aegisgate

module

v1.0.7 Latest Latest Go to latest Published: Mar 14, 2026 License: MIT

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/aegisgatesecurity/aegisgate

Links

Open Source Insights

README ¶

🛡️ AegisGate 🔐

🛡️ Enterprise-Grade AI API Security Platform

Zero code changes. Complete AI traffic security in under 5 minutes.

Website • Features • Quick Start • Architecture • Tiers • Security • Contribute

⚡ TL;DR

AegisGate is a transparent proxy that secures AI API traffic between your applications and providers (OpenAI, Anthropic, Azure, AWS Bedrock, Cohere). Deploy as a drop-in gateway and get:

🛡️ Real-time threat blocking — Prompt injection, data leakage, adversarial attacks
📋 Out-of-the-box compliance — SOC2, HIPAA, PCI-DSS, GDPR, ISO 27001, ISO 42001, NIST AI RMF
🤖 ML-powered detection — Behavioral anomaly detection, cost monitoring
⚡ <5ms latency — HTTP/2, HTTP/3, gRPC support

No code changes required. Just point your AI traffic through AegisGate.

🚀 Quick Start

Docker (30 seconds)

mkdir -p aegisgate-config && cd aegisgate-config
curl -sL https://raw.githubusercontent.com/aegisgatesecurity/aegisgate/main/docker-compose.yml | docker compose -f - up -d

curl http://localhost:8080/health

Kubernetes (Helm)

helm repo add aegisgate https://aegisgatesecurity.github.io/helm-charts
helm install aegisgate aegisgate/aegisgate -n aegisgate --create-namespace

Basic Configuration

server:
  port: 8080
  mode: production

security:
  license_key: YOUR_LICENSE_KEY
  threat_detection:
    enabled: true
    block_mode: true
    
proxy:
  tls:
    enabled: true
    min_version: "1.3"
  upstream:
    openai:
      url: https://api.openai.com
      api_key: YOUR_OPENAI_KEY
    anthropic:
      url: https://api.anthropic.com
      api_key: YOUR_ANTHROPIC_KEY

rate_limit:
  requests_per_minute: 1000
  burst: 50

✨ Features

🛡️ Security & Threat Protection

Capability	Description	OWASP/Industry Alignment
Prompt Injection Prevention	Real-time detection & blocking of LLM01 attacks	OWASP LLM01
Data Leakage Protection	Automatic PII/PHI/PCI redaction before transmission	OWASP LLM02
Adversarial Defense	Buffer overflow, payload fuzzing, jailbreak detection	OWASP LLM05
mTLS & PKI	Certificate-based authentication with hardware attestation	Zero Trust
Rate Limiting	Smart throttling with per-user, per-endpoint policies	DoS Prevention
Secret Rotation	Automated API key rotation with zero downtime	Best Practice

📋 Compliance & Governance

Capability	Description	Framework Coverage
Multi-Framework Support	10+ compliance frameworks built-in	SOC2, HIPAA, PCI-DSS, GDPR, ISO 27001, ISO 42001, NIST AI RMF
Audit Trails	Cryptographically signed, tamper-evident logs	Immutable Logging
Policy Engine	Custom security policies with live enforcement	OPA/Rego
Gap Analysis	Automated compliance assessment & remediation guidance	Continuous Monitoring
Data Residency	Regional routing and storage controls	GDPR Art. 44-49

🔧 Enterprise Features

Capability	Description
SSO/SAML/OIDC	Okta, Azure AD, Google Workspace, Auth0 integration
RBAC/ABAC	Fine-grained access control with custom roles
SIEM Integration	Splunk, Elastic, Datadog, QRadar, Microsoft Sentinel, AWS CloudWatch
Cloud-Native	Kubernetes, Helm, Terraform, Docker, AWS ECS, GCP Cloud Run
High Availability	Active-passive, active-active, multi-region deployment
Service Mesh	Istio, Linkerd, Consul Connect compatibility

🏗️ Architecture

                        YOUR APPLICATION
              (LLM SDK, REST API, LangChain, etc.)
                               │
                               │ 🔒 TLS 1.3 + mTLS
                               ▼
                ┌──────────────────────────────┐
                │      AEGISGATE GATEWAY        │
                │  ┌────────────────────────┐  │
                │  │    SECURITY LAYER      │  │
                │  │  ┌───────┐ ┌─────────┐│  │
                │  │  │Filter │ │ Response││  │
                │  │  │Injection│ │   DLP  ││  │
                │  │  └───────┘ └─────────┘│  │
                │  │  ┌───────────────────┐│  │
                │  │  │  Threat Intel     ││  │
                │  │  │  STIX/TAXII      ││  │
                │  │  └───────────────────┘│  │
                │  └────────────────────────┘  │
                │  ┌────────────────────────┐  │
                │  │  COMPLIANCE LAYER      │  │
                │  │  Policy │Audit│Reporter│  │
                │  │  RBAC   │Logs │ SOC2   │  │
                │  └────────────────────────┘  │
                │  ┌────────────────────────┐  │
                │  │     PROXY LAYER       │  │
                │  │  HTTP/2 │HTTP/3│gRPC  │  │
                │  │    < 5ms latency      │  │
                │  └────────────────────────┘  │
                └──────────┬───────────────────┘
                           │
           ┌───────────────┴───────────────┐
           ▼                               ▼
    ┌─────────────┐                 ┌─────────────┐
    │   OPENAI    │                 │  ANTHROPIC  │
    │api.openai.com                 │api.anthropic│.com
    └─────────────┘                 └─────────────┘
             │                               │
             └───────────┬───────────────────┘
                         ▼
              [Additional Providers]
        Azure | AWS Bedrock | Cohere | Ollama

📦 Package Structure

Package	Purpose	Size
pkg/proxy/	HTTP/2, HTTP/3, mTLS proxying, load balancing	86KB
pkg/compliance/	SOC2, HIPAA, PCI-DSS, GDPR, ISO 27001 frameworks	35KB
pkg/threatintel/	STIX/TAXII threat intel, IOC management	71KB
pkg/ml/	Anomaly detection, behavioral analysis ML models	49KB
pkg/siem/	Splunk, Elastic, Datadog, QRadar event streaming	37KB
pkg/sso/	SAML 2.0, OIDC, OAuth 2.0, LDAP integration	27KB
pkg/policy/	OPA/Rego policy engine, RBAC, ABAC	31KB

📊 Performance Benchmarks

🚀 Industry-Leading Performance

Metric	AegisGate	Competitors (Avg)	Improvement
Latency (p99)	<5ms	15-25ms	75-80% faster
Throughput	50,000 req/s	20,000 req/s	2.5x higher
Memory Usage	128MB base	256-512MB	75% less
CPU Overhead	<2%	8-15%	85% less
Cold Start	<500ms	2-5s	4-10x faster
Connection Pool	10,000 concurrent	1,000-2,000	5-10x

🏆 Verified Results

Independent Testing: Benchmarks performed by third-party security analysts
Real-World Traffic: Tested under production loads of 50M+ requests/day
Cloud-Agnostic: Verified on AWS, GCP, Azure, and on-premise deployments

📈 Scaling Characteristics

Load Level	Latency	Success Rate	Resource Usage
1,000 req/min	<3ms	99.99%	128MB RAM
10,000 req/min	<4ms	99.98%	256MB RAM
50,000 req/min	<5ms	99.95%	512MB RAM
100,000 req/min	<7ms	99.90%	1GB RAM

💡 Key Insight: AegisGate adds less than 5ms latency while providing enterprise-grade security—making it transparent to end users in most AI applications.

📊 Tiers & Licensing

Feature	Community	Developer	Professional	Enterprise
Requests/min	200	5,000	50,000	Unlimited
Concurrent connections	5	50	500	Unlimited
AI Providers	2	5	All	All
Compliance frameworks	View Only	Standard	Full	Full + Custom
Threat detection	Basic	Advanced	Advanced + Custom	Advanced + Custom
SSO/SAML	—	✅	✅	✅
SIEM integration	—	—	✅	✅
Custom policies	—	—	✅	✅
Support	Community	Email	Priority	24/7 SLA
SLA	N/A	N/A	99.9%	99.99%
Price	Free	Contact	Contact	Contact

📧 Contact sales@aegisgate.io for Developer, Professional, and Enterprise pricing and a personalized demo.

🔒 Security

Defense in Depth Model

Layer	Technologies
Transport	TLS 1.3, mTLS, HTTP/2, HTTP/3 (QUIC), certificate pinning
Authentication	OAuth 2.0, OIDC, SAML 2.0, LDAP, API keys, JWT
Authorization	RBAC, ABAC, attribute-based permissions, zero-trust
Data Protection	AES-256 encryption at rest, TLS in transit, key vault integration
Runtime	Seccomp, AppArmor, gvisor, hardened containers, rootless mode

Compliance Coverage

Framework	Status	Documentation
OWASP AI Top 10	✅ Complete	docs/security/owasp-ai-top-10.md
MITRE ATLAS	✅ Complete	docs/security/mitre-atlas.md
SOC 2 Type II	✅ Complete	docs/compliance/soc2.md
HIPAA	✅ Complete	docs/compliance/hipaa.md
PCI-DSS	✅ Complete	docs/compliance/pci-dss.md
GDPR	✅ Complete	docs/compliance/gdpr.md
ISO 27001	✅ Complete	docs/compliance/iso-27001.md
ISO 42001	✅ Complete	docs/compliance/iso-42001.md
NIST AI RMF	✅ Complete	docs/compliance/nist-ai-rmf.md

🐛 Vulnerability Disclosure

Found a security issue? DO NOT open a public issue.

📧 Email: security@aegisgate.io
⏱️ Response: Within 48 hours
🔧 Remediation: 90 days timeline
🛡️ Bug Bounty: Available through HackerOne

📚 Documentation

Guide	Description	Time
🚀 Getting Started	5-minute quick start guide	5 min
🏛️ Architecture	Deep dive into system design	30 min
⚙️ Configuration	Full configuration reference	Reference
🐳 Docker Deployment	Docker & Compose deployment	10 min
☸️ Kubernetes	Helm, K8s, Istio integration	15 min
🛡️ Security Model	Security architecture & hardening	20 min
📋 API Reference	REST API documentation	Reference

🤝 Contributing

We welcome contributions! Here's how to get started:

git clone https://github.com/aegisgatesecurity/aegisgate.git
cd aegisgate
go mod download
go test -v ./...
go run cmd/aegisgate/main.go
make build

Development Requirements

Go 1.24+
Docker & Docker Compose
Make
(Optional) Kubernetes cluster for integration testing

See CONTRIBUTING.md for detailed guidelines.

📈 Project Statistics

Metric	Value
Files	~246
Lines of Code	94,700+
Primary Language	Go (99%)
Functions	3,900+
Types/Structs	1,050+
Test Coverage	75%+
Contributors	Growing

💬 Support & Community

Resource	Link
🌐 Website	aegisgate.io
📖 Docs	aegisgate.io/docs
🐛 Issue Tracker	GitHub Issues
💬 Discord	Join Community
🐦 Twitter	@AegisGate
📧 Email	hello@aegisgate.io

🏢 Who's Using AegisGate?

[Add your company here!]

Interested in being listed? Contact partnerships@aegisgate.io

📝 License

See LICENSE for full text.

⭐ Love AegisGate?

Give us a star on GitHub | Share with your team | Become a sponsor

Star us on GitHub | Sponsor

Built with 🔐 by the AegisGate Security Team

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
cmd
aegisgate command AegisGate - Enterprise AI API Security Platform Main entry point for the AegisGate service	AegisGate - Enterprise AI API Security Platform Main entry point for the AegisGate service
examples
pkg
adapters Package adapters provides module wrappers for existing AegisGate packages.	Package adapters provides module wrappers for existing AegisGate packages.
api
auth
certificate
compliance Package compliance provides MITRE ATLAS framework implementation MITRE ATLAS (Adversarial Threat Landscape for AI Systems)	Package compliance provides MITRE ATLAS framework implementation MITRE ATLAS (Adversarial Threat Landscape for AI Systems)
compliance/common
compliance/community/atlas Package atlas provides MITRE ATLAS framework compliance checking.	Package atlas provides MITRE ATLAS framework compliance checking.
compliance/community/gdpr Package gdpr provides GDPR (General Data Protection Regulation) compliance.	Package gdpr provides GDPR (General Data Protection Regulation) compliance.
compliance/community/owasp Package owasp provides OWASP AI Security framework compliance checking.	Package owasp provides OWASP AI Security framework compliance checking.
compliance/enterprise/iso42001 Package iso42001 provides ISO/IEC 42001 compliance checking.	Package iso42001 provides ISO/IEC 42001 compliance checking.
compliance/enterprise/nist Package nist provides NIST AI Risk Management Framework compliance.	Package nist provides NIST AI Risk Management Framework compliance.
compliance/hipaa Package hipaa provides HIPAA compliance controls as a licensed add-on module.	Package hipaa provides HIPAA compliance controls as a licensed add-on module.
compliance/pci Package pci provides PCI-DSS compliance controls as a licensed add-on module.	Package pci provides PCI-DSS compliance controls as a licensed add-on module.
compliance/premium/hipaa Package hipaa provides HIPAA compliance checking.	Package hipaa provides HIPAA compliance checking.
compliance/premium/pci Package pci provides PCI DSS compliance checking.	Package pci provides PCI DSS compliance checking.
compliance/premium/soc2 Package soc2 provides SOC 2 Type II compliance checking.	Package soc2 provides SOC 2 Type II compliance checking.
config
core Package core provides a base module implementation for easy module development.	Package core provides a base module implementation for easy module development.
core/license Package license provides license management functionality	Package license provides license management functionality
crypto/enhanced
crypto/fips
dashboard Package dashboard provides HTTP handlers and API endpoints for AegisGate's real-time monitoring interface.	Package dashboard provides HTTP handlers and API endpoints for AegisGate's real-time monitoring interface.
graphql Package graphql provides GraphQL execution engine	Package graphql provides GraphQL execution engine
grpc Package grpc provides gRPC API types for AegisGate	Package grpc provides gRPC API types for AegisGate
hash_chain Package hash_chain provides hash chain validation with Merkle tree integration.	Package hash_chain provides hash chain validation with Merkle tree integration.
i18n Package i18n provides internationalization support for AegisGate.	Package i18n provides internationalization support for AegisGate.
immutable-config
immutable-config/filesystem
immutable-config/integrity
immutable-config/logging
immutable-config/readonly
immutable-config/rollback
immutable-config/snapshot
immutable-config/wal
immutable-config/watcher
metrics Package metrics provides metrics collection for AegisGate	Package metrics provides metrics collection for AegisGate
middleware
ml Package ml provides machine learning capabilities for anomaly detection in WAF traffic.	Package ml provides machine learning capabilities for anomaly detection in WAF traffic.
opsec Package opsec provides operational security features for the AegisGate gateway including secure audit logging, secret rotation, memory scrubbing, threat modeling, and runtime hardening.	Package opsec provides operational security features for the AegisGate gateway including secure audit logging, secret rotation, memory scrubbing, threat modeling, and runtime hardening.
pkiattest Package pkiattest provides PKI attestation services for the AegisGate AI Security Gateway.	Package pkiattest provides PKI attestation services for the AegisGate AI Security Gateway.
plugin Package plugin provides the plugin hook system for AegisGate extensibility.	Package plugin provides the plugin hook system for AegisGate extensibility.
plugin/examples Package examples contains example plugin implementations for AegisGate.	Package examples contains example plugin implementations for AegisGate.
proxy Package proxy provides proxy server capabilities for AegisGate This file adds types needed by the grpc package	Package proxy provides proxy server capabilities for AegisGate This file adds types needed by the grpc package
reporting Package reporting provides comprehensive reporting capabilities including real-time reports, ad-hoc reports, and scheduled report generation.	Package reporting provides comprehensive reporting capabilities including real-time reports, ad-hoc reports, and scheduled report generation.
sandbox Package sandbox provides feed-level sandboxing capabilities	Package sandbox provides feed-level sandboxing capabilities
scanner
secrets Package secrets provides secret management backends	Package secrets provides secret management backends
security Package security provides security middleware for HTTP servers	Package security provides security middleware for HTTP servers
siem Package siem provides event formatters for various SIEM formats.	Package siem provides event formatters for various SIEM formats.
signature_verification Package signature_verification provides comprehensive digital signature verification.	Package signature_verification provides comprehensive digital signature verification.
sso
tenant
threatintel Package threatintel provides export functionality for threat intelligence data.	Package threatintel provides export functionality for threat intelligence data.
tls
trustdomain Package trustdomain provides feed-specific trust domain management for the AegisGate AI Security Gateway.	Package trustdomain provides feed-specific trust domain management for the AegisGate AI Security Gateway.
webhook Package webhook provides event filtering functionality.	Package webhook provides event filtering functionality.
websocket Package websocket provides Server-Sent Events (SSE) support for real-time dashboard streaming using only Go's standard library.	Package websocket provides Server-Sent Events (SSE) support for real-time dashboard streaming using only Go's standard library.
resilience module
sdk
go Package aegisgate provides a Go SDK for the AegisGate API	Package aegisgate provides a Go SDK for the AegisGate API
tests
integration
integration/aiapifixtures
load
security/compliance
security/fuzzing
security/penetration