One precision engine, every stage of Terraform delivery
One non-AI engine catches AWS misconfigurations at code-time (the MCP server your agent calls), review-time (the pull-request comment), and plan-time (the plan before apply). Every finding is backed by a check it can name, and all of it is free right now.
iam-vulnerable — tied #1How it shows up in a PR
One comment per pull request — updated in place on every push, security and cost in the same digest.
One comment per push
Posted within seconds, severity-sorted, findings folded into a collapsible <details>
block. Updated in place on every push — never re-posted.
One-click fixes + a sound autofix loop
Precisely line-anchored findings post as GitHub one-click suggestions; the same soundness gate drives
autofix_terraform over MCP. If a fix can't be applied cleanly, it isn't applied at all.
Visible reasoning block — the part you won't mute
Every suppressed finding shows up in a 🧠 reasoned about N findings block with its check ID,
resource, and the axis that drove the call. Dismissals carry their rationale.
SARIF → GitHub Code Scanning
The same findings upload as SARIF to GitHub's Security tab; context suppressions surface as dismissed alerts with their reason. Your security lead sees the same calls you do.
Cost opportunities, same comment
gp2→gp3, NAT vs VPC endpoints, non-prod Multi-AZ, S3 Bucket Keys — quantified and rolled up as dollar bands in the PR header. Cost and security in one tool, not two.
For the agents writing your Terraform
The same engine, callable over MCP before the PR ever exists — free with a Client ID, no install required.
claude mcp add --transport http audytx https://audytx.com/mcp \ --header "X-Client-ID: YOUR_CLIENT_ID"
scan_terraform
Returns findings with file/line evidence, severity, and fix snippets — plus the context-suppressed false positives, each with its own rationale.
autofix_terraform
Applies the sound, line-anchored fixes server-side, re-scans, and loops (≤3 passes) until nothing auto-fixable remains. Same reasoning as the PR path.
Plan-enhanced scans
Hand audytx your terraform show -json output to resolve what static parsing can't: undefaulted
variables, count/for_each expansion, module-internal resources. Strictly opt-in.
An effective-permission attack-path engine
Not a pattern list: privilege-escalation paths found by reachability across the
sts:AssumeRole / iam:PassRole graph.
Wildcard expansion + statement math
Actions expand against an embedded AWS action table, so iam:Create* resolves to the concrete
privesc verbs it covers. Explicit Deny, NotAction inversion, and Condition gating all count — a
grant scores only when genuinely exploitable.
Attack paths by graph search
An internet entry point — public Lambda, Fargate, EC2 with IMDSv1, open API Gateway, or Cognito — that
chains role to role to admin. Curated ATTACK_PATH_* paths ship, but the search generalizes past
them, so multi-hop chains a pattern list would miss surface too.
The reasoning engine
24 axes the engine pre-computes per scan to decide whether a check actually applies — the seam that turns "always fires" into "fires only when the graph says it should."
A representative slice — the full list and per-check mapping live at /status.
aws_secretsmanager_secret_rotation already has rotation configured.Every suppression is a latent false negative, so audytx measures recall too: an adversarial must-NOT-suppress corpus is scanned and every axis is currently leak-free. We publish the FN-rate beside the false-positive benchmark — most scanners measure neither.
Suppression and workflow
Commit a baseline to dismiss specific findings — with required expiry dates, so suppressions can't rot silently.
- rule_id: AWS_S3_010 resource_address: aws_s3_bucket.legacy_public_assets reason: "Public by design; replatform tracked in PLAT-441" expires: 2026-09-30
Suppressions with expiry
Dismiss {rule_id, resource_address} pairs at the repo root. When an entry's
expires: date passes, the finding fires again.
Reconciled suppression counts
The PR footer enumerates context-suppressed vs baseline-suppressed vs shown-live, and the numbers reconcile against the total. The engine can't silently lose a finding.
Public testbed repo
audytx-testbed holds long-lived PRs of real public AWS-Terraform repos that exercise every axis — see what the engine does on real HCL, without trusting screenshots.
Operational fundamentals
Deterministic by construction: same input, byte-identical findings, versioned on every comment.
Pure-Rust engine
No Python, Java, or Docker. A typical scan finishes its analysis in tens of milliseconds — cheap enough to run on every PR.
Versioned and observable
Every comment carries the engine + check-catalog version. /status exposes the axis inventory and per-check mapping; /metrics reports aggregate usage.
Reproducible by design
Same input ⇒ byte-identical findings. Findings are a function of your code and the pinned engine version — not a model's mood.
Start free during the open beta
Every feature above runs free right now — 266 checks, the MCP server, and the autofix loop — on public and private repos. Install on a repo, or point your agent at the MCP server.
Not yet (and why)
The questions we get asked most, answered. Going deep on AWS is the strategy, and we intend to keep it.
Does audytx support multi-cloud (Azure or GCP)?
No — AWS and Terraform only, by design. AWS-deep is the wedge: depth beats breadth, and multi-cloud comes only if the AWS product proves sticky.
Does audytx support CloudFormation, Pulumi, or CDK?
CloudFormation: yes — live on the hosted MCP server (JSON, YAML including short tags, SAM, CDK-synthesized output) and in GitHub App pull-request review, with the same AWS_* rule ids as Terraform; the offline CLI is still Terraform-only while CFN rolls out there. CDK: scan the synthesized templates in cdk.out. Pulumi: no — the strategy is still depth over breadth, one stack at a time.
Does audytx open auto-remediation pull requests on arbitrary infrastructure?
No. audytx shows the fix and applies the sound ones as one-click suggestions or through the autofix loop. We don't open fix PRs on infrastructure we've never seen deployed — that's a level of trust a scanner has to earn, and we'd rather show you the change first.
Does audytx enforce org policies, merge gates, or compliance export?
Not yet. audytx reviews and flags pull requests; it never blocks a merge. A governance layer (block-on-Critical, cross-repo baselines, CIS or SOC 2 evidence) is planned, but we want real org usage to shape it before we build it.
Does audytx offer SAML SSO or SOC 2 certification?
Not during public beta. Right now we're spending everything on the product; SSO and SOC 2 will follow real demand.
Install on a repo
Every feature above is free: 266 checks, the MCP server, and the autofix loop, on public and private repos.
Install audytx →