Your infrastructure tells a story. Make sure you're the first one to read it.
AI agents and service accounts are the new attack surface, ungoverned, under-monitored, and multiplying fast. AgentSentry discovers every non-human identity in your cloud, scores each one with a provable risk formula, and gives you a fix-it checklist before attackers find what you haven't.
From zero to attack graph in under three minutes.
No agents to deploy. No SaaS data upload. Runs entirely local, your cloud credentials never leave your machine.
Discover
Point AgentSentry at your AWS account. It enumerates every IAM role, access key, service account, OAuth token, and AI agent in minutes, including ones you forgot existed.
Score
Each identity gets a P×R×E×A risk score: Privilege × Reachability × Exposure × AI-Amplification. Critical identities surface immediately. CISA KEV enrichment flags active CVEs.
Visualize
An interactive attack graph shows every identity and the access paths between them. See exactly what an attacker could reach if any given identity is compromised.
Not just AWS. Everywhere you deploy.
Six independent providers, install only what you need. Each one checks its own permissions before touching a single API. Start with local, it needs nothing and finds more than you expect.
- IAM Roles & Access Keys
- Lambda execution roles
- S3, RDS, Secrets Manager
$ pip install agentsentry[aws]- Managed Identities
- Service Principals
- Role assignments (Owner/Contributor)
$ pip install agentsentry[azure]- Service Accounts
- User-managed SA keys
- Project IAM bindings
$ pip install agentsentry[gcp]- Personal Access Tokens
- Deploy Keys & SSH Keys
- Actions Secrets
$ export GITHUB_TOKEN=<pat>- ServiceAccounts & RBAC
- ClusterRoleBindings
- Automount token exposure
$ pip install agentsentry[k8s]- Env vars & .env files
- SSH keys & credential files
- Docker socket & git tokens
Watch a real scan run
No staged demo, this is the actual CLI scanning a sample agent codebase and surfacing a critical PREA finding line by line.
Every attack surface. One scanner.
The only open-source tool that audits machine identities across every cloud and environment, with the same risk model, in the same scan.
Multi-Cloud NHI Discovery
Finds every IAM role, API key, service account, Managed Identity, and OAuth token, across AWS, Azure, GCP, GitHub, Kubernetes, and your local machine. One command. Every environment.
AI Agent Scanner
Statically analyzes LangChain, CrewAI, and AutoGen codebases. Extracts tool permissions. Computes the AI-Amplification Factor.
CISA KEV Enrichment
Correlates every finding against 1,610+ actively exploited CVEs. Flags ransomware-linked vulnerabilities in real time.
Attack Graph
Cross-provider attack graph. Computes blast radius: if this identity is compromised, what does the attacker reach, regardless of which cloud it lives in?
MITRE ATT&CK Mapping
Every finding maps to ATT&CK techniques. T1078.004, T1528, T1552, T1611, the language your SOC already speaks.
Risk Scoring: P×R×E×A
Privilege × Reachability × Exposure × AI-Amplification. Consistent across all providers, the same score model whether the identity lives in AWS, K8s, or a local .env file.
From one compromised agent to your data
Click a node to inspect the raw evidence behind each hop in the blast radius graph.