{
  "markdown": "# AgentAegis MCP Server\n\n[![Glama score](https://glama.ai/mcp/servers/astafford8488/agentaegis-mcp/badges/score.svg)](https://glama.ai/mcp/servers/astafford8488/agentaegis-mcp)\n\nEvery cybersecurity service, callable by any AI agent, billed per use.\n\nAgentAegis is an MCP server that lets AI agents perform cybersecurity operations on demand — from compliance checks to vulnerability scans to code security analysis. It wraps best-in-class open-source scanning engines (nmap, Nuclei, sslyze, Semgrep, trufflehog, trivy) in clean, agent-discoverable tool definitions with structured inputs and outputs.\n\n**Phase 2 ships:** HTTP transport for remote deployment, x402 micropayments, API key auth with monthly limits, Supabase persistence, webhooks, ISO 27001 + HIPAA frameworks, Railway deploy config, and a full test suite.\n\n## Quick Start\n\n### Local (stdio for Claude Desktop)\n\n```bash\ngit clone https://github.com/astafford8488/agentaegis-mcp.git\ncd agentaegis-mcp\npnpm install\ncp .env.example .env  # add API keys\npnpm build\n```\n\nAdd to `claude_desktop_config.json`:\n```json\n{\n  \"mcpServers\": {\n    \"agentaegis\": {\n      \"command\": \"node\",\n      \"args\": [\"/path/to/agentaegis-mcp/dist/index.js\"],\n      \"env\": {\n        \"NVD_API_KEY\": \"...\",\n        \"ABUSEIPDB_API_KEY\": \"...\",\n        \"OTX_API_KEY\": \"...\",\n        \"ABUSECH_API_KEY\": \"...\",\n        \"HIBP_API_KEY\": \"...\"\n      }\n    }\n  }\n}\n```\n\n### Remote (HTTP, for agent platforms)\n\n```bash\n# Local dev\npnpm dev:http\n\n# Production via Docker\ndocker compose -f docker/docker-compose.yml up -d\n\n# Production via Railway\nrailway up\n```\n\nConnect from any MCP-aware agent:\n```\nPOST https://your-host/mcp\nAuthorization: Bearer aegis_<your-api-key>\n```\n\n## Architecture\n\n```\n┌─────────────────────────────────────────────────────────┐\n│         AI Agent (Claude, custom MCP client)            │\n└────────────────┬───────────────────────┬─────────────────┘\n                 │ stdio                 │ HTTP\n                 │                       │\n┌────────────────▼───────────┐  ┌────────▼─────────────────┐\n│   stdio entry (index.ts)   │  │  HTTP entry (http-server)│\n└────────────────┬───────────┘  └────────┬─────────────────┘\n                 │                       │\n                 │      ┌────────────────┴─────────────┐\n                 │      │  Auth Gate                   │\n                 │      │  - API key (DB-backed)       │\n                 │      │  - x402 micropayment         │\n                 │      └─────────────┬────────────────┘\n                 │                    │\n┌────────────────▼────────────────────▼──────────────────────┐\n│              MCP Server (server.ts)                          │\n│              20 Tool Handlers                                │\n├──────────────────────────┬────────────────────────────────┤\n│  Engine Wrappers         │  External APIs                  │\n│  nmap, Nuclei, sslyze,   │  NVD, AbuseIPDB, AlienVault OTX + abuse.ch,    │\n│  Semgrep, trufflehog,    │  HIBP, Shodan                   │\n│  trivy                   │                                  │\n├──────────────────────────┴────────────────────────────────┤\n│  Sandbox    │ Rate Limit │ Target Validation │ Logging     │\n└────────────────────────────────────────────────────────────┘\n                            │\n                  ┌─────────▼──────────┐\n                  │  Supabase          │\n                  │  - customers       │\n                  │  - api_keys        │\n                  │  - scan_jobs       │\n                  │  - usage_log       │\n                  │  - webhooks        │\n                  └────────────────────┘\n```\n\n## HTTP API (Phase 2)\n\n| Endpoint | Method | Auth | Description |\n|----------|--------|------|-------------|\n| `/health` | GET | None | Health check |\n| `/pricing` | GET | None | Tool catalog with prices |\n| `/v1/customers` | POST | None | Create customer account |\n| `/v1/customers/:id/api-keys` | POST | None | Issue an API key |\n| `/v1/customers/:id/usage` | GET | API key | Usage statistics |\n| `/v1/jobs/:jobId` | GET | API key | Async scan job status |\n| `/mcp` | POST | API key OR x402 | MCP Streamable HTTP transport |\n\n### Payment Flow\n\n**Option 1: API Key** — Customer registers, gets a key, pays via prepaid balance or invoice. Each tool call deducts from the monthly budget.\n\n```bash\ncurl -X POST https://api.agentaegis.org/v1/customers \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"email\":\"you@company.com\",\"name\":\"Your Name\"}'\n\ncurl -X POST https://api.agentaegis.org/v1/customers/<id>/api-keys \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"name\":\"production\",\"monthly_limit_usd\":100}'\n```\n\n**Option 2: x402 Micropayment** — No signup. Each tool call settles on-chain via USDC. The server returns `402 Payment Required` with payment requirements; the client signs and retries with `X-PAYMENT` header.\n\n## Tool Catalog (28 tools: 23 paid + 5 free)\n\nLive pricing is always at [`/pricing`](https://agentaegis-mcp-production.up.railway.app/pricing).\n\n| Tool | Category | Description | Price |\n|------|----------|-------------|-------|\n| `compliance_framework_check` | Compliance | SOC 2, ISO 27001, HIPAA, PCI-DSS, NIST CSF assessment | $2.00 |\n| `evidence_collect` | Compliance | Evidence collection plans for audit controls | $1.00 |\n| `control_gap_analysis` | Compliance | Prioritized remediation roadmap | $2.00 |\n| `audit_report_generate` | Compliance | Audit-ready compliance reports | $5.00 |\n| `policy_generate` | Compliance | Tailored security policy documents | $2.00 |\n| `vuln_scan_network` | Vuln Mgmt | Network port and vulnerability scan | $3.00 |\n| `vuln_scan_web_app` | Vuln Mgmt | OWASP Top 10 web app scan | $5.00 |\n| `vuln_prioritize` | Vuln Mgmt | Risk-based vulnerability prioritization | $1.00 |\n| `cve_lookup` | Vuln Mgmt | CVE details, CVSS, KEV status | $1.00 |\n| `ssl_tls_audit` | Vuln Mgmt | SSL/TLS configuration audit | $1.00 |\n| `sast_scan` | Code Security | Static security analysis | $5.00 |\n| `secret_scan` | Code Security | Hardcoded secret detection | $2.00 |\n| `dependency_audit` | Code Security | Dependency vulnerability scan | $2.00 |\n| `incident_triage` | Blue Team | Incident classification & response plan | $3.00 |\n| `threat_intel_lookup` | Blue Team | IOC reputation lookup | $2.00 |\n| `dns_security_check` | Blue Team | DNS security audit | $1.00 |\n| `email_security_audit` | Blue Team | Email security configuration audit | $2.00 |\n| `access_review` | Identity | Access privilege audit | $1.00 |\n| `mfa_audit` | Identity | MFA coverage assessment | $1.00 |\n| `credential_check` | Offensive | Breach database lookup | $2.00 |\n| `vet_endpoint` | Trust Layer | Composite PROCEED/CAUTION/BLOCK trust verdict on an endpoint before your agent calls or pays it | $3.00 |\n| `scan_mcp_plugin` | Trust Layer | Supply-chain scan of an MCP server/plugin before your agent installs or trusts it | $5.00 |\n| `scan_skill` | Trust Layer | Prompt-injection and over-broad-grant scan of an agent skill (SKILL.md) | $5.00 |\n\nFree tools (no charge): `help`, `account_balance`, `agent_whoami`, `agent_history`, `agent_scan_get`.\n\n## Compliance Frameworks Supported\n\n- **SOC 2 Type II** — Full Trust Services Criteria (35 controls)\n- **ISO 27001:2022** — All 4 Annex A control groups (93 controls)\n- **HIPAA Security Rule** — Administrative, physical, and technical safeguards (43 controls)\n- **NIST CSF 2.0** — All 6 functions with categories\n- **PCI DSS v4.0** — All 12 requirements with detailed controls (full evaluation logic)\n\n## Development\n\n```bash\npnpm install        # Install dependencies\npnpm dev            # stdio mode (for Claude Desktop)\npnpm dev:http       # HTTP mode (with Streamable HTTP transport)\npnpm build          # Build for production\npnpm test           # Run vitest test suite (46 tests)\n```\n\n## Deployment\n\n### Railway (Recommended)\n\n```bash\nrailway login\nrailway init\nrailway up\n```\n\nRequired env vars (set in Railway dashboard):\n- `SUPABASE_URL`, `SUPABASE_SERVICE_KEY`\n- `X402_PAYEE_ADDRESS` (your wallet)\n- `NVD_API_KEY`, `ABUSEIPDB_API_KEY`, `OTX_API_KEY`, `ABUSECH_API_KEY`, `HIBP_API_KEY`\n\n### Database setup\n\nRun the migration in your Supabase SQL editor:\n```bash\ncat supabase/migrations/001_initial_schema.sql\n```\n\n## Security Policy\n\n- **Target validation**: Only public IPs and registered domains. Private/reserved ranges blocked.\n- **Scan isolation**: Each scan runs in an isolated process with temp directory cleanup.\n- **Code safety**: Repos cloned shallow (depth=1), max 500MB, 5-minute timeout, no execution.\n- **Secret redaction**: Full secret values never returned — first 4 and last 4 characters only.\n- **Rate limiting**: Per API key AND per target. Max 5 concurrent scans, 10/hour per target.\n- **Audit logging**: All tool calls logged to `usage_log` (90-day retention).\n- **API key hashing**: Keys stored as SHA-256 hashes; raw keys never stored.\n\n## Responsible Use\n\nAgentAegis scanning tools must only be used against systems you own or have explicit written authorization to test. By using this service, you agree that:\n\n1. You have authorization from the system owner to perform security testing\n2. You will not use these tools for unauthorized access or malicious purposes\n3. You accept responsibility for any scans initiated through your API key\n\n## License\n\nMIT\n",
  "bytes": 9282,
  "sha": "ee1463e8c3d5f36f081f994c6321c1f9b4cba24877b711d897c07e3a1450c3f9",
  "repo_slug": "astafford8488/agentaegis-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_astafford8488_agentaegis_2cfafb5d/readme"
}