cyntrisec/cyntrisec-cli

> **Historical pre-company project.** cyntrisec-cli was created before Cyntrisec narrowed its company focus to EphemeralML and AIR v1. It is not a current Cyntrisec product, support surface, or commercial offering. The PyPI package name cyntrisec, CLI command cyntrisec, and MCP server ID io.github.cyntrisec/cyntrisec are retained only to avoid breaking historical installs.
> [!CAUTION]
> **Historical Software Disclaimer**: This tool is no longer an active Cyntrisec product. It is provided "as is", without warranty of any kind.
> While the CLI is a read-only analysis tool by default, the user assumes all responsibility for any actions taken based on its findings.
> **Always review** generated remediation plans and Terraform code before application.
Historical AWS capability graph analysis and attack path discovery CLI.
A read-only CLI tool that historically:
- Scans AWS infrastructure via AssumeRole
- Builds a capability graph (IAM, network, dependencies)
- Discovers attack paths from internet to sensitive targets
- Prioritizes fixes by ROI (security impact + cost savings)
- Identifies unused capabilities (blast radius reduction)
- Outputs deterministic JSON with proof chains
Demo
> *Watch how to discover attack paths and generate fixes using natural language with Claude MCP.*
Architecture
Data Flow
Installation
Windows PATH Fix
If you see "cyntrisec is not recognized", the Scripts folder isn't on PATH:
Quick Start
> **Prerequisite**: Ensure you have AWS CLI installed and configured with credentials (e.g., aws configure) or environment variables set. terraform is required for the setup step.
Commands
Core Analysis
| Command | Description |
|---------|-------------|
| scan | Scan AWS infrastructure |
| analyze paths | View attack paths |
| analyze findings | View security findings |
| analyze stats | View scan statistics |
| analyze business | Business entrypoint analysis |
| report | Generate HTML/JSON report |
Setup & Validation
| Command | Description |
|---------|-------------|
| setup iam | Generate IAM role Terraform |
| validate-role | Validate IAM role permissions |
Remediation
| Command | Description |
|---------|-------------|
| cuts | Find minimal fixes (Cost & ROI prioritized) |
| waste | Find unused IAM permissions |
| remediate | Generate or optionally apply Terraform plans (gated) |
Policy Testing
| Command | Description |
|---------|-------------|
| can | Test "can X access Y?" |
| diff | Compare scan snapshots |
| comply | Check CIS AWS / SOC2 compliance |
Agentic Interface
| Command | Description |
|---------|-------------|
| manifest | Output machine-readable capabilities |
| explain | Natural language explanations |
| ask | Query scans in plain English |
| serve | Run as MCP server for AI agents |
MCP Server Mode
The historical CLI can still run as an MCP server for compatibility with existing local setups:
MCP Tools (15)
| Category | Tool | Description |
|----------|------|-------------|
| **Discovery** | list_tools | List all available tools |
| | set_session_snapshot | Set active snapshot for session |
| | get_scan_summary | Get summary of latest AWS scan |
| **Assets** | get_assets | Get assets with type/name filtering |
| | get_relationships | Get relationships between assets |
| | get_findings | Get security findings with severity filtering |