Cynative
Cynative is an open-source framework for building security agents that have live, read-only access to your infrastructure. It solves the problem of asking complex security questions across code, cloud, and runtime environments by reasoning through GitHub, GitLab, AWS, GCP, Azure, and Kubernetes as one system. It is for security engineers and developers who need verified answers about their infrastructure without risking write access.
✨ Key features
- Read-only by construction with action-gate and sandbox
- Reasons across AWS, GCP, Azure, Kubernetes, GitHub, GitLab
- Writes and runs code in an ephemeral sandbox
- Cross-checks findings against live evidence
- Supports many LLM providers via Bifrost SDK
- One binary, your model, your data stays yours
🎯 Use cases
- Find publicly exposed cloud resources
- Identify IAM roles that can escalate to admin
- Trace high-risk permissions to the PR where granted
- Detect cloud credentials leaked in source code
- Review Terraform for misconfigurations
📦 Installation
🧰 Requirements: Requires a 64-bit OS (macOS, Linux, Windows) and an LLM provider API key (e.g., Anthropic, OpenAI, Google Vertex, etc.). Credentials for your infrastructure are picked up from your shell.
Installation
Homebrew (macOS / Linux - recommended):
brew install cynative/tap/cynative
Install script (macOS / Linux - verifies the download's SHA-256 against the release checksums.txt, failing closed):
curl -fsSL https://raw.githubusercontent.com/cynative/cynative/main/install.sh | sh
Windows (Scoop):
scoop bucket add cynative https://github.com/cynative/scoop-bucket
scoop install cynative
🚀 Usage
Quickstart
Install and set an LLM:
brew install cynative/tap/cynative
export CYNATIVE_LLM_PROVIDER=anthropic
export CYNATIVE_LLM_MODEL=claude-opus-5
export ANTHROPIC_API_KEY=...
It picks up the credentials already in your shell. Ask it anything:
cynative -p "which IAM roles can escalate to admin?"
cynative -p "high-risk cloud permissions, trace each to the PR where it was granted"
cynative -p "cloud credentials leaked in source code and their current blast radius"
cynative "live cloud resources absent from IaC - drift" # starts an interactive session
cat findings.json | cynative -p "triage these findings by exploitability"
❓ FAQ
How does Cynative ensure read-only access?
It uses an action-gate that resolves every call to required IAM actions and applies a read-only policy before attaching credentials, plus a sandbox with no network or host access of its own.
What LLM providers are supported?
It supports almost any AI provider out of the box, including OpenAI, Anthropic, Azure OpenAI, Amazon Bedrock, Google Vertex/Gemini, Cohere, Mistral, Groq, Ollama, and vLLM.
Can I run it non-interactively?
Yes, use the -p or --print flag to run a single task non-interactively and exit, which is suitable for scripts and pipes.
How do I create a custom agent?
Create a markdown file in ~/.cynative/agents/ with a description and prompt, then run it with --agent <name>.
📊 Repository
🤖 Overview, features, install steps and FAQ were generated from the project's README on Sep 4, 2026. Always check the original source before running commands.