🧩 Using AI without enterprise protections? AegisGate Lens is our free browser extension that brings 153 detection patterns to everyday AI conversations — for the 95% of users who don't have a security gateway. Install Lens →

Why AegisGate?

Every AI interaction is an attack surface. Prompt injections leak secrets. MCP servers exfiltrate context. A2A agents escalate privileges across trust boundaries. A single misconfigured LLM response can expose PII, violate compliance, or hand an attacker a credential.

AegisGate sits in front of all of it — one binary, zero dependencies, fail-closed by default.

• Sub-millisecond overhead. 3.2ms p95 at 24K+ RPS. Your users won't notice it's there.
• Fail-closed. If AegisGate can't scan a response, it blocks it. No silent failures, no pass-through on error.
• Self-hosted. No API keys to rotate, no third-party to trust. Your data stays in your infrastructure.
• 6 pillars, one gateway. HTTP, MCP, A2A, ACP, RESPONSE, and Trust — no patchwork of point products.
• 153 detection patterns. Secrets, XSS, PII, and compliance — wired into every response, every time.
• Red-team hardened. 26/27 adversarial tests pass. TRACE methods rejected. All security headers present. No unsafe-eval in CSP.

Security Posture

Request Flow

flowchart LR
    Client["👤 Client / Agent"] -->|"HTTP · MCP · A2A"| Gateway["🛡️ AegisGate"]

    subgraph Pillars["6 Protection Pillars"]
        direction TB
        HTTP["HTTP API<br/>pkg/response/"]
        MCP["MCP<br/>pkg/mcpserver/"]
        A2A["A2A<br/>pkg/a2a/"]
        ACP["ACP<br/>pkg/acp/"]
        RESP["RESPONSE<br/>pkg/response/detectors/"]
        TRUST["Trust<br/>pkg/attestation/"]
    end

    Gateway --> Pillars
    Pillars -->|"Scanned ✅"| LLM["🤖 LLM / AI Service"]
    Pillars -->|"Blocked ❌"| Client

    LLM -->|"Response"| Gateway
    Gateway -->|"Clean"| Client
    Gateway -->|"Sanitized / Rejected"| Client

    subgraph Infra["Infrastructure"]
        PG[("PostgreSQL<br/>persistence")]
        Redis[("Redis<br/>rate limiting")]
    end

    Gateway --- Infra

Detection Engine

The pkg/response/detectors/ package provides 153 regex patterns with full Lens parity:

import "github.com/aegisgatesecurity/aegisgate-platform/pkg/response/detectors"

// Scan all 153 patterns
matches := detectors.DetectAll(text)

// Scan by category
secrets := detectors.DetectSecrets(text)
xss := detectors.DetectXSS(text)
pii := detectors.DetectPIIUSCore(text)
compliance := detectors.DetectCompliance(text)

// Wired into ResponseGuard (default: enabled)
guard := response.NewResponseGuard()
result, _ := guard.Scan(ctx, text)
// result.DetectedXSS, result.DetectedCompliance, result.DetectedPII, result.DetectedSecrets

How AegisGate Compares

v3.5.0 Highlights

6 Pillars

Compliance Coverage

Quick Start

# Build
go build -o aegisgate ./cmd/aegisgate-platform

# Run with defaults (in-memory stores)
./aegisgate

# Run with PostgreSQL
export DATABASE_URL="postgres://user:pass@localhost:5432/aegisgate"
./aegisgate

# Run integration tests (requires Docker)
go test -tags=integration -timeout 300s ./pkg/ioc/... ./pkg/persistence/...

Architecture

cmd/aegisgate-platform/     # Binary entry point
pkg/
├── a2a/                    # Agent-to-Agent security
├── acp/                    # Agent Capability Policy
├── attestation/            # Cryptographic envelope (Sign/Verify/VerifyWithKey/VerifyOnline)
├── audit/soc2/             # SOC 2 evidence collection
├── compliance/             # 15+ framework modules
├── cluster/                # HA clustering & distributed rate limiting
├── correlation/            # Event correlation engine
├── cve/                    # CVE-for-AI feed
├── detectors/              # 153-pattern detection engine
├── evaluator/              # Adversarial benchmark suite
├── ioc/                    # IOC management
├── mcpserver/              # MCP guardrails
├── persistence/            # Storage backends (file + PostgreSQL)
├── rbac/                   # Role-based access control
├── response/               # 6-pillar response guard
├── trust/                  # Trust Framework (6 sub-packages)
└── testdb/                 # Shared testcontainers infrastructure

Testing

# Unit tests (99 packages)
go test ./...

# Integration tests (6 PostgreSQL packages, requires Docker)
go test -tags=integration -timeout 300s ./pkg/ioc/... ./pkg/persistence/... ./pkg/rbac/... \
  ./pkg/license/... ./pkg/correlation/... ./pkg/attestation/...

# Coverage
go test -coverprofile=coverage.out ./...
go tool cover -func=coverage.out | grep total

License

Apache 2.0 — see LICENSE.

Security

See SECURITY.md for vulnerability reporting. See govulncheck.toml for the GO-2026-5932 suppression (openpgp transitive, not called).