Security skills and a SOC agent, on your own AI.
Aegis is 24 defensive security skills in the open Agent Skills format. Themis is a governed security-operations agent that runs inside Claude Code, Codex or Gemini CLI, or as a local dashboard with your own model. No account, no hosted inference, Apache-2.0 OR MIT.
Nothing to install and no account. Or choose your path.
Aegis
24 skills across 5 families: ATT&CK, ATLAS and Engage mapping, threat hunting, exposure validation, forensics, malware analysis, OT, identity, compliance and more. Each skill is plain markdown with a scope and authorization section, and its content is updated monthly.
Aegis provides the specialist skill; Themis decides how an agent invokes it.
Browse skills
Themis
Plans a security task, fans it out to specialist skills, checks every output with guardrails, and writes a report stamped with the exact Themis and Aegis versions. Tools that write or execute only run after a human approves them.
Themis governs how an agent invokes an Aegis skill and what it can do with the result.
Local-first and still being matured. It runs from the repository today; it is not on npm or in AI directories yet.
How Themis worksOne task, two roles
Aegis provides the specialist skill. Themis governs how an agent invokes it and what it can do with the result. Illustrative task, real skill names:
- You
You ask
"Assess exposure of CVE-2026-12345 on web-01." A plain-language task, typed in your AI client or the Themis dashboard.
- Themis + Aegis
Themis plans, Aegis supplies the method
Themis splits the task into sub-tasks and picks specialist skills, here exposure-validation and threat-modeling. Aegis supplies each skill's methodology: the phases the agent follows.
- Themis
A write-capable call is proposed
Following the method, the agent proposes an active check against web-01 through a tool you connected. Themis classifies it as write or execute and records an approval request. It does not run.
- You
A person decides
You approve or decline on the dashboard's Approvals page, or in your client's own prompt. Only an approved request runs, once. A declined one is never executed.
- Themis + Aegis
The report is stamped
The report records the Themis, Aegis and osk versions it was produced with, the guardrail results and each proposed action with its outcome.
The CVE number and the tool are examples. See governance for the rules Themis enforces.
Pick a product, then your path.
Aegis
Skill packAvailableInstall the skills into your assistant, connect the read-only MCP, or paste one file into any chat AI. Nothing to sign up for, and it never calls a model.
Fastest start, in a terminal
npx aegis-skills install --platform claudeAlso codex, gemini, cursor, vscode and antigravity.
3 ways to use Aegis
- Zero installFor · Anyone, in any chat AICopy a single-file prompt or download a skill zip.Set up
- Hosted MCPFor · Claude.ai, ChatGPT and any MCP clientConnect to the hosted, read-only Aegis MCP server.Set up
- Skill packFor · Coding assistantsInstall every skill into your assistant's native skills folder.Set up
Themis
SOC agentIn developmentA governed agent that plans a task and uses the Aegis skills, on your own machine. It is still being matured: you run it from the repository today, and the npm and directory installs are not available yet.
2 ways to use Themis
Every path uses the same skills. Start with zero install and move up when you need more. All install commands →
Aegis 1.5.0 is on npm, and the plugin, the zero-install prompts and the hosted MCP all work today. Themis is in development and local-first; it is not published to npm or AI directories yet, and its rows are marked.
Know what produced it, and who approved it.
Version stamp
Themis records the exact versions behind each run: its own core, the installed Aegis pack and the skill-format (osk) version. This is a real stamp, read from this repository.
{
"themis": "0.1.0",
"aegis": "1.5.0",
"osk": "1.1"
}Themis 0.1.0 · Aegis 1.5.0 (osk 1.1)
In standalone reports it is the footer line above and a field in the JSON export. In plugin mode it is returned with every run and with the report. The website itself produces none.
Approval boundary
- Every external tool is classified read, write or execute. An unmarked tool counts as a write.
- Writes and executes become approval requests. The gateway runs one only if it is approved and decided by a human, and only once.
- Only two channels can decide: the dashboard's Approvals page and your client's own prompt. No tool, graph step or model output can.
Honest limit: tools you connect straight to your assistant bypass Themis. Governance · On the Themis page · Trust and data flow
- 01
No hosted inference
The website never calls a model. Prompts and zips are static files; the hosted MCP only serves skill text. Each path's data flow is written out and checkable. Trust and data flow →
- 02
Human-approved actions
Themis classifies every external tool as read, write or execute. Every call waits for a person to approve it, never the model.
- 03
Scoped by design
Every skill states its defensive purpose and is for systems you own or are authorized to assess.
- 04
Open and portable
Apache-2.0 OR MIT. Markdown and JSON you can read, fork and run anywhere.
Skills go stale as the threat landscape moves. Threat-intel feeds are distilled into reusable attack patterns, and each pattern is routed into the skills whose attack surface it lands on. Skill content is updated monthly. Generated intel lives in its own reference file, is labelled LIVE, and never edits hand-written tradecraft. Every download carries an "Intel as of" date.
Ingest
Pull the window's feeds, knowledge graph, and teardowns. Tier each source and deduplicate against prior runs.
Extract
Turn individual incidents into reusable attack patterns and map them across the full ATT&CK chain.
Route
Send each pattern to the skills whose attack surface it lands on — by technology and domain, not headline.
Map coverage
Derive coverage prompts: recurring CVEs, dominant techniques, and where telemetry may not even exist.