AEGIS Academic Integrity Checker

_{Real CLI output on a synthetic sample paper (docs/demo/sample_paper.txt). Both DOIs in it are invented, and AEGIS flags them.}

Open-source, offline, bias-aware academic integrity analysis. Documents are processed entirely on your own hardware and never uploaded anywhere. Citation checks may query Crossref/OpenAlex with reference metadata (titles, authors, DOIs) when online verification is enabled. Analyzes plagiarism, AI-generated content, citation hallucinations, ghostwriting, predatory references, and essay mill patterns in a single pipeline -- plus an experimental token-distribution heuristic for LLM watermark research. Plagiarism detection is corpus-based, not a live web/database crawl: AEGIS compares your document against a corpus of papers you supply (your own prior works, a downloaded reference set, etc. -- see Building a Corpus Index). With no corpus loaded, plagiarism modules correctly report "no prior works loaded" rather than silently finding nothing to flag -- that isn't a scan failure. Results are a supporting signal for human review, not a determination of misconduct.

Get Started

Pick the way you want to use AEGIS. All three run on your own computer.

1. In your browser (easiest). Install once, then open the web app:

pip install "aegis-integrity[ml]"
aegis ui

Drag in a PDF, Word, LaTeX or text file, choose Full check, Private / offline, References only or Style & formatting, and get a plain-language report: an overall rating, what to look at, every reference with its verification result, and a downloadable full report. A Compare two papers tab and a My comparison library tab cover self-plagiarism and building the corpus. On Windows, install.bat sets everything up and start-aegis.bat opens the web app with a double-click.

2. Inside Claude Code. Install the package with the mcp extra, then add the plugin:

pip install "aegis-integrity[mcp,ml]"

/plugin marketplace add sunilgentyala/aegis-integrity
/plugin install aegis-integrity@aegis-integrity

Then ask in plain words ("check references in ~/drafts/paper.pdf", "is this ready for an Elsevier journal?"), or use the /integrity-check and /submission-check skills.

3. In Claude Desktop. Install the package as in option 2, download aegis-integrity-<version>.mcpb from the Releases page and open it. In the extension settings, choose the Python where AEGIS is installed. Any other MCP client can run the aegis-mcp command directly.

Not sure what works on your machine? Run aegis doctor. It lists every capability, whether it's ready, and the one command that fixes it. aegis doctor --warm-up downloads the AI models ahead of time so your first full check doesn't wait on them.

MCP Tools

aegis-mcp exposes seven tools to Claude Code, Claude Desktop and any MCP client.

Security

AEGIS is local-first and the MCP server runs over stdio. Documents never leave your machine; only reference metadata goes to Crossref/OpenAlex.

• MCP tools read only .pdf, .docx, .tex and .txt files up to 50 MB (AEGIS_MAX_FILE_MB).
• Set AEGIS_ALLOWED_ROOTS to confine every tool to specific folders (recommended when an agent drives AEGIS).
• Tool output is stripped of control characters and truncated; tools carry read-only / non-destructive MCP hints.
• DOIs from documents are percent-encoded and fetched without redirects. The MCP server never loads ./.env.
• CI runs tests, bandit, a blocking pip-audit, and CodeQL; Dependabot is on.

Report vulnerabilities privately: see SECURITY.md.

Support the project

If AEGIS helped you, a star on GitHub helps other researchers find it. Bug reports, sample papers that break it and pull requests are worth more: see the open issues labelled good first issue.

How AEGIS Compares

Every major integrity tool has blind spots. AEGIS v3.3 aims to close fourteen of them simultaneously.

Based on each vendor's public documentation and pricing pages as of August 2026. "Not public" means the capability isn't documented publicly by that vendor -- not a confirmed absence. Corrections welcome.

Fourteen Detection Modules

1. Citation Hallucination Detection

Resolves every DOI via the Crossref REST API and cross-checks author, year, and title. A peer-reviewed study found ChatGPT fabricated up to 55% of references depending on model version (Walters & Wilder, Scientific Reports, 2023).

Verdicts: VALID | MISMATCH | HALLUCINATED | UNRESOLVABLE | NO_DOI

2. LLM Watermark Analysis -- Experimental (v2.1)

AEGIS ships two distinct capabilities here, and they should not be confused:

• Experimental token-distribution anomaly heuristic (default, WatermarkMode.EXPERIMENTAL): a keyless statistic loosely modeled on the shape of the Kirchenbauer (2023) green-list z-test and Zhao et al. (2023) entropy/rank-skew analysis. It does not have access to any real LLM provider's watermark key, seeding scheme, or tokenizer -- the "green list" it tests against is fabricated locally as a statistical null, not recovered from any actual deployment. It can report STATISTICAL_ANOMALY or NO_STATISTICAL_ANOMALY, never a definitive watermark claim, and it never affects the overall integrity risk score.
• Known-scheme verification (WatermarkMode.VERIFIED_SCHEME, opt-in): for when the real scheme, tokenizer, and key are actually known and supplied. AEGIS does not currently implement a real scheme's verifier, so this mode reports UNSUPPORTED_CONFIGURATION rather than silently falling back to the heuristic above.

See Watermark Detection: Capabilities and Limitations below before relying on any watermark output.

3. Citation Network Analysis (v2.0 -- novel)

Analyzes the full reference list for structural anomalies that single-citation DOI checking misses:

• Self-citation inflation -- flags when >30% of references share an author with the submission
• Predatory journal detection -- heuristic pattern matching against known predatory name patterns
• Citation clustering -- detects when all references cluster in a single year (LLM fabrication signature)
• OpenAlex integration -- free API lookup for journal quality tier and citation impact
• Missing DOI rate -- very high DOI-absence is consistent with AI-hallucinated bibliographies

4. ESL-Calibrated AI Content Detection

Targets the bias documented by Liang et al. (Stanford, 2023): GPT detectors misclassified more than half of non-native-authored TOEFL essays as AI-generated, one detector flagging up to 98%, while native-English essays were scored accurately. Defines per-language threshold multipliers for 15 languages, but this part is experimental: the language is detected from the text, which is "en" for nearly all English submissions, so the non-English multipliers rarely fire (see the v3.1.1 changelog note). Do not treat AEGIS as having solved ESL false positives; keep a human in the loop. Paragraph-level scoring pinpoints injected AI sections rather than giving one document-level verdict.

Signals: GPT-2 perplexity, burstiness, cross-perplexity ratio, stylometric ensemble, GPT-4/GPT-5-era lexical-tell density (v2.5 -- transition/elevation vocabulary disproportionately common in ChatGPT/GPT-4/GPT-5-family output, which GPT-2 perplexity alone under-detects against fluent frontier-model text).

5. Semantic Coherence Analysis (v2.0 -- novel)

Detects AI-polished text that passes perplexity filters because it was post-processed by a humanizer. Targets the "too smooth to be human" signature:

• Discourse connector density (AI overuses "Furthermore", "Moreover", "Additionally")
• Sentence length uniformity (AI produces unnaturally low variance)
• Epistemic hedging rate (AI hedges at a formulaic, characteristic frequency)
• Section template matching (standard AI paper structure: Introduction -> Methods -> ...)

6. Semantic / Paraphrase Plagiarism

SBERT dense retrieval + CrossEncoder reranking catches concept-level paraphrase where no exact words are shared. Traditional BM25/TF-IDF-only tools miss this entirely.

Model: paraphrase-MiniLM-L6-v2 (80 MB, CPU-friendly). Index: FAISS IndexFlatIP. Requires a corpus you load first (--corpus) -- there is no built-in web/database crawl to compare against.

7. N-Gram Plagiarism (MinHash LSH)

Dual index: word 3-gram (verbatim copy) and character 5-gram (obfuscation via typos or character substitution). 128 MinHash permutations; sub-linear query time over large corpora via LSH banding. Also requires a loaded corpus -- same scope note as above.

8. Stylometric Authorship Profiling (Burrows' Delta)

60-dimensional feature vector per segment (10 scalar + 50 function-word dimensions). Segments with Burrows' Delta > 0.40 from the document baseline are flagged as potential ghostwritten sections. Catches professional essay mills that mix human and AI writing.

9. Self-Plagiarism / Text Recycling

Three-layer detection: character 5-gram Jaccard (verbatim), word 3-gram Jaccard (near-verbatim), SBERT cosine >= 0.88 (cross-language paraphrase recycling). Risk levels follow COPE text recycling guidelines (15% / 30% thresholds).

10. Batch / Classroom Analysis (v2.0 -- novel)

Detects essay mill operations and shared AI source documents by analyzing a set of submissions simultaneously:

• Pairwise similarity matrix across all submissions (MinHash + rare vocabulary overlap)
• Structural fingerprinting (identical section sequences with different surface text)
• AI score clustering (statistically unlikely for a class to all independently write AI-like prose)
• Union-Find clustering to group submissions by suspected common source

11. Target-Publisher Verification (v2.4 -- novel)

Scopes citation and duplicate-submission checking to six publishers authors most commonly ask about: IEEE, ACM, Elsevier, IET, IETE, BCS. No outside tool (this one included) can query those publishers' actual full-text plagiarism databases -- Crossref's Similarity Check corpus that backs Turnitin/iThenticate is restricted to paying member organizations, and Scopus/IEEE Xplore's public APIs are metadata- or abstract-only even with a key. What this module does instead, entirely via free Crossref metadata:

• Venue-claim verification -- flags a reference that reads as "IEEE Trans. ..." or "Proc. ACM ..." whose DOI actually resolves to a different publisher (venue misattribution or fabrication), reusing citations already resolved by module 1 -- no extra network calls.
• Duplicate-submission search -- searches each target publisher (via Crossref member id for IEEE/ACM/Elsevier/IET; via DOI-prefix + container-title matching for IETE and BCS, which publish through Informa/Taylor & Francis and Oxford University Press respectively rather than holding their own Crossref membership) for near-identical titles already indexed under that venue.

Configurable via --target-publishers IEEE,ACM,... (CLI) or PipelineConfig.venue_target_publishers (Python API); defaults to all six.

12. Mathematical Formula Checking (v3.0 -- novel)

Checks the structural integrity of numbered equations: consecutive numbering (catches duplicates, gaps, and out-of-order numbers), dangling in-text references to equation numbers that don't exist (a common leftover from renumbering during revision), orphaned equations that are numbered but never referenced, and a set of notation conventions sourced from actual publisher style manuals -- exponential notation (5E03 vs. 5×10³), decimal leading zeros, percentage-range formatting, and doubly-parenthesised references. Equations are extracted from LaTeX source (\begin{equation}/align/eqnarray/...), from Word's native OMML math XML (python-docx doesn't expose this at all -- Paragraph.text silently skips every equation in a .docx), or via text-pattern heuristics for PDF/TXT. Pure Python, no ML dependency. This is a compliance/quality signal, not a misconduct signal -- it never affects overall_risk.

13. Grammar & Language Convention Checking (v3.0 -- novel)

An offline, dependency-light grammar/usage checker: contraction detection ("don't" in formal text), US/UK spelling-consistency detection across 30+ word pairs, subject/verb agreement heuristics ("the data is" vs. "the data are"), common usage errors ("comprised of", "could of", "less samples" vs. "fewer samples", decade/acronym apostrophe misuse), and readability metrics. Runs fully in-process on regex + optional spaCy POS tagging (already an AEGIS dependency) -- no Java runtime, no external grammar service, no new hard dependency. Also a compliance/quality signal, never part of overall_risk.

14. Per-Venue Publisher Guideline Compliance (v3.0 -- novel; Elsevier added v3.1)

Runs the math and grammar findings above against six publishing bodies' own sourced style guidance, checked SEPARATELY rather than one generic merged rule set -- so a document that's fine by ACM's conventions but violates an IEEE-specific one (or vice versa) is visible per venue instead of averaged away:

Results are PASS / NEEDS_REVIEW / NOT_ENOUGH_DATA -- advisory, never FAIL. These are style conventions, not academic-integrity findings; AEGIS does not claim to be a venue's editorial desk. Run via aegis guidelines paper.pdf --venues IEEE,ACM,BCS,IET,ISACA,ELSEVIER (fast, no ML models at all) or opt in from aegis analyze ... --guidelines all.

Architecture

submission (PDF / DOCX / TEX / TXT)
       |
       v
  DocumentParser              -- PyMuPDF / python-docx / TexSoup / striprtf
       |
  ┌────┴──────────────────────────────────────────────────────────────┐
  │  AEGISPipeline v3.0                                               │
  │                                                                   │
  │  NGramDetector             word 3-gram + char 5-gram MinHash LSH  │
  │  SemanticDetector          SBERT + FAISS + CrossEncoder reranker  │
  │  AIContentDetector[v2.5]   GPT-2 perplexity+burstiness+ESL+tell   │
  │  CitationIntegrityDetector Crossref REST API (DOI resolution)     │
  │  StylometricAnalyzer       Burrows' Delta; 60-dim feature vector  │
  │  SelfPlagiarismDetector    SBERT + n-gram vs. prior works         │
  │  LLMWatermarkDetector [v2.1] experimental, no real key            │
  │  CitationNetworkAnalyzer[v2] self-cite inflation; OpenAlex        │
  │  SemanticCoherenceAnalyzer[v2] discourse connectors; uniformity   │
  │  BatchAnalyzer         [v2] classroom-level essay mill detection  │
  │  TargetPublisherVerifier[v2.4] IEEE/ACM/Elsevier/IET/IETE/BCS     │
  │  MathFormulaChecker    [v3.0] equation numbering/refs/notation    │
  │  GrammarLanguageChecker[v3.0] contractions/spelling/agreement     │
  │  GuidelineComplianceChecker[v3.0] IEEE/ACM/BCS/IET/ISACA/Elsevier │
  └────────────────────────────┬──────────────────────────────────────┘
                               |
                          AnalysisReport
                               |
                          HTML report
                        (self-contained,
                         offline-viewable)

Installation

Minimal (no ML models -- citation, stylometric, watermark, coherence, math, grammar, and per-venue guideline compliance; all pure-Python):

pip install -e .

Full (all 14 detectors):

pip install -e ".[ml,nlp,bib]"
python -m spacy download en_core_web_sm

Docker (recommended for production / air-gapped environments):

docker compose up --build
# Web app at http://localhost:8000/ ; API at the same address (bound to localhost only by default)
# Swagger UI at http://localhost:8000/docs

The container runs as a non-root user and its healthcheck needs no extra tools. By default the compose file only publishes the API on the host's loopback interface. Before exposing it beyond localhost (a different host binding, a reverse proxy, etc.), set AEGIS_API_KEY -- otherwise every route except /health is unauthenticated.

Windows one-click:

install.bat

Quick Start

Command-line

# Full analysis (all 14 detectors):
aegis analyze paper.pdf --html report.html

# Fast, offline-only scan: math + grammar + per-venue guideline compliance,
# checked SEPARATELY for each requested venue -- no ML models at all:
aegis guidelines paper.pdf --venues IEEE,ACM,BCS,IET,ISACA,ELSEVIER --html guidelines.html

# Fold guideline compliance into the full analysis instead:
aegis analyze paper.pdf --guidelines all --html report.html

# Disable the experimental watermark heuristic entirely:
aegis analyze paper.pdf --watermark-mode disabled

# Against a reference corpus:
aegis analyze paper.pdf --corpus ./prior_papers/ --html report.html

# Self-plagiarism check against own prior publications:
aegis analyze paper.pdf --prior-works ./my_previous_papers/ --html report.html

# Pairwise comparison (conference vs. journal version):
aegis compare conference_draft.pdf journal_submission.pdf

# Batch / classroom analysis (essay mill detection):
aegis batch ./submissions/ --html batch_report.html

# Build a persistent index for a large corpus:
aegis index build ./corpus_dir/ --index-dir ./aegis_index/
aegis analyze paper.pdf --index-dir ./aegis_index/ --html report.html

# Start the REST API server:
aegis serve --host 0.0.0.0 --port 8000

Python API

from aegis.core.pipeline import AEGISPipeline, PipelineConfig

from aegis.detectors.watermark_detector import WatermarkMode

cfg = PipelineConfig(
    citation_email="you@university.edu",
    run_watermark_detector=True,       # v2.0
    watermark_mode=WatermarkMode.EXPERIMENTAL,  # default; never affects overall_risk
    run_citation_network=True,         # v2.0
    run_coherence_analyzer=True,       # v2.0
)
pipeline = AEGISPipeline(config=cfg)

# Load a reference corpus (optional)
pipeline.load_corpus([("Smith2023", open("smith2023.txt").read())])

# Load your own prior publications (optional)
pipeline.load_prior_works([("My2022Conf", open("my2022.txt").read())])

report = pipeline.analyze("submission.pdf")
print(report.overall_risk)           # LOW | MEDIUM | HIGH | CRITICAL

# v2.0 new fields
print(report.watermark_result)       # WatermarkResult
print(report.citation_network_result)# CitationNetworkResult
print(report.coherence_result)       # CoherenceResult

# v3.0 new fields -- compliance/quality signals, never part of overall_risk
print(report.math_result)            # MathAnalysisResult
print(report.grammar_result)         # GrammarAnalysisResult
print(report.guideline_results)      # {"IEEE": GuidelineComplianceResult, ...}
                                      # (empty unless PipelineConfig.guideline_venues is set)

from aegis.report.generator import ReportGenerator
gen = ReportGenerator("./reports")
gen.generate_html(report)

# Batch classroom analysis (v2.0)
from aegis.detectors.batch_analyzer import BatchAnalyzer
analyzer = BatchAnalyzer()
batch = analyzer.analyze(
    doc_names=["alice.pdf", "bob.pdf", "carol.pdf"],
    doc_texts=[text_alice, text_bob, text_carol],
    ai_scores=[0.72, 0.69, 0.71],
)
print(batch.overall_risk)            # CRITICAL if essay mill detected
print(batch.suspicious_pairs)

REST API

# Upload for analysis:
curl -X POST http://localhost:8000/analyze \
     -F "file=@paper.pdf" -F "format=json"

# Add to reference corpus:
curl -X POST http://localhost:8000/corpus/add \
     -F "file=@reference.pdf" -F "label=Smith2023"

# Build search index:
curl -X POST http://localhost:8000/corpus/build

# Pairwise comparison:
curl -X POST http://localhost:8000/compare \
     -F "file_a=@journal.pdf" -F "file_b=@conference.pdf"

# Batch classroom analysis:
curl -X POST http://localhost:8000/batch \
     -F "files=@a.pdf" -F "files=@b.pdf" -F "files=@c.pdf"

Report Fields (v2.1)

detector_status distinguishes "this detector found nothing" from "this detector didn't run" -- a 0.0 score alone is ambiguous between a disabled detector, a missing corpus, and a genuinely clean result. citation_summary.assessment is "INCONCLUSIVE" (rather than a confident risk level) when fewer than 5 references were detected or verification coverage is below 80% -- a single low-confidence reference should never read as "100% of citations are fabricated."

{
  "overall_risk": "HIGH",
  "scores": {
    "plagiarism": 0.12,
    "ai_content": 0.71,
    "citation_issue_rate": 0.22,
    "style_inconsistency": 0.08,
    "self_recycling_pct": 4.2
  },
  "flags": ["AI content detected: AI_LIKELY (score=0.71)", "..."],
  "network_activity": {
    "document_content_transmitted": false,
    "citation_check_mode": "online",
    "citation_network_mode": "online",
    "external_services_contacted": ["Crossref", "OpenAlex"]
  },
  "detector_status": {
    "ngram": {"status": "completed", "reason": null},
    "semantic": {"status": "disabled", "reason": null},
    "ai_content": {"status": "completed", "reason": null},
    "citation": {"status": "completed", "reason": null},
    "self_plagiarism": {"status": "unavailable", "reason": "no prior works loaded"},
    "...": "one entry per detector -- completed | disabled | unavailable | failed"
  },
  "ai_detection": {
    "document_verdict": "AI_LIKELY",
    "ai_fraction": 0.62,
    "paragraph_scores": [...]
  },
  "citation_summary": {
    "total_references": 22,
    "references_with_identifier": 20,
    "references_verified": 19,
    "verification_coverage": 0.864,
    "assessment": "ASSESSED",
    "risk_level": "MEDIUM"
  },
  "citation_integrity": [...],
  "citation_network": {
    "self_citation_rate": 0.08,
    "predatory_journal_count": 0,
    "missing_doi_rate": 0.14,
    "flags": []
  },
  "watermark": {
    "mode": "experimental",
    "status": "completed",
    "verdict": "NO_STATISTICAL_ANOMALY",
    "evidence_status": "experimental",
    "affects_overall_risk": false,
    "tokens_evaluated": 842,
    "z_score": 0.41,
    "confidence": 0.0,
    "limitations": ["This is a keyless heuristic...", "..."]
  },
  "coherence": {
    "verdict": "AI_POLISHED",
    "ensemble_score": 0.63,
    "discourse_connector_density": 5.2,
    "sentence_length_cv": 0.29
  },
  "stylometric": {...},
  "self_plagiarism": {...}
}

Configuration

Copy .env.example to .env and set:

All settings can also be passed as PipelineConfig arguments in the Python API.

Watermark Detection: Capabilities and Limitations

AEGIS's watermark analysis is experimental by default and does not affect the overall integrity risk score. Before relying on any watermark output, understand:

• An unrelated green list cannot verify a secret watermark. Real watermark schemes (Kirchenbauer et al. 2023, etc.) partition the vocabulary using a secret key and a seeding scheme tied to the actual generating model's tokenizer. AEGIS's experimental heuristic has none of that -- it fabricates its own green/red split from a hash of the previous word, purely as a statistical null to compare against. Matching that fabricated null is not evidence of matching a real provider's watermark.
• Tokenizer alignment matters. The heuristic approximates tokens via a word-level hash, not the BPE tokenizer any real LLM actually uses. Token boundaries differ, which further breaks any correspondence to a real scheme.
• Anomaly detection is not scheme verification. A STATISTICAL_ANOMALY verdict means the heuristic's own null was exceeded -- it does not mean a watermark was found. Only a VERIFIED_SCHEME run against a real, correctly configured scheme (not currently implemented in AEGIS) could support that claim.
• Minimum text length. Fewer than 200 alphabetic tokens returns INSUFFICIENT_TEXT -- short excerpts are not evaluated at all.
• Paraphrasing and editing reduce detectability of any real watermark, and AEGIS makes no claim about robustness to either.
• Results require human interpretation. Even a validated scheme signal (when/if implemented) is provenance evidence, not proof of misconduct, and is capped to raising risk by at most one level rather than forcing CRITICAL.
• No provider-specific claims. AEGIS does not claim to detect GPT-4, Gemini, Claude, or any other proprietary provider's watermark. No such scheme is documented or implemented here.

Running Tests

pip install pytest
pytest tests/ -v

The test suite runs without network calls or ML model downloads.

Why Choose AEGIS

1. Local-first processing. AEGIS never uploads your manuscript anywhere -- analysis runs entirely on your own machine. Citation checks may query Crossref/OpenAlex with reference metadata (titles, authors, DOIs), never the document itself, and only when online verification is enabled.

2. Reduced false-positive bias against international researchers. Liang et al. (Stanford, 2023) found GPT detectors misclassified more than half of non-native-authored TOEFL essays as AI-generated. AEGIS applies per-language calibration across 15 languages to reduce this bias.

3. Closes gaps not publicly documented elsewhere. Citation cartels, essay mills, and AI-polished text that passes perplexity filters are not publicly documented as covered by mainstream tools. AEGIS also includes an experimental, informational-only LLM watermark heuristic not commonly found in open-source alternatives -- see its capabilities and limitations.

4. Explainable, not a black box. Every flag cites the exact sentence, the source it was matched against, and the metric that triggered it, so a human reviewer can verify or dismiss it -- rather than a single opaque score. AEGIS results are a supporting signal for human review, not a determination of misconduct.

5. Built for research institutions. REST API for LMS integration, Docker for air-gapped deployment, batch mode for classroom scanning, persistent indices for journal editorial systems.

6. Free, forever. MIT license. No per-submission fees, no seat licenses, no vendor lock-in -- commercial tools require an institutional license or paid API credits. AEGIS costs compute time only.

References

• Kirchenbauer et al. (2023). A Watermark for Large Language Models. ICML 2023.
• Zhao et al. (2023). Provable Robust Watermarking for AI-Generated Text. ICLR 2024.
• Liang et al. (2023). GPT Detectors Are Biased Against Non-Native English Writers. Patterns 4(7), 2023. arXiv:2304.02819.
• Walters & Wilder (2023). Fabrication and Errors in the Bibliographic Citations Generated by ChatGPT. Scientific Reports 13, 14045. doi:10.1038/s41598-023-41032-5.
• Burrows (1987). Word Patterns and Story Shapes. Literary Linguistic Computing 2(2).
• McCarthy & Jarvis (2010). MTLD, vocd-D, and HD-D. Behavior Research Methods 42(2).
• COPE (2019). Text Recycling Guidelines. Committee on Publication Ethics.

Docker (GitHub Packages)

A prebuilt container image is published to the GitHub Container Registry:

docker pull ghcr.io/sunilgentyala/aegis-integrity:latest
docker run --rm -p 8000:8000 -v aegis-data:/data ghcr.io/sunilgentyala/aegis-integrity

How to Cite

If you use AEGIS in your research, please cite the software:

@software{gentyala2026aegis,
  author    = {Gentyala, Sunil},
  title     = {{AEGIS}: Offline, Bias-Aware Academic Integrity Checker},
  year      = {2026},
  version   = {3.3.2},
  url       = {https://github.com/sunilgentyala/aegis-integrity}
}

Machine-readable metadata is in CITATION.cff; GitHub shows it under "Cite this repository".

License

MIT License. See LICENSE.

Author

Sunil Gentyala Independent Research | HCL America Inc., Dallas TX, USA

Contact: sunil.gentyala@ieee.org GitHub: sunilgentyala LinkedIn: linkedin.com/in/sunil-gentyala Website: sunilgentyala.github.io/aegis-integrity

Changelog

v3.3.2 (October 2026)

Packaging release for the official MCP Registry. No detection behaviour changes.

• mcp is now a core dependency and a new aegis-integrity command starts the MCP server, so uvx aegis-integrity works. aegis-mcp is unchanged.
• README carries the MCP Registry ownership marker.

v3.3.1 (October 2026)

Security hardening release. No detection behaviour changes.

• SECURITY: MCP file access. Tools now read only .pdf, .docx, .tex and .txt files up to AEGIS_MAX_FILE_MB (default 50). New AEGIS_ALLOWED_ROOTS confines tools to listed folders; prior_works_dir is validated the same way. Paths are passed as absolute paths so a file named -x.pdf cannot be read as a CLI option.
• SECURITY: tool output. Output returned to the model is stripped of control characters and truncated at 60,000 characters. All tools carry MCP read-only / non-destructive annotations. Venue names are validated.
• SECURITY: DOIs. DOIs extracted from documents are percent-encoded and fetched without following redirects (Crossref, DataCite, OpenAlex).
• SECURITY: configuration. The MCP server no longer loads ./.env (only AEGIS_ENV_FILE or ~/.aegis/.env). .dockerignore excludes .env, key files and virtualenvs.
• CI / repo: SECURITY.md, Dependabot, CodeQL, blocking pip-audit, least-privilege workflow token, 10 regression tests.
• README: demo GIF, MCP tools table, and the ESL calibration is now labelled experimental (see the v3.1.1 note).

v3.3.0 (October 2026)

• NEW: IEEE plagiarism-level check. Maps similarity evidence onto the levels of IEEE PSPB Operations Manual 8.2.4.D (amended 25 June 2026): Level 1 (major portion, 50% or more), Level 2 (large, 20-50%), Level 3 (uncredited verbatim, under 20%) and Level 4 (credited verbatim without quotation marks). Matches are merged so words are never double-counted, and matches from several sources are summed as the manual requires. Levels are indicative; IEEE sets them by adjudication.
• NEW: reuse of your own prior work is checked against 8.2.4.G / 8.2.10 (undisclosed earlier version), and captions of borrowed figures and tables without a reference or permission note are flagged. Overlap with your own prior works is left to the self-plagiarism detector, not counted twice.
• New "IEEE Plagiarism Level" section in the HTML and JSON reports; PipelineConfig.run_ieee_plagiarism turns it off.

v3.3.0 (September 2026)

• NEW (web app): aegis ui opens a browser app at http://127.0.0.1:8765/ (also served at / by aegis serve and Docker). Drag-and-drop checking with four modes (Full, Private/offline, References only, Style & formatting), publisher-guideline selection, a plain-language verdict, score tiles that say "Not run" instead of showing a misleading 0%, a reference table sorted problems-first, a "which checks ran" panel, a plain-English "internet use" summary, the full HTML report in a sandboxed viewer, and JSON/HTML downloads. Also Compare two papers and My comparison library tabs. Single self-contained page: no CDN, fonts or trackers, so it works offline; all document text is inserted with textContent, never as HTML.
• NEW (aegis doctor): lists every capability (document reading, corpus, paraphrase and AI detection, non-native-English calibration, Crossref, spaCy, MCP) as Ready / Limited / Not installed, with the exact command that fixes each. --warm-up pre-downloads the models; --plain for scripts. The same data backs GET /status, the web app's status panel and the MCP aegis_status tool.
• NEW (Claude integration): installable aegis-mcp server (was a root-level script with hardcoded C:\Gitrepos paths that only worked on one machine); a Claude Code plugin + marketplace (claude-plugin/, .claude-plugin/marketplace.json) with integrity-check, submission-check and aegis-setup skills; and a Claude Desktop extension (mcpb/). aegis_mcp.py remains as a backward-compatible launcher for existing configs.
• NEW (API): /analyze accepts offline=true (no network calls at all), guidelines=, include_html=true, and toggles for every detector. /health reports auth_required and no longer exposes the server's index path to unauthenticated callers.
• FIX (API responsiveness): /analyze, /compare and /corpus/add ran CPU-bound work directly on the async event loop, so one analysis froze every other request (including /health) for minutes. That work now runs in a thread pool.
• FIX (plagiarism false positive): the n-gram detector reported every MinHash LSH candidate, including unrelated paragraphs at 8-14% exact Jaccard, far below its own 25%/40% thresholds. On a published journal paper this produced six "copied" passages pairing lung-cancer text with network-security text and raised the overall risk to MEDIUM. Candidates are now kept only if their exact Jaccard meets the threshold.
• FIX (citation false positives on two-column PDFs): a DOI wrapped across lines (10.1016/j. + newline + ebiom...) was cut to 10.1016/j and reported HALLUCINATED; running page headers ("... Control 115 (2026) ...") inside the reference list were read as publication years; author lists or page ranges guessed as titles produced MISMATCH even when the reference contained the real title; and an online-first year was called a mismatch with the print year. Wrapped DOIs are rejoined (page numbers and following words are not), repeated header/footer lines are stripped from references, a title is accepted when the resolved title appears in the reference text, and any of Crossref's print/online/issued years is accepted. A one-year difference Crossref can't explain (it often stores only the online-first date) is now a note on a verified reference, not a MISMATCH; larger gaps still are. The first year of a page range ("(2022) 2049-2065") is no longer read as the publication year. On the test paper: 12 -> 17 references verified, 1 -> 0 false HALLUCINATED, 6 -> 0 false MISMATCH.
• FIX (equation false positives on PDFs): equation numbers that PDF extraction places on their own line were not recognised, so every "equation (N)" reference was reported as dangling (28 of 28 on the test paper). Standalone "(N)" lines now count when the preceding line looks like math. The equation checker also now skips the References section, which is found by heading line when section detection misses it.
• FIX (configuration): the .env file created by install.bat was never read by the CLI or API; ./.env and ~/.aegis/.env are now loaded, and aegis analyze --email honours AEGIS_CITATION_EMAIL.
• CHANGED: default data location is ~/.aegis/{index,reports} so the CLI, web app and MCP server share one library. An existing ./aegis_index / ./aegis_reports in the working directory, or AEGIS_INDEX_DIR / AEGIS_REPORT_DIR, still take precedence.

v3.1.3 (September 2026)

• FIX (plagiarism false positive): the n-gram and semantic similarity detectors ran on the full submission text, including its own References section. A correctly formatted citation necessarily reproduces the cited paper's own title/author string near-verbatim, so any two papers citing the same source got flagged as plagiarizing each other's bibliography -- a real submission scored CRITICAL/0.93 plagiarism purely from routine citation overlap. Both detectors now run on ParsedDocument.body_text (References/Bibliography sections excluded); AI detection and citation verification are unaffected.
• FIX (citation year mismatch false positive): DocumentParser. _extract_year took the first 4-digit "19xx"/"20xx"-shaped number anywhere in a reference's raw text as its claimed publication year. That picks up a page/article number that happens to look like a year ("..., p. 1947, 2025." claimed 1947, not 2025) or a conference's event year instead of its proceedings' actual publication year ("...CRITIS 2016), ... 2017." claimed 2016, not 2017). Now strips a trailing DOI, ignores any match immediately preceded by a page/volume/issue label or a page-range dash, and takes the last surviving candidate.

v3.1.2 (September 2026)

• REMOVED: JSON report file generation (ReportGenerator.generate_json, aegis analyze --output/-o, aegis guidelines --output/-o, aegis batch --json, and the corresponding MCP tool JSON output paths). The JSON file duplicated the HTML report's data in a form nobody read; the self-contained HTML report is now the only report file AEGIS writes. The REST API's GET /analyze?format=json machine-readable response is unaffected -- that's a live API contract, not a report file.
• FIX (citation false positive, short/generic titles): a DOI-less reference to a spec/document page (e.g. titled just "Authorization") triggered a Crossref title search that coincidentally word-matched an unrelated publication with the same short, generic title, producing a fabricated-looking MISMATCH/HALLUCINATED verdict against a reference that was never a DOI-bearing publication in the first place. Title lookup is now skipped for extracted titles under 4 words.
• FIX (citation false positive, secondary-lookup rate limiting): the concurrent per-reference verification fan-out queries both a primary /works/{doi} call and a secondary /agency call; the /agency call hits Crossref's rate limit far more easily on reference-heavy papers, and a 429/5xx response there fell through the same code path as a genuine 404 (DOI unregistered), turning a transient rate limit into a false HALLUCINATED verdict against real, resolvable DOIs. Non-404 failures on the agency check are now reported UNAVAILABLE, not HALLUCINATED.
• FIX (citation title-extraction, Word smart quotes): Word's smart-quote autocorrect renders reference titles in single curly quotes rather than double quotes; a naive quote-to-quote match broke because the closing curly quote is the same character Word uses for an apostrophe inside the title itself (e.g. "You've"), truncating the match mid-title. Now anchors on a comma immediately before the closing quote (the true title boundary in IEEE/ACM style), which a mid-title apostrophe never precedes.
• FIX (venue-mismatch false positive, jointly-sponsored venues): a reference naming a jointly-sponsored venue (e.g. "IEEE/ACM ... Conference") was checked against only the first-listed co-sponsor, so a DOI that legitimately resolves to the second-listed co-sponsor's Crossref member produced a false VENUE_MISMATCH flag even though the reference's own text already named both sponsors. claimed_publisher() gained a claimed_publishers_all() counterpart and the mismatch check now passes if the resolved publisher is any of the venues actually claimed.

v3.1.1 (September 2026)

• FIX (AI-detector accuracy, ensemble weighting): GPT_TELL_PHRASES (the lexical-tell signal, 25% ensemble weight) mixed idiosyncratic AI catchphrases ("delve into", "tapestry of", "testament to") with ordinary formal-register connectives ("furthermore", "moreover", "in conclusion", "robust", "leverage") that are standard vocabulary in every academic- writing curriculum -- exactly what ESL writing courses teach as formal transition words. Counting both tiers equally meant this signal could disproportionately penalize careful, formal (often non-native) academic prose, undermining the detector's own ESL bias correction (ESL_THRESHOLD_MULTIPLIER). Split into GPT_TELL_PHRASES_STRONG (full weight) and GPT_TELL_PHRASES_WEAK (WEAK_TELL_WEIGHT = 0.35) in aegis.detectors.ai_detector; _gpt_tell_density now weights hits by tier instead of counting every phrase equally.
• NOTED, not yet fixed: ESL_THRESHOLD_MULTIPLIER's non-English entries are effectively unreachable in practice -- the calibration keys off langdetect(text), which (correctly) detects the language the text is written in, not the author's native language, so it returns "en" for essentially every real English-language submission, including grammatically non-native-influenced English. Verified directly: langdetect("This paper propose a novel method for is more efficient...") still returns "en". A real fix needs a genuine L2- English-style heuristic (e.g. article/preposition error density), which is a new detector, not a quick tweak -- left as a scoped follow-up rather than guessed at without a labeled corpus to validate against.

v3.1.0 (September 2026)

• NEW: Elsevier added as a sixth per-venue guideline profile (aegis.guidelines.profiles.GUIDELINE_PROFILES["ELSEVIER"]), sourced from Elsevier's own Guide for Authors / CRediT / Highlights / Declaration of Competing Interest policy pages and cross-checked against a real published ScienceDirect article. Unlike the other five venues, Elsevier explicitly accepts either US or UK spelling and only flags a document that mixes the two -- the checker's spelling rule was extended with a new "EITHER" variant to represent this correctly instead of forcing a false single-target verdict. Four new structural checks run only for venues that require them (Elsevier, for now): a CRediT authorship contribution statement, a Declaration of Competing Interest, a Data Availability Statement, and a Highlights section capped at 3-5 bullets of 85 characters each.
• SECURITY: Fixed a timing side-channel in the REST API's X-API-Key check (aegis.api.app.require_api_key) -- it compared the header to AEGIS_API_KEY with plain !=, which short-circuits on the first mismatching character and so takes measurably longer to reject a key that matches more leading characters, in principle letting an attacker recover the key one character at a time. Now uses hmac.compare_digest.
• SECURITY: Raised minimum dependency versions past several since- disclosed CVEs: transformers (RCE via unsafe deserialization, CVE-2024-11394/11392), torch (torch.load RCE even with weights_only=True, CVE-2025-32434), PyMuPDF (path traversal in embed-extract, CVE-2026-3029), requests (Session cert-verification bypass, CVE-2024-35195), jinja2 (sandbox breakout via the |attr filter, CVE-2024-56201/56326/CVE-2025-27516), python-multipart (DoS/ ReDoS, CVE-2024-53981/24762), and an explicit starlette floor (DoS via unbounded multipart-field buffering and blocking event-loop rollover, CVE-2024-47874/CVE-2025-54121) rather than relying on FastAPI's own looser transitive floor. See requirements.txt / setup.py for the per-package citations.

v3.0.0 (August 2026)

• NEW: Mathematical formula checking (aegis.detectors.math_formula). Equation numbering (duplicates/gaps/out-of-order), dangling in-text references to equations that don't exist, orphaned equations never referenced, and notation conventions (exponential notation, decimal leading zeros, percentage-range formatting) sourced from IEEE/IET style manuals. Extracts equations from LaTeX source, from Word's native OMML math XML (previously invisible to AEGIS entirely -- python-docx's Paragraph.text silently skips every .docx equation), or via text-pattern heuristics for PDF/TXT. Pure Python, no ML dependency.
• NEW: Grammar & language convention checking (aegis.detectors.grammar). Contractions, US/UK spelling-consistency detection across 30+ word pairs, subject/verb agreement heuristics, common usage errors, and readability metrics -- fully offline via regex
  • optional spaCy, no Java runtime or external grammar service required.
• NEW: Per-venue publisher guideline compliance (aegis.guidelines). Runs the math/grammar findings against IEEE, ACM, BCS, IET, and ISACA's own sourced style guidance separately (not one merged rule set) via aegis guidelines <file> --venues ... or aegis analyze ... --guidelines all. Every rule cites its source; results are advisory (PASS/NEEDS_REVIEW/NOT_ENOUGH_DATA), never FAIL -- these are style conventions, not misconduct findings, and are never factored into overall_risk.

v2.5.0 (August 2026)

• FIX (correctness, high severity): Target-publisher keyword matching (publisher_registry.classify_publisher / claimed_publisher) used bare substring containment on short, generic venue keywords ("iet", "iete", "acm", "bcs"). This false-matched inside unrelated words -- a reference mentioning a "quiet cooling system" was classified as claiming IET, one mentioning noise being "quieted" was classified as claiming IETE, and a "pacman-style scheduling" reference was classified as claiming ACM -- each producing a spurious VENUE_MISMATCH flag with no real venue claim present. Matching now requires the keyword not be glued to a letter/digit on either side (whole-word/phrase match), eliminating the collision while leaving genuine "IEEE Trans...", "Proc. ACM...", "IET Communications" matches unaffected.
• NEW: GPT-4/GPT-5-era lexical-tell signal in the AI content detector. GPT-2 perplexity/burstiness -- the detector's core signal -- was designed against GPT-2-era output and under-detects frontier chat models (GPT-4o-, GPT-5-class, and comparably RLHF-tuned models), which produce far more fluent, human-like perplexity and burstiness than GPT-2 ever did. Adds a complementary lexical signal (GPT_TELL_PHRASES) covering transition/elevation vocabulary disproportionately common in ChatGPT/GPT-4/GPT-5-family output ("delve into", "underscores", "pivotal role", "leverage", "in conclusion", ...), reported per-paragraph as gpt_tell_density and folded into the ensemble score at a modest, fixed weight alongside perplexity/burstiness/stylometrics -- a hit is a stylistic tell, not proof of AI authorship, consistent with this project's existing no-overclaiming stance (see watermark detector).

v2.4.0 (August 2026)

• NEW: Target-Publisher Verification module (detector #11), scoping citation and duplicate-submission checks to IEEE, ACM, Elsevier, IET, IETE, and BCS. Adds venue_verification to every report: per-venue verified-citation counts, VENUE_MISMATCH flags when a reference claims one of these six venues but its DOI resolves elsewhere, and a duplicate/prior-publication search scoped per venue via Crossref (member id for IEEE/ACM/Elsevier/IET; DOI-prefix + container-title match for IETE/BCS, which don't hold independent Crossref membership). Configurable via --target-publishers (CLI) / venue_target_publishers (Python API); enabled by default, adds no new required dependency (reuses the existing requests + Crossref integration).

v2.3.0 (July 2026)

Follow-up audit fixes from testing against real manuscripts, plus CI/security hardening. Second consecutive minor bump for behavioral fixes, not a patch:

• FIX (correctness, high severity): DOCX paragraphs were joined with a single \n, but paragraph-level detectors (AI content, n-gram) split on \n\n+ to find paragraph boundaries -- every DOCX submission silently collapsed into one giant "paragraph," disabling paragraph-level AI/n-gram detection entirely for that format. Also now extracts table cell text, previously dropped completely.
• FIX (correctness, high severity): A single low-confidence reference verdict (even from one detected citation) could read as "100% Citation Issues" and independently force overall_risk to CRITICAL. Citation findings now only influence risk once there's an adequate sample (>=5 references, >=80% verification coverage); below that, the report says "assessment": "INCONCLUSIVE" instead of a false-confidence verdict. UNRESOLVABLE verdicts (network/parse failures) no longer count toward citation_score either -- only confirmed HALLUCINATED/MISMATCH do.
• FIX (correctness): DataCite-registered DOIs (arXiv's 10.48550/* prefix, etc.) previously only got a generic "not independently verified" pass-through after the Crossref-404/agency-check fix in v2.2.0. AEGIS now queries DataCite's own REST API for real title/author/year metadata and runs the same comparison used for Crossref results.
• FIX (correctness): Reference title extraction sometimes returned an author-list fragment (e.g. "Gentyala, F", "Mireshghallah, K") as the "title" when splitting on ". " hit an abbreviated author initial before reaching the real title -- a long-known false-positive source. Now prefers a quoted title (present in most citation styles) and, in the fallback path, explicitly skips fragments matching the surname+initial shape instead of returning the first sufficiently-long fragment.
• FIX (transparency): The report footer claimed "no data transmitted to third parties" unconditionally, even though citation checking contacts Crossref/DataCite and citation-network analysis contacts OpenAlex by default. Reports now include network_activity stating exactly which services (if any) were contacted for that specific run.
• NEW: detector_status in every report: each of the 9 detectors reports completed / disabled / unavailable / failed with a reason. A 0.0 score used to be ambiguous between "ran and found nothing," "was disabled," "had no corpus to compare against," and "raised an exception that got logged and silently swallowed" -- these are now distinguishable.
• FIX (security): Pinned the GPT-2 / GPT-2-medium model revisions used by the AI content detector (bandit B615: unpinned Hugging Face downloads) and marked the watermark heuristic's non-cryptographic MD5 bucketing hash as usedforsecurity=False (bandit B324).
• NEW: CI (GitHub Actions): test matrix across Python 3.10-3.12 with a coverage gate (60%, the current baseline -- 80% is a follow-up target, not enforced yet), ruff check (pinned to the version actually run against this codebase, not "latest" -- a ruff minor release changing default rules would otherwise break this gate with no code change), bandit, and a Docker build + healthcheck smoke test. pip-audit runs for visibility but doesn't block on transitive-dependency CVEs.
• CHANGED: Dropped Python 3.9 support. It reached end of life in October 2025, and spacy's current dependency chain (thinc>=8.3.12) no longer publishes a build for it -- the full [ml,nlp,bib] install is no longer installable on 3.9 regardless of anything in this project. python_requires is now >=3.10.

v2.2.0 (July 2026)

Behavioral and security fixes from an independent audit -- not documentation-only, so this is a minor version bump rather than a patch:

• FIX (correctness, high severity): ESL calibration multipliers were inverted -- values below 1.0 lowered the AI-flagging threshold for non-native languages, making false positives against ESL writers more likely, the opposite of the documented intent. Multipliers are now >1.0, raising the threshold instead.
• FIX (correctness): A Crossref 404 was treated as proof a citation was hallucinated (confidence 0.95), but Crossref only covers Crossref-registered DOIs -- DataCite-registered DOIs (e.g. arXiv's 10.48550/* prefix) always 404 there even when valid. Now checks the DOI's registration agency first and returns NOT_FOUND_IN_CROSSREF instead of HALLUCINATED when appropriate. Timeouts/429/5xx now return UNAVAILABLE rather than being folded into a verdict about the citation.
• FIX (correctness, data loss): CorpusIndexer reloaded document metadata after a restart but not the actual document text, so build_indices() would silently rebuild from an empty corpus and drop every previously-indexed document. Document text is now persisted and reloaded correctly.
• FIX (security): Replaced pickle-based corpus/index serialization with JSON -- the REST API's /corpus/add + /corpus/build wrote to the same directory /analyze deserialized via pickle.load, an arbitrary-code- execution risk if that directory were ever writable by an untrusted party.
• FIX (security): The REST API had no authentication, no upload size limit, and no concurrency limit. Added optional AEGIS_API_KEY header auth (all routes except /health), AEGIS_MAX_UPLOAD_MB (default 50MB), and AEGIS_MAX_CONCURRENT_JOBS (default 2, returns 503 instead of queuing unboundedly). API version now reports aegis.__version__ instead of a hardcoded 1.0.0.
• FIX: Report JSON/HTML hardcoded "aegis_version": "2.1.0" and a stale footer version instead of using aegis.__version__. source_breakdown keys (document labels) were interpolated into HTML unescaped. citation_network and coherence detector results were produced by the pipeline but never appeared in the JSON report or HTML output -- both are now included.
• NEW: aegis batch CLI command and POST /batch API endpoint. Both were documented in the README and on the GitHub Pages site already, but neither existed -- aegis batch returned "Error: No such command 'batch'". Both now wire in the existing (previously untested) BatchAnalyzer detector.
• FIX (Docker): the healthcheck ran curl, which the image never installed, so it always failed. Replaced with a Python-based check. Added a non-root user, removed a silently-swallowed model-download failure, stopped installing dependencies twice (requirements.txt + editable install overlapped almost entirely), pinned the base image to a content digest, and added CPU/memory limits + localhost-only port binding to docker-compose.yml.
• CHANGED: Softened several unqualified claims on the README and GitHub Pages site ("Production Stable" -> "Beta -- Human Review Required", "Zero Blind Spots", "Closes Every Gap", "Enterprise-Ready", "Defensible in any hearing") given the correctness bugs found in this audit, and corrected a privacy claim that didn't account for Crossref/OpenAlex citation lookups.

v2.1.1 (July 2026)

• FIX: Replaced unsourced comparison-table claims and stats on the README and GitHub Pages site with cited sources (Liang et al. 2023 for ESL false-positive bias; Walters & Wilder 2023 for citation fabrication rates) and hedged "Not public" language for competitor capabilities that aren't independently verifiable
• FIX: Removed invented per-submission dollar figures for competitor pricing (no public source existed for several of them); replaced with pricing-model descriptions
• FIX: Corrected Liang et al. (2023) citation -- published in Patterns (Cell Press), not Science
• FIX: Stale "AEGIS v2.0" heading/table references updated to v2.1

v2.1.0 (July 2026)

• FIX: Watermark heuristic could unconditionally force overall_risk to CRITICAL; it now never affects the risk score in experimental mode and is capped at +1 level even in a hypothetical validated-scheme mode
• NEW: WatermarkMode (disabled / experimental / verified_scheme) and --watermark-mode CLI flag
• CHANGED: Watermark verdicts renamed to STATISTICAL_ANOMALY / NO_STATISTICAL_ANOMALY / etc.; the old definitive WATERMARKED verdict is gone
• FIX: Removed unsupported false-positive-rate and GPT-4/Gemini-detection claims from the README and GitHub Pages site

v2.0.0 (June 2026)

• NEW: LLM Watermark Detector (Kirchenbauer z-test + entropy + rank skew)
• NEW: Citation Network Analyzer (self-citation inflation, predatory journals, OpenAlex)
• NEW: Semantic Coherence Analyzer (discourse connectors, sentence uniformity, MTLD)
• NEW: Batch / Classroom Analyzer (essay mill detection, pairwise similarity matrix)
• NEW: aegis batch CLI command
• IMPROVED: Pipeline now runs 10 detectors in sequence with unified risk scoring
• IMPROVED: JSON report includes all v2.0 detector outputs
• IMPROVED: setup.py bumped to stable (5 - Production/Stable)

v1.0.0 (May 2026)

• Initial release: citation integrity, ESL-calibrated AI detection, SBERT semantic similarity, MinHash n-gram, Burrows' Delta stylometrics, self-plagiarism detection, REST API + CLI