Scan · the real engine, in your browser
Scan your agent. Nothing leaves.
Paste the mcpServers block your agent already uses and get a real security review: the actual 293-rule engine plus attack-path analysis, loaded straight from PyPI and run entirely in your browser. No account, no upload, no install. This is the same engine pip install attestral gives you, compiled to WebAssembly, so your config is reviewed on your machine and sent nowhere.
How this works, honestly.
This is not a reimplementation or a demo. It is the published Attestral package running in a WebAssembly Python, so what you see here is exactly what the CLI produces.
Loaded from PyPI, not faked
The page boots Pyodide and runs micropip.install("attestral"), pulling the same wheel pip would. It builds a system model from your config and runs the full deterministic rule pack, the zero-dependency prompt-injection tier, and attack-path reachability.
Your config stays on your machine
The scan happens in your browser tab. Your config is written to an in-memory filesystem, reviewed, and discarded when you close the page. Nothing is sent to Attestral or anyone else. Confirm it yourself in the network tab.
Then go deeper on the CLI
The browser runs the agentic and cross-boundary review. The CLI adds your Terraform and Kubernetes in the same graph, the evidence chain, SARIF, and the compile-to-runtime-policy loop. pip install attestral when you want the full loop.