New · adversarial validation · attestral validate
Proof, not findings.
Every other scanner stops at "this looks risky." Attestral takes the attack path it assembled from your system model, walks it over the model's own edges, and proves it holds - entry, pivot, impact, stage by stage - then commits the proof to a tamper-evident evidence chain. A static finding is arguable. A walked, chained proof of the exact path is not.
Watch a proof render. Then try to break it.
This is a real fleet: a support agent with a web fetcher, a ticket reader, a shell, and a deploy tool. One tool description carries a hidden instruction to read ~/.ssh/id_rsa and post it out. Hit Run validation and watch the path get walked. Then toggle a server off and watch the proof die: remove any one rung and the exploit is gone. That is the whole point. The fix is one toggle, and now you can see it.
The fleet (toggle any server, then re-run). Capability tags mirror the MCP ingester; the walk mirrors attestral/paths.py and attestral/redteam.py.
The proof is chained, so an auditor can verify it offline.
Each proof commits to a SHA-256 hash chain exactly as attestral verify does: entry N hashes its canonical JSON together with the hash of entry N-1, from a zero genesis. The head is the integrity commitment for the run. Recomputed live below from the proofs above. Tamper with one entry and the whole chain gives it away.
A waived proof is never deleted, only marked. A proven path that you accept and document stays in the chain with its justification, so the record shows what was known and when. That is what makes it audit-grade rather than a scan log.
The same thing, in your terminal.
Real output from attestral validate examples/vulnerable-agent. The browser engine above is a faithful port; the CLI is the source of truth, and it also writes the proof report and the evidence chain when you pass -o.
Adversarial validation (1 proven)
ATL-RT-INTERNAL Proven traversable: a prompt injection can reach exfiltration
1. entry: jira - ingests untrusted input via saas_data
2. entry: web - ingests untrusted input via network
3. pivot: deploy - runs code via shell
4. pivot: shell - runs code via shell
5. impact: web - exfiltrates via network
boundaries: agent_runtime
verdict: traversable
fix: Break the chain: remove any one rung. Drop the code-execution capability on deploy...
$ attestral validate examples/vulnerable-agent -o proof --fail-on-proof
wrote proof.md · proof.json
$ attestral verify proof.json
chain VALID
Three tiers. One proof schema.
The symbolic tier ships today and is what you just watched. The generative and executed tiers build on the exact same proof, and degrade gracefully: the tier you have installed is the tier you get, and a missing key or extra is never an error.
Prove the path holds
Walk each attack path over the model's own edges. Deterministic, zero-dependency, no execution, no network. It proves the path is structurally traversable and names every rung. A design with no complete path proves nothing, which is itself an attestable result.
shipping nowDraft the payload
An LLM turns a specific path into the concrete artifact that would traverse it: the injection text, the predicted tool-call sequence, the transcript it expects. No live target is touched. Honestly labeled predicted, not executed.
on the roadmapCapture the transcript
Drive a sandboxed instance of a target you own with the drafted payload and record the real transcript. Own-target-only by construction, gated, sandboxed, benign canaries. The visceral "here is the working exploit" artifact.
on the roadmapScope, by design
The symbolic tier never touches a live system at all. It reasons over the model you already attested. The executed tier will run only against a target whose fingerprint matches that attested model and only with explicit authorization, in a sandbox, moving planted canaries rather than real secrets. Attestral proves the flaws in a design you own so you can close them. It is not a point-it-at-any-endpoint attack tool, and it never will be.
Does this make you flinch?
Point it at your own fleet. If the proof makes you reach for the config, that is the signal a static finding could never give you. It reads only what you point it at, runs on your laptop, and sends nothing anywhere.