Aegis Security CLI

Aegis Security CodeQL OpenSSF Scorecard Passive by default Multilingual npm ready

한국어 · English · 日本語 · 中文

Aegis Security CLI is the reusable engine behind Privit Aegis. It is an authorized, non-destructive security verification CLI that enforces scope before execution, selects checks from a safe catalog, redacts sensitive data, and produces JSON, Markdown, HTML, and SARIF reports.

This repository is intentionally focused on the CLI engine. The web console, GitHub Pages site, AI settings, local reports, and Privit-specific workflow live in the workspace repository: https://github.com/LeeHueeng/privit-aegis-workspace.

Keeping the engine separate makes the CLI easy to reuse from other workspaces without carrying Privit-specific report assets, web UI state, or local scan artifacts.

• Passive and scope-guarded by default
• 2,970 generated safe verification checks
• Korean, English, Japanese, and Chinese CLI/docs support
• Redacted evidence and report generation built in
• SARIF output for security review systems
• Small Node.js CLI with no runtime dependencies
• Clean separation from the Privit workspace, so the engine can be reused
• CodeQL, Dependency Review, OpenSSF Scorecard, SBOM generation, and provenance attestations are wired into GitHub Actions

Aegis supports Korean, Japanese, Chinese, and English.

npm run aegis -- help --lang ko-KR
npm run aegis -- help --lang ja-JP
npm run aegis -- help --lang zh-CN
npm run aegis -- help --lang en-US
AEGIS_LANG=ko-KR npm run aegis -- help

Localized docs are generated under:

• docs/ko-KR/
• docs/ja-JP/
• docs/zh-CN/
• docs/en-US/

npm install
npm run catalog:generate
npm run aegis -- profiles list
npm run aegis -- attacks list
npm run aegis -- init --profile baseline_web --attack-pack initial_access_hardening
npm run aegis -- scope verify
npm run aegis -- plan --mode passive --target frontend --profile baseline_web --attack-pack initial_access_hardening
npm run aegis -- run --target frontend --mode passive --dry-run
npm run aegis -- report --format html

Aegis is not limited to one company or one service shape. Use profiles to adjust safe priorities, evidence focus, role assumptions, and denied path hints for different authorized training contexts.

npm run aegis -- profiles list
npm run aegis -- profiles show fintech_payments
npm run aegis -- init --profile healthcare_privacy
npm run aegis -- plan --mode passive --target frontend --profile ecommerce_marketplace

Current profiles include:

• baseline_web: neutral web application baseline
• saas_b2b: multi-tenant B2B SaaS and support workflows
• ecommerce_marketplace: checkout, seller, order, coupon, and inventory flows
• fintech_payments: passive-first payments, wallet, ledger, KYC, and audit coverage
• healthcare_privacy: patient privacy, consent, portal, and clinical workflow coverage
• public_education: citizen, student, staff, and document workflow coverage
• internal_admin: backoffice, support, admin, and operational workflow coverage
• api_platform: OpenAPI, API key, webhook, integration, and developer portal coverage
• media_community: user-generated content, moderation, profile, and media metadata coverage

Inspired by the ATT&CK-mapped structure of mukul975/Anthropic-Cybersecurity-Skills, Aegis includes safe attack emulation packs. They do not execute attacks. They translate adversary tactics into defensive validation checks, evidence requirements, denied-action lists, and safe planning metadata.

npm run aegis -- attacks list
npm run aegis -- attacks show credential_access_defense
npm run aegis -- plan --mode passive --target frontend --attack-pack recon_exposure_review

Current safe packs include:

• recon_exposure_review
• initial_access_hardening
• credential_access_defense
• execution_lolbin_detection
• persistence_hunting_readiness
• privilege_escalation_controls
• defense_evasion_telemetry
• lateral_movement_readiness
• collection_exfiltration_monitoring
• command_control_detection
• impact_ransomware_resilience
• fraud_abuse_monitoring

Blocked by design: exploit payloads, phishing delivery, password guessing, credential dumping, persistence creation, C2 traffic, data exfiltration, and destructive write activity.

Install directly from GitHub after this repository is public:

npm install -g github:LeeHueeng/privit-project
aegis help --lang ko-KR

The package is prepared for npm as aegis-security-cli, but it has not been published to npm yet.

The workspace pins this CLI by commit SHA in GitHub Actions and installs it from GitHub:

npm install -g git+https://github.com/LeeHueeng/privit-project.git#<commit-sha>

For local development against the workspace, either install from GitHub or link the package:

cd privit-project
npm link
cd ../privit-aegis-workspace
npm link aegis-security-cli
aegis help --lang ko-KR

See docs/WORKSPACE_INTEGRATION.md for the two-repository workflow.

• aegis.scope.json is required before planning or running.
• Hosts and paths must match the allowlist.
• Production environments only allow passive mode by default.
• Destructive, brute-force, exfiltration, persistence, and evasion behavior is blocked.
• LLMs are not allowed to create or execute arbitrary shell commands.
• Reports and LLM-bound data are redacted.

aegis init
aegis profiles list
aegis profiles show saas_b2b
aegis attacks list
aegis attacks show credential_access_defense
aegis scope verify
aegis catalog generate
aegis docs generate --lang all
aegis docs generate --lang ko-KR
aegis docs generate --lang ja-JP
aegis docs generate --lang zh-CN
aegis docs generate --lang en-US
aegis plan --mode passive --target frontend --profile saas_b2b --attack-pack initial_access_hardening
aegis run --mode passive --target frontend --dry-run
aegis findings list
aegis report --format markdown
aegis report --format html
aegis report --format sarif

• aegis.scope.json: authorization, target allowlists, environment, safety limits.
• aegis.policy.json: blocked behavior and tool-adapter policy.
• aegis.auth.json: test-account metadata only.
• aegis.plan.json: selected safe checks for a run.
• catalog/security-checks.jsonl: 2,970 generated safe verification checks.
• docs/AGENT_SECURITY_CHECKS.md: agent and adapter operating guide.
• docs/HUMAN_SECURITY_GUIDE.md: human usage guide.
• docs/{ko-KR,ja-JP,zh-CN,en-US}/: localized agent and human guides.
• .aegis/: local scan results, artifacts, findings, and reports.

• Examples: docs/EXAMPLES.md
• Architecture: docs/ARCHITECTURE.md
• Detection catalog: docs/DETECTION_CATALOG.md
• Safe attack emulation: docs/ATTACK_EMULATION.md
• Workspace integration: docs/WORKSPACE_INTEGRATION.md
• Supply-chain security: docs/SUPPLY_CHAIN_SECURITY.md
• Release process: docs/RELEASE_PROCESS.md
• Roadmap: docs/ROADMAP.md

This project is for authorized testing only. Do not use it against systems you do not own or do not have written permission to test. Destructive, brute-force, exfiltration, persistence, and evasion behavior is blocked by default.

• Exploit payload collections
• Brute-force or credential stuffing
• Persistence, evasion, or destructive testing
• Secret extraction or data exfiltration
• Automated attacks against third-party systems

Issues and pull requests are welcome when they keep the default behavior safe and passive. Start with CONTRIBUTING.md and run npm test before opening a pull request.