Try it in 2 minutes

Fastest. Works in Claude.ai, ChatGPT, Gemini or any chat that takes pasted text.

1. 1
   Open the exposure-validation skill (or any skill) and press Copy prompt. It is one markdown file, about 41 KB.
2. 2
   Paste it as the first message of a new chat.
3. 3
   Then ask:

   your messageCOPY

   Using the Aegis exposure-validation skill I pasted, assess whether CVE-2026-12345 is exposed on web-01. I am authorised to test web-01.

What you will see

Real: near the top of the file you pasted, right after the title, the skill states its scope. Copied from the skill itself:

Purpose: Prove which exposures are real, exploitable and closed, using the least invasive test under recorded approval.

Use only on systems you own or are explicitly authorized to assess.

Out of scope: any test without written authorization, explicit scope and named-human approval, and persistence, credential theft or lateral movement beyond what the test requires.

Illustrative, not captured output: because the skill asks for authorization and scope first, expect your AI to confirm what web-01 is, that you may test it and what is out of bounds before it suggests any check. Its wording will differ from run to run.

Read-only. Your AI client can list skills and read their methodology on demand. No key, no account.

https://aegis-skills.vercel.app/api/mcp

What you will see

Real output. Ask your AI to "list Aegis skills about exposure". It calls the first tool below with {"query":"exposure"} and receives exactly this. The same server code runs at the hosted endpoint; the output was captured by running the tools in-process when this page was built.

{
  "count": 2,
  "skills": [
    {
      "name": "attack-surface-mapping",
      "family": "Threat Intel",
      "summary": "Attack surface mapping and exposure analysis workflow",
      "phases": 5,
      "liveIntel": true
    },
    {
      "name": "exposure-validation",
      "family": "Threat Intel",
      "summary": "Continuous exposure validation (CTEM) — prove which vulnerabilities are actually exposed, exploitable and impactful in an authorized environment, then prove the exploit window is closed after remediat…",
      "phases": 6,
      "liveIntel": false
    }
  ]
}

Ask for one of them and it calls get_skill with {"name":"exposure-validation"}. Trimmed here: the description, tags, context fields are left out for length.

{
  "name": "exposure-validation",
  "version": "1.1.0",
  "family": "Threat Intel",
  "frameworks": [
    "mitre-attack",
    "ssvc",
    "nist-800-115",
    "ctem"
  ],
  "phases": [
    {
      "index": 0,
      "id": "exposure-state-model",
      "liveIntel": false
    },
    {
      "index": 1,
      "id": "validation-authorization-and-scope",
      "liveIntel": false
    },
    {
      "index": 2,
      "id": "impact-and-attack-paths",
      "liveIntel": false
    },
    {
      "index": 3,
      "id": "evidence-and-confidence",
      "liveIntel": false
    },
    {
      "index": 4,
      "id": "remediation-verification",
      "liveIntel": false
    },
    {
      "index": 5,
      "id": "rapid-exposure-response",
      "liveIntel": false
    }
  ]
}

A third tool, get_skill_phase, returns the methodology text of one phase.

For coding assistants: Claude Code, Codex, Gemini CLI, Cursor, VS Code Copilot and Antigravity. One command copies all 24 skills into the skills folder your assistant reads and registers the read-only MCP server.

1. 1
   Check Node.js: node --version must print v24 or higher. Nothing else is needed.
2. 2
   Pick your assistant and run its command. Add --project to install into the current folder only.

   Claude CodeCodexGemini CLICursorVS Code CopilotAntigravity

   Inside Claude Code:

   Claude CodeCOPY

   /plugin marketplace add drupadsachania/aegis-skills
   /plugin install aegis@aegis-skills

   Or from a terminal:

   shellCOPY

   npx aegis-skills install --platform claude

3. 3
   Check it worked:

   shellCOPY

   npx aegis-skills list

4. 4
   Restart your assistant, then ask it:

   your messageCOPY

   Which Aegis skills cover MITRE ATT&CK, and what does each one do?

What you will see

Real output. From the 1.5.0 installer on a clean project; only the folder path is shortened to ~/my-project.

$ npx aegis-skills install --platform claude --project
  MCP: registered "aegis" in ~/my-project/.mcp.json
✓ Claude Code (project): 24 skills in ~/my-project/.claude/skills

$ npx aegis-skills list
aegis-skills 1.5.0: 24 skills bundled
  claude       project  v1.5.0  24 skills  ~/my-project/.claude/skills

Full step-by-step guide: Getting started with npx. Every flag: CLI reference. Where files go and how to remove them: Install reference.