Your agent's context is your attack surface. Act accordingly.

Secure context engineering for production AI agents.
Content security. Integrity verification. Trust hierarchy. Context that improves itself.

Website • Docs • Blog • Quickstart • Security Guide

Agents are getting compromised. Not theoretically — right now.

• EchoLeak (CVE-2025-32711, CVSS 9.3) — a single email triggered zero-click data exfiltration from Microsoft 365 Copilot¹
• CrewAI + GPT-4o — researchers achieved 65% exfiltration success rate against multi-agent systems (COLM 2025)²
• Drift chatbot cascade — one compromised chatbot integration cascaded into 700+ organizations via Salesforce, Google Workspace, Slack, S3, and Azure³
• OWASP Top 10 for Agentic Applications published December 2025 — memory and context manipulation is a top risk category⁴

Agent A's output is Agent B's instruction. Memory is the vector.

Every other memory layer trusts content by default. That is the vulnerability.

We audited the docs, repos, and changelogs of every major memory tool.⁵ These protections do not exist anywhere else:

Aegis is the only OSS context hub. Four artifacts, one secure surface, one API call to load them all:

Every artifact: HMAC integrity-signed. Content-scanned. Trust-gated. Audit-logged.

from aegis_memory import AegisClient
client = AegisClient(api_key="...")

bundle = client.load_context(
    agent_id="executor",
    query="paginate the orders API",
    token_budget=8000,
)
# → ranked memories + active prompt + matched skills + available subagents
# → integrity-verified across all four
# → token-budgeted to fit your model

Other context hubs (LangSmith, MindStudio) are closed-source. Other memory layers (mem0, Zep, Letta) stop at memory. Aegis does both, with security as the foundation.

Beyond storing memories, Aegis owns their lifecycle. mem0, Zep, and Letta ship variants of these primitives; what's distinct in Aegis is the audit-preserving and human-reviewable shape of each one — typed edges with explicit resolution states, consolidation that soft-deprecates rather than deletes.

Hybrid retrieval. Every query runs through dense (pgvector cosine) and sparse (PostgreSQL tsvector) channels, fused with Reciprocal Rank Fusion. Catches the exact-match cases (entity names, error codes, tool names, file paths) that pure embedding similarity blurs.

results = client.hybrid_query(query="ZX7-PAGE-94 cursor pagination", agent_id="executor")

Contradiction detection. When two memories make incompatible claims, Aegis surfaces the conflict as a contradicts edge — a typed link with confidence and rationale. Resolve via API.

client.scan_contradictions(namespace="default")
unresolved = client.list_contradictions()
client.resolve_edge(edge_id=..., resolution="kept_source")
metrics = client.contradiction_metrics()
# → {"unresolved_contradictions": 3, "total_contradictions_detected": 17}

Semantic consolidation. Real merge, not prefix matching. Embedding-similar memories above threshold get merged via heuristic or LLM, with full audit trail (losing memory stays queryable with is_deprecated=True and metadata.consolidated_into).

plan = client.consolidate_memories(dry_run=True)   # review first
client.consolidate_memories(dry_run=False)         # then apply

Aegis implements OWASP AI Agent Security recommendations natively. Six capabilities, none optional:

1. 4-stage content security pipeline — input validation, sensitive data scanning, prompt injection detection, optional LLM-based injection classification. Every memory write. Not optional.
2. HMAC-SHA256 integrity signing — tamper detection on store, verification on demand. You know if a memory was modified.
3. OWASP 4-tier trust hierarchy — untrusted, internal, privileged, system. Agents get compromised. Aegis limits the blast radius.
4. Cryptographic agent binding — API keys bound to agent identity. No more trusting a request body that says "I'm the admin agent."
5. ACE loop — generation, reflection, curation. Agents that learn from their own mistakes and promote what works.
6. Multi-agent coordination — scoped access control, cross-agent query, structured handoffs. Memory sharing with boundaries.

git clone https://github.com/quantifylabs/aegis-memory.git
cd aegis-memory

export OPENAI_API_KEY=sk-...
docker compose up -d

curl http://localhost:8000/health
# {"status": "healthy"}

pip install aegis-memory

from aegis_memory import AegisClient

client = AegisClient(api_key="dev-key", base_url="http://localhost:8000")

# Planner agent stores task breakdown
client.add(
    content="Task: Build login. Steps: 1) Form, 2) Validation, 3) API",
    agent_id="planner",
    scope="agent-shared",
    shared_with_agents=["executor"]
)

# Executor queries planner's memories
memories = client.query_cross_agent(
    query="current task",
    requesting_agent_id="executor",
    target_agent_ids=["planner"]
)
print(memories[0].content)

Full Quickstart Guide

Aegis Memory is the first context layer with a complete ACE loop — the Generation → Reflection → Curation cycle from Stanford/SambaNova's research, engineered for production.

Your agent made the same mistake 5 times? ACE loop remembers the fix forever. Stale memories polluting retrieval? Curation auto-cleans your playbook.

Generation          Execution          Reflection          Curation
    |                   |                   |                  |
 Query playbook  ->  Run task with   ->  Auto-vote on    ->  Promote effective
 for strategies      tracked memories    used memories       Flag ineffective
                                         Auto-reflect        Consolidate duplicates
                                         on failures

from aegis_memory import AegisClient

client = AegisClient(api_key="your-key")

# 1. GENERATION: Query agent-specific playbook
playbook = client.get_playbook_for_agent(
    "executor",
    query="API pagination task",
    task_type="api-integration",
)
memory_ids = [e.id for e in playbook.entries]

# 2. EXECUTION: Track which memories the agent uses
run = client.start_run(
    "task-42", "executor",
    task_type="api-integration",
    memory_ids_used=memory_ids,
)

# ... agent does its work ...

# 3. REFLECTION: Complete with outcome (auto-feedback!)
client.complete_run("task-42", success=True, evaluation={"score": 0.95})
# -> Auto-votes 'helpful' on every memory used
# -> On failure: auto-votes 'harmful' AND creates a reflection memory

# 4. CURATION: Periodically clean up
curation = client.curate(namespace="production")
# -> Promotes high-effectiveness entries
# -> Flags low-effectiveness for deprecation
# -> Identifies duplicate entries to consolidate

ACE Patterns Guide

Different tools solve different problems. This comparison stays focused on capabilities clearly documented in public repos and docs.⁵

Memory-depth primitives (hybrid retrieval, contradiction handling, consolidation) are now table stakes — mem0, Zep, Letta, and Aegis all ship variants in 2026.⁶ The differences are in how, not whether.

Pick Aegis Memory when most of these are true:

• You need content security — injection detection, integrity verification, sensitive data protection.
• You need multiple agents to share memory safely with explicit ACL/scopes.
• You need handoffs where one agent passes a reliable state bundle to another.
• You want ACE patterns (vote/reflection/playbook) to continuously improve memory quality.
• You want hybrid retrieval that catches exact-token cases (entity names, error codes, file paths) without giving up semantic similarity.
• You need contradiction tracking that's reviewable, not just auto-deleted — typed edges with explicit kept_source / kept_target / both_valid / both_invalid resolutions, plus a /metrics endpoint for measuring epistemic conflict over time.
• You need consolidation with an audit trail — losing memories stay queryable (is_deprecated=True, metadata.consolidated_into) rather than being deleted.
• You prefer a self-host posture with operational control over storage and deployment.
• You need temporal decay so stale memories don't pollute retrieval over time.

Benchmarked on 8 vCPU / 7.6 GB RAM (Intel 13th Gen), 1000 memories, Docker Compose (PostgreSQL 16 + pgvector), concurrency=10. Queries include OpenAI embedding latency. Reproduce with cd benchmarks && bash run_benchmark.sh.

Query tail latency (p95/p99) is dominated by the external OpenAI embedding call, not Aegis or PostgreSQL. Write and vote operations that skip embedding are consistently under 100ms at p50.

docker compose up -d

kubectl apply -f k8s/

Full Configuration

docs.aegismemory.com — Full documentation

• Quickstart — Get running in 5 minutes
• Security Guide — Content security, integrity, trust hierarchy
• ACE Patterns — Self-improving agent patterns
• Smart Memory — Zero-config memory extraction
• Integrations — CrewAI, LangChain guides
• CLI Reference — Command-line tools

We welcome contributions! See CONTRIBUTING.md for guidelines.

# Run tests
pytest tests/ -v

# Run linting
ruff check server/

Apache 2.0 — Use it however you want. See LICENSE.

• Documentation
• GitHub Discussions
• Issue Tracker
• Changelog

Built by engineers who read the OWASP reports and acted on them.