Cyntrisec CLI

Historical pre-company project. cyntrisec-cli was created before Cyntrisec narrowed its company focus to EphemeralML and AIR v1. It is not a current Cyntrisec product, support surface, or commercial offering. The PyPI package name cyntrisec, CLI command cyntrisec, and MCP server ID io.github.cyntrisec/cyntrisec are retained only to avoid breaking historical installs.

[!CAUTION] Historical Software Disclaimer: This tool is no longer an active Cyntrisec product. It is provided "as is", without warranty of any kind. While the CLI is a read-only analysis tool by default, the user assumes all responsibility for any actions taken based on its findings. Always review generated remediation plans and Terraform code before application.

Historical AWS capability graph analysis and attack path discovery CLI.

A read-only CLI tool that historically:

• Scans AWS infrastructure via AssumeRole
• Builds a capability graph (IAM, network, dependencies)
• Discovers attack paths from internet to sensitive targets
• Prioritizes fixes by ROI (security impact + cost savings)
• Identifies unused capabilities (blast radius reduction)
• Outputs deterministic JSON with proof chains

Demo

Watch how to discover attack paths and generate fixes using natural language with Claude MCP.

Architecture

+----------------------------------------------------------------------------------+
|                                   CYNTRISEC CLI                                   |
+----------------------------------------------------------------------------------+
| CLI Layer (Typer)                                                                 |
|   scan   analyze   cuts   waste   report   comply   can   diff   serve   ...      |
+-----------------------------+----------------------------------------------------+
| Core Engine                 | Storage (local)                                     |
|  - AWS collectors           |  ~/.cyntrisec/scans/<scan_id>/                      |
|  - Normalization/schema     |    snapshot.json, assets.json, relationships.json   |
|  - GraphBuilder -> AwsGraph |    findings.json, attack_paths.json                 |
|  - Path search -> paths     |  ~/.cyntrisec/scans/latest -> <scan_id>             |
|  - Min-cut + Cost (ROI)     |  (Windows fallback: latest is a file)               |
+-----------------------------+----------------------------------------------------+
| Outputs: JSON/agent, HTML report, remediation plan + Terraform hints              |
+----------------------------------------------------------------------------------+