Cynative: AI-Powered Cybersecurity Platorm

Open-source CLI framework that runs frontier LLMs over AWS, GCP, Azure, Kubernetes, GitHub, and GitLab to perform read-only security deep research.

Cynative is a single static binary that puts a frontier language model directly over your cloud infrastructure. Ask it anything — from “what’s publicly exposed?” to “which IAM roles can escalate to admin?” — and it fans out read-only API calls across your stack, verifies every finding against live evidence, and returns a traced, cross-checked report.

Quickstart

Install Cynative, configure an LLM provider, and run your first security audit in minutes.

Installation

Homebrew, install script, Scoop, and manual download instructions for all platforms.

Built-in Agents

Browse all 45 built-in agents for AWS, GCP, Azure, GitHub, and Kubernetes.

Write Your Own Agent

Create a custom security agent in a single Markdown file.

Key capabilities

45 Built-in Agents

AWS (20), Azure (11), GCP (5), GitHub (4), and Kubernetes (5) agents covering privilege escalation, public exposure, supply chain, detection coverage, and more.

Read-Only by Construction

Action gate, host pinning, and dial-time IP verification enforce read-only before any credential is attached. Fails closed on anything unclassifiable.

Sandbox

Model writes code that fans out cloud API calls concurrently. No network or host access of its own. Faster answers, fewer tokens.

Multi-Cloud Connectors

AWS, GCP, Azure, EKS, GKE, AKS, self-managed Kubernetes, GitHub, and GitLab. Uses credentials already in your shell.

Any LLM Provider

Powered by the Bifrost SDK. Bring your own model: OpenAI, Anthropic, Bedrock, Vertex, Ollama, vLLM, and 20+ more.

Audit Log

Fail-closed JSONL audit log records every tool call with agent name, source, and file digest. Redacted before writing.

How it works

Cynative starts from the credentials already in your shell. When you ask a question or run an agent, a frontier model reasons across your infrastructure — writing JavaScript that fans out API calls concurrently in an isolated sandbox — then cross-checks every finding before presenting results.

1. Install Cynative

   Install the single static binary via Homebrew, the install script, or Scoop on Windows.

   brew install cynative/tap/cynative
   
2. Configure an LLM provider

   Set your provider and model. Cynative supports OpenAI, Anthropic, AWS Bedrock, GCP Vertex, Ollama, and 20+ more.

   export CYNATIVE_LLM_PROVIDER=anthropic
   export CYNATIVE_LLM_MODEL=claude-opus-5-5
   export ANTHROPIC_API_KEY=sk-ant-...
   
3. Run a built-in agent or ask freely

   Use a built-in agent for a specific question, or ask anything in natural language.

   cynative -p --agent aws-privilege-escalation
   cynative -p "what in my cloud is publicly exposed that shouldn't be?"
   
4. Review verified findings

   Cynative’s verifier cross-checks each finding against live evidence. Every result is traced back to the exact API call that produced it.

Explore the docs

Connectors

Configure AWS, GCP, Azure, Kubernetes, and source control connectors.

LLM Providers

Set up any supported language model provider.

Configuration

Full reference for config.yaml and CYNATIVE_* environment variables.

Sessions & Approvals

Interactive mode, print mode, approval flow, and exit codes.

Architecture

Understand how Cynative’s components fit together.

Contributing

Dev setup, gates, and PR conventions.