The security scanner for AI agents and MCP servers.

How it works

One command. Seven phases. Three layers.

Every scan runs the same pipeline: ingest everything the agent touches, build one system model, trace what can actually reach what, sweep the graph with typed rule packs grounded in current attack research, then seal the evidence and compile the verdict into runtime policy. Follow any phase to watch it run live.

Inside the pipeline, three review layers keep their labels: deterministic rules always run, a local ML tier scores the language surfaces offline, and an LLM judge cross-examines findings when you bring a key. Every finding carries its origin, so a reviewer knows what is reproducible fact, what is a score, and what is reasoning.

What only a whole-fleet model catches

It builds a model of your whole fleet, then reasons across it.

Not a config-by-config scan. Attestral ingests your MCP servers, prompts, cloud, and Kubernetes into one graph of components, edges, and trust boundaries. That is how it sees the path a single injected sentence can take: from an untrusted input, through a shell, across the boundary into your cloud. Hover a node to see its reach, or trace the attack path.

Because the model knows what every surface can reach, findings are not rated in isolation. A prompt-injection hit is raised to critical only when the surface it sits on can reach a secret or an egress channel, and left low when it reaches nothing worth taking. A cross-server tool-name collision is raised when one side is a lower-trust, mutable package positioned to shadow a trusted tool, and look-alike names (a Cyrillic letter, a zero-width space) are folded so an impersonation cannot hide behind a spelling an exact match would miss.

New in the system model

The system model, deepened.

The same graph of components, edges, and trust boundaries now reasons in five new ways. Each is deterministic, cites a real control, and ships with a fixture in the repo you can run today. Two of them read further than any single-config scan: they walk the graph rather than the capability set, so they name a path and clear when a mitigation sits on it.

Honest by default. These deepen the design-time review; they do not replace it. The taint walk and the reachability behind it are sound over-approximations over declared capability and declared edges, necessary, not sufficient, for exploitation, and a posture grade summarizes the reviewed design, not the running system or the code inside each tool.

Real systems · aggregate, no repo named

Scanned in the wild: 33 popular MCP servers.

The rest of the evaluation is a synthetic suite with an answer key. This is different: Attestral run against 33 of the most widely used public MCP servers, at pinned commits. It reviews the documented launch configuration, the mcpServers block users copy from a README, and every hit is a configuration default, not an exploited vulnerability. The aggregate below carries no embargo; per-repo results stay under responsible disclosure until each maintainer has been notified.

What those 23 shipped configs contain (percentages are of the 23):

The headline is the compositional one. The lethal trifecta and toxic-flow hits are fleet-level: they exist only once you model several servers, and in one case a committed sub-agent, together. That is the finding no config-by-config scanner produces, and it showed up in nearly a quarter of the configs that had enough to model.

We have since widened this to 390 servers, and the compositional rate held at one in three. Two per-server numbers above were corrected on the way: the no-auth rate was an OAuth false positive and fell to under 1% once the check became OAuth-aware, and monorepo README merges can manufacture a false "fleet." The trifecta survived every correction.

A named per-repo gallery, one screenshot of a genuine trifecta in a project you recognize, publishes as a second wave, after each maintainer has been given a responsible-disclosure window. We would rather be fair to maintainers than fast to a headline.

Don't take the demo's word for it. Paste your own config.

Drop in an .mcp.json or claude_desktop_config.json and twenty-seven of the agentic checks from the rule pack, the same typed matchers the engine runs, review it right here. Everything happens in this tab: the page makes no network request with what you paste. The CLI goes further, with the cloud packs, attack paths, prompt surfaces, and the evidence chain; the playground runs whole fleet scenarios in the browser.

Why not just Checkov or Trivy?

Keep using them. They are excellent at cloud infrastructure, and attestral is not out to replace them; it scans the same Terraform and Kubernetes with a solid CIS-grounded pack of its own. But those tools were built before agents had tools. They do not parse an .mcp.json, they cannot tell that a tool description is quietly asking the model to read your SSH key, and they have no concept of the trust boundary between an agent and the shell it can call. Attestral does one thing they structurally can't: it builds a system model of your whole agent fleet, so it catches the toxic flows that only exist across servers, where private data meets an exit and one injected sentence walks out with your secrets.

The honest version: run Checkov and Trivy for cloud depth, and run attestral for everything that lives above the infrastructure, the agent, its tools, and the prompts that drive them. It happens to cover the cloud underneath too.

293 checks, and the balance is the strategy.

We do not chase rule count. Every check earns its place with a real control and a fixture. The agentic and cross-boundary rules are the hard-to-copy core, the surfaces nobody else models; the cloud packs are deliberately good enough that you need no second scanner, never an arms race.

104 agentic and cross-boundary checks that are genuinely hard to copy, over 189 cloud checks across AWS, Azure, GCP, and Kubernetes, mapped to 21 named control families across the six standards it cites. Depth where it counts most, parity where it just has to be solid. The newest checks reach further than a config scan: the information-flow lattice that turns the lethal trifecta into a discharge-able property (above), known-CVE scanning of the agent's own dependency manifest (requirements.txt / pyproject / package.json, the surface a config review never reads), and the cross-boundary flows a system model uniquely sees: untrusted input written into agent long-term memory, a sampling-capable server driving tools on another with no human checkpoint, and indirect injection reaching cloud credentials.

Recall you cannot self-grade. The in-repo benchmark scores 174/174, but its labels come from our own fixtures, so we also measure against eight published 2025-2026 CVE advisories labelled from the advisory, not our output. That number is allowed to fall below 100% and does; each miss is itemised with a concrete path to close it. It is how a tool whose product is trust should report its reach.

Proven on real Terraform, tuned against first-scan noise. A pinned regression suite runs the cloud packs against Bridgecrew's deliberately-vulnerable TerraGoat corpus, so what fires today keeps firing tomorrow. The ingester also reads security-group CIDRs direction-aware: the world-open egress block nearly every production repo ships never reads as "open to the world", so a first scan of real infrastructure does not open with a false alarm. A benign real-Terraform design sits in the CI benchmark to keep it that way.

The finding that lives in no single file.

Every server below is individually defensible, and a config-by-config scanner would wave them all through. The risk is compositional: the moment one agent session can read private data and reach an exit, a single injected sentence anywhere in its inputs becomes an exfiltration. Toggle the fleet and watch the pack's combination rules evaluate it live, using the same capability groups attestral scan applies to your real configs.

Fleet-level findings only: the per-server findings these toggles would also raise (a shell server is ATL-103 all by itself) are left out here to keep the composition visible. On a real scan the full attack path is also synthesized end to end, entry to pivot to impact.

The flagship

...and no single repo.

Real agent estates span repositories: a data reader in one, an ops runner in another, a notifier in a third. Each repo passes its own review. The attack chain completes only across the boundary, and only a model that spans them can see it. Assign each tool to a repo and watch every per-repo scan stay green while attestral fleet lights up.

ATL-213 fires only when the fleet completes a chain that no single repo completes alone. Move all three tools into one repo and it goes silent, because that repo's own scan already catches the flow. It is never noise, and it is the one finding a per-repo scanner structurally cannot produce.

Three review layers. Run each one.

Regulated buyers can't accept "the AI said so." Attestral separates what is deterministic from what is model-reasoned, and every finding carries its origin. Pick a layer and watch it run against the same insecure agent, real commands, the output the CLI actually prints.

Tamper with the record. Watch it break.

Every finding commits to a SHA-256 chain: entry N hashes its own canonical JSON together with the hash of entry N-1, from a zero genesis. The head is the integrity commitment for the run. This recomputes live in your browser, the same construction attestral verify uses. Edit one entry and every hash after it stops matching.

That is integrity: the chain is internally consistent. A determined editor could recompute every hash and forge a fresh head, and this check alone would still pass. So attestral sign adds authenticity: an Ed25519 signature over the head, in a DSSE envelope (the Sigstore / in-toto envelope). attestral verify --public-key then catches a recomputed forgery, because re-sealing the chain needs the reviewer's private key. Tamper-evident, and now provably the chain they sealed.

Then the policy watches. Drift gets caught.

The attested design compiled to a default-deny policy. Now runtime telemetry is diffed against it, in batch or as a continuous sidecar: attestral drift --stdin reads a live telemetry pipe and --watch tails the log, streaming drift the moment it happens. What the review saw passes, and what it never saw is drift, each tagged with the rule that caught it: an unattested server, a rug-pull where the served tool schema no longer matches the attested manifest, a runaway loop. This is the loop no scanner and no gateway closes on its own.

Honest by default

What it does not do.

A tool you can trust is one that is honest about its edges. In a field full of overclaiming, the tool that documents where it stops is the one a skeptical engineer keeps. So here are the limits, stated plainly, not buried in a footnote.

Start in sixty seconds.

No account, no server, no API key. The whole attest → prove → enforce → detect loop runs on your laptop, under Apache 2.0.

Gate every deploy in CI with the GitHub Action: