AEGIS is a challenge project that uses a graph, bounded investigation tools, retrieval-augmented context, and human approval gates to investigate fraud alerts. Its design treats a risk signal as a reason to gather and assess evidence—not as a verdict—and keeps recommendations separate from authorization and execution. Kanwal Vyas describes the system in “Building AEGIS: An Agentic Fraud Investigation System with TigerGraph, MCP, and GraphRAG,” published on DEV Community on September 25, 2026. That project account explains the intended workflow and reports its own benchmark results; it is not independent validation of production reliability.
What AEGIS is designed to do
AEGIS stands for Agentic Evidence & Graph Intelligence System. Vyas describes it as a fraud-investigation platform built for the TigerGraph HHGOA challenge. Rather than stopping at a transaction score, it aims to help investigators answer four practical questions: what entities are connected to the transaction, what evidence supports or contradicts suspicion, what remains uncertain, and what action policy permits.
As an Amazon Associate I earn from qualifying purchases.
The design is an investigation workflow, not a claim that an autonomous agent can reliably determine fraud or take consequential action without oversight. The author describes an eight-step orchestrator; the broader case lifecycle runs from a fraud signal or customer report through triage, evidence gathering, assessment, policy evaluation, recommendation, human authorization, and case writeback.
Free tools Windows power users keep installed
One-click scans. No signup required.
How the investigation moves from alert to case record
- Start with a trigger. A risk-score alert or customer report enters alert triage.
- Investigate the transaction. The orchestrator invokes bounded tools to retrieve transaction details and examine relevant activity and relationships.
- Expand the evidence. Findings guide which tool or entity to examine next; a shared device, for example, can lead to a search for connected cards and historical cases.
- Add context. GraphRAG brings current graph evidence together with closed investigations, policy context, and regulatory references.
- Assess the case. The system considers fraud evidence, uncertainty, and whether the evidence is sufficient for the next decision as distinct questions.
- Apply policy. A policy evaluation constrains what action can be recommended and whether approval is required.
- Recommend, then seek authorization. The system can recommend a next-best action, while an authorized human reviews actions that require approval.
- Preserve the investigation. Findings and case status can be written back to graph-backed case memory for future investigations.
What the graph and MCP tools contribute
TigerGraph represents connected entities
The project describes a graph containing customers, cards, device profiles, email domains, billing regions, transactions, closed investigations, and investigation cases. An investigator can traverse from a transaction to its customer and card, then explore devices, related cards, or prior cases. This makes relationships available as investigative leads that a transaction-level score alone would not show.
#1 Best Overall
AEGIS also uses TigerGraph Weakly Connected Components as a structural signal. Membership in a component can help identify connected records, but it is not, by itself, a fraud verdict. A relationship may justify further investigation without proving that every account or card in the connected group is fraudulent.
MCP exposes bounded investigation operations
The article names six MCP tools, each providing a defined operation for the orchestrator:
Rank #2
get_transactionretrieves transaction details.detect_velocitychecks for activity patterns involving transaction velocity.find_shared_devicesidentifies device links.find_connected_cardsexplores connected cards.get_card_historyretrieves card history.get_historical_casesretrieves relevant prior investigations.
The reported design selects further steps based on collected evidence rather than treating every case as a fixed sequence of identical lookups.
GraphRAG supplies context, not an automatic ruling
GraphRAG combines current graph evidence with historical closed investigations, policy context, and regulatory references. Prior cases can inform an investigation, but the article presents precedent as context and evidence—not as an automatic conclusion that a new case must have the same outcome.
Rank #3
- Used Book in Good Condition
Why evidence, uncertainty, and sufficiency are separate
AEGIS distinguishes three judgments that can easily be conflated:
- Evidence strength: How strongly do the available facts support a fraud hypothesis?
- Uncertainty: What ambiguity, conflict, or missing information remains?
- Evidence sufficiency: Is there enough information to justify the next decision?
For example, a shared device may be suspicious, but it does not establish that every account using that device is fraudulent. The project says it records uncertainty and evidence gaps explicitly, allowing a recommendation to reflect incomplete or conflicting information instead of presenting suspicion as certainty.
How recommendations, approval, and execution are separated
The project separates an action recommendation from its authorization and execution. A BLOCK_CARD recommendation, for example, can require L1 approval while its execution status remains PENDING_APPROVAL. That separation is an important control boundary: a recommendation does not silently become a destructive action.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →For suspicious-activity-report work, the described system can prepare an auditable package containing investigation information and entity lineage for review. Vyas states that AEGIS does not autonomously file a SAR with regulators.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the two example cases show
HHG-010: a risk-score alert with unresolved uncertainty
In the author’s example, a $1,000.03 risk-score alert led to transaction retrieval, velocity checks, shared-device analysis, connected-card analysis, and historical-case retrieval. Vyas says the investigation found significant evidence but also high uncertainty. AEGIS recommended VERIFY_WITH_CUSTOMER, required L1 approval, and left execution pending approval. It also generated a SAR-preparation recommendation and wrote the case to memory.
HHG-003: a customer report and a gated card-block recommendation
A customer-report trigger in this example led to a BLOCK_CARD recommendation. The action still required L1 approval and remained pending approval; the example therefore illustrates the boundary between suggesting an action and executing it.
What the reported benchmark does—and does not—establish
Vyas reports the following results for the project. These are the author’s benchmark and test results, not independently verified industry findings:
Recommended Free Tools
| Reported measure | Project-reported result |
|---|---|
| Benchmark cases processed | 20/20, reported by Kanwal Vyas in the 2026 project article |
| Investigation cases persisted | 20/20, reported by Kanwal Vyas in the 2026 project article |
| Budget compliance | 100%, reported by Kanwal Vyas in the 2026 project article |
| Automated tests passed | 111, reported by Kanwal Vyas in the 2026 project article |
| Duplicate tool calls | 0, reported by Kanwal Vyas in the 2026 project article |
| Missing-entity contamination | 0, reported by Kanwal Vyas in the 2026 project article |
| Policy mismatches | 0, reported by Kanwal Vyas in the 2026 project article |
| Unreferenced destructive recommendations | 0, reported by Kanwal Vyas in the 2026 project article |
| Denied destructive actions | 0, reported by Kanwal Vyas in the 2026 project article |
| Lifecycle inconsistencies | 0, reported by Kanwal Vyas in the 2026 project article |
The article says the benchmark includes pre- and post-additional-evidence fields for cases where more evidence is needed. It does not provide independent evaluation details sufficient to treat these figures as externally audited, to generalize them to other fraud systems, or to establish real-world effectiveness.
What to take from the design
AEGIS’s central design idea is to keep investigation, evidence, policy, and action control connected without collapsing them into one automated verdict. The graph broadens the set of relationships an investigator can examine; MCP tools provide bounded operations; GraphRAG adds historical and policy context; and the case record preserves findings and outcomes. The project account supports understanding those design choices, but it does not establish comparative performance against other systems or prove that the workflow is dependable in production.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
