AEGIS: reviewing the full command before an agent plugin launches it

[Escape Studio (antropos17)]

I'm Ruslan Murtuzaliyev, the AEGIS maintainer at Escape Studio. AI assisted the project and this write-up. AEGIS is a free, MIT-licensed Windows-first desktop security tool for local AI agents, currently at public beta 0.20.1-beta.

For builders connecting agent plugins to local commands, there is a useful review boundary before the command starts: what executable, arguments, working directory and environment did the operator actually allow?

AEGIS has an explicitly configured selected-command execution policy built around that complete action. A deny decision or failed preparation does not launch the selected process. The action has to be deliberately routed through this owner; other plugin and application calls keep their own security boundaries.

That can sit alongside a local review workflow: inspect a selected skill, project or supported agent profile for command/instruction patterns, save an inventory snapshot, then compare changes after an update. Static review does not execute the selected code. A separate MCP gateway can require one-use grants for exact tool arguments on a configured connection.

I am sharing this as an external protection workflow for agent builders. I have not qualified a Semantic Kernel adapter or an end-to-end Semantic Kernel execution path, and this post does not claim one. The command-policy and MCP contracts are available to inspect independently of any framework.

Current source UI preview with simulated data, captured 27 October 2026; no live framework integration or blocking test is depicted.

• Source and Windows beta
• Exact action and execution-policy contract

For people building local tool plugins: which part of a launch description is most often missing from the human review — the full arguments, the working directory, or the environment? A small sanitized example would help shape a practical future adapter without assuming every plugin uses the same execution route.