Launching today
Cynative Security Research Agent
Ask your cloud anything without breaking prod. Read-only.
50 followers
Ask your cloud anything without breaking prod. Read-only.
50 followers
Open-source AI CLI that answers security questions across cloud, code and runtime - GitHub, GitLab, AWS, GCP, Azure, K8s. Ask in plain language: "what's publicly exposed that shouldn't be?" or "can my CI escalate to cloud admin?". Read-only by construction: every call is resolved to its IAM actions and authorized against a read-only policy before credentials attach. It can't modify your infra even if asked. Unlike MCP tools, it writes JS in a sandboxed runtime - a script per turn, not one call.
Cynative Security Research Agent
A debate we had: do we just document how to scope credentials right and leave it to you - or enforce read-only even if you run it with admin creds? We went with enforcing it, despite the tradeoff of keeping up as providers ship new APIs. Pulling permission definitions from each provider (a few MB, daily by default) instead of a static map keeps coverage current automatically. Every API call is resolved to the IAM actions it needs and authorized against the provider's own policy definitions before a credential is attached, failing closed on anything it can't classify. The allowed sets come from the providers themselves (AWS IAM action simulation, GCP role permission eval, Azure RBAC role definitions, the K8s cluster own live view RBAC role) so coverage tracks the APIs as they grow. On AWS, assumed-role credentials are additionally re-vended through STS AssumeRole scoped to SecurityAudit. Every request host is pinned to its mapped service and region and the resolved IP is verified before connecting, so the agent can only reach your own infra. The code execution has no host access and every call is enforced to go through the read-only action gate or it fails.
Cynative Security Research Agent
I'll be around, happy to answer any question.
Cynative Security Research Agent
@etiennegarcia Thanks!
Hi Shaked, the reassurance that it only ever reads and never touches my systems is exactly what would make me brave enough to really poke around a live setup. That peace of mind matters more than people tend to admit.
Cynative Security Research Agent
@robin_de_lacroix Thank you Robin, I'm glad you like our approach!