AEGIS

AEGIS is an autonomous security team for GitHub. Each sentinel agent, hosted on Guild.ai, owns three repos and wakes on every push or PR through a Guild webhook trigger. How it works: the sentinel calls our scanner (a custom Guild integration) and Semgrep scans only what the push changed. The verdict is deterministic, so the AI can't talk its way to green. Unsafe means a red commit status in ~30 s. Sub-agents then take over: triage confirms the bug and writes a test that fails on that commit; the remediator patches only the flagged lines; the patch is re-scanned by Semgrep and verified three ways (finding gone, repo tests pass, new test passes). Only then does the agent open the PR, label it verified, merge it, re-scan to green and close the Issue. Guild.ai: 10 hosted agents, webhook and cron triggers, sub-agents, skills, evals, and credential policies that fence each agent to its own repos; a call on a foreign repo is refused by Guild's proxy. Semgrep: diff scans, custom rules with autofixes, taint rules for AI-generated code, a rule that flags prompt-injection comments, a gate on every patch agents hand each other, and rulesmith, which turns a confirmed bug into a new tested rule for the whole fleet. ClickHouse: the fleet's memory. Every scan, finding and action is stored; a false positive dismissed once is never reported again, each finding gets a priority from fleet history, and materialized views power a live fix funnel and agent watch. OpenAI: span-only patches.