Quickstart

Install, see what your agents did, scan what they could do. About a minute.

1. Install

   Homebrew

   brew install aspex-security/tap/aspex
   

   One Go binary. Every release ships SHA-256 checksums.

2. See the whole picture

   Run aspex with no arguments. It joins your MCP configs with your clients’ own logs.

   $ aspex
   
     ▸ In the last 30 days your agents made 333 tool calls to 12 MCP servers.
     ▸ 329 of those calls went to 11 servers no security scan had ever checked.
     ▸ 1 call tripped a detection rule. Most common: cross-server data chain (1).
     ▸ 7 configured servers, overall security score 39/100. […]
   

   Then a menu opens underneath. aspex share prints the same headlines with no names or paths.

3. Scan what your agents could do

   $ aspex scan
   
     ╭─────────────────────────────────────────────────────────────╮
     │   18 / 100  ████░░░░░░░░░░░░░░░░░░░░  HIGH RISK (100 = safe)  │
     │  7 servers · 99 tools · 34 findings · 7s elapsed           │
     │  5 critical  17 high  12 medium                               │
     │  ↓ -21 pts since last scan (was 39/100)                     │
     ╰─────────────────────────────────────────────────────────────╯
   
     Blast radius HIGH  ✓ reads credentials or sensitive files · ✓ arbitrary external network egress · ✓ command execution · ✓ can rewrite agent config or hooks that run at next start · ✓ can rewrite agent instructions or memory · ✓ external content enters the agent's context
   
     CRITICAL  AP001  Potential sensitive data exfiltration path  confidence: high
        filesystem
          └─ read_file: reads files by path
          └─ read_text_file: reads files by path
          └─ read_media_file: reads files by path
          └─ read_multiple_files: reads files by path
          └─ allowed root /Users/steven (home directory: includes ~/.ssh, ~/.aws, browser profiles)
          └─ and 5 more items (see --json)
        playwright
          └─ browser_navigate: reaches network destinations (takes a URL parameter)
          └─ browser_navigate_back: reaches network destinations
          └─ browser_network_request: reaches network destinations
          └─ browser_tabs: reaches network destinations (takes a URL parameter)
          └─ and 1 more item (see --json)
     […]
   

   Every finding carries evidence, a hop-by-hop path and a fix. aspex scan →

4. Ask it a question

   $ aspex explain "Can this agent exfiltrate SSH keys?"
   
     YES  plausible path exists
   
     A potential exfiltration path exists: filesystem reads credentials (~/.ssh, ~/.aws, keychains), playwright can send it to any network destination.
   
        credentials (~/.ssh, ~/.aws, keychains)
          ↓
        filesystem (read, inferred)
          ↓
        agent context
          ↓
        playwright (network, inferred)
          ↓
        any network destination
   
     Required conditions
        ✓ external content enters the agent's context
          via brave-search, github, playwright; also any pasted document or prompt
        ✓ a server can read credentials (~/.ssh, ~/.aws, keychains)
          filesystem (read, inferred): reads credential files such as ~/.ssh and ~/.aws (root /Users/steven)
        ✓ a server can send data off this machine
          playwright (network, inferred) reaches any network destination
   
     Not proven
        ✗ no runtime evidence that credentials (~/.ssh, ~/.aws, keychains) was transmitted; payloads are not in the logs
        ✗ whether an instruction to do so ever reached the agent
   
     Confidence: MEDIUM
   

   Computed from the graph, never generated. A YES never claims anything happened. aspex explain →

5. Lock it

   aspex lock          # write .aspex.lock, commit it
   aspex verify        # exit 1 on drift: NEW TOOL, DESCRIPTION CHANGED, SCOPE EXPANDED, NEW ATTACK PATH
   

   Next:

   • Understand a finding with aspex explain AP001, and follow the data with aspex explain "Where could data from ~/.ssh go?".
   • Investigate what happened with aspex trace, then aspex explore.
   • Add Aspex to CI to gate PRs on new attack paths.
   • Browse common workflows: task first, command second.