Find every machine identity
before they do.
45 machine identities for every 1 human. IAM roles, API keys, AI agents — almost none governed. AgentSentry audits your cloud, scores every NHI by blast radius, and maps attack paths to your crown jewels.
From zero to attack graph
in under three minutes.
No agents to deploy. No SaaS data upload. Runs entirely local — your cloud credentials never leave your machine.
Discover
Point AgentSentry at your AWS account. It enumerates every IAM role, access key, service account, OAuth token, and AI agent in minutes — including ones you forgot existed.
Score
Each identity gets a P×R×E×A risk score: Privilege × Reachability × Exposure × AI-Amplification. Critical identities surface immediately. CISA KEV enrichment flags active CVEs.
Visualize
An interactive attack graph shows every identity and the access paths between them. See exactly what an attacker could reach if any given identity is compromised.
Not just AWS.
Everywhere you deploy.
Six independent providers — install only what you need. Each one checks its own permissions before touching a single API. Start with local — it needs nothing and finds more than you expect.
- ▸IAM Roles & Access Keys
- ▸Lambda execution roles
- ▸S3, RDS, Secrets Manager
- ▸Managed Identities
- ▸Service Principals
- ▸Role assignments (Owner/Contributor)
- ▸Service Accounts
- ▸User-managed SA keys
- ▸Project IAM bindings
- ▸Personal Access Tokens
- ▸Deploy Keys & SSH Keys
- ▸Actions Secrets
- ▸ServiceAccounts & RBAC
- ▸ClusterRoleBindings
- ▸Automount token exposure
- ▸Env vars & .env files
- ▸SSH keys & credential files
- ▸Docker socket & git tokens
Explore a real attack graph.
Drag to rotate · Scroll to zoom · Click a node to inspect
Every attack surface.
One scanner.
The only open-source tool that audits machine identities across every cloud and environment — with the same risk model, in the same scan.
Multi-Cloud NHI Discovery
Finds every IAM role, API key, service account, Managed Identity, and OAuth token — across AWS, Azure, GCP, GitHub, Kubernetes, and your local machine. One command. Every environment.
AI Agent Scanner
Statically analyzes LangChain, CrewAI, and AutoGen codebases. Extracts tool permissions. Computes the AI-Amplification Factor.
CISA KEV Enrichment
Correlates every finding against 1,610+ actively exploited CVEs. Flags ransomware-linked vulnerabilities in real time.
Attack Graph
Cross-provider attack graph. Computes blast radius: if this identity is compromised, what does the attacker reach — regardless of which cloud it lives in?
MITRE ATT&CK Mapping
Every finding maps to ATT&CK techniques. T1078.004, T1528, T1552, T1611 — the language your SOC already speaks.
Risk Scoring: P×R×E×A
Privilege × Reachability × Exposure × AI-Amplification. Consistent across all providers — the same score model whether the identity lives in AWS, K8s, or a local .env file. Novel academic contribution.
Peer-reviewed.
Production-validated.
The mathematical model behind AgentSentry is published as a research paper. Real scan results. Real AWS environments. Novel metric introduced.
Free forever.
Pro when you need it.
The core scanner is free and always will be. Pro unlocks continuous governance for enterprise teams.
- AWS IAM role & access key scanner
- LangChain / CrewAI / AutoGen agent scanner
- P×R×E×A risk scoring engine
- CISA KEV threat intel enrichment
- Interactive NHI attack graph
- MITRE ATT&CK mapping
- CLI — runs locally, no data leaves you
- Open source — MIT license
- Everything in Free
- Continuous monitoring — alerts on new NHIspro
- Remediation workflows — auto Jira/ServiceNow ticketspro
- Audit-grade PDF reports — SOC 2, ISO 27001, NIS 2pro
- Azure AD + GCP scanner
- GitHub Actions secrets scanner
- Priority support
- Early access to new features
Stay ahead of machine identity threats
Weekly intel on NHI security and AI agent risks — real findings, practical commands, no fluff. Get it before it hits the feeds. Every Tuesday, free.
No spam. Unsubscribe anytime. Every Tuesday.
Contact the developer
Found a bug? Want to contribute? Just have a question? Pick whichever channel works best.