cursorrules-afa8e8 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cursorrules-afa8e8 (Rules) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Security guardrails for AI coding agents powered by threat models
Aegis is an MCP server that gives AI coding agents (Cursor, Claude Code, Cline, Windsurf, etc.) project-specific security requirements in real time. You define your threat model once in a security-context.yaml file; every time the agent is about to write security-relevant code, it calls aegis_assess and gets back mandatory requirements, approved patterns, and anti-patterns -- deterministically, with zero token cost. After code is generated, aegis_review checks requirement-to-implementation completeness before final output.
AI coding agents write working code fast, but they don't know your project's security rules. They'll generate a login endpoint without your rate-limiting policy, or query a database without your parameterization requirement. Aegis fixes that by injecting your threat model into the agent's workflow at the moment it matters.
From your project root:
cd your-project
pip install aegis-mcp
aegis setupaegis setup handles setup end-to-end in one command:
security-context.yaml or helps you generate one with your IDE LLMaegis server entryWhen setup completes, start coding. The agent will call aegis_assess and aegis_review automatically for security-relevant work.
Useful CLI commands:
aegis validate security-context.yaml
aegis help
aegis aboutIf you prefer to set everything up by hand, see docs/quickstart.md and docs/generating-security-context.md.
Reference files:
catalogs/security-patterns.yaml -- comprehensive traditional + LLM code-gen pattern catalogtemplates/security-context.template.yaml -- blank schema-shaped templateschemas/security-context.schema.json -- schema contractdocs/schema-reference.md -- field-level referenceStarter contexts from examples/:
examples/minimal.yaml -- smallest valid context for first-time setup.examples/rest-api.yaml -- healthcare-style REST API with PHI-focused guardrails.examples/ecommerce.yaml -- e-commerce and payments with card-data and checkout controls.examples/internal-tool.yaml -- internal admin dashboard with role-based controls.examples/microservices.yaml -- multi-service architecture with mTLS and service-identity controls.examples/security-context.example.yaml -- comprehensive reference covering most sections.sequenceDiagram
participant You
participant Agent as AI Coding Agent
participant Aegis as Aegis MCP Server
You->>Agent: "Build a signup endpoint"
Note over Agent: Reads template instructions
Note over Agent: Categorizes task into canonical IDs
Agent->>Aegis: aegis_assess(boundary, data_types, action, ...)
Aegis->>Agent: Requirements + approved patterns + anti-patterns
Note over Agent: Writes code following the checklist
Agent->>Aegis: aegis_review(requirements, self-report mappings)
Aegis->>Agent: pass: false (missing encrypt-pii-at-rest)
Note over Agent: Revises code to satisfy missing requirements
Agent->>Aegis: aegis_review(updated mappings)
Aegis->>Agent: pass: true (4/4 covered)
Agent->>You: Delivers secure codeaegis://summary (e.g. boundary_crossing: "public-to-internal", data_types: ["user-pii"], action: "create-endpoint").aegis_assess with those IDs. Aegis does a deterministic lookup against your security-context.yaml and returns all matching requirements, approved patterns, and anti-patterns.aegis_review with the requirements and a self-report of how each was satisfied. If any critical/high requirements are missing, Aegis returns pass: false and the agent revises the code.The agent calls aegis_assess with the relevant service IDs, data types, boundary crossings, and action (using canonical values from aegis://summary, including known_actions). Aegis returns:
| Field | Description |
|---|---|
requirements | Mandatory security constraints the generated code must satisfy. |
approved_patterns | Preferred implementations (e.g. "use auth middleware"). |
anti_patterns | Forbidden practices (e.g. "no raw SQL interpolation"). |
warnings | Unknown IDs or potential schema gaps. |
conflicts | When multiple sources disagree on a requirement. |
no_match | true if the boundary crossing wasn't found in the context. |
After implementing code, the agent calls aegis_review with:
requirements from the latest aegis_assess responsemappings entries with requirement_id and satisfied_byaegis_review returns covered, missing, extra_mappings, coverage, and pass.
| Name | Type | Description |
|---|---|---|
aegis_assess | Tool | Returns requirements, approved patterns, and anti-patterns for a given context. Deterministic; no LLM. |
aegis_validate | Tool | Validates a security-context.yaml against the schema; reports errors with line numbers. |
aegis_review | Tool | Verifies requirement-to-implementation coverage after code generation using provided mappings. Deterministic completeness check. |
aegis://summary | Resource | Lightweight overview of trust boundaries and data classifications. Read once per session. |
See qa/README.md for a step-by-step benchmark workflow (task suite, manual A/B agent runs, scoring, and aggregate statistics generation).
See docs/schema-reference.md for the full field reference and contract rules.
git clone https://github.com/bgigurtsis/aegis-mcp.git
cd aegis-mcp
pip install -e .
python -m unittest discover -s tests -vMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.