{"id":"210ae0ae-6d9d-4d6f-8e12-5295897402d2","slug":"aegisops-agentic-portfolio","kind":"mcp","name":"aegisops-agentic-portfolio","summary":"Live enterprise agent systems lab: LangGraph, MCP, OPA, AI SDK, real tools, and agentic-vs-rules execution.","owner":"ajaycyril","repoUrl":"https://github.com/ajaycyril/aegisops-agentic-portfolio","license":"MIT","licenseTier":"permissive","trust":"community","stars":0,"match":null,"fewStars":true,"format":"mcp","createdAt":"2026-07-14T14:07:28.000Z","addedAt":"2026-10-21T06:25:57.618Z","logoUrl":"https://avatars.githubusercontent.com/u/58912968?u=9ee6f6be9517a614ccb771701df5035c32c4b420&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["developer-tools","memory-knowledge"],"tags":["agentic-ai","langgraph","open-policy-agent","multi-agent-systems","nextjs","enterprise-ai"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-28T01:26:19.233Z","sample":false,"url":"https://conduits.dev/tools/aegisops-agentic-portfolio","language":"Python","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# AegisOps\n\n### See exactly when an enterprise workflow should be agentic, deterministic, or policy-driven\n\n[](https://aegisops-agentic-portfolio.vercel.app)\n[](https://github.com/ajaycyril/aegisops-agentic-portfolio/stargazers)\n[](https://github.com/ajaycyril)\n[](https://github.com/ajaycyril/aegisops-agentic-portfolio/actions)\n[](https://github.com/ajaycyril/aegisops-agentic-portfolio/security/code-scanning)\n[](./LICENSE)\n[](./docs/architecture/05-live-workbench-runtime.md)\n\n**AegisOps is a live enterprise agent systems lab.** It runs agentic and deterministic systems side by side against the same live evidence, then makes the control boundary visible.\n\nYou can inspect what the graph constrains, what the model chooses, which typed tools execute, what evidence returns, where policy intervenes, when approval is required, and why a fixed rule engine cannot perform the same adaptive work.\n\n[**Launch the workbench**](https://aegisops-agentic-portfolio.vercel.app) | [**Run locally**](#run-locally) | [**Read the architecture**](./docs/architecture/01-system-architecture.md) | [**Enterprise playbook**](./docs/ENTERPRISE_AGENTIC_PLAYBOOK.md)\n\n\n ![\"AegisOps](\"docs/assets/screenshots/live-workbench.jpg\")
\n\n\n## See the difference in five minutes\n\n1. Open the live workbench and press **Run both live**.\n2. Watch an agentic lane and a deterministic rules lane process the same official evidence.\n3. Inspect selected tools, observations, handoffs, policy decisions, grounding, latency, and cost.\n4. Switch to the architecture view to see which stack layers produced real runtime evidence.\n5. Change the input and observe where adaptation creates value and where fixed logic remains sufficient.\n\n> Building governed agent systems in public. Star the repository and follow [@ajaycyril](https://github.com/ajaycyril) for releases, architecture notes, and new workflows.\n\n## The Question This Project Answers\n\nEnterprises do not need an agent for every workflow. They need a defensible way to decide where\nagentic control adds value and where deterministic automation remains safer, cheaper, and clearer.\n\n| Control mode | Best fit | What is visible in AegisOps |\n| -------------------- | ------------------------------------------------------------------------- | -------------------------------------------------------------------------- |\n| Deterministic system | Stable facts, typed derivations, decision tables, known routes | Inputs, derived facts, matched outcomes, exception path, zero model cost |\n| Dynamic policy | Contextual allow, block, and approval decisions | OPA/Rego input, decision, controls, approval requirement |\n| AI workflow | Bounded generation or evaluation inside a fixed graph | Model, prompt boundary, structured output, tokens, eval result |\n| Agentic | Evidence changes the next action, tool choice, handoff, or stopping point | LangGraph state, model decision, MCP call, observation, adaptation, policy |\n\nThe product does not expose or fabricate private model chain-of-thought. It exposes the operational\ndecisions required to audit the system: available and selected tools, graph constraints, agent role,\nevidence, handoffs, finish reason, policy state, cost, latency, and trace identity.\n\nThe default **Decision story** is designed for a non-technical reader. Every stage shows the actual\ninput, who or what controls the step, the observable decision or fixed condition, and the resulting\noutput. A plain-language line explains why the step is adaptive in the agentic lane or preconfigured\nin the deterministic lane. The final model conclusion and matched rule outcome are compared in the\nsame surface; the full React Flow topology remains available as an architect lens.\n\nThe runtime is not artificially slowed. AegisOps buffers only events that the live runtime has\nalready emitted, then presents them on a readable clock with a received-versus-presented counter.\nOne animated stage per lane stays in focus while a compact progress rail allows manual review. The\ntrace inspector, raw payloads, stack map, tuning controls, and editable inputs remain available\nthrough progressive disclosure instead of competing with the primary explanation.\n\n\n\n## What Runs Today\n\nPress **Run both live** and two concurrent lanes execute against the same official public source:\n\n1. A LangGraph and AI SDK agentic lane selects typed MCP tools, observes validated evidence,\n adapts or reconciles, passes OPA policy, and completes a grounding evaluation.\n2. A `json-rules-engine` lane fetches predefined fields and can return only outcomes configured\n before the run.\n\nFour interactive workflows are deployed:\n\n| Workflow | Live evidence | Enterprise integration pattern | Why agentic |\n| -------------------------------- | ------------------ | ------------------------------------------------ | --------------------------------------------------------------------- |\n| Production Incident Investigator | GitHub Status API | Datadog, PagerDuty, deployment telemetry, GitHub | Parallel specialists reconcile independent operational evidence |\n| Engineering Issue Triage | GitHub REST API | GitHub Enterprise, Jira, CI/CD, code search | Investigation changes as issue and repository context arrive |\n| Supplier Entity Risk | GLEIF LEI API | ERP supplier master, sanctions, procurement | Entity ambiguity and incomplete evidence require explainable research |\n| Finance Evidence Analyst | SEC EDGAR Data API | ERP subledger, filings, policy, approvals | Filing periods and caveats must be grounded before judgment |\n\nThe repository also contains production contracts for customer support, security remediation,\ninvoice exceptions, compliance evidence, sales/RFP, BI analysis, and HR/IT access workflows.\n\n## Governed Policy Retrieval\n\nEvery workflow retrieves authoritative policy evidence through the typed\n`enterprise_policy_search` MCP tool. The public deployment uses a versioned MiniSearch corpus;\nmanaged deployments can switch to tenant-scoped Postgres full-text plus pgvector retrieval using\nthe included migration without changing the workflow contract. See\n[`docs/architecture/07-governed-policy-rag.md`](docs/architecture/07-governed-policy-rag.md).\n\n## Live Architecture\n\nThe architecture view is generated from the same streamed run events as the workflow graph. A\nlayer lights up only when its runtime evidence exists.\n\n\n\nOn mobile, decision stages become full-width vertical cards so inputs, controls, outputs, and the\nagentic value remain readable. The technical topology stays interactive and pannable rather than\nbeing reduced to a static illustration.\n\n![\"AegisOps](\"docs/assets/screenshots/mobile-workbench.jpg\")
\n\n```mermaid\nflowchart LR\n UI[\"Next.js workbench\"] --> Stream[\"AI SDK UIMessage stream\"]\n Stream --> Graph[\"LangGraph state graph\"]\n Stream --> Rules[\"json-rules-engine\"]\n Graph --> Agent[\"AI SDK ToolLoopAgent\"]\n Graph --> Policy[\"OPA / Rego WASM\"]\n Graph --> State[\"PostgresSaver or MemorySaver\"]\n Agent --> MCP[\"MCP TypeScript SDK\"]\n MCP --> Sources[\"Official live APIs\"]\n Sources --> Contracts[\"Zod evidence contracts\"]\n Contracts --> Trace[\"Trace and OTel telemetry\"]\n Policy --> Trace\n Rules --> Trace\n Trace --> UI\n```\n\n### Stack\n\n| Layer | Production choice |\n| ----------------------- | ---------------------------------------------------------------------------- |\n| Experience | Next.js 16, React 19, AI Elements, React Flow 12 |\n| Agent orchestration | LangGraph JS 1.4 with fan-out, fan-in, checkpoints, evaluators |\n| Model/tool loop | Vercel AI SDK 6 `ToolLoopAgent`; OpenAI-compatible provider adapters |\n| Tool boundary | MCP TypeScript SDK with Zod input and result contracts |\n| Deterministic decisions | `json-rules-engine` 7 |\n| Dynamic authorization | OPA/Rego compiled to WASM |\n| State and memory | Postgres/pgvector architecture; LangGraph `PostgresSaver` adapter |\n| Observability | Typed run events, trace IDs, model/tool telemetry, token and cost accounting |\n| Full API | FastAPI, Pydantic, SQLAlchemy, Alembic, approval and audit records |\n| Deployment | Vercel Services with a bounded public runtime and read-only registry API |\n\n## Multi-Agent Work That Is Justified\n\nThe incident workflow uses three model agents because the topology matches the operational problem:\n\n- A platform-health specialist reads component state.\n- An incident specialist reads unresolved incident evidence.\n- LangGraph runs both specialists in parallel and waits at a fan-in barrier.\n- A tool-less supervisor reconciles the handoffs without silently collecting new evidence.\n- OPA holds side effects, and a grounding evaluator requires both sources before completion.\n\nThis is not multiple agents for visual effect. Independent evidence collection reduces blind spots;\nthe supervisor exists because the reports may need conflict resolution and one accountable output.\n\n## Public Runtime Safety\n\nThe public deployment is narrower than the enterprise runtime by design:\n\n- Read-only, allowlisted MCP tools only.\n- Server-side model allowlist.\n- Mandatory approval semantics for side effects.\n- OPA/Rego policy outside the model.\n- Typed request, tool, evidence, event, and policy contracts.\n- Request-size, rate, concurrency, tool-count, token, spend, and duration bounds.\n- No browser credentials and no committed secrets.\n- Security headers and no-store streaming responses.\n- CodeQL, Dependabot, CI, policy tests, and contract tests.\n\nThe free public deployment uses `MemorySaver` and an in-process limiter when managed state is not\nconfigured. An enterprise deployment must activate Postgres checkpoints, shared Redis-compatible\nrate limiting, authenticated connectors, durable approval/audit records, and identity-aware policy\nbefore enabling writes.\n\nSee [SECURITY.md](./SECURITY.md) for disclosure and deployment boundaries.\n\n## Run Locally\n\nPrerequisites: Node.js 24 and pnpm 10.15.1.\n\n```bash\npnpm install --frozen-lockfile\ncp .env.example .env.local\npnpm --filter @aegisops/web dev\n```\n\nOpen `http://localhost:3000`. A provider credential is required for model-backed runs; health,\ndocumentation, contracts, rules, and most tests do not require one. Never expose a provider key as\na `NEXT_PUBLIC_*` variable.\n\nValidation:\n\n```bash\npnpm --filter @aegisops/web lint\npnpm --filter @aegisops/web typecheck\npnpm --filter @aegisops/web test\npnpm --filter @aegisops/web build\nnode scripts/check-docs-placeholders.mjs\n```\n\nFull setup details: [Local development](./docs/development/local-setup.md) and\n[production runbook](./docs/deployment/production-runbook.md).\n\n## Repository Map\n\n```text\napps/web/ live workbench and bounded public agent runtime\nservices/api/ stateful FastAPI enterprise runtime\nservices/api-vercel/ read-only public registry API\nconfigs/workflows/ enterprise workflow contracts\nconfigs/tools/ typed tool registry\nconfigs/connectors/ connector identity and scope contracts\npolicies/ OPA/Rego governance\nmcp/ MCP server and tool-boundary design\ndocs/ architecture, operations, use cases, and runbooks\n```\n\n## Documentation\n\n- [User guide](./docs/USER_GUIDE.md): run and inspect the live workbench.\n- [Enterprise agentic playbook](./docs/ENTERPRISE_AGENTIC_PLAYBOOK.md): determine when agentic\n control is justified and how to productionize it.\n- [System architecture](./docs/architecture/01-system-architecture.md): runtime and trust boundaries.\n- [Stack decisions](./docs/architecture/02-stack-decisions.md): library choices and tradeoffs.\n- [Workflow taxonomy](./docs/architecture/03-agentic-workflow-taxonomy.md): deterministic through\n multi-agent patterns.\n- [Live runtime](./docs/architecture/05-live-workbench-runtime.md): the deployed execution contract.\n- [Use-case portfolio](./docs/use-cases/README.md): ten enterprise workflow families.\n- [Project plan](./PROJECT_PLAN.md): durable implementation status and next work.\n- [Contributing](./CONTRIBUTING.md): engineering and validation requirements.\n\n## Project Status\n\nThe dual-lane live workbench, five public-source workflows, multi-agent incident and UAE villa-fire graphs, typed MCP\ntools, OPA policy, grounding checks, observable decision ledger, unit economics, and live stack map\nare production deployed. Managed shared state and authenticated enterprise write connectors remain\nexplicit deployment upgrades, not hidden claims.\n\n## Follow the Build\n\n- Star this repository to keep it easy to find.\n- Follow [@ajaycyril](https://github.com/ajaycyril) for new releases and related AI, physical-AI, and edge-video projects.\n- Open an issue for a reproducible bug, workflow proposal, or architecture question.\n- Read [CONTRIBUTING.md](./CONTRIBUTING.md) before submitting a pull request.\n\n## Author\n\nDesigned and built by [Ajay Cyril](https://github.com/ajaycyril) as an opinionated reference\nimplementation for transparent, governed enterprise agent systems: agentic where adaptation creates\nmeasurable value, deterministic where certainty is the better engineering choice.\n\n## License\n\n[MIT](./LICENSE) © 2026 Ajay Cyril"}