AI agent & MCP security
The security scanner for AI agents and MCP servers.
Attestral reads your MCP configs, system prompts, and tool descriptions, builds one system model, and reviews the agentic surfaces most scanners never look at. It models the cloud and Kubernetes your agent runs on too, so it can see the trust boundary between them. Findings map to NIST, ASVS, SOC 2, CIS, and OWASP Agentic, and land in a tamper-evident evidence chain.
Scan the MCP servers you've already installed.
No account, no API key, fully offline. It reads the MCP configs your agents already use (Claude Desktop, Cursor, .mcp.json) and reviews every server it finds.
[CRITICAL] ATL-103 Shell-capable MCP server configured (mcp_server.shell)
[CRITICAL] ATL-103 Shell-capable MCP server configured (mcp_server.deploy)
[HIGH ] ATL-101 MCP server uses non-TLS transport (mcp_server.jira)
[HIGH ] ATL-102 Filesystem MCP server rooted at a broad path (mcp_server.filesystem)
[HIGH ] ATL-105 MCP server auto-installs packages at launch (mcp_server.filesystem)
[HIGH ] ATL-105 MCP server auto-installs packages at launch (mcp_server.web)
[MEDIUM ] ATL-104 Secrets passed to MCP server via environment (mcp_server.jira)
[MEDIUM ] ATL-106 MCP server pinned to a mutable tag (mcp_server.deploy)
[MEDIUM ] ATL-107 MCP server grants outbound network or browser access (mcp_server.web)
6 components · 9 findings · 2 critical, 4 high, 3 medium
A design review of the vulnerable-agent example in the repo: two small config files, nine design findings, zero cloud credentials required. Point it at your own machine with attestral scan --local, or add --ml to also catch the prompt-injection payload hidden in a tool description.
prev 000000…0000
prev 9f41c2…a07e
prev b8d005…44c1
entries 14 · verified
Each entry commits to the one before it. If anyone edits a past finding, the head stops matching, and attestral verify will catch it offline. No server involved.
Why not just Checkov or Trivy?
Keep using them. They are excellent at cloud infrastructure, and attestral is not out to replace them; it scans the same Terraform and Kubernetes with a solid CIS-grounded pack of its own. But those tools were built before agents had tools. They do not parse an .mcp.json, they cannot tell that a tool description is quietly asking the model to read your SSH key, and they have no concept of the trust boundary between an agent and the shell it can call. Attestral does one thing they structurally can't: it builds a system model of your whole agent fleet, so it catches the toxic flows that only exist across servers, where private data meets an exit and one injected sentence walks out with your secrets.
| Capability | Checkov · Trivy · tfsec | Attestral |
|---|---|---|
| Cloud IaC misconfiguration | Mature and deep. Their home turf. | ✓A CIS-grounded pack across AWS, Azure, GCP, and Kubernetes. |
| MCP server configs (shell access, transport, secrets) | Not modeled. | ✓First-class components in the system model. |
| System prompts and tool descriptions | Not parsed. | ✓Reviewed, and scored for prompt injection. |
| Agent-to-tool trust boundaries | No concept of one. | ✓The center of the graph attestral builds. |
| Prompt injection in agentic text | Out of scope. | ✓Optional local ML classifier, fully offline. |
| Toxic flows across the tool fleet (lethal trifecta) | No fleet model. | ✓Named source and sink servers, mapped over the graph. |
| Memory poisoning & risky agent skills | Not modeled. | ✓World-writable CLAUDE.md, vector stores, SKILL.md grants. |
| Runtime drift & tool rug-pulls | Static only. | ✓Attested design compiles to a policy; drift is caught. |
| Tamper-evident audit evidence | Report only. | ✓SHA-256 evidence chain you verify offline. |
The honest version: run Checkov and Trivy for cloud depth, and run attestral for everything that lives above the infrastructure, the agent, its tools, and the prompts that drive them. It happens to cover the cloud underneath too.
Design review is where security is cheapest. It is also where the tooling is oldest.
The enterprise threat modeling market just consolidated into a single private-equity-owned vendor, priced for the Fortune 500 and built on decade-old architecture. Everyone else reviews designs in spreadsheets and wiki templates: slow, inconsistent, and with nothing to show an auditor. And the fastest-growing attack surface, AI agents and their tools, is the part legacy platforms understand least.
A security review you can't prove happened is an opinion, not a control.
Three layers. Nothing hidden.
Regulated buyers can't accept "the AI said so." Attestral separates what is deterministic from what is model-reasoned, and labels every finding with its origin.
Typed rules over a unified model
Terraform, Kubernetes manifests, MCP configs, agent instructions, and system prompts become one graph of components, edges, and trust boundaries. A CIS-grounded pack of typed YAML rules fires against that graph, spanning AWS, Azure, GCP, Kubernetes, and the agentic surfaces nobody else models. There is no eval anywhere in the path, and an unknown matcher simply never matches.
Local ML + LLM, clearly tagged
An optional local DeBERTa classifier scores agentic text surfaces (MCP tool descriptions, system prompts) for prompt injection, offline. A frontier model then reviews the same graph for design-level gaps rules can't express: trust-boundary violations, tool-permission escalation, handoff confusion. Both optional, both always labeled by origin.
A chain you can hand to an auditor
Findings, mitigations, and sign-offs get committed to a SHA-256 hash chain. Every finding carries its NIST 800-53, ASVS, SOC 2, and OWASP Agentic references. Export the review once and anyone can verify it offline, years later. Emit it as SARIF and the same findings land in your GitHub Security tab and right on the pull request.
[CRITICAL] ATL-003 IAM policy grants wildcard actions (aws_iam_policy.admin)
[CRITICAL] ATL-103 Shell-capable MCP server configured (mcp_server.shell)
[HIGH ] ATL-102 Filesystem MCP server rooted at a broad path (mcp_server.filesystem)
7 components · 10 findings · chain head c31f8e…9bd4
$ attestral verify review.json
chain VALID ✅
Built for the review board, not just the terminal.
PR design-diff
Each pull request is diffed against the system model. New attack surface (a fresh public edge, a broader tool permission) gets flagged before merge instead of at the annual review.
MCP and agent coverage first
Tool servers, capability scopes, and multi-agent handoffs are first-class parts of the model, not an afterthought bolted onto a diagramming canvas.
Model import
Bring your existing threat models with you. Import from legacy platform exports and keep your review history, chain-sealed from day one. On the roadmap.
The review is the policy. The policy is the proof.
This is the depth that makes a review audit-grade, not just a linter. Scanners stop at findings. Gateways enforce policies nobody reviewed. Attestral makes them the same artifact. The reviewed system model compiles into an mcp-guard runtime policy stamped with the review's chain head, and anything the review never saw counts as drift.
Attest
Terraform, Kubernetes, and MCP configs become one system model, reviewed against typed rules and (optionally) a local ML classifier and LLM reasoning. Findings are hash-chained.
Enforce
The reviewed model compiles to a default-deny policy. Denied capabilities carry the rule id that denied them, filesystem roots narrow to what was reviewed, and the policy header binds to the review's chain head.
Prove
Runtime telemetry gets diffed against the compiled policy. An unattested server, a denied invocation, an out-of-scope path: each one is a drift finding. Deployment and review can no longer quietly diverge.
wrote policy.yaml · default deny · 1 allowed, 3 denied
[DENY ] shell (denied by attested design review: ATL-103)
$ attestral drift policy.yaml events.jsonl --fail-on-drift
[CRITICAL] DRF-001 Unattested server observed at runtime (mcp_server.jira-sync)
[HIGH ] DRF-003 Filesystem access outside attested roots (mcp_server.docs)
DRIFT: deployment no longer matches the attested design
Start in sixty seconds.
No account, no server, no API key. The whole attest → prove → enforce → detect loop runs on your laptop, under Apache 2.0.
$ attestral scan ./my-project # attest: one system model, reviewed
$ attestral verify review.json # prove: chain VALID ✅
$ attestral compile ./my-project -o policy.yaml # enforce: default-deny policy
$ attestral drift policy.yaml events.jsonl # detect: runtime vs. reviewed design
Gate every deploy in CI with the GitHub Action:
- uses: attestral-labs/attestral@v1
with:
policy: policy.yaml
events: events.jsonl