{
  "markdown": "# Cyntrisec CLI\n\n[![PyPI](https://img.shields.io/pypi/v/cyntrisec?style=flat-square&logo=pypi&logoColor=white)](https://pypi.org/project/cyntrisec/)\n[![License](https://img.shields.io/badge/license-Apache%202.0-blue?style=flat-square)](LICENSE)\n[![Status](https://img.shields.io/badge/status-historical-lightgrey?style=flat-square)](https://pypi.org/project/cyntrisec/)\n\n<!-- mcp-name: io.github.cyntrisec/cyntrisec -->\n\n> **Historical pre-company project.** `cyntrisec-cli` was created before Cyntrisec narrowed its company focus to EphemeralML and AIR v1. It is not a current Cyntrisec product, support surface, or commercial offering. The PyPI package name `cyntrisec`, CLI command `cyntrisec`, and MCP server ID `io.github.cyntrisec/cyntrisec` are retained only to avoid breaking historical installs.\n\n![image-download](https://github.com/user-attachments/assets/83a8b7d2-23c8-4e6e-a471-2e6a0a6f93e7)\n\n> [!CAUTION]\n> **Historical Software Disclaimer**: This tool is no longer an active Cyntrisec product. It is provided \"as is\", without warranty of any kind.\n> While the CLI is a read-only analysis tool by default, the user assumes all responsibility for any actions taken based on its findings.\n> **Always review** generated remediation plans and Terraform code before application.\n\nHistorical AWS capability graph analysis and attack path discovery CLI.\n\nA read-only CLI tool that historically:\n- Scans AWS infrastructure via AssumeRole\n- Builds a capability graph (IAM, network, dependencies)\n- Discovers attack paths from internet to sensitive targets\n- Prioritizes fixes by ROI (security impact + cost savings)\n- Identifies unused capabilities (blast radius reduction)\n- Outputs deterministic JSON with proof chains\n## Demo\n\n[![Cyntrisec Demo](https://img.youtube.com/vi/-g3PjWyK3mo/0.jpg)](https://www.youtube.com/watch?v=-g3PjWyK3mo)\n\n> *Watch how to discover attack paths and generate fixes using natural language with Claude MCP.*\n## Architecture\n\n```text\n+----------------------------------------------------------------------------------+\n|                                   CYNTRISEC CLI                                   |\n+----------------------------------------------------------------------------------+\n| CLI Layer (Typer)                                                                 |\n|   scan   analyze   cuts   waste   report   comply   can   diff   serve   ...      |\n+-----------------------------+----------------------------------------------------+\n| Core Engine                 | Storage (local)                                     |\n|  - AWS collectors           |  ~/.cyntrisec/scans/<scan_id>/                      |\n|  - Normalization/schema     |    snapshot.json, assets.json, relationships.json   |\n|  - GraphBuilder -> AwsGraph |    findings.json, attack_paths.json                 |\n|  - Path search -> paths     |  ~/.cyntrisec/scans/latest -> <scan_id>             |\n|  - Min-cut + Cost (ROI)     |  (Windows fallback: latest is a file)               |\n+-----------------------------+----------------------------------------------------+\n| Outputs: JSON/agent, HTML report, remediation plan + Terraform hints              |\n+----------------------------------------------------------------------------------+\n```\n\n<!-- Legacy Unicode diagram (kept for reference; may render oddly in some environments) -->\n<!--\n```\n┌─────────────────────────────────────────────────────────────────────────────┐\n│                              CYNTRISEC CLI                                  │\n├─────────────────────────────────────────────────────────────────────────────┤\n│                                                                             │\n│  ┌─────────────────────────────────────────────────────────────────────┐    │\n│  │                         CLI Layer (typer)                           │    │\n│  │  ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐        │    │\n│  │  │  scan   │ │ analyze │ │  cuts   │ │  waste  │ │ report  │ ...    │    │\n│  │  └────┬────┘ └────┬────┘ └────┬────┘ └────┬────┘ └────┬────┘        │    │\n│  └───────┼──────────┼──────────┼──────────┼──────────┼─────────────────┘    │\n│          │          │          │          │          │                      │\n│  ┌───────▼──────────▼──────────▼──────────▼──────────▼────────────────┐     │\n│  │                         Core Engine                                │     │\n│  │  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐              │     │\n│  │  │    Graph     │  │    Paths     │  │  Compliance  │              │     │\n│  │  │  (AwsGraph)  │  │  (BFS/DFS)   │  │  (CIS/SOC2)  │              │     │\n│  │  └──────────────┘  └──────────────┘  └──────────────┘              │     │\n│  │  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐              │     │\n│  │  │    Cuts      │  │    Waste     │  │  Simulator   │              │     │\n│  │  │  (ROI/Min)   │  │  (Unused)    │  │  (IAM Eval)  │              │     │\n│  │  └──────────────┘  └──────────────┘  └──────────────┘              │     │\n│  │  ┌──────────────┐                                                  │     │\n│  │  │ Cost Engine  │                                                  │     │\n│  │  │ (Estimator)  │                                                  │     │\n│  │  └──────────────┘                                                  │     │\n│  └────────────────────────────────────────────────────────────────────┘     │\n│          │                                                                  │\n│  ┌───────▼────────────────────────────────────────────────────────────┐     │\n│  │                         AWS Layer                                  │     │\n│  │  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐              │     │\n│  │  │  Collectors  │  │  Normalizers │  │ Relationship │              │     │\n│  │  │  (EC2, IAM,  │  │  (Asset →    │  │   Builder    │              │     │\n│  │  │   RDS, ...)  │  │   Schema)    │  │              │              │     │\n│  │  └──────────────┘  └──────────────┘  └──────────────┘              │     │\n│  └────────────────────────────────────────────────────────────────────┘     │\n│          │                                          │                       │\n│  ┌───────▼──────────────────────┐   ┌──────────────▼──────────────────┐     │\n│  │      Storage Layer           │   │         MCP Server              │     │\n│  │  ┌────────────┐ ┌─────────┐  │   │  ┌──────────────────────────┐   │     │\n│  │  │ Filesystem │ │ Memory  │  │   │  │  Tools: get_scan_summary │   │     │\n│  │  │ (~/.cyntri │ │ (tests) │  │   │  │  get_attack_paths, ...   │   │     │\n│  │  │   sec/)    │ │         │  │   │  └──────────────────────────┘   │     │\n│  │  └────────────┘ └─────────┘  │   │                                 │     │\n│  └──────────────────────────────┘   └─────────────────────────────────┘     │\n│                                                                             │\n└─────────────────────────────────────────────────────────────────────────────┘\n                                      │\n                                      ▼\n┌─────────────────────────────────────────────────────────────────────────────┐\n│                            AWS Account                                      │\n│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐         │\n│  │     IAM     │  │     EC2     │  │     RDS     │  │     S3      │  ...    │\n│  │  (Roles,    │  │ (Instances, │  │ (Databases) │  │  (Buckets)  │         │\n│  │  Policies)  │  │  SGs, VPCs) │  │             │  │             │         │\n│  └─────────────┘  └─────────────┘  └─────────────┘  └─────────────┘         │\n└─────────────────────────────────────────────────────────────────────────────┘\n```\n-->\n\n### Data Flow\n\n```text\nCLI (scan) --AssumeRole--> AWS Session --Describe/Get/List--> AWS APIs (read-only)\n     |\n     v\nCollectors -> normalize -> Assets + Relationships -> AwsGraph\n                                                |\n                                                v\n                                   Attack path search (BFS/DFS)\n                                                |\n                                                v\n                                   Min-cut (remediation cuts)\n                                                |\n                                                v\n                                      Cost engine (ROI)\n\nLocal artifacts: ~/.cyntrisec/scans/<scan_id>/*.json\n```\n\n<!-- Legacy Unicode diagram (kept for reference; may render oddly in some environments) -->\n<!--\n```\n┌──────────┐    AssumeRole     ┌──────────┐    Describe/Get/List     ┌─────────┐\n│   CLI    │ ─────────────────▶│   AWS    │ ◀─────────────────────▶│  APIs   │\n│  (scan)  │                   │  Session │                          │(read-only)\n└────┬─────┘                   └──────────┘                          └─────────┘\n     │\n     ▼\n┌──────────┐    normalize      ┌──────────┐    build edges    ┌──────────────┐\n│Collectors│ ─────────────────▶│  Assets  │ ─────────────────▶│Relationships│\n└──────────┘                   └──────────┘                   └──────┬───────┘\n                                                                     │\n     ┌───────────────────────────────────────────────────────────────┐\n     ▼\n┌──────────┐    BFS/DFS        ┌──────────┐    min-cut        ┌──────────────┐\n│ AwsGraph │ ─────────────────▶│  Attack  │ ─────────────────▶│ Remediation │\n│          │                   │  Paths   │                   │    Cuts      │\n└──────────┘                   └──────────┘                   └──▲───────────┘\n                                                                 │ (ROI)\n                                                          ┌──────┴───────┐\n                                                          │ Cost Engine  │\n                                                          └──────────────┘\n```\n-->\n\n## Installation\n\n```bash\npip install cyntrisec\n```\n\n### Windows PATH Fix\n\nIf you see \"cyntrisec is not recognized\", the Scripts folder isn't on PATH:\n\n```powershell\n# Option 1: Run with python -m\npython -m cyntrisec --help\n\n# Option 2: Add to PATH for current session\n$env:PATH += \";$env:APPDATA\\Python\\Python311\\Scripts\"\n```\n\n## Quick Start\n\n> **Prerequisite**: Ensure you have [AWS CLI](https://aws.amazon.com/cli/) installed and configured with credentials (e.g., `aws configure`) or environment variables set. `terraform` is required for the setup step.\n\n```bash\n# 1. Create the read-only IAM role in your account\ncyntrisec setup iam 123456789012 --output role.tf\n\n# 2. Apply the Terraform\ncd your-infra && terraform apply\n\n# 3. Run a scan\ncyntrisec scan --role-arn arn:aws:iam::123456789012:role/CyntrisecReadOnly\n\n# 4. View attack paths\ncyntrisec analyze paths --min-risk 0.5\n\n# 5. Find minimal fixes (prioritized by ROI)\ncyntrisec cuts --format json\n\n# 6. Generate HTML report\ncyntrisec report --output report.html\n```\n\n## Commands\n\n### Core Analysis\n\n| Command | Description |\n|---------|-------------|\n| `scan` | Scan AWS infrastructure |\n| `analyze paths` | View attack paths |\n| `analyze findings` | View security findings |\n| `analyze stats` | View scan statistics |\n| `analyze business` | Business entrypoint analysis |\n| `report` | Generate HTML/JSON report |\n\n### Setup & Validation\n\n| Command | Description |\n|---------|-------------|\n| `setup iam` | Generate IAM role Terraform |\n| `validate-role` | Validate IAM role permissions |\n\n### Remediation\n\n| Command | Description |\n|---------|-------------|\n| `cuts` | Find minimal fixes (Cost & ROI prioritized) |\n| `waste` | Find unused IAM permissions |\n| `remediate` | Generate or optionally apply Terraform plans (gated) |\n\n### Policy Testing\n\n| Command | Description |\n|---------|-------------|\n| `can` | Test \"can X access Y?\" |\n| `diff` | Compare scan snapshots |\n| `comply` | Check CIS AWS / SOC2 compliance |\n\n### Agentic Interface\n\n| Command | Description |\n|---------|-------------|\n| `manifest` | Output machine-readable capabilities |\n| `explain` | Natural language explanations |\n| `ask` | Query scans in plain English |\n| `serve` | Run as MCP server for AI agents |\n\n## MCP Server Mode\n\nThe historical CLI can still run as an MCP server for compatibility with existing local setups:\n\n```bash\n# Install with MCP support (now included by default)\npip install cyntrisec\n```\n\n```bash\ncyntrisec serve              # Start stdio server\ncyntrisec serve --list-tools # List available tools\n```\n\n### MCP Tools (15)\n\n| Category | Tool | Description |\n|----------|------|-------------|\n| **Discovery** | `list_tools` | List all available tools |\n| | `set_session_snapshot` | Set active snapshot for session |\n| | `get_scan_summary` | Get summary of latest AWS scan |\n| **Assets** | `get_assets` | Get assets with type/name filtering |\n| | `get_relationships` | Get relationships between assets |\n| | `get_findings` | Get security findings with severity filtering |\n| **Attack Paths** | `get_attack_paths` | Get attack paths with risk scores |\n| | `explain_path` | Detailed hop-by-hop path breakdown |\n| | `explain_finding` | Detailed finding explanation |\n| **Remediation** | `get_remediations` | Find optimal fixes for attack paths |\n| | `get_terraform_snippet` | Generate Terraform code for remediation |\n| **Access** | `check_access` | Test if principal can access resource |\n| | `get_unused_permissions` | Find unused IAM permissions |\n| **Compliance** | `check_compliance` | Check CIS AWS or SOC 2 compliance |\n| | `compare_scans` | Compare scan snapshots |\n\n### Claude Desktop\n\n**MacOS**: `~/Library/Application Support/Claude/claude_desktop_config.json`\n**Windows**: `%APPDATA%\\Claude\\claude_desktop_config.json`\n\n```json\n{\n  \"mcpServers\": {\n    \"cyntrisec\": {\n      \"command\": \"python\",\n      \"args\": [\"-m\", \"cyntrisec\", \"serve\"]\n    }\n  }\n}\n```\n\n### Claude Code (CLI)\n\nRun the following command to configure the server:\n\n```bash\nclaude mcp add cyntrisec -- python -m cyntrisec serve\n```\n\n### Google Gemini / Antigravity\n\nLocate your agent configuration (e.g., `~/.gemini/antigravity/mcp_config.json`) and add:\n\n```json\n{\n  \"mcpServers\": {\n    \"cyntrisec\": {\n      \"command\": \"python\",\n      \"args\": [\"-m\", \"cyntrisec\", \"serve\"]\n    }\n  }\n}\n```\n\n## Trust & Safety\n\n### Read-Only Guarantees\n\nThis tool makes **read-only API calls** to your AWS account. The IAM role\nshould have only `Describe*`, `Get*`, `List*` permissions.\n\n### No Data Exfiltration\n\nAll data stays on your local machine. Nothing is sent to external servers.\nScan results are stored in `~/.cyntrisec/scans/`.\n\n### No Auto-Remediation (Default Safe Mode)\n\nBy default, Cyntrisec is **read-only** and **does not modify** your AWS infrastructure.\n\n- It **analyzes** your account using read-only APIs.\n- It can **generate** remediation artifacts (e.g., Terraform modules) for you to review.\n- It does **not** apply changes automatically.\n\n### Optional Remediation Execution (Explicit Opt-In)\n\nCyntrisec includes an **explicitly gated** path that can execute Terraform **only if you intentionally enable it**.\n\nThis mode is:\n- **Disabled by default**\n- Requires `--enable-unsafe-write-mode`\n- Requires an additional explicit flag (e.g. `--execute-terraform`) to run Terraform\n- Intended for controlled environments (sandbox / CI with approvals), not unattended production\n\nIf you do not pass these flags, Cyntrisec will never run `terraform apply`.\n\n### Write Operations\n\nCyntrisec makes **no AWS write API calls** during scanning and analysis.\n\nThe only supported \"write\" behavior is optional execution of Terraform **locally on your machine**, and only when explicitly enabled via unsafe flags.\n\nEvery AWS API call is logged in CloudTrail under session name `cyntrisec-cli`.\n\n## Trust & Permissions\n\nCyntrisec runs with a read-only IAM role. Generate the recommended policy with\n`cyntrisec setup iam <ACCOUNT_ID>` and keep permissions to `Describe*`, `Get*`,\nand `List*`. Live modes (`waste --live`, `can --live`) require extra IAM\npermissions; the generated policy and docs cover those additions.\n\n## Output Format\n\nPrimary output is JSON to stdout. When stdout is not a TTY, the CLI automatically switches to JSON:\n\n```bash\ncyntrisec analyze paths --format json | jq '.paths[] | select(.risk_score > 0.7)'\n```\n\nAgent-friendly output wraps results in a structured envelope:\n\n```bash\ncyntrisec analyze paths --format agent\n```\n\n```json\n{\n  \"schema_version\": \"1.0\",\n  \"status\": \"success\",\n  \"data\": {...},\n  \"artifact_paths\": {...},\n  \"suggested_actions\": [...]\n}\n```\n\n## Exit Codes\n\n| Code | Meaning |\n|------|---------|\n| 0 | Success / compliant |\n| 1 | Findings / regressions / denied |\n| 2 | Usage error |\n| 3 | Transient error (retry) |\n| 4 | Internal error |\n\nUse in CI/CD:\n\n```bash\ncyntrisec scan --role-arn $ROLE_ARN || exit 1\ncyntrisec diff || echo \"Regressions detected\"\n```\n\n## Storage\n\nScan results are stored locally:\n\n```text\n~/.cyntrisec/\n|-- scans/\n|   |-- 2026-01-17_123456_123456789012/\n|   |   |-- snapshot.json\n|   |   |-- assets.json\n|   |   |-- relationships.json\n|   |   |-- findings.json\n|   |   `-- attack_paths.json\n|   `-- latest -> 2026-01-17_...\n`-- config.yaml\n```\n\n<!-- Legacy Unicode tree (kept for reference; may render oddly in some environments) -->\n<!--\n```\n~/.cyntrisec/\n├── scans/\n│   ├── 2026-01-17_123456_123456789012/\n│   │   ├── snapshot.json\n│   │   ├── assets.json\n│   │   ├── relationships.json\n│   │   ├── findings.json\n│   │   └── attack_paths.json\n│   └── latest -> 2026-01-17_...\n└── config.yaml\n```\n-->\n\n## Versioning\n\nThis project follows Semantic Versioning. See `CHANGELOG.md` for release notes.\n\n## License\n\nApache-2.0\n\n## Links\n\n- [PyPI Package](https://pypi.org/project/cyntrisec/)\n- [Historical Source](https://github.com/cyntrisec/cyntrisec-cli)\n",
  "bytes": 17778,
  "sha": "b698c29d10e6917671df32340e0b7445de66bd4b3079aaccc53a785e75571ce8",
  "repo_slug": "cyntrisec/cyntrisec-cli",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_cyntrisec_cyntrisec_5745c841/readme"
}