Cynative Security Research Agent - Ask your cloud anything without breaking prod. Read-only.

A debate we had: do we just document how to scope credentials right and leave it to you - or enforce read-only even if you run it with admin creds? We went with enforcing it, despite the tradeoff of keeping up as providers ship new APIs. Pulling permission definitions from each provider (a few MB, daily by default) instead of a static map keeps coverage current automatically. Every API call is resolved to the IAM actions it needs and authorized against the provider's own policy definitions before a credential is attached, failing closed on anything it can't classify. The allowed sets come from the providers themselves (AWS IAM action simulation, GCP role permission eval, Azure RBAC role definitions, the K8s cluster own live view RBAC role) so coverage tracks the APIs as they grow. On AWS, assumed-role credentials are additionally re-vended through STS AssumeRole scoped to SecurityAudit. Every request host is pinned to its mapped service and region and the resolved IP is verified before connecting, so the agent can only reach your own infra. The code execution has no host access and every call is enforced to go through the read-only action gate or it fails.

Hi Shaked, the reassurance that it only ever reads and never touches my systems is exactly what would make me brave enough to really poke around a live setup. That peace of mind matters more than people tend to admit.

Shaked — the "script per turn, not one call" design is neat. Curious what happens when one call inside that script hits something outside the read-only gate — full abort, or does it just fail that line and move on? My own agent chains multi-step calls, and one blocked step derailing the whole run is a real pain.

fail-closed-by-default on the classification is the right call, but it raises a timing question - you pull permission definitions daily, so what happens on the day a provider ships a brand new API action that isn't in that day's pull yet. does it just refuse to classify it and block the call until the next sync picks it up, or is there some other fallback for that gap window

The promise of investigating cloud infrastructure without risking production is compelling. How do you enforce read-only boundaries, and does every finding include the evidence and cloud resources used to reach it?

Honestly love that the IAM-bound read-only layer is the default, not a setting you have to remember to flip on. Most security tools treat least-privilege as homework, you basically baked it into the call path. That kind of restraint takes real thought.

ran a couple of checks against our AWS setup and the read-only guard is genuinely enforced, not just a claim. the per-turn sandboxed scripts feel like the right way to do this instead of hoping an MCP tool behaves.

the read-only enforcement design is genuinely more thorough than most tools that just document best practice and hope you follow it. one thing I'd want answered before pointing this at a real environment though - the answers this thing produces are basically a complete map of what's exposed and how to get to it. where does that output live once it's generated, and is there any access control on the audit history itself, since that history becomes a pretty valuable target on its own

@szin makes sense, and redacting secrets before it hits disk is the right default. the part that still nags at me - a local file is exactly the kind of thing that ends up in a laptop backup or synced to some cloud drive without anyone deciding that on purpose. is there a documented way to pipe that audit log somewhere with actual access control, like a SIEM or a locked-down bucket, or is "local file on your machine" the intended end state for now?