Aegis — Evidence-backed security for VS Code
Find vulnerabilities, trace attack paths, and verify security claims without leaving your editor.
Aegis brings deterministic security scanning, evidence-bound analysis, attack-path reasoning, remediation verification, policy, and optional AI-assisted review directly into VS Code.
Start immediately: open a source file → select code → open the Command Palette → run Aegis: Fast Scan Selected Code.
Deterministic scanning does not require an AI API key.
See the evidence, not just the alert
Deep Analysis
Go beyond a scanner result with explicit model provenance, canonical claims, evidence, verifier metadata, and uncertainty boundaries.
Fix & Prove
A code change is not proof. Aegis keeps remediation, target re-verification, regression checks, and unavailable validation steps separate so a weaker state is never silently promoted.
Attack Graph / Data Sentinel
Materialize source → sink attack paths, trust-boundary crossings, and sensitive-data flows from evidence instead of reducing the result to a generic risk score.
Trusted Analysis
A single surface for executed orchestration, policy, memory, evidence, integrity, and the final trust decision — while keeping incomplete execution from becoming an accidental baseline.
Threat Model
Tie threats to assets, trust boundaries, exploitability reasoning, source locations, and concrete evidence rather than rendering them as generic risk labels.
What you can do in Aegis
| Surface |
Purpose |
| Fast Scan |
Deterministic source-code findings with explicit result provenance |
| Deep Analysis |
Optional provider-backed analysis with evidence and verifier metadata |
| Workspace Security Scan |
Scan supported source files across the workspace with visible coverage boundaries |
| Dependency Security |
Analyze supported dependency lockfiles and advisory coverage |
| Attack Graph / Data Sentinel |
Materialize attack paths, trust crossings, and sensitive-data flows |
| Threat Model |
Bind threats to assets, trust boundaries, exploitability, and evidence |
| Fix & Prove |
Keep remediation and re-verification evidence separate from the original claim |
| Security Task Plan |
Preview a bounded security workflow before execution |
| Trusted Analysis |
Execute the gated workflow with policy, memory, evidence, and integrity boundaries |
Start in VS Code
- Install Aegis.
- Open a source file.
- Select the code you want to inspect.
- Run Aegis: Fast Scan Selected Code.
- Use workspace, dependency, graph, and planning surfaces as needed.
- Configure an AI provider only if you want provider-backed Deep Analysis.
Aegis does not require an AI provider for deterministic scanning.
If a provider-backed route cannot complete, Aegis keeps scanner fallback distinct from completed AI analysis.
Security claims need proof
Aegis is designed around a stricter question than “did a tool emit an alert?”
What was detected, what was inferred, what was verified, and what evidence supports the claim?
That means:
- AI NOT RUN is different from completed AI analysis.
- Scanner fallback remains visible.
- Partial coverage is not promoted to “clean.”
- Planning is not presented as execution.
- Verification and provenance remain attached to the result.
- A missing validation step cannot silently become a verified state.
Core commands
- Aegis: Fast Scan Selected Code
- Aegis: Deep Analysis Selected Code
- Aegis: Scan Entire Workspace
- Aegis: Scan Dependencies
- Aegis: Show Attack Graph & Data Sentinel
- Aegis: Preview Security Task Plan
- Aegis: Run Trusted Analysis
- Aegis: Configure AI Providers
Requirements
- VS Code:
^1.100.0
- Deterministic scanning does not require an AI API key.
- Dependency analysis requires a supported dependency lockfile or pinned requirements file.
- Provider-backed Deep Analysis requires a configured provider route.
Aegis
Trust infrastructure for software and AI agents.
Website
