jaouad
/
aegis402
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Pay-per-call CVE intelligence MCP server, x402 native — autonomous experiment
4 Commits 1 Branch 0 Tags 118 KiB
Python 100%
Go to file
Kaouani Jaouad 6df6b80a68 Add autonomous monitor: 5-min systemd timer + on-chain USDC balance check 
deploy/monitor.py probes /health, /mcp/rpc initialize, /scan x402 challenge,
and reads USDC.balanceOf(wallet) on Base mainnet via public RPC. Appends one
JSON line per run to data/monitor.jsonl and persists state to detect:
- service_down / ingest_stale / mcp_transport_broken / x402_misconfig
- FIRST_PAYMENT_RECEIVED (when wallet balance crosses 0)
- balance_changed (delta vs previous run)

Installed as aegis402-monitor.{service,timer} on the VPS with hardened
systemd sandbox (NoNewPrivileges, ProtectSystem=strict, ReadWritePaths
limited to data/). Timer active, first run green: cves=500, mcp=ok,
x402 challenge returns 402 with payTo=0x3D1F...4ff6, balance=0 USDC.
 		2026-04-13 13:20:31 +02:00
data Add autonomous monitor: 5-min systemd timer + on-chain USDC balance check 2026-04-13 13:20:31 +02:00
decisions Initial public release — Aegis402 v0.1.0 2026-04-13 11:47:05 +02:00
deploy Add autonomous monitor: 5-min systemd timer + on-chain USDC balance check 2026-04-13 13:20:31 +02:00
plan Initial public release — Aegis402 v0.1.0 2026-04-13 11:47:05 +02:00
recherche Initial public release — Aegis402 v0.1.0 2026-04-13 11:47:05 +02:00
src Add MCP Streamable HTTP transport (JSON-RPC 2.0 at /mcp/rpc) 2026-04-13 13:18:31 +02:00
tests Initial public release — Aegis402 v0.1.0 2026-04-13 11:47:05 +02:00
.gitignore Phase 4 distribution audit: server-card.json + auth-wall findings 2026-04-13 11:57:32 +02:00
JAOUAD_TODO.md Phase 4 distribution audit: server-card.json + auth-wall findings 2026-04-13 11:57:32 +02:00
JOURNAL.md Add MCP Streamable HTTP transport (JSON-RPC 2.0 at /mcp/rpc) 2026-04-13 13:18:31 +02:00
README.md Initial public release — Aegis402 v0.1.0 2026-04-13 11:47:05 +02:00
STATE.md Phase 4 distribution audit: server-card.json + auth-wall findings 2026-04-13 11:57:32 +02:00
requirements.txt Initial public release — Aegis402 v0.1.0 2026-04-13 11:47:05 +02:00

README.md

IA Business Autonome — Aegis402

Projet exploratoire : monter un business 100% opérable par un agent IA seul, sans humain dans la boucle, avec 2000€ de capital initial.

Statut

Phase : Build local complet, productionisation gratuite finalisée, en attente d'engagement capital pour deploy Décision produit : Aegis402 — MCP server CVE intelligence, x402-natif Date : 2026-04-13

Quickstart local

./venv/bin/python -m src.ingest_ghsa     # mirror GHSA (1000 advisories)
./venv/bin/python -m src.ingest_kev      # mirror CISA KEV (1559 entries)
./venv/bin/uvicorn src.server:app --host 127.0.0.1 --port 8743
curl -X POST http://127.0.0.1:8743/scan \
  -H 'content-type: application/json' \
  -d '{"deps":[{"ecosystem":"pip","package":"rembg","version":"2.0.74"}]}'

Endpoints

  • GET / — liveness
  • GET /health — DB count, ingest freshness
  • POST /scan — scan up to 200 deps, returns CVE/KEV hits
  • GET /mcp — MCP manifest for marketplace discovery
  • GET /payment — current x402 paywall config

Files

  • src/server.py — FastAPI app
  • src/scan.py — version range matcher + scan_dependency
  • src/ingest_ghsa.py — GHSA mirror with cursor pagination
  • src/ingest_kev.py — CISA KEV mirror
  • src/wallet.py — encrypted Base wallet (AES-256-GCM)
  • src/x402_middleware.py — x402 paywall + facilitator client
  • src/mcp_manifest.py — MCP manifest builder
  • deploy/cloud-init.yaml — VPS bootstrap
  • deploy/aegis402-ingest.{service,timer} — systemd cron unit
  • deploy/marketplace_copy.md — pre-written listings + HN post

Documents

  • decisions/DECISION_001_produit.md — pourquoi ce produit, critères d'échec
  • plan/ARCHITECTURE.md — carte technique du système
  • plan/PLAN_90_JOURS.md — exécution jour par jour
  • recherche/01_findings_infra.md — état infra crypto/paiement 2026
  • recherche/02_findings_marche.md — état marché agent économie 2026

Logique en une phrase

Une IA seule en 2026 ne peut pas être un sujet légal, donc elle doit être un sujet économique sur le sous-web crypto-natif (x402 + MCP), en vendant à d'autres agents ce que les humains sont trop ennuyés ou trop chers pour faire eux-mêmes : du data feed structuré, frais, et contextualisé.

Pourquoi CVE intelligence en particulier

  1. Gap explicite documenté par x402.org/ecosystem
  2. Données 100% publiques sans anti-bot (NVD, KEV, GH Advisories)
  3. Marché en feu (45M$+ de pertes 2026 sur AI agent vulns)
  4. Distribution agent-native via marketplaces MCP existantes
  5. Coût marginal quasi-nul, marge >90%