AEGIS
Open-source defense-in-depth for LLM apps and agents — input/output detection, a policy engine, and tool-permissioning that stops a prompt injection from getting an agent to misuse a tool.
Input / output defense
Prompt-injection and jailbreak detection on the way in, toxicity/PII/leak detection on the way out — fused into one action, not a single opaque score.
Policy engine
CEL-rule policy packs decide allow/transform/escalate/block per tenant, independent of the raw detector output.
Agent tool-permissioning
Taint-tracked tool calls and human-approval gating for irreversible actions — the layer most guardrail projects skip entirely.
Try it live
Try to get something past it. Type a message and watch the real defense pipeline decide what happens to it, stage by stage — same detectors, same policy engine, no LLM API keys required. Source on GitHub.
Be upfront about what this demo is: depending on the VM this instance happens to be running on, detectors may use lightweight pattern-based backends instead of full trained models — the trace below names each detector's backend so you can always check. The model completion itself always runs on a mock model, never a real provider — that's also labeled explicitly below, so nothing here pretends to be something it isn't. And even the hardened, full-model version of the detectors doesn't catch everything — our own adaptive red-team testing found real-model detectors converge to roughly the same ~48% bypass rate as the lightweight ones by round 3 of an adapting attacker. We publish that number so you find out from us, not from a bypass. Full methodology and numbers: RESULTS.md.
Where exactly does it get blocked?
The pipeline has four places a request can actually be stopped: input-defense's own detectors, the policy engine evaluating that input, output-defense's own detectors, and the policy engine evaluating the output. These four buttons send real, crafted requests through the live pipeline — not a diagram — designed to land at a specific one of those four checkpoints. Live detector scoring means the exact stopping point can shift between runs (that's the same honesty as everywhere else on this page: we show you what actually happened, not a scripted outcome). Click "Run all four" to see them side by side, CI-check style.
Agent actions — a second, independent layer
The box above is text-level detection, and it will get bypassed sometimes (that's the whole point of the honesty above). This is different: it tests agent-gate, the layer that decides whether a tool call is allowed to execute — independent of whether the text that triggered it was caught. An irreversible action waits for a human, and critically, not the same credential the calling agent itself holds — a compromised or prompt-injected agent can submit a tool call, but it cannot approve its own irreversible action.