AWS · Terraform · CloudFormation · deterministic engine
Check the infrastructure your agents write. In one line.
No CI step, no model in the loop. One line for your agent, one comment on your pull request.
$
claude mcp add --transport http audytx https://audytx.com/mcp \
--header "X-Client-ID: YOUR_CLIENT_ID"
Get a free Client ID · or install the GitHub App · the Free plan is 100 scans a month
Works with
Terraform
CloudFormation
GitHub
Claude Code
Cursor
VS Code
any MCP client
0
High or Critical findings on our own clean-infrastructure test set
301
checks across AWS services · 33 reasoning axes
One engine · three stages
Checked at code-time, review-time, and plan-time.
agent session · any MCP client · POST https://audytx.com/mcp
› the agent that wrote the Terraform checks it before a pull request exists
toolscan_terraform { files: [ { path, content }, … ] }
→ summary · findings · context_suppressed — the same engine and rules as the pull-request comment
toolautofix_terraform
→ applies only fixes that pass its safety checks, re-scans, at most three passes
Also: scan_cloudformation · scan_workspace · autofix_cloudformation · dry_run_autofix · dry_run_autofix_cloudformation · explain_finding · get_context_graph
The agent that wrote the Terraform gets the finding — and the fix. Claude Code, Cursor, VS Code, or any MCP client.
audytx · pull request comment
deterministic
A summary comment on the pull request each time it is scanned.Captured on GitHub, 2026-09-08: a testbed pull request importing terraform-aws-modules/terraform-aws-rds (Apache-2.0).
terraform show -json · uploaded from CI with the run's OIDC token
variables · count / for_each · module internalsresolved before the rules run
the plan wins per attribute; resources the HCL never showed become visible
an enriched comment is posted on the pull requestno shared secret
CloudFormation: the same flow over a DescribeChangeSet upload
Checks the resolved plan — Terraform plan or CloudFormation change set — catching what only the plan reveals.
In a market full of "AI-powered"
A security check that never calls a model.
Deterministic, hand-written Rust. Your source is parsed in memory and not stored, and it is not sent to a language model. Findings (rule, message, resource, file and lines) are kept for 90 days.
Read the trust page →What we can prove
✓No LLM anywhere in the loop
✓Source parsed in memory, not stored
✓Identical input → identical findings
✓SARIF → GitHub Code Scanning
✓Every verdict cites its exact check
No session state·OIDC plan upload·never touches your cloud
The scanner your team won't turn off.
Real risks stay loud. Benign ones go quiet, with the reason shown.
Start free.
Install on one repo or point your agent at the MCP server. The Free plan includes 100 scans a month, and the free tier stays free.