The security layer for the code your AI writes
A context-aware engine that models your AWS infrastructure and judges every line of Terraform against it — catching real risk where the work happens: in your pull request, and in front of the agent that wrote it.
What audytx is
A context-aware analysis engine for AWS and Terraform. It reconstructs the system your code describes — which services invoke which functions, which keys encrypt which stores, which roles can be assumed from where — and its verdicts come from that model, not from matching one resource at a time.
The GitHub App
Posts one comment per pull request — security findings and cost analysis in one digest, plus inline review and SARIF. No CI config, no runners, no cloud credentials.
The hosted MCP server
A hosted MCP server exposes the same engine to any coding agent — Claude Code, Cursor, Codex — so it checks the Terraform it just wrote without leaving the session. Setup is on the MCP page.
Review time, not run time
audytx is pull-request-time static analysis: it reads the surrounding Terraform for context, then reports only on what the pull request changed — before merge, while a mistake is still a diff and not an incident.
Code time
The MCP server puts findings in front of the agent that wrote the code, so the fix happens in the same loop that introduced the risk.
Review time
Findings flow into GitHub Code Scanning as SARIF and live in the security tab your team already triages.
Plan time
Plan enrichment is strictly opt-in: a GitHub Actions step uploads your resolved plan over OIDC, no shared secrets. Plan-enhanced scans →
Context decides the verdict
Most IaC scanners are single-resource pattern matchers — they flag a Lambda for a missing dead-letter queue even when nothing async invokes it, then flag the dead-letter queue for lacking one of its own. audytx computes the relationships first, then decides.
A finding the graph proves benign is suppressed and surfaced with the reason, never silently dropped — and the same graph chains individual weaknesses into full attack paths. The payoff is the most precise Terraform scanner we've measured.
How the reasoning works → · The measured comparison → · Live engine stats →
Your code is never stored
Your Terraform is parsed in memory and discarded. audytx keeps scan metadata only — never
source content — and the GitHub App holds a read-only contents permission.
The trust page spells out every claim, and carries the vulnerability disclosure policy.
Two founders, one narrow focus
audytx is built and operated by Victor and Sabari, the two founders of Rexstart Labs Pvt Ltd. Between us: thirty-plus years of building large-scale systems and platforms across the US and India, including work at Delta, Nike, Comcast, and Topcoder.
The same pattern keeps repeating: teams move fast, merge on "trust me, bro" confidence, and the subtle gaps that slip through reach production, where they turn into real risk. audytx exists to close that gap — a deterministic, context-aware security layer that shows a team exactly what their AI coding agents are generating, before it merges.
It covers AWS only, on purpose — Terraform first, and now CloudFormation through the same engine. The kind of cross-resource reasoning we do (invocation topology, IAM trust graphs, encryption chains) only stays tractable when every resource is modeled thoroughly, and that thoroughness doesn't survive going wide. Staying narrow is the plan, not a phase.
Start free during the open beta
Install on GitHub, point your agent at the MCP server, and see what audytx says about your next pull request. Free for every team, and the free tier stays free.
Quotas and the upcoming Pro tier are on the pricing page.