
It is stored encrypted and can be written but never read back.
Test through the gateway
A staged check reports DNS, TLS, authentication and schema results.
Grant
Allow specific agent versions to request this tool.
Technical explanation
What the gateway enforces.
Separation. The gateway is the only component with credential access. A compromised worker should not expose every secret.
Network limits. Outbound calls are filtered to stop requests to internal addresses and cloud metadata services.
Limits. Rate limits, timeouts and maximum response sizes apply per tool.
Scope of release. Phase 1 covers HTTP tools and synthetic tools. MCP, per-user OAuth and a connector catalog come later.