Attestral

The security scanner for AI agents and MCP servers.

Your agent has a shell, a browser, your database, and a Slack token. Each tool is fine on its own. Together they are one injected sentence away from walking your secrets out the door. Attestral is the scanner that reads the whole picture.

It parses your MCP configs, agent instructions, system prompts, tool descriptions, and agents defined in code (LangGraph, CrewAI, the OpenAI Agents SDK, raw Anthropic/MCP tool definitions), builds a single system model of the fleet, and reviews the agentic surfaces every other scanner walks right past: prompt injection, tool poisoning, excessive agency, memory poisoning, and the toxic flows that only exist across servers. A shell tool and an egress tool are one injected sentence apart whether they were declared in .mcp.json or three @tool functions, and Attestral sees the flow either way. It models your cloud (Terraform) and Kubernetes in the same graph, so it sees the trust boundary between the agent and the infrastructure it can reach, not each in isolation - and the graph carries real node-to-node edges (Terraform references, Kubernetes Service and ServiceAccount links, and credential reach from a cred-holding server to the exact same-provider resources it can touch), not just co-presence.

Three layers, and every finding is labeled by which one found it: deterministic rules (always on, no eval, fails closed), an optional local ML classifier for injection text, and an optional LLM-as-judge to cut false positives. Every finding lands in a tamper-evident SHA-256 evidence chain you can hand an auditor and verify offline. No account, no server, no telemetry.

pip install attestral
attestral scan ./my-project

Scan the MCP servers you've already installed

No repo needed. Audit the MCP servers your agent tools are already wired to:

attestral scan --local           # full report: inventory + every finding
attestral scan --local --card     # a compact, screenshot-ready self-audit card

Discovers and scans configs from Claude Code (user scope, project .mcp.json, and the current project's local scope inside ~/.claude.json), Claude Desktop, Cursor, VS Code, and Windsurf. It reports which sources were found vs absent and how many servers each contributed, prints an inventory of the agent tool surface it reviewed, and runs everything through the same rule pipeline as a repo scan.

--card answers one question in one screen: does your installed fleet assemble the lethal trifecta, yes or no. It is honest by construction, a single-server machine is told the cross-surface checks could not fire (a thin result, not a clean bill of health), and a genuinely clean machine gets a clean result rather than a manufactured scare.

Get started in one command

attestral init      # scaffold CI, pre-commit, a waivers file, and a Claude Code skill
attestral scan .    # review the current project - prints straight to your terminal

attestral init writes four onboarding files, and never overwrites anything that already exists (existing files are skipped and reported):