Aegisure

Control & audit plane for AI coding agents — one constitution, every agent, safer commits.

Aegisure is a local-first CLI for teams and developers using coding agents such as Codex, Claude Code, Cursor, Copilot, Cline, and Roo. It gives every repo a shared Constitution, scans AI-generated diffs before they land, exports rule files that agents can read, and creates constrained repair prompts when a change is risky.

The static core is LLM-free. It runs locally, works without API keys, and does not send your code to a model.

What It Does

• Scans staged, working-tree, or PR diffs for secret values, destructive shell commands, permissive CORS, auth/session/permission changes, payment/billing changes, risky dependency scripts, deployment config changes, deleted tests, and large risky changes.
• Generates a canonical Aegisure.md Constitution for a repository.
• Exports the Constitution into agent-readable files: AGENTS.md, CLAUDE.md, .cursorrules, .clinerules, and .github/copilot-instructions.md.
• Preserves existing user-authored agent files by writing only inside an Aegisure-managed block.
• Produces constrained repair prompts that tell an agent exactly what to fix and what not to touch.
• Captures declared provenance and attribution when you commit through aegisure commit.
• Supports a lightweight GitHub Actions path with aegisure scan --changed --json.

Install

pip install aegisure

Requires Python 3.10 or newer.

Quickstart

Initialize Aegisure in a repo:

aegisure init
aegisure export

Stage a risky change:

echo 'OPENAI_API_KEY = "sk-proj-realfakekey1234567890abcdef"' >> app.py
git add app.py

Scan the staged diff:

aegisure scan --staged

Example output:

Aegisure verdict: block (100/100)
1 files changed, 1 additions, 0 deletions, 1 risk findings.
- CRITICAL secret_in_diff at app.py:1: This added line looks like a secret, token, password, private key, or credential.

Create a constrained repair prompt:

aegisure repair --staged --agent codex

CLI Commands

aegisure init      Generate the canonical Aegisure.md Constitution.
aegisure export    Export Aegisure.md into standard agent memory files.
aegisure scan      Analyze a local or CI diff using the LLM-free static core.
aegisure repair    Generate a constrained repair prompt for risky diffs.
aegisure commit    Commit changes and capture declared agent provenance.
aegisure login     Store local workspace metadata for CLI use.
aegisure doctor    Run a read-only repository readiness check.
aegisure run       Start or end a git snapshot-and-scan session.
aegisure rewind    Prepare a safe git-based rollback for an Aegisure-tagged commit.

The public CLI is intentionally static-core and LLM-free.

GitHub Actions

Copy .github/workflows/aegisure.yml.example into your repository as .github/workflows/aegisure.yml:

name: Aegisure

on:
  pull_request:
    branches: ["**"]

jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: python -m pip install aegisure
      - run: aegisure scan --changed --base origin/${{ github.base_ref }} --json

aegisure scan --json exits non-zero when the verdict is block, so CI can fail safely on critical findings.

Hosted Dashboard Beta

A hosted dashboard beta exists for teams that want GitHub App PR comments, audit history, BYOK audit chat, and workspace views.

Learn more: https://aegisure.dev

License

MIT