The model never gets a shell.
Aegis keeps endpoint authority inside deterministic policy. AI investigates evidence and proposes typed actions. It cannot execute arbitrary commands.
Install on Linux or macOS
curl -fsSL https://aegis.erzen.dev/install.sh | sh
Downloads the matching published release asset, verifies its SHA-256 checksum, then opens guided onboarding.
What the preview does today
These capabilities run in the public repository now. The implementation ledger keeps incomplete platform work visible.
| Endpoint connection | Device-owned certificates, mutual TLS, certificate-bound identity, and ordered offline replay. |
|---|---|
| Deterministic detection | Host posture, YARA signatures, Trivy vulnerabilities, suspicious persistence, authentication anomalies, and ransomware-like file bursts. |
| Constrained reasoning | A vendored fx ACP profile with native tools disabled and exactly seven Aegis MCP tools. |
| Response admission | Deterministic evidence, confidence ≥ 0.95, 24-hour observation, recovery capability, telemetry health, idempotency, and rollback. |
| Audit and updates | SQLite retention, a SHA-256 audit chain, and Ed25519 update-manifest verification primitives. |
It is not production EDR yet
Privileged repair remains locked. Native eBPF, ETW, and Endpoint Security sensors are not complete, the Windows fx planner still has upstream portability work, and production macOS monitoring requires Apple entitlement approval.
Start with a machine you can recover
Run the preview in a lab, inspect the event flow, and contribute one platform adapter or recovery invariant at a time.