aspex (front door)

Run aspex with no arguments: see what your agents did this month, then pick a tool.

aspex with no arguments answers the question before you ask it. It reads your MCP configs and your AI clients’ own logs, joins them, and shows one screen. On the machine this was written on:

aspex            # or, without installing anything: npx aspex

  ◆  Your AI agents, last 30 days  aspex v0.9.0

  ▸ In the last 30 days your agents made 320 tool calls to 12 MCP servers.
  ▸ 316 of those calls went to 11 servers no security scan had ever checked.
  ▸ 2 calls tripped a detection rule. Most common: cross-server data chain (2).
  ▸ 7 configured servers, overall security score 54/100. Riskiest: github (39), not used in this period.

    github                39  CRITICAL  not used
    brave-search          39  CRITICAL  not used
    playwright            90  MEDIUM    not used
    slack                 95  clean     4 calls
    +3 more

  ? In use, never scanned:
    Claude_Browser                         196 calls
    claude-in-chrome                        72 calls
    +9 more

  aspex scan for findings and fixes  ·  aspex trace for the full audit trail  ·  aspex share to post this

It took 1.9 seconds. Then the tool menu opens underneath. Arrow keys to move, Enter to run, → for each tool’s options, q to quit.

Everything on that screen comes from files already on your machine. Nothing is sent anywhere.

Every command, by what it is for

You will spend most of your time in five commands. The rest support them.

Start here (the five questions)

aspex scan	what CAN happen: servers, tools, hooks, skills, attack paths, blast radius
aspex trace	what DID happen, from your clients’ own logs
aspex diff	what CHANGED between two states or git revisions
aspex explain	why a path exists, what breaks it, where data could flow
aspex simulate	what a change would do, without touching your config

Harden

aspex tighten	least-privilege recommendations, each simulated
aspex inspect	a server’s impact before you install it

Change control

aspex lock · aspex verify	fingerprint the environment; fail on drift
aspex history · aspex watch	posture over time; re-scan on change

Investigate and integrate

aspex explore	the local session explorer
aspex mcp	expose Aspex to your coding agent (read-only)
aspex bom	a portable inventory of the environment
aspex doctor · aspex attack	pre-flight check; adversarial probing

New here? Follow Common workflows.

Share it

aspex share

Prints a Markdown card with the same headlines but no server names, paths, or commands - counts and score only. Paste it in Slack, a PR, or a post. If the numbers surprised you, they will surprise your team.

Just the snapshot

aspex snapshot      # no menu; good for a shell prompt, a cron job, or CI logs

Direct commands

Command	Runs
aspex scan [...]	aspex scan - audit every configured server, 140+ rules
aspex trace [...]	aspex trace - full audit trail from client logs
aspex doctor	aspex scan doctor - 2-second pre-flight
aspex attack [...]	aspex-attack - red-team a server you own (advanced)

What “never scanned” means

Connectors added through claude.ai are configured in the cloud and have no local file, so no static scanner can score them. Aspex is honest about that: they appear as in use, never scanned, with their call counts, so you know exactly how much of your agents’ activity runs through servers nobody has looked at. aspex scan inspect <url> can scan one directly.

Every command through aspex

aspex is the front door; you never need to know which binary owns a command.

aspex scan	every server, hook, skill, attack path, blast radius
aspex trace	what your agents actually did, from their clients’ logs
aspex explain "…"	deterministic yes/no security questions
aspex lock / aspex verify	the security lockfile and drift against it
aspex diff main..HEAD	security impact of a config change
aspex tighten	least-privilege recommendations
aspex bom	Agent Security BOM
aspex explore	local session explorer
aspex mcp	read-only MCP server for your agent
aspex history	posture over time
aspex hooks, aspex doctor, aspex attack	hooks, pre-flight, red team