Aegis Security Skills

io.github.drupadsachania

Read-only library of 24 defensive cybersecurity skills: ATT&CK, ATLAS, DFIR, CTEM and more.

Add to Cursor Add in Claude Add to VS Code Run on PlugMCP

1{2  "mcpServers": {3    "io.github.drupadsachania-aegis-skills": {4      "url": "https://aegis-skills.vercel.app/api/mcp",5      "headers": {}6    }7  }8}

.cursor/mcp.jsonMCP server

Transport: http
Status: Remote

Power your agent

Add this server

The publisher's own URL. Not a PlugMCP endpoint.

Add to Cursor Add in Claude Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Server URL

https://aegis-skills.vercel.app/api/mcp

The Claude button above opens Claude with the name and URL filled in. You still confirm it there.

shClaude Code

1claude mcp add --transport http io.github.drupadsachania-aegis-skills https://aegis-skills.vercel.app/api/mcp

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "io.github.drupadsachania-aegis-skills": {4      "command": "npx",5      "args": [6        "-y",7        "mcp-remote",8        "https://aegis-skills.vercel.app/api/mcp"9      ]10    }11  }12}

claude_desktop_config.json

Remote · HTTPPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Remote

Transport: http
Version: 1.5.0
Last checked: 2026-10-27

Stars: —
Tools: —
Uptime: —

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install Aegis Security Skills?

Copy the http config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Aegis Security Skills need an API key?

No required environment variable is listed on this record.

What transport does Aegis Security Skills use?

Aegis Security Skills is reached over HTTP.

When was Aegis Security Skills last checked?

Last checked 2026-10-27. Read-only library of 24 defensive cybersecurity skills: ATT&CK, ATLAS, DFIR, CTEM and more.

From the publisher

Documentation

	Aegis	Themis
What	24 security skills, an installer and a read-only MCP server	A security-operations agent that plans, fans out to Aegis skills, checks every output and writes a version-stamped report
Calls a model?	Never. It is markdown and JSON	Uses your assistant (plugin) or your own key or a local model (standalone)
Package	`aegis-skills`	`@aegis-skills/themis-plugin` and `@aegis-skills/themis`

Status: Aegis 1.5.0 is on npm as aegis-skills, and the Claude Code plugin installs straight from this repository. The website is live. Themis is in development, local-first and not published as an app yet (run it from a checkout, see docs/themis); its two libraries, @aegis-skills/themis-core and @aegis-skills/themis-gateway, are on npm. The status table below says what is done and what is next.

Aegis

Defensive security skills in the open Agent Skills format. One source installs natively into coding assistants, is served over the Model Context Protocol, and flattens into a single-file prompt for any chat AI.

Skill library: 24 skills across 5 families

Family	Skills
Frameworks	`mitre-attack` · `mitre-atlas` · `mitre-engage`
Threat Intel	`attack-surface-mapping` · `exposure-validation` · `threat-hunting` · `threat-intel-synthesis` · `threat-modeling`
Response & Analysis	`digital-forensics` · `malware-analysis` · `reverse-engineering` · `security-operations`
Domain Defence	`application-security` · `data-loss-prevention` · `deception-engineering` · `endpoint-security` · `identity-access-management` · `infrastructure-security` · `network-security` · `operational-technology`
Governance & Risk	`compliance` · `governance` · `risk-management` · `security-documentation`

Each skill is a workflow of phases (methodology references) plus a live-threat-intel phase. Skill content is updated monthly. Browse them at aegis-skills.vercel.app.

Quick start

# Install the skills into your tool's native skills folder and register the MCP server
npx aegis-skills install --platform claude      # codex | gemini | cursor | vscode | antigravity | all
npx aegis-skills install --platform claude --project   # this project only

# Serve the whole library over MCP on stdio
npx aegis-skills mcp

Claude Code plugin: /plugin marketplace add drupadsachania/aegis-skills, then /plugin install aegis-skills@aegis-skills.

Needs Node.js 24 or later.

CLI commands

Command	What it does
`aegis install [--platform <id>] [--project]`	Copy the skills into each tool's native folder and register the MCP server (config files are backed up first). `init` is an alias
`aegis uninstall [--platform <id>] [--project]`	Remove only what Aegis installed; edited files are kept as `.bak`
`aegis update`	Re-sync every recorded install with the installed version
`aegis list [--json]`	Bundled skills and recorded installs
`aegis mcp`	Serve the skill library over MCP on stdio

Installed skills refresh automatically after an upgrade; set AEGIS_NO_AUTO_REFRESH=1 to turn that off.

Using a skill without installing

Every skill page on the website offers a single-file prompt (all phases flattened, stamped "Intel as of ") and a skill zip, and the whole library is available from the hosted MCP server. Build the prompts locally with npm run build:prompts (written to dist/prompts/, not committed).

MCP

Three read-only tools are offered: list_skills, get_skill, get_skill_phase. They serve public skill content only and never call a model.

{
  "mcpServers": {
    "aegis": { "command": "npx", "args": ["-y", "aegis-skills", "mcp"] }
  }
}

Hosted, with nothing to install (Streamable HTTP, no authentication): https://aegis-skills.vercel.app/api/mcp.

Themis

Give Themis a task such as "validate exposure to CVE-2026-12345 on our VPN gateways". It runs a fixed seven-step workflow: validate, decompose, schedule, fan out to Aegis skills, guardrail, synthesise and audit. Deterministic steps are plain code in themis-core; reasoning steps are done by a model.

	Themis on your AI	Themis standalone
Model	Your assistant (Claude Code, Codex, Gemini CLI)	Your Anthropic, OpenAI or Gemini key, or a local model (Ollama, LM Studio)
Interface	Your assistant's chat, through the `themis-mcp` MCP server	A local web dashboard on 127.0.0.1
Approvals	Your client's MCP elicitation prompt, otherwise handed back to you	The dashboard's Approvals page
Install	An MCP config (a marketplace listing is planned)	`npx @aegis-skills/themis dashboard`

Governance is enforced in code, not by the model:

External tools are classified read, write or execute. Every call, read included, becomes an approval request that only a human can approve; approved reads also run within a call budget.
Access is default-deny: a server is reachable only by the skills in its allowedSkills.
Secrets are redacted, tool output is size-capped and wrapped as untrusted, and every step, call and decision goes to a local audit log in ~/.themis.
In plugin mode, tools you connect directly to your assistant bypass Themis and are not governed. Read more: Themis docs and docs/themis.

Where things stand

	State	Next
Aegis skills, CLI, MCP	Built and tested on Linux, macOS and Windows (Node 24); 24 skills at version 1.5.0	Released: `[email protected]` is on npm. Next: marketplace and directory listings
Website and hosted MCP	Live at aegis-skills.vercel.app	Install commands are live
`themis-core`, `themis-gateway`	Built and tested; packaged and ready for npm	Released right after Aegis
Themis plugin and standalone app	Working from a checkout; no real-model run recorded in CI yet	Public beta: a model-backed end-to-end run, a clearer approval confirmation, diagnostics and issue templates
Marketplace listings	Aegis first, as a skills-only plugin	Themis follows once the beta settles

How this is maintained

CI on every change. Tests run on Ubuntu, macOS and Windows with Node 24, plus lint, dependency and layout guards, a production site build, and install smoke tests of each package. Releases are published by a tag-driven workflow with provenance, not from a laptop.
Skill content is refreshed monthly. Every flattened prompt is stamped with the date of its intel.
Dependencies are pinned and watched. GitHub Actions are pinned to full commit SHAs and kept current by Dependabot.
Defaults are conservative. Aegis never calls a model. Themis denies tool access by default, a human approves every external call, and prompts are redacted before they reach a model provider. Skills never make network or API calls themselves.

Found a bug or a skill that is out of date? Open an issue. For a vulnerability, use private reporting instead, as described in SECURITY.md.

Development

npm install
npm run dev                         # http://localhost:3000
npx jest                            # tests for every package
npm run build                       # production build
npm run check:deps                  # dependency guards
node scripts/check-layout.js        # layout guard
npm run lint:skills                 # skill format lint

The site lives in apps/web; npm run dev -w @aegis-skills/web starts it. Requires Node.js 24 or later.

Project structure

├── apps/web/            # the website: catalogue, docs hub, downloads, hosted MCP (no model calls)
├── packages/
│   ├── aegis/           # aegis-skills: 24 skills, installer CLI, MCP server
│   ├── themis-core/     # deterministic workflow, redaction, approvals, local store
│   ├── themis-gateway/  # governed MCP client for external tools
│   ├── themis-plugin/   # Themis on your AI (MCP server, orchestrator skill, agents)
│   └── themis-app/      # Themis standalone (CLI and local dashboard)
├── scripts/             # repo scripts: lint, guards, prompt builder
├── docs/{aegis,themis,web}/   # user documentation, published by the website
└── .claude-plugin/      # Claude Code marketplace manifest

License

Licensed under either of Apache License, Version 2.0 or MIT license at your option (SPDX: Apache-2.0 OR MIT). See LICENSE and, for reporting vulnerabilities, SECURITY.md.

Aegis Security Skills

io.github.drupadsachania

Read-only library of 24 defensive cybersecurity skills: ATT&CK, ATLAS, DFIR, CTEM and more.

Security

Add to Cursor Add in Claude Add to VS Code Run on PlugMCP

GitHub npm Website

Add to Cursor Add in Claude Add to VS Code Run on PlugMCP

1{2  "mcpServers": {3    "io.github.drupadsachania-aegis-skills": {4      "url": "https://aegis-skills.vercel.app/api/mcp",5      "headers": {}6    }7  }8}

.cursor/mcp.jsonMCP server

Transport: http
Status: Remote

Power your agent

Add this server

The publisher's own URL. Not a PlugMCP endpoint.

Add to Cursor Add in Claude Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Server URL

https://aegis-skills.vercel.app/api/mcp

The Claude button above opens Claude with the name and URL filled in. You still confirm it there.

shClaude Code

1claude mcp add --transport http io.github.drupadsachania-aegis-skills https://aegis-skills.vercel.app/api/mcp

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "io.github.drupadsachania-aegis-skills": {4      "command": "npx",5      "args": [6        "-y",7        "mcp-remote",8        "https://aegis-skills.vercel.app/api/mcp"9      ]10    }11  }12}

claude_desktop_config.json

Remote · HTTPPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Remote

Transport: http
Version: 1.5.0
Last checked: 2026-10-27

Stars: —
Tools: —
Uptime: —

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install Aegis Security Skills?

Copy the http config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Aegis Security Skills need an API key?

No required environment variable is listed on this record.

What transport does Aegis Security Skills use?

Aegis Security Skills is reached over HTTP.

When was Aegis Security Skills last checked?

Last checked 2026-10-27. Read-only library of 24 defensive cybersecurity skills: ATT&CK, ATLAS, DFIR, CTEM and more.

From the publisher

Documentation

	Aegis	Themis
What	24 security skills, an installer and a read-only MCP server	A security-operations agent that plans, fans out to Aegis skills, checks every output and writes a version-stamped report
Calls a model?	Never. It is markdown and JSON	Uses your assistant (plugin) or your own key or a local model (standalone)
Package	`aegis-skills`	`@aegis-skills/themis-plugin` and `@aegis-skills/themis`

Aegis

Skill library: 24 skills across 5 families

Family	Skills
Frameworks	`mitre-attack` · `mitre-atlas` · `mitre-engage`
Threat Intel	`attack-surface-mapping` · `exposure-validation` · `threat-hunting` · `threat-intel-synthesis` · `threat-modeling`
Response & Analysis	`digital-forensics` · `malware-analysis` · `reverse-engineering` · `security-operations`
Domain Defence	`application-security` · `data-loss-prevention` · `deception-engineering` · `endpoint-security` · `identity-access-management` · `infrastructure-security` · `network-security` · `operational-technology`
Governance & Risk	`compliance` · `governance` · `risk-management` · `security-documentation`

Each skill is a workflow of phases (methodology references) plus a live-threat-intel phase. Skill content is updated monthly. Browse them at aegis-skills.vercel.app.

Quick start

# Install the skills into your tool's native skills folder and register the MCP server
npx aegis-skills install --platform claude      # codex | gemini | cursor | vscode | antigravity | all
npx aegis-skills install --platform claude --project   # this project only

# Serve the whole library over MCP on stdio
npx aegis-skills mcp

Claude Code plugin: /plugin marketplace add drupadsachania/aegis-skills, then /plugin install aegis-skills@aegis-skills.

Needs Node.js 24 or later.

CLI commands

Command	What it does
`aegis install [--platform <id>] [--project]`	Copy the skills into each tool's native folder and register the MCP server (config files are backed up first). `init` is an alias
`aegis uninstall [--platform <id>] [--project]`	Remove only what Aegis installed; edited files are kept as `.bak`
`aegis update`	Re-sync every recorded install with the installed version
`aegis list [--json]`	Bundled skills and recorded installs
`aegis mcp`	Serve the skill library over MCP on stdio

Installed skills refresh automatically after an upgrade; set AEGIS_NO_AUTO_REFRESH=1 to turn that off.

Using a skill without installing

MCP

Three read-only tools are offered: list_skills, get_skill, get_skill_phase. They serve public skill content only and never call a model.

{
  "mcpServers": {
    "aegis": { "command": "npx", "args": ["-y", "aegis-skills", "mcp"] }
  }
}

Hosted, with nothing to install (Streamable HTTP, no authentication): https://aegis-skills.vercel.app/api/mcp.

Themis

	Themis on your AI	Themis standalone
Model	Your assistant (Claude Code, Codex, Gemini CLI)	Your Anthropic, OpenAI or Gemini key, or a local model (Ollama, LM Studio)
Interface	Your assistant's chat, through the `themis-mcp` MCP server	A local web dashboard on 127.0.0.1
Approvals	Your client's MCP elicitation prompt, otherwise handed back to you	The dashboard's Approvals page
Install	An MCP config (a marketplace listing is planned)	`npx @aegis-skills/themis dashboard`

Governance is enforced in code, not by the model:

External tools are classified read, write or execute. Every call, read included, becomes an approval request that only a human can approve; approved reads also run within a call budget.
Access is default-deny: a server is reachable only by the skills in its allowedSkills.
Secrets are redacted, tool output is size-capped and wrapped as untrusted, and every step, call and decision goes to a local audit log in ~/.themis.
In plugin mode, tools you connect directly to your assistant bypass Themis and are not governed. Read more: Themis docs and docs/themis.

Where things stand

	State	Next
Aegis skills, CLI, MCP	Built and tested on Linux, macOS and Windows (Node 24); 24 skills at version 1.5.0	Released: `[email protected]` is on npm. Next: marketplace and directory listings
Website and hosted MCP	Live at aegis-skills.vercel.app	Install commands are live
`themis-core`, `themis-gateway`	Built and tested; packaged and ready for npm	Released right after Aegis
Themis plugin and standalone app	Working from a checkout; no real-model run recorded in CI yet	Public beta: a model-backed end-to-end run, a clearer approval confirmation, diagnostics and issue templates
Marketplace listings	Aegis first, as a skills-only plugin	Themis follows once the beta settles

How this is maintained

CI on every change. Tests run on Ubuntu, macOS and Windows with Node 24, plus lint, dependency and layout guards, a production site build, and install smoke tests of each package. Releases are published by a tag-driven workflow with provenance, not from a laptop.
Skill content is refreshed monthly. Every flattened prompt is stamped with the date of its intel.
Dependencies are pinned and watched. GitHub Actions are pinned to full commit SHAs and kept current by Dependabot.
Defaults are conservative. Aegis never calls a model. Themis denies tool access by default, a human approves every external call, and prompts are redacted before they reach a model provider. Skills never make network or API calls themselves.

Found a bug or a skill that is out of date? Open an issue. For a vulnerability, use private reporting instead, as described in SECURITY.md.

Development

npm install
npm run dev                         # http://localhost:3000
npx jest                            # tests for every package
npm run build                       # production build
npm run check:deps                  # dependency guards
node scripts/check-layout.js        # layout guard
npm run lint:skills                 # skill format lint

The site lives in apps/web; npm run dev -w @aegis-skills/web starts it. Requires Node.js 24 or later.

Project structure

├── apps/web/            # the website: catalogue, docs hub, downloads, hosted MCP (no model calls)
├── packages/
│   ├── aegis/           # aegis-skills: 24 skills, installer CLI, MCP server
│   ├── themis-core/     # deterministic workflow, redaction, approvals, local store
│   ├── themis-gateway/  # governed MCP client for external tools
│   ├── themis-plugin/   # Themis on your AI (MCP server, orchestrator skill, agents)
│   └── themis-app/      # Themis standalone (CLI and local dashboard)
├── scripts/             # repo scripts: lint, guards, prompt builder
├── docs/{aegis,themis,web}/   # user documentation, published by the website
└── .claude-plugin/      # Claude Code marketplace manifest

License

Licensed under either of Apache License, Version 2.0 or MIT license at your option (SPDX: Apache-2.0 OR MIT). See LICENSE and, for reporting vulnerabilities, SECURITY.md.

Add this server

Host a copy with our keys and logs.

Server facts

Tools

Questions

How do I install Aegis Security Skills?

Does Aegis Security Skills need an API key?

What transport does Aegis Security Skills use?

When was Aegis Security Skills last checked?

Documentation

Aegis

Skill library: 24 skills across 5 families

Quick start

CLI commands

Using a skill without installing

MCP

Themis

Where things stand

How this is maintained

Links

Development

Project structure

License

Add this server

Host a copy with our keys and logs.

Server facts

Tools

Questions

How do I install Aegis Security Skills?

Does Aegis Security Skills need an API key?

What transport does Aegis Security Skills use?

When was Aegis Security Skills last checked?

Documentation

Aegis

Skill library: 24 skills across 5 families

Quick start

CLI commands

Using a skill without installing

MCP

Themis

Where things stand

How this is maintained

Links

Development

Project structure

License