Show HN: Cynative – Read-only CLI in Go that explains your live infrastructure

Hey, we built an open-source CLI in Go purposed to help you answer security questions across your cloud, code and runtime. It connects to your GitHub, GitLab, AWS, GCP, Azure & K8s using the credentials that are already in your shell, while limiting itself to read-only.

The core innovation here is the trust boundary - our agent has a built-in code execution sandbox with no host or network access; it is exposed to an internal tool which we call an “action gate” that performs read-only HTTP requests to your own infrastructure. Since the cloud providers constantly expand actions and services, the read-only allowed set comes from the providers themselves, refreshed every 24 hours (and is configurable).

Some additional neat features: verifiers that recheck every finding, fail-closed audit log, host-pinning to your own infra, STS rescoping to SecurityAudit in AWS AssumeRole, secret redaction so the LLM never sees them, and much more.

Even though the frontier models are becoming quite capable at answering broad security questions like “review my code” or “audit my cloud security posture”, we’d recommend starting with something more specific, like “what in my cloud is publicly exposed and shouldn’t be?” or “can my CI escalate to cloud admin?”.

Repo and documentation available here: https://github.com/cynative/cynative

Would love to hear any feedback / feature requests.