cynative
Deep research for your infra. Cynative runs frontier models across your code, cloud and runtime - reasoning through GitHub, GitLab, AWS, GCP, Azure and Kubernetes as one system - and comes back with verified answers.
What is it?
What it is
An agentic security research tool that uses frontier LLMs to reason through infrastructure across cloud providers (AWS, GCP, Azure), Kubernetes, and VCS (GitHub, GitLab) to provide verified answers to infrastructure queries.
Why it exists
To provide a secure, read-only, and evidence-backed way to perform deep research and threat hunting across complex, heterogeneous infrastructure stacks without the risks associated with standard coding agents.
Who should use it
Security teams, DevOps engineers, cloud architects, developers needing security audits
Who should avoid it
Users requiring write access, those without LLM setup, infrastructure not supported by connectors
How it works
A quick walkthrough in plain English
How cynative works
Step 1 of 3
You interact with it
Open cynative, send a request, or connect it to your stack.
Features
Advantages
- High security posture due to 'fail-closed' design and read-only enforcement
- Reduced blast radius via sandboxed execution and network pinning
- Increased efficiency through concurrent tool execution and sandboxed scripting
- Sovereign data privacy: single binary, user-provided models, and local data storage
- High observability with detailed audit trails and real-time execution visibility
Disadvantages
- Requires manual configuration of LLM providers and API keys
- Potential for increased token usage due to finding verification processes
- Requires careful management of least-privileged credentials to ensure security boundaries
- Complexity in managing environment variables for multi-cloud setups
Installation
FAQ
How do I install Cynative on macOS or Linux?
You can install Cynative via Homebrew with `brew install cynative/tap/cynative`. If you prefer a script, run `curl -fsSL https://raw.githubusercontent.com/cynative/cynative/main/install.sh | sh`. The script downloads the latest release, verifies its SHA‑256 checksum against `checksums.txt`, and places the binary in `~/.local/bin` (no sudo required). For manual installation, download the appropriate tarball from the releases page, verify the checksum, and add the binary to your PATH.
How do I tell Cynative which LLM provider to use?
Set the environment variables that match your chosen provider. For example, for Anthropic: `export CYNATIVE_LLM_PROVIDER=anthropic` and `export CYNATIVE_LLM_MODEL=claude-opus-5`. For OpenAI: `export CYNATIVE_LLM_PROVIDER=openai` and `export CYNATIVE_LLM_MODEL=gpt-5.6-sol`. Each provider has its own set of required variables; see the Quick Examples section in the README for the full list. You can also supply a YAML file with a `llm` section to configure advanced options such as retry behavior or proxy settings.
What mechanisms does Cynative use to keep my infrastructure read‑only?
Cynative enforces read‑only access at three layers: (1) **Network** – every request host is pinned to the mapped service and region, and the resolved IP is verified before connecting. (2) **Action gate** – each API call is mapped to the minimal IAM actions required and checked against a read‑only policy (e.g., `SecurityAudit` for AWS, `roles/viewer` for GCP, `Reader` for Azure). If a call would require a write action, the gate fails closed before any credentials are attached. (3) **Credential scoping** – for AWS, assumed roles are re‑issued via STS with a managed read‑only policy; for other clouds, the credentials already in your shell are used but are still gated by the action‑gate logic.
What is the difference between running `cynative "task"` and `cynative -p "task"`?
`cynative "task"` starts an interactive session: after executing the task it keeps the prompt open so you can ask follow‑up questions or run additional tasks. `cynative -p "task"` (or `--print`) runs the task non‑interactively, prints the final answer to stdout, and exits immediately—useful for scripts, CI pipelines, or piping the output to other tools.
How can I limit resource usage for unattended or scheduled runs?
Cynative exposes several configuration knobs via environment variables or the config file: `CYNATIVE_MAX_TOTAL_TOKENS` limits the total token budget per session; `CYNATIVE_MAX_ITERATIONS` caps the number of main‑loop tool calls; `CYNATIVE_MAX_SUBAGENT_ITERATIONS` limits iterations inside sub‑agents; `CYNATIVE_MAX_CONSECUTIVE_FAILURES` stops the run after a set number of failed calls; and `CYNATIVE_SANDBOX_MAX_CONCURRENCY` limits concurrent sandboxed tool calls. Adjust these values to fit your cost and performance constraints.
Featured in Videos
YouTube tutorials and walkthroughs for cynative
Alternatives
Similar projects ranked by category, topics, and text overlap.