The Terraform security build plan, agent surface first
Ten phases, depth over breadth. What's shipped, what's next, and what audytx won't build at all.
A precise, defensible lane
Every incumbent — Checkov, Trivy, Snyk, KICS — wins on breadth and rule count. The false positives are real and recurring, and none of them fix what they flag.
The lane
Accurate, IAM-deep, and it teaches you why — running in the cloud, so a solo dev on a Chromebook gets the same review as a funded startup.
The bet
More of the world's Terraform is written by coding agents every month; when the author is an agent, the reviewer must be consumable by one — so the agent surface ships first.
Measured before claimed
A 5-tool benchmark on 28 corpora with ground truth labeled against documented privilege-escalation paths. We score against ground truth, never a raw finding count.
Callable before the PR exists
audytx is now an MCP server — the same engine the GitHub App runs, in front of the agent that wrote the code. One line of config, no CI, just a free Client ID.
claude mcp add --transport http audytx https://audytx.com/mcp --header "X-Client-ID: YOUR_CLIENT_ID"scan_terraform
Findings with file:line evidence, severity, and fix snippets — plus the context-suppressed findings with their rationale.
autofix_terraform
Applies the precisely-anchored sound fixes, re-scans, loops; returns fixed files + what remains. Same soundness bar as the GitHub one-click suggestions — never a corrupting edit.
Depth across the whole pipeline
Ten build phases landed under the foundation — the reasoning, the fixes, the corpus, and the integrity checks that keep suppression honest.
The IAM attack graph
Privilege-escalation gated on exploitability, trust-graph reasoning, and multi-hop role chaining across resources — the way attackers reason.
Context-reasoning axes
The false-positive suppression layer — every suppression surfaced with its rationale, never silently dropped.
One-click fixes
Single-line and multi-line GitHub suggestions anchored to the offending lines, each with a plain-English "why this matters."
Secrets + bill-shock fusion
Hardcoded-credential detection fused with cost×security signals — GPU plus admin IAM, keys plus expensive compute.
Benchmark ground truth
Every tool scored on true precision and recall against the labeled IAM corpus — published, reproducible, not a finding-count contest.
Never silent, never blind
A check-run per scan — a failed or skipped scan is a visible status instead of silence. A reviewer you can't tell is working is one you stop trusting.
AI-generated-Terraform corpus
Terraform generated from frontier models, its characteristic failure modes cataloged, the engine calibrated against them — re-run per model generation.
Parser ceiling raised
Registry module expansion, variable / tfvars / locals resolution, and
count/for_each — so every axis reasons over real, composed repos.
Suppression integrity
Every context-suppression tested against real HCL where it must not fire — published as a false-negative rate beside the false-positive benchmark.
Opt-in plan ingestion
terraform plan JSON accepted as a secondary, never-required input over OIDC — it resolves
what HCL heuristics can't. Mandatory plan ingestion stays off the table.
What's next — honestly
Two tracks are sequenced but unstarted. They are demand-gated: individual devs and agents have to love the core first.
Findable everywhere Deferred
GitHub Marketplace listing, the published benchmark, and the MCP endpoint announced where agent builders look. Zero-setup only matters if you can find the thing to not-set-up.
Cost×security → team governance Horizon
Before/after cost delta fused with security context, then the org layer: required-check policies, cross-PR baselines, and compliance evidence export.
Built for the review no one else does
Early-stage startups
3–10 people, no dedicated security or platform engineer. PR-level guidance without a CI config or a week of setup.
Solo developers
Refuse the overhead of local CLI scanners. Install the GitHub App once, and every future PR is reviewed for you.
Resource-constrained devs
Can't run Checkov + Trivy + Infracost on every push. A Chromebook gets the same review as a funded team's workstation.
Coding agents
Writing more of the world's Terraform every month. One MCP endpoint gives the full context-aware review and the autofix loop, before the PR exists.
Deliberately not on the roadmap
AWS-deep is the wedge — every resource type and reasoning axis is AWS-specific by design, and breadth across clouds at the cost of IAM depth isn't the trade.
terraform plan ingestion
SAML SSO / enterprise onboarding
The autofix loop returns fixed files to the agent that asked for them and never pushes commits to your repo; on the PR surface, fixes stay one-click suggestions you apply. Enterprise paperwork waits until the product is sticky with individuals and agents.
Frequently asked
Does audytx support Azure or GCP?
No — AWS-deep is the v0.x wedge. Every resource-type and reasoning axis is AWS-specific by design — breadth across clouds at the cost of IAM depth isn't the trade.
Does audytx support CloudFormation or Pulumi?
CloudFormation: yes — live on the hosted MCP server, with the GitHub App and CLI surfaces next. Pulumi: no.
Does audytx auto-commit fixes to my repo?
No — the MCP autofix loop returns fixed files to the agent that asked for them, gated to precisely-anchored sound fixes — audytx never pushes commits to your repo. On the PR surface, fixes stay one-click suggestions you apply.
Start free during the open beta
< Install the GitHub App, point your agent at the MCP server, and see how far the engine already is. Free for every team while the beta is open.Track every release on the changelog.