Program 02 / Offensive Tooling
AEGIS
A Rust and WASM sandbox for detonating and constraining untrusted MCP tool calls: an eight-crate policy → capability → sandbox → audit pipeline, MIT. Built, and the harness the ECHOS red team work runs inside.
The problem
An MCP tool call runs with whatever authority its host process has. A server that should only read one directory can, in practice, often do a great deal more. The protocol defines the interface between agent and tool; it does not define the containment around the tool. Today that containment is usually nothing.
The approach
AEGIS executes tools inside a WebAssembly sandbox with a capability-based policy: every resource a tool touches, filesystem paths, network hosts, execution time, is granted explicitly and denied by default. Execution is metered, and every call leaves an auditable record of what was requested, what was allowed, and what was refused.
Why it exists
It was built for ECHOS: attacking a third-party MCP server requires running it, and detonating unaudited code requires containment. The same harness that makes the work safe also makes every reported behavior reproducible by the vendor receiving the report.
Status
Built and archived. The code is open source under MIT and stays where it was published; it is finished work rather than an active program, and no further development is planned. Anything new goes out on @botzrdev.