Cyntrisec CLI is a historical command-line tool for AWS capability graph analysis and attack path discovery. It is not a current Cyntrisec product, support surface, or commercial offering, but rather a project created before the company focused on EphemeralML and AIR v1; the PyPI package name cyntrisec, the CLI command cyntrisec, and the MCP server ID io.github.cyntrisec/cyntrisec are retained only to avoid breaking historical installations. The tool is provided "as is", without warranties of any kind.
In terms of main capabilities, this read-only CLI tool historically could: scan AWS infrastructure via AssumeRole; build a capability graph (covering IAM, network, and dependency relationships); discover attack paths from the internet to sensitive targets; prioritize remediations by ROI (security impact and cost savings); identify unused capabilities to reduce blast radius; and output deterministic JSON with proof chains.
In terms of usage, you need to first install and configure the AWS CLI (e.g., aws configure) or set environment variables, and the setup step requires terraform. It supports an agent interface and an MCP server mode, and is compatible with existing local setups: the macOS configuration file is located at ~/Library/Application Support/Claude/claude_desktop_config.json, and on Windows at %APPDATA%\Claude\claude_desktop_config.json; Claude Code (CLI) can configure the server via a command; Google Gemini / Antigravity can be added in the agent configuration (e.g., ~/.gemini/antigravity/mcp_config.json). The CLI's primary output is JSON to stdout, and it automatically switches to JSON when stdout is not a TTY; agent-facing output wraps results in a structured envelope. Scan results are stored locally in ~/.cyntrisec/scans/. If "cyntrisec is not recognized" appears on Windows, it means the Scripts folder has not been added to PATH.
In terms of security and privacy, the tool makes read-only API calls to AWS accounts, IAM roles should have only Describe*, Get*, and List* permissions; all data stays local and is not sent to external servers, with no data exfiltration. The default security mode is read-only and does not modify AWS infrastructure. It can generate remediation artifacts (such as Terraform modules) for review, but does not automatically apply changes. It includes an explicitly gated optional remediation execution path that can execute Terraform locally only when intentionally enabled by the user: disabled by default, requires --enable-unsafe-write-mode, and additionally requires an explicit flag (such as --execute-terraform) to run Terraform, suitable for controlled environments (sandboxes / CI with approval), not unattended production environments; if these flags are not passed, the tool will never run terraform apply. No AWS write API calls are made during scanning and analysis; the only supported "write" behavior is the optional local execution of Terraform, and only when explicitly enabled via the unsafe flag. Every AWS API call is logged in CloudTrail with the session name cyntrisec-cli. It is recommended to use cyntrisec setup iam <ACCOUNT_ID> to generate a read-only policy; live mode (waste --live, can --live) requires additional IAM permissions, and the generated policies and documentation cover these additions.
The applicable scenarios are historical AWS security analysis, attack path discovery, and remediation planning. In terms of limitations, the tool is no longer an active product and is no longer supported; users bear full responsibility for any actions based on its findings; generated remediation plans and Terraform code should always be reviewed before application. The project follows semantic versioning, and release notes are available in CHANGELOG.md. Regarding specific fees, pricing, and platform support, the materials do not currently provide this information.