Show HN: Aegis – A Layer-4 Postgres proxy in Go to block destructive AI SQL

🛡️ Aegis Security Proxy

Aegis sits between your application and your Postgres database and blocks destructive queries before they run, without you changing a line of your database code.

👋 Note: If you are cloning this to test the Wasm AST parser locally, please drop a ⭐ on the repo! It helps me know people are actually using the open-source tier.

How it fits together

        sequenceDiagram
    participant App as Your Application<br/>(psycopg2, or any client)
    participant Proxy as Aegis Proxy<br/>:5433 TCP intercept / :5434 admin+metrics
    participant DB as Your Database<br/>(e.g. Neon Postgres)

    App->>Proxy: SELECT ... (benign query)
    Proxy->>DB: forwarded over TLS
    DB-->>Proxy: rows
    Proxy-->>App: rows

    App->>Proxy: DROP TABLE ... (destructive query)
    Note over Proxy: parsed, blocked, connection terminated<br/>(the "Guillotine")
    Proxy-->>App: fatal error
    Note over DB: never reached
      

Your application never talks to the database directly — every query passes through the proxy first. A benign query is forwarded and the rows come straight back. A destructive one (DROP TABLE, an unfiltered DELETE, etc.) is intercepted and the connection is terminated before it reaches your database.

        Your Application                          Aegis Proxy                            Your Database
   (psycopg2, or any client)                                                          (e.g. Neon Postgres)

   +--------------------+   Postgres wire    +-----------------------------+   TLS    +--------------------+
   |                    | ------------------> |  :5433  TCP intercept       | -------> |                    |
   |  SELECT ...        |                     |    - parses every query     |          |   real database    |
   |  DROP TABLE ...    | <------------------ |    - enforces rate limits   | <------- |                    |
   |                    |   rows, or a        |    - blocks destructive     |          |                    |
   +--------------------+   fatal error       |      statements (the        |          +--------------------+
                            if blocked        |      "Guillotine")          |
                                              |  :5434  admin + metrics API |
                                              +-----------------------------+
      

Quickstart

Three steps, one command to start the stack, and a running proxy.

Step 1 — Get Aegis and your credentials

The primary way to install Aegis is to pull the published image straight from Docker Hub:

        docker pull raymondartin2/aegis-proxy
      

Expected output (tag/digest will vary by release):

        latest: Pulling from raymondartin2/aegis-proxy
Digest: sha256:...
Status: Downloaded newer image for raymondartin2/aegis-proxy:latest
docker.io/raymondartin2/aegis-proxy:latest
      

You still need this repo's docker-compose.yml and .env.sample to run the stack, so grab those too:

        git clone https://github.com/raymondhani/aegis-proxy.git
cd aegis-proxy
cp .env.sample .env
      

Building the image yourself instead of pulling it is also supported — see Dockerfile in this repo — but pulling the published image is the recommended, primary path.

Now open .env and replace the four placeholders with your own values:

None of these are optional: the proxy exits immediately at startup if AEGIS_JWT_SECRET is missing, and every step below assumes all four are set.

Step 2 — Start the stack

        docker compose up -d
      

Expected output (container name may vary slightly depending on your folder name):

        Container aegis-proxy            Started
      

This single command starts the container Aegis needs: the proxy itself, listening on 5433 (the database connection) and 5434 (an admin/metrics API). The OSS proxy runs on in-memory state and has no hard dependency on Redis — Redis is used only by the Enterprise tier for distributed/HA state.

Step 3 — Confirm it's running

        curl -s http://localhost:5434/metrics
      

Expected output:

        {"queries_processed":0,"queries_blocked":0,"active_connections":0,"sessions_jailed":0,"anomalies_detected":0}
      

If you see that, the proxy is up and ready to accept connections.

Try it: block a destructive query

Install the SDK and the Postgres driver, then run this against the stack you just started — nothing here needs modification beyond the credentials you already set in .env.

        pip install aegis-proxy-sdk psycopg2-binary
      

        import psycopg2
from aegis_sdk import safe_db_run

@safe_db_run()
def run_demo(db_url: str):
    conn = psycopg2.connect(db_url)
    conn.autocommit = True
    cursor = conn.cursor()

    print("Running an ordinary query...")
    cursor.execute("SELECT 1;")
    print(f"Result: {cursor.fetchone()}")

    print("Running a destructive query: DROP TABLE users;")
    cursor.execute("DROP TABLE users;")

if __name__ == "__main__":
    try:
        run_demo()
    except psycopg2.OperationalError as e:
        print(f"\n[Aegis] Connection severed by the proxy: {e}")
      

The @safe_db_run() decorator does the setup for you: it provisions a throwaway Neon database branch, mints a session token, and points db_url at the local proxy instead of the real database — then deletes the branch again when the function returns. Your function just receives a working db_url and uses it like any other Postgres connection string.

Expected output:

        Running an ordinary query...
Result: (1,)
Running a destructive query: DROP TABLE users;

[Aegis] Connection severed by the proxy: server closed the connection unexpectedly
	This probably means the server terminated abnormally
	before or while processing the request.
      

The SELECT 1 succeeds normally. The DROP TABLE never reaches the database — the proxy detects it, terminates the connection, and psycopg2 surfaces that as OperationalError. Catching that exception around the specific call you expect to be blocked is the intended pattern, not a workaround.

@safe_db_run also accepts a few optional keyword arguments for less common setups:

Drop-in Guardrails for LangChain & AI Agents

Because Aegis operates completely transparently at Layer-4 (the network layer), developers do not need to write custom application code, install framework-specific plugins, or change their AI logic. To secure an AI agent against hallucinations, simply spin up Aegis and change your standard database connection port from 5432 to 5433.

        # The Old, Dangerous Way (Direct to DB):
db = SQLDatabase.from_uri("postgresql://user:pass@localhost:5432/my_db")

# The Secure, Aegis Way (Routed through the Layer-4 Proxy):
db = SQLDatabase.from_uri("postgresql://user:pass@localhost:5433/my_db")
      

What each tier gives you

Aegis ships as three products built on the same core. Every capability below is enforced by the proxy itself, not just documented — the automated benchmark suite in this workspace asserts each one directly against a running instance of every tier.

Troubleshooting

🏗️ Multi-Agent Architecture

Aegis is designed to support a Multi-Agent Workflow where several autonomous AI agents can operate simultaneously without cross-contamination.

• Sandboxed Execution: Every agent interaction is securely sandboxed in a dedicated Copy-on-Write (CoW) ephemeral branch provisioned via the Neon API.

• Z-Score Anomaly Detection: Agents' queries are mathematically analyzed in real-time using native PostgreSQL AST parsing via wasilibs/go-pgquery.

• Cryptographic Agent Identity: Agents are identified using signed JWTs for secure, tamper-proof authentication.

• Advanced Threat Telemetry: Zero-latency monitoring is powered by OpenTelemetry.

🌉 Go/Python Bridging Mechanism

Aegis seamlessly bridges high-performance systems-level intercept logic with accessible data-science workflows.

• The Go Proxy Engine (Layer 4): Written in Go using Clean Architecture. It binds to local ports (5433 for TCP, 5434 for the HTTP admin/metrics API) and intercepts PostgreSQL wire-protocol traffic.

• The Python SDK (Application Layer): Using the @safe_db_run decorator, the SDK automatically provisions an ephemeral branch, configures the agent's connection string to point to the local Go proxy instead of directly to the database, and manages the lifecycle of the run.

🚀 CI/CD Deployment Pipeline

Aegis uses a hardened CI/CD pipeline for distribution:

• Continuous Integration: Every commit to main and every pull request triggers a suite of unit tests.

• Docker Publishing: The pipeline builds multi-architecture Docker images (ARM64 & AMD64) and pushes them to Docker Hub.

🧠 Advanced SDK Usage

While @safe_db_run provides a seamless, zero-friction wrapper, aegis_sdk also exposes its underlying classes for developers who need custom integrations or manual state management:

• NeonProvisioner: Programmatically create, monitor, and tear down Neon ephemeral branches outside of the standard decorator flow.

• AnomalyDetector: Interface directly with the Z-Score engine to evaluate query payloads or agent behaviors before they hit the execution pipeline.

🏢 Aegis Enterprise Edition

The open-source proxy is built for local development and single-node sandboxing. For production-scale teams, Aegis Enterprise is commercially backed by Languaza Software and adds, on top of everything above:

• eBPF Kernel Acceleration: Drops malicious packets at the Linux XDP layer for the lowest possible latency.

• Cryptographic Identity Validation: Verifies JWTs against cached JWKS to prevent API key sharing.

• Distributed State: Redis-backed rate limiting for High Availability (HA) clusters.

• SIEM Exporters: Batches and streams anomaly events directly to Datadog and Splunk.

• Local Management Console: A self-hosted control plane is available at port 3000.

Need production-grade guardrails for your AI agents? Contact our enterprise team at [email protected] to schedule a technical architecture review.

📚 Further Reading

• AGENTS.md: Machine-readable specifications and boundaries for AI coding assistants.