The security scanner for AI agents and MCP servers.

The moat

It builds a model of your whole fleet, then reasons across it.

Not a config-by-config scan. Attestral ingests your MCP servers, prompts, cloud, and Kubernetes into one graph of components, edges, and trust boundaries. That is how it sees the path a single injected sentence can take: from an untrusted input, through a shell, across the boundary into your cloud. Hover a node to see its reach, or trace the attack path.

Adversarial validation · attestral validate

It no longer just flags the path. It proves it holds.

A finding is an opinion. attestral validate takes the attack path it built from your system model and walks it over the model's own edges, proving whether it actually holds: entry, pivot, impact. The proof lands in the tamper-evident evidence chain, it scores the risk with an OWASP AIVSS agentic score (AARS), and it even proves the fix - the one change that closes the path, verified by re-synthesis. Watch one prove itself below, then open the fully interactive walker.

Don't take the demo's word for it. Paste your own config.

Drop in an .mcp.json or claude_desktop_config.json and seventeen of the agentic checks from the rule pack, the same typed matchers the engine runs, review it right here. Everything happens in this tab: the page makes no network request with what you paste. The CLI goes further, with the cloud packs, attack paths, prompt surfaces, and the evidence chain.

Why not just Checkov or Trivy?

Keep using them. They are excellent at cloud infrastructure, and attestral is not out to replace them; it scans the same Terraform and Kubernetes with a solid CIS-grounded pack of its own. But those tools were built before agents had tools. They do not parse an .mcp.json, they cannot tell that a tool description is quietly asking the model to read your SSH key, and they have no concept of the trust boundary between an agent and the shell it can call. Attestral does one thing they structurally can't: it builds a system model of your whole agent fleet, so it catches the toxic flows that only exist across servers, where private data meets an exit and one injected sentence walks out with your secrets.

The honest version: run Checkov and Trivy for cloud depth, and run attestral for everything that lives above the infrastructure, the agent, its tools, and the prompts that drive them. It happens to cover the cloud underneath too.

183 checks, and the balance is the strategy.

We do not chase rule count. Every check earns its place with a real control and a fixture. The agentic and cross-boundary rules are the moat, the surfaces nobody else models; the cloud packs are deliberately good enough that you need no second scanner, never an arms race.

36 agentic and cross-boundary checks that are genuinely hard to copy, over 147 cloud checks across AWS, Azure, GCP, and Kubernetes, mapped to 21 framework families. Depth where it is the moat, parity where it just has to be solid.

The finding that lives in no single file.

Every server below is individually defensible, and a config-by-config scanner would wave them all through. The risk is compositional: the moment one agent session can read private data and reach an exit, a single injected sentence anywhere in its inputs becomes an exfiltration. Toggle the fleet and watch the pack's combination rules evaluate it live, using the same capability groups attestral scan applies to your real configs.

Fleet-level findings only: the per-server findings these toggles would also raise (a shell server is ATL-103 all by itself) are left out here to keep the composition visible. On a real scan the full attack path is also synthesized end to end, entry to pivot to impact.

Design review is where security is cheapest. It is also where the tooling is oldest.

The enterprise threat modeling market just consolidated into a single private-equity-owned vendor, priced for the Fortune 500 and built on decade-old architecture. Everyone else reviews designs in spreadsheets and wiki templates: slow, inconsistent, and with nothing to show an auditor. And the fastest-growing attack surface, AI agents and their tools, is the part legacy platforms understand least.

A security review you can't prove happened is an opinion, not a control.

For the teams who review before they ship.

Banks, insurers, and compliance teams under audit review architecture on purpose, because for them a flaw found after an agent reaches production is not a code fix. It is change management, re-certification, and an incident write-up. The same flaw caught in the design review is a one-line config change. Attestral is built for that review: it reads the agent design the way a security architect would, and it produces something an auditor can actually verify.

Three layers. Nothing hidden.

Regulated buyers can't accept "the AI said so." Attestral separates what is deterministic from what is model-reasoned, and labels every finding with its origin.

Layer 2 · reasoning

The risk that lives in the words, not a flag.

A shell flag is a boolean any matcher can catch. A tool description that quietly tells the model to read your SSH key and post it out is language, and no rule sees it. Attestral scores agentic text surfaces for prompt injection with a local classifier: a zero-dependency heuristic by default, an ONNX or DeBERTa tier once you install it, always offline. Load a description or paste your own, and watch it score in real time.

A browser illustration of the heuristic signals. The shipped classifier is a fine-tuned DeBERTa model, see the ML layer explainer. Language risk is scored, never hard-blocked: it becomes a finding tagged origin: ml, so a human still decides.

One command, the whole loop.

From raw config to a runtime policy that catches drift. Scroll through the pipeline: every stage is a real step in a single attestral run, and nothing is hidden between them.

Built for the review board, not just the terminal.

Tamper with the record. Watch it break.

Every finding commits to a SHA-256 chain: entry N hashes its own canonical JSON together with the hash of entry N-1, from a zero genesis. The head is the integrity commitment for the run. This recomputes live in your browser, the same construction attestral verify uses. Edit one entry and every hash after it stops matching.

The review is the policy. The policy is the proof.

This is the depth that makes a review audit-grade, not just a linter. Scanners stop at findings. Gateways enforce policies nobody reviewed. Attestral makes them the same artifact. The reviewed system model compiles into an mcp-guard runtime policy stamped with the review's chain head, and anything the review never saw counts as drift.

Then the policy watches. Drift gets caught.

The attested design compiled to a default-deny policy. Now runtime telemetry is diffed against it. Watch the events stream in: what the review saw passes, and what it never saw is drift, each tagged with the rule that caught it. This is the loop no scanner and no gateway closes on its own.

Every finding cites a real control.

A finding is not an opinion with a severity attached. Each one maps to a named framework an auditor already recognizes, so the review is evidence, not assertion. Attestral spans the agentic frameworks nobody else covers and the cloud controls everybody expects.

Start in sixty seconds.

No account, no server, no API key. The whole attest → prove → enforce → detect loop runs on your laptop, under Apache 2.0.

Gate every deploy in CI with the GitHub Action: