Security review for systems that act.
An AI agent isn’t a program you scan line by line. It’s a system that reaches: across tools, across trust boundaries, straight into your cloud. Attestral builds a living model of the whole thing and reviews the architecture, from the first design sketch to whatever’s running at 2am. Below is the entire pipeline, one stage at a time, as a living diagram. Scroll, and watch it build itself.
First, it reads your mess.
Terraform, Kubernetes, MCP configs, the prompt files nobody admits to committing. Attestral slurps them all in, comments and trailing commas included, and doesn’t judge. Yet.
Then it builds a map, not a list.
Files become a system model: every component, every edge, and the trust boundaries they cross (agent runtime, cluster, cloud). This is the part linters skip, which is exactly why they miss the interesting failures.
267 checks sweep the graph.
No vibes, no maybes. Named, deterministic checks that either fire or don’t, from unpinned installs to a lethal trifecta spanning three servers. Watch the scan pass through and the findings pop up where the relationships go wrong.
The uncomfortable question, answered early.
If this node gets popped, what goes with it? Attestral fires a wave from a compromised surface and ranks everything it can reach, across boundaries, in order. You get the postmortem before the incident, which is a much nicer time to get it.
Some risks hide in the words.
A tool description that’s a little too eager to “ignore previous instructions.” The ML layer scores the language surfaces for prompt injection. It ships with a zero-dependency heuristic and upgrades to a real transformer only if you ask, and every tier returns the same shape of finding.
For the gray areas, two models argue.
One tries to elicit the bad behavior, the other judges whether it’s actually real. It’s cross-examination, minus the courtroom drama and the hourly rate. Opt-in, bring your own API key, off by default.
Not every finding is a fire.
Waive one and it’s documented, dated, and set to expire, never quietly deleted. It stays right there in the record with a note attached and turns into a proper SARIF suppression. Auditors love this. You will too, eventually.
Everything gets sealed.
Findings link into a SHA-256 evidence chain. Nudge one after the fact and verification lights up like a smoke alarm. Hand the whole thing to your auditor, tamper-evident and boring in the best way, and go get a coffee.
Here’s the part that isn’t a scanner.
Attestral compiles the attested design into a default-deny policy, then diffs live traffic against it. The design you reviewed becomes the guardrail that enforces it. When reality improvises, drift catches it mid-note. Most events sail through. The one that shouldn’t, doesn’t.
Point it at a repo. Pick a command.
Every stage above is one command with tidy, severity-grouped output and attestral explain <ID> a keystroke away. Pick one and watch it work.
A system of record for how your agents are allowed to behave.
Right now most agent deployments have no artifact that says what the system is supposed to do: which tools may touch which data, which flows are allowed, what happens when one gets compromised. Attestral turns that into something real, verifiable, and enforceable.
Aimed at its full potential, every agent ships with an attested security design: reviewed against the OWASP Agentic and LLM Top 10 and MITRE ATLAS, compiled into a default-deny policy that enforces it at runtime, with a blast radius you already know before anything goes wrong, and an evidence chain an auditor can walk line by line. Not a report you file and forget. A living contract between the design and the running system.
That’s the moat, and it’s stubbornly hard to copy by piling on rules: a per-resource linter has no system model to attest, and a pure-LLM reviewer has nothing deterministic to enforce. Attestral holds both ends, the reasoning and the proof.
Try it. It works.
That’s the whole pitch. One pip install, one command, and you are reviewing the agents you already run.