Documentation

Aegis is a skill marketplace and compilation system. Each skill is authored in SKILL.md — a single markdown bundle containing metadata, multiple phases, and guidance text. The compiler generates three artifacts:

• System Prompt — Ready to paste into ChatGPT, Claude, or your LLM
• OpenAI Action Schema — For ChatGPT custom actions and function calling
• MCP Manifest — For Model Context Protocol servers

Skills can be invoked individually through the Aegis API, or chained together through Themis for multi-phase reasoning.

Browse the Marketplace

Go to the Skills page to browse all available skills. Click any skill to see its full documentation, phases, and installation instructions.

Skill Properties

Each skill has:

• Name & Version — Unique identifier and semantic version
• Description — One-line summary of what it does
• Tags — Keywords: network, endpoint, lateral-movement, detection, etc.
• Frameworks — mitre-attack, mitre-engage, mitre-atlas, etc.
• Phases — Usually 3-5 distinct reasoning phases
• Health Score — 0-100 rating based on phase coverage and freshness

GET /api/skills

Retrieve all available skills:

GET /api/[skill]/manifest

Fetch the full manifest for a skill, including phases and input/output schema:

POST /api/[skill]/invoke

Execute a skill with your input:

GET /api/[skill]/phase/[phaseId]

Fetch raw phase content (used internally by Themis):

Aegis speaks MCP in both directions: it serves the skill library to MCP clients, and Themis can call tools on external MCP servers during analysis.

Serve Aegis skills to a client

Expose the library to Claude Desktop, Claude Code, Cursor or any MCP client. Three read-only tools are offered: list_skills, get_skill and get_skill_phase.

Local, over stdio — add to your client config:

Remote, over Streamable HTTP — a deployed instance serves MCP at POST /api/mcp:

Both transports serve the same read-only tools and only public skill content — no writes, no execution, no network calls.

Let Themis use external MCP tools

Themis sub-agents can call tools on external MCP servers during analysis, under a governance boundary enforced in code — opt-in and default-deny. Configure servers in the THEMIS_MCP_SERVERS environment variable (a JSON array):

• Default-deny: with no config, agents get no external tools. A server is only reachable by the skills in its allowedSkills.
• Autonomous agents auto-invoke only read-classified tools. Write and execute tools are never run by the model — they are recorded as approval requests for a human, and only when allowWrite is true.
• External output is redacted, size-capped and wrapped so it is treated as data, not instructions; each run has a call budget and timeouts.

On serverless deployments only http servers are reachable; stdio is for local development.

Themis orchestrates skills for complex threat analysis. Instead of invoking a single skill, submit a task and Themis decomposes it into sub-tasks, invokes multiple skills in parallel, validates outputs, and synthesises a findings report.

Submit a Task

The response includes the findings report, skills invoked, guardrail verdicts, token usage, and a thread ID for session continuity.

For full details on Themis architecture, see the Themis page.

The Audit API runs a structured compliance audit against one or more security standards. Supported standards: CIS L1/L2, NIST CSF, ISO 27001, SOC 2, PCI-DSS, HIPAA, IEC 62443, NIST 800-53.

POST /api/audit

Submit a configuration, policy document, or architecture description for audit:

Request fields:

• input — the configuration or policy text to audit (required)
• inputType — one of: config, policy, architecture, description (optional, defaults to description)
• standards — array of standard slugs to apply (optional, auto-detected from input if omitted)

The response includes executiveSummary, findings (per control), summary (severity counts), standardsApplied, skillTrace, and durationMs.

The Exposure API runs the exposure-validation workflow for one vulnerability on one asset. A scanner finding is treated as a hypothesis. The workflow tracks exposure, exploitability, impact, detection, remediation and verification as separate states, so a report cannot blur "the CVE exists" into "the asset is exploitable".

POST /api/exposure

Request fields:

• input — advisory, finding or asset description (required, max 12,000 characters)
• cve, kevListed, epss — threat signals (optional; KEV outranks CVSS)
• authorization — mandate, scope and target-identity flags. Any missing field counts as false, and the policy engine denies the request.
• context — asset ID, system type, business criticality, environments, and whether the asset is a crown jewel
• providedEvidence — evidence you already hold (exploitation, telemetry, EDR, SIEM, remediation, verification)

What decides what

• Deterministic rules handle authorization, the capability registry, risk scores and state transitions. The model never decides these.
• The model classifies the input, correlates exposure, picks validation steps from the fixed registry, maps attack paths and writes the summary.
• The workflow never executes a test. It returns a validation plan gated by policy. Without exploitation evidence, exploitability stays NOT_VALIDATED rather than being guessed.
• A case only closes when a retest of the original proof is supplied. A patch record on its own is not enough.

The response includes the case states, the validation plan, impact with attack-path edges, risk before and after (plus the delta once a retest is verified), the policy decision, plain-language answers to the seven explainability questions, skillTrace and durationMs.

Q: Skill returns 404

The skill name does not exist or is misspelled. Call GET /api/skills to see all available skill names.

Q: Invoke returns 400 (Bad Request)

Your input does not match the skill schema. Fetch the manifest with GET /api/[skill]/manifest to see required fields and types.

Q: Invoke times out (>30s)

The skill took longer than expected. This is normal for LLM-based skills. Timeout limits vary — see your deployment documentation.

Q: Themis returns a sanitized error

Themis hides internal details for security. Your input may violate guardrails, or a skill invocation may have failed. Check that your task and context are valid.

Q: How do I use the system prompt?

Click on a skill to view its page. The system prompt is available in an InstallTabs section. Copy it and paste into your LLM interface, or use it to build a custom agent.

Q: What is the health score?

A 0-100 rating based on phase coverage, tag completeness, framework linkage, and freshness. Higher scores indicate more developed and well-maintained skills.

Security skills decay as the threat landscape shifts. aegis intel-sync ingests a threat-intelligence corpus, extracts reusable attack patterns, and routes each one into the skills whose attack surface it affects.

aegis intel-sync --days 7          # sync the last week, then recompile
aegis intel-sync --dry-run         # show routing without writing
aegis intel-sync --news <dir> --breakdowns <dir>

What it writes

• references/live-threat-intel.md — current observations, techniques seen in the window, and coverage prompts, written strictly between BEGIN/END markers.
• intel-state.json — derived coverage gaps and the last sync date, merged into self-learning at compile time.

Safety properties

• Hand-authored reference files are never read, modified, or overwritten. Generated content lives only inside its own marked block and is fully regenerable.
• Generated phases are flagged auto: true and excluded from phase-coverage scoring, so a live feed cannot inflate a skill's health score.
• Intel state is stored separately from skill.json, which is a build artifact regenerated on every compile.

Aegis and Themis follow strict security principles:

• All LLM provider SDKs run server-side only. No API keys are exposed to the client.
• Logs contain only metadata (hashes, token counts, durations) — never task or response content.
• Client errors are sanitized through a fixed error handler — no stack traces, internal paths, or model names reach the client.
• Findings and task content are never persisted to disk, database, or external storage — only in-memory during execution.
• All skill phase content is validated against content integrity patterns (script injection, eval, data URIs) before reaching agents.

Ready to use Aegis? Start with the Skills marketplace. For advanced orchestration, explore the Themis documentation. For complete technical details, see TECHNICAL.md in the repository.