Scan · the real engine, in your browser

Scan your agent. Nothing leaves.

Paste the mcpServers block your agent already uses and get a real security review: the actual 293-rule engine plus attack-path analysis, loaded straight from PyPI and run entirely in your browser. No account, no upload, no install. This is the same engine pip install attestral gives you, compiled to WebAssembly, so your config is reviewed on your machine and sent nowhere.

Runs client-side. Your config never leaves this page.
load a risky example load a hardened example clear
Your review appears here.Paste a config or load an example, then hit Review my config. The first run downloads the engine (a few seconds); after that it is instant.

How this works, honestly.

This is not a reimplementation or a demo. It is the published Attestral package running in a WebAssembly Python, so what you see here is exactly what the CLI produces.

The real engine

Loaded from PyPI, not faked

The page boots Pyodide and runs micropip.install("attestral"), pulling the same wheel pip would. It builds a system model from your config and runs the full deterministic rule pack, the zero-dependency prompt-injection tier, and attack-path reachability.

Private by construction

Your config stays on your machine

The scan happens in your browser tab. Your config is written to an in-memory filesystem, reviewed, and discarded when you close the page. Nothing is sent to Attestral or anyone else. Confirm it yourself in the network tab.

The whole picture

Then go deeper on the CLI

The browser runs the agentic and cross-boundary review. The CLI adds your Terraform and Kubernetes in the same graph, the evidence chain, SARIF, and the compile-to-runtime-policy loop. pip install attestral when you want the full loop.