The security layer for the code your AI writes
A context-aware engine that models your AWS infrastructure and checks your Terraform and CloudFormation against it. It reports risk where the work happens: in your pull request, and in front of the agent that wrote the code.
What audytx is
A context-aware analysis engine for AWS, covering Terraform and CloudFormation. It reads the resources around a finding before it decides whether the finding applies. It runs in three places:
- The GitHub App posts a summary comment on the pull request: security findings and cost analysis in one digest, with inline review comments and SARIF. No CI setup and no cloud credentials.
- The hosted MCP server gives coding agents such as Claude Code, Cursor and Codex the same engine, so an agent can check the infrastructure it just wrote. Setup is on the MCP page.
- The VS Code extension shows the same findings in the editor, using a Client ID from your dashboard.
Review time, not run time
audytx is pull-request-time static analysis. It reads the surrounding Terraform or CloudFormation for context, then reports on what the pull request changed, before merge, while a mistake is still a diff and not an incident.
- Code time. The MCP server puts findings in front of the agent that wrote the code.
- Review time. Findings can go to GitHub Code Scanning as SARIF, in the security tab your team already triages.
- Plan time. Plan enrichment is strictly opt-in: a GitHub Actions step uploads your resolved plan over OIDC, with no shared secrets. Plan-enhanced scans →
Context decides the verdict
A check that looks at one resource at a time can flag a Lambda for a missing dead-letter queue even when nothing invokes it asynchronously. audytx reads the surrounding resources first, then decides.
A finding that the surrounding resources show to be benign is set aside and surfaced with the reason, never silently dropped. audytx also links individual weaknesses into attack paths.
How the reasoning works → · Benchmark results → · Engine version and coverage →
What audytx keeps
audytx reads your Terraform and CloudFormation in memory to scan it. Scan records hold results, not source files: the rule, message, resource, file and line. They are kept for a limited time.
The trust page sets out what is stored and for how long, and carries the vulnerability disclosure policy. The permissions the GitHub App asks for are on its docs page.
Two founders, one narrow focus
audytx is built and operated by Victor and Sabari, the two founders of Rexstart Labs Pvt Ltd. Between us we have thirty-plus years of building large-scale systems and platforms across the US and India. audytx covers AWS only, on purpose: Terraform first, and now CloudFormation through the same engine. Reasoning across resources stays tractable only when every resource is modeled thoroughly, and that thoroughness does not survive going wide.
Start free
Install on GitHub, point your agent at the MCP server, and see what audytx says about your next pull request. The Free plan has a monthly allowance of scans, and the free tier stays free.
Allowances and plans are on the pricing page.