AegisFlow代理治理系统

Install without building from source

Grab a prebuilt binary (no Go toolchain needed):

curl -fsSL https://raw.githubusercontent.com/saivedant169/AegisFlow/main/scripts/install.sh | sh

Or run the published container:

docker run --rm -p 8080:8080 -p 8081:8081 \
  -v "$PWD/configs/aegisflow.yaml:/app/configs/aegisflow.yaml" \
  saivedant169/aegisflow:v0.8.0

Building from source still works (make build, Go 1.26.4+) if you prefer.

---

Option 1: Docker Compose

git clone https://github.com/saivedant169/AegisFlow.git
cd AegisFlow
docker compose -f deployments/docker-compose.yaml up

Putting nginx or Caddy in front for TLS, SSE buffering, and admin-port isolation: see docs/deploy/reverse-proxy.md. Hit a snag? docs/troubleshooting.md covers port conflicts, Docker daemon issues, GitHub App config, invalid policy files, and evidence-verify failures.

Install Go 1.26.4+

brew install go

Clone and build

git clone https://github.com/saivedant169/AegisFlow.git cd AegisFlow make build

Cost-free examples

The examples directory includes local-only configs and requests:

• examples/configs/single-tenant.yaml
• examples/configs/multi-tenant.yaml
• examples/configs/policy-blocking.yaml
• examples/requests/openai-compatible-curl.sh

Run an example config:

make build
./bin/aegisflow --config examples/configs/single-tenant.yaml
./examples/requests/openai-compatible-curl.sh

One-click gateway demo

git clone https://github.com/saivedant169/AegisFlow.git
cd AegisFlow
make demo-local

Run the governance demo

```bash

In another terminal, run the interactive demo

./scripts/demo.sh

The demo walks through the full agent governance flow: allowed reads, blocked
destructive operations, human-in-the-loop approval for writes, and evidence
chain verification. See [`configs/demo.yaml`](configs/demo.yaml) for the
policy configuration and [`scripts/demo.sh`](scripts/demo.sh) for the script.

To run with Docker instead:

Run the interactive demo

./scripts/realworld_demo.sh ```

The demo sends MCP tool calls through AegisFlow and demonstrates: - Allowed reads: github.list_repos, github.list_pull_requests pass through - Review required: github.create_pull_request enters the approval queue - Blocked destructive ops: github.delete_repo is rejected - Evidence chain: all decisions are recorded and verifiable

See configs/realworld.yaml for the policy configuration, scripts/mock-mcp-server.js for the mock server, and scripts/realworld_demo.sh for the full test script.

---

The core object: ActionEnvelope

Every agent action is normalized into an ActionEnvelope:

type ActionEnvelope struct {
    ID                string            // unique action ID
    Actor             ActorInfo         // who: user, agent, session
    Task              string            // declared task or ticket
    Protocol          string            // MCP, HTTP, shell, SQL, Git
    Tool              string            // github.create_pull_request, shell.exec
    Target            string            // repo, host, table, service
    Parameters        map[string]any    // normalized arguments
    RequestedCapability string          // read, write, delete, deploy, approve
    CredentialRef     string            // to-be-issued or attached
    PolicyDecision    string            // allow, review, block
    EvidenceHash      string            // chain pointer
    Justification     string            // model explanation, approval, policy match
}

---

Option 2: Run locally

```bash

Run with default config

make run ```

Start AegisFlow with demo config

make run CONFIG=configs/demo.yaml

Configuration

AegisFlow is configured via a single YAML file. See configs/aegisflow.example.yaml for the full annotated reference.

Minimal config

server:
  port: 8080
  admin_port: 8081

providers:
  - name: "mock"
    type: "mock"
    enabled: true
    default: true

tenants:
  - id: "default"
    api_keys: ["my-api-key"]
    rate_limit:
      requests_per_minute: 60
      tokens_per_minute: 100000

routes:
  - match:
      model: "*"
    providers: ["mock"]
    strategy: "priority"

Policy configuration

policies:
  input:
    - name: "block-jailbreak"
      type: "keyword"
      action: "block"
      keywords:
        - "ignore previous instructions"
        - "ignore all instructions"
        - "DAN mode"
    - name: "pii-detection"
      type: "pii"
      action: "warn"
      patterns: ["ssn", "email", "credit_card"]
  output:
    - name: "content-filter"
      type: "keyword"
      action: "log"
      keywords: ["harmful-keyword"]

Multi-provider config with fallback

providers:
  - name: "openai"
    type: "openai"
    enabled: true
    base_url: "https://api.openai.com/v1"
    api_key_env: "OPENAI_API_KEY"
    models: ["openai-chat", "openai-fast"]

  - name: "anthropic"
    type: "anthropic"
    enabled: true
    base_url: "https://api.anthropic.com/v1"
    api_key_env: "ANTHROPIC_API_KEY"
    models: ["claude-sonnet-4-20250514"]

routes:
  - match:
      model: "openai-*"
    providers: ["openai", "mock"]
    strategy: "priority"

  - match:
      model: "claude-*"
    providers: ["anthropic", "mock"]
    strategy: "priority"

---

Adoption

• [x] Phase 9: Governed Coding Agent Starter Kit (3 policy packs, editor configs, Docker/Helm/Terraform deploy templates, efficacy tests, evidence examples)
• [x] Phase 10: PR-writer proof page, focused installer, tuned policy pack, design-partner onboarding

---

API Reference

Gateway API (port 8080)

Admin API (port 8081)

---

Runtime Integration

• [x] Approval notifications: Slack + GitHub notifiers fire automatically on submit/approve/deny
• [x] Behavioral kill switch: Sessions auto-blocked when cumulative risk exceeds threshold
• [x] Manifest drift enforcement: Configurable warn/enforce mode blocks out-of-scope actions
• [x] Evidence reports: Human-readable Markdown and HTML reports for auditors