DEV Community

Pedro Dawybida França
Pedro Dawybida França

Posted on

I Built an Ultra-Fast (<0.1ms) Go Reverse Proxy to Guard Autonomous AI Agents

#ai #go #opensource #security

Autonomous AI Agents powered by frameworks like LangChain, CrewAI, AutoGen, and OpenAI SDK are revolutionizing automation through Tool-Calling.

However, giving an LLM unsupervised access to execute raw HTTP endpoints or database operations introduces severe security and privacy risks. An unguided AI agent could trigger destructive mutations (DELETE /transactions) or leak sensitive customer data (GET /customers) violating privacy laws (such as LGPD) and central bank cybersecurity resolutions (CMN 5.274 / BACEN 538/2025).

To solve this, I built and open-sourced Aegis Core 🛡️.

💡 What is Aegis Core?

Aegis Core is an open-source, ultra-low latency HTTP reverse proxy written in Go that sits between your AI Agents and your internal backend APIs.

It evaluates every incoming agent tool-call against $O(1)$ in-memory compliance policy rules, proactively blocking dangerous requests before they reach your backend, and recording immutable JSON audit logs.

flowchart LR
    A[🤖 AI Agent / LLM Tool-Call] -->|Bearer Token + HTTP Req| B[🛡️ Aegis Core Proxy]
    B -->|Check Policy O1| C{Compliance Valid?}
    C -->|YES - ALLOWED| D[🟢 Internal Backend API]
    C -->|NO - BLOCKED| E[🔴 403 Forbidden Response]
    B -->|Immutable JSON Log| F[📜 audit_bacen.log]
Enter fullscreen mode Exit fullscreen mode

⚡ Engineering & Architecture Highlights

1. Ultra-Low Overhead (~0.08ms per request)

Benchmarked using Go's native testing package (go test -bench), Aegis adds under 0.1ms latency overhead per request:

BenchmarkAegisProxy-10    14493    81553 ns/op    40859 B/op    95 allocs/op
Enter fullscreen mode Exit fullscreen mode

2. Thread-Safe Audit Logging

The audit logger uses a sync.Mutex lock to guarantee atomic JSON line writes under heavy concurrent HTTP request loads without log corruption or race conditions.

3. Graceful Shutdown & Health Endpoints

The server handles OS interrupt signals (SIGINT, SIGTERM) cleanly via signal.Notify and context.WithTimeout, closing active connections and flushing log files safely.

4. Embedded Visual Web Console

It serves an embedded glassmorphism Web Console at http://localhost:8080/_aegis/dashboard for live inspection, policy card viewing, and interactive tool-call simulations out of the box.

🚀 Quickstart: Running the 5-Second Interactive Demo

You can test Aegis blocking non-compliant requests in seconds:

git clone https://github.com/pedrodawybida/aegis-core.git
cd aegis-core
make demo
Enter fullscreen mode Exit fullscreen mode

The demo script:

  1. Spawns a mock backend banking API on port 9000.
  2. Builds and starts Aegis Core on port 8080.
  3. Tests 4 compliance scenarios (Allowed POST, Blocked LGPD GET, Blocked BACEN DELETE, Blocked CFM GET).
  4. Displays the generated immutable JSON audit log in real time.

🛠️ Zero-Code Integration Example

Developers don't need to rewrite their agent logic. Simply update your OpenAI SDK or HTTP client's base_url to point to Aegis:

import openai

client = openai.OpenAI(
    base_url="http://aegis-proxy.internal:8080",  # Point to Aegis Proxy
    default_headers={"Authorization": "Bearer ia-fintech-support"}
)
Enter fullscreen mode Exit fullscreen mode

🔗 Try it out & Contribute!

Aegis Core is 100% Open-Source under the MIT License.

⭐ GitHub Repository: github.com/pedrodawybida/aegis-core

I'd love to hear your feedback on Go concurrency, performance benchmarks, and security rules! Feel free to star the repo or open an issue! 🚀

Top comments (2)

Collapse
 
alexshev profile image
Alex Shev •

A fast proxy is a nice place to put agent guardrails because it sits outside the model's explanation layer. The model can say a request is safe, but the proxy can still enforce what is actually allowed.

The useful next step is policy observability: which calls were blocked, which were allowed, and which rules would have fired in dry-run mode. Guardrails are much easier to trust when they leave receipts.

Collapse
 
pedrodawybida profile image
Pedro Dawybida França •

Spot on, Alex! Trusting the model to police itself is exactly what I wanted to avoid. I absolutely love the dry-run idea. Letting people see the 'receipts' and what would have been blocked is the perfect way to build trust before turning on active blocking. I'm definitely adding this to the roadmap! If you have any specific thoughts on how that observability should look, feel free to drop an issue on the repo! Would love to bounce some ideas around if you're up for it.