> Source: https://botzr.com/programs/aegis
> Part of Botzr Research — https://botzr.com
> Last updated: 2026-08-12

Program 02 / Offensive Tooling

# AEGIS

A Rust and WASM sandbox for detonating and constraining untrusted MCP tool calls: an eight-crate policy → capability → sandbox → audit pipeline, MIT. Built, and the harness the ECHOS red team work runs inside.

## The problem

An MCP tool call runs with whatever authority its host process has. A server that should only read one directory can, in practice, often do a great deal more. The protocol defines the interface between agent and tool; it does not define the containment around the tool. Today that containment is usually nothing.

## The approach

AEGIS executes tools inside a WebAssembly sandbox with a capability-based policy: every resource a tool touches, filesystem paths, network hosts, execution time, is granted explicitly and denied by default. Execution is metered, and every call leaves an auditable record of what was requested, what was allowed, and what was refused.

## Why it exists

It was built for [ECHOS](https://botzr.com/programs/echos): attacking a third-party MCP server requires running it, and detonating unaudited code requires containment. The same harness that makes the work safe also makes every reported behavior reproducible by the vendor receiving the report.

## Status

Built and archived. The code is open source under MIT and stays where it was published; it is finished work rather than an active program, and no further development is planned. Anything new goes out on [@botzrdev](https://x.com/botzrdev).

[The ECHOS program](https://botzr.com/programs/echos) [GitHub](https://github.com/botzrDev)