Capabilities · v0.18.0 · Apache‑2.0

Security review for systems that act.

An AI agent isn’t a program you scan line by line. It’s a system that reaches: across tools, across trust boundaries, straight into your cloud. Attestral builds a living model of the whole thing and reviews the architecture, from the first design sketch to whatever’s running at 2am. Below is the entire pipeline, one stage at a time, as a living diagram. Scroll, and watch it build itself.

267 checks· MCP + agent + cloud· OWASP Agentic & LLM Top 10· MITRE ATLAS
↓ scroll the pipeline
01  Ingest
readingterraform, kubernetes, mcp configs, prompts
This diagram needs JavaScript. The pipeline still holds: Attestral ingests your configs, models the system, reviews the graph, then compiles the reviewed design into a runtime policy.
Stage 01 / Ingest

First, it reads your mess.

Terraform, Kubernetes, MCP configs, the prompt files nobody admits to committing. Attestral slurps them all in, comments and trailing commas included, and doesn’t judge. Yet.

Four ingesters, zero setup. Point it at a repo and it finds the agent surface on its own.
Stage 02 / Model

Then it builds a map, not a list.

Files become a system model: every component, every edge, and the trust boundaries they cross (agent runtime, cluster, cloud). This is the part linters skip, which is exactly why they miss the interesting failures.

Nodes are components, shaped by tier. Lines are reachability. The three lanes are trust boundaries.
Stage 03 / Rules

267 checks sweep the graph.

No vibes, no maybes. Named, deterministic checks that either fire or don’t, from unpinned installs to a lethal trifecta spanning three servers. Watch the scan pass through and the findings pop up where the relationships go wrong.

Critical in seal red, high in amber. Each one links to a one-line fix.
Stage 04 / Blast radius

The uncomfortable question, answered early.

If this node gets popped, what goes with it? Attestral fires a wave from a compromised surface and ranks everything it can reach, across boundaries, in order. You get the postmortem before the incident, which is a much nicer time to get it.

Here: secrets-manager falls, and the blast rolls out through the cloud floor.
Stage 05 / Language layer

Some risks hide in the words.

A tool description that’s a little too eager to “ignore previous instructions.” The ML layer scores the language surfaces for prompt injection. It ships with a zero-dependency heuristic and upgrades to a real transformer only if you ask, and every tier returns the same shape of finding.

heuristic → onnx → deberta. Same output, your choice of horsepower.
Stage 06 / Cross-examination

For the gray areas, two models argue.

One tries to elicit the bad behavior, the other judges whether it’s actually real. It’s cross-examination, minus the courtroom drama and the hourly rate. Opt-in, bring your own API key, off by default.

Elicitor proposes, judge disposes. Only survivors make the report.
Stage 07 / Waivers

Not every finding is a fire.

Waive one and it’s documented, dated, and set to expire, never quietly deleted. It stays right there in the record with a note attached and turns into a proper SARIF suppression. Auditors love this. You will too, eventually.

Waived is not the same as hidden. The finding keeps its seat.
Stage 08 / Evidence chain

Everything gets sealed.

Findings link into a SHA-256 evidence chain. Nudge one after the fact and verification lights up like a smoke alarm. Hand the whole thing to your auditor, tamper-evident and boring in the best way, and go get a coffee.

Hash, prev-hash, seal. Change anything and the chain stops verifying.
Stage 09 / Runtime loop

Here’s the part that isn’t a scanner.

Attestral compiles the attested design into a default-deny policy, then diffs live traffic against it. The design you reviewed becomes the guardrail that enforces it. When reality improvises, drift catches it mid-note. Most events sail through. The one that shouldn’t, doesn’t.

Green passes the policy. Red is drift, flagged the instant it happens.
One toolchain, terminal-first

Point it at a repo. Pick a command.

Every stage above is one command with tidy, severity-grouped output and attestral explain <ID> a keystroke away. Pick one and watch it work.

attestral scan ./agent
Where this goes

A system of record for how your agents are allowed to behave.

Right now most agent deployments have no artifact that says what the system is supposed to do: which tools may touch which data, which flows are allowed, what happens when one gets compromised. Attestral turns that into something real, verifiable, and enforceable.

Aimed at its full potential, every agent ships with an attested security design: reviewed against the OWASP Agentic and LLM Top 10 and MITRE ATLAS, compiled into a default-deny policy that enforces it at runtime, with a blast radius you already know before anything goes wrong, and an evidence chain an auditor can walk line by line. Not a report you file and forget. A living contract between the design and the running system.

That’s the moat, and it’s stubbornly hard to copy by piling on rules: a per-resource linter has no system model to attest, and a pure-LLM reviewer has nothing deterministic to enforce. Attestral holds both ends, the reasoning and the proof.

267
Checks
agent, MCP & cloud
111
Cloud controls
AWS · Azure · GCP · K8s
100s
Real servers
standing regression corpus
0
Keys to start
ML & LLM opt-in
OWASP LLM Top 10OWASP Agentic Top 10 MITRE ATLASNIST controls CIS AWS / Azure / GCP / K8sSARIF output
Terminal-first · nothing hits disk unless you ask

Try it. It works.

That’s the whole pitch. One pip install, one command, and you are reviewing the agents you already run.

$ attestral scan --local