How to set up Terraform and CloudFormation security scanning for your GitHub pull requests
audytx is a deterministic Terraform and CloudFormation security engine for AWS, hand-written in Rust with no model in the loop. Identical input, identical findings, and every verdict cites the exact check and, for cross-resource findings, the relationship behind it.
Pick a surface — the engine is the same
The same reasoning engine runs at code time, review time, and plan time. It flags issues and never blocks a merge.
GitHub App
Reads your code; writes pull request comments and a check run, plus Code Scanning results where enabled. Install →
MCP server
The same engine your coding agent calls before the PR exists. Connect →
Plan enrichment
Opt-in: upload a resolved terraform plan for exact values. Enable →
Install the GitHub App
This section has its own page: Install the GitHub App →
MCP server setup (coding agents)
This section has its own page: MCP server setup (coding agents) →
Terraform plan scanning (optional)
This section has its own page: Terraform plan scanning (optional) →
What does audytx check?
This section has its own page: What does audytx check? →
Context-aware reasoning
This section has its own page: Context-aware reasoning →
GitHub Code Scanning integration (SARIF)
This section has its own page: GitHub Code Scanning integration (SARIF) →
Current limits
This section has its own page: Current limits →
Start free
Install on GitHub, point your agent at the MCP server, and your next pull request gets its first review. The Free plan includes 100 scans a month.
Privacy Policy
The privacy policy has its own page: audytx.com/privacy.
Terms of Service
The terms of service have their own page: audytx.com/terms.