Quickstart

$ aspex

  ▸ In the last 30 days your agents made 333 tool calls to 12 MCP servers.
  ▸ 329 of those calls went to 11 servers no security scan had ever checked.
  ▸ 1 call tripped a detection rule. Most common: cross-server data chain (1).
  ▸ 7 configured servers, overall security score 39/100. […]

$ aspex scan

  ╭─────────────────────────────────────────────────────────────╮
  │   18 / 100  ████░░░░░░░░░░░░░░░░░░░░  HIGH RISK (100 = safe)  │
  │  7 servers · 99 tools · 34 findings · 7s elapsed           │
  │  5 critical  17 high  12 medium                               │
  │  ↓ -21 pts since last scan (was 39/100)                     │
  ╰─────────────────────────────────────────────────────────────╯

  Blast radius HIGH  ✓ reads credentials or sensitive files · ✓ arbitrary external network egress · ✓ command execution · ✓ can rewrite agent config or hooks that run at next start · ✓ can rewrite agent instructions or memory · ✓ external content enters the agent's context

  CRITICAL  AP001  Potential sensitive data exfiltration path  confidence: high
     filesystem
       └─ read_file: reads files by path
       └─ read_text_file: reads files by path
       └─ read_media_file: reads files by path
       └─ read_multiple_files: reads files by path
       └─ allowed root /Users/steven (home directory: includes ~/.ssh, ~/.aws, browser profiles)
       └─ and 5 more items (see --json)
     playwright
       └─ browser_navigate: reaches network destinations (takes a URL parameter)
       └─ browser_navigate_back: reaches network destinations
       └─ browser_network_request: reaches network destinations
       └─ browser_tabs: reaches network destinations (takes a URL parameter)
       └─ and 1 more item (see --json)
  […]

$ aspex explain "Can this agent exfiltrate SSH keys?"

  YES  plausible path exists

  A potential exfiltration path exists: filesystem reads credentials (~/.ssh, ~/.aws, keychains), playwright can send it to any network destination.

     credentials (~/.ssh, ~/.aws, keychains)
       ↓
     filesystem (read, inferred)
       ↓
     agent context
       ↓
     playwright (network, inferred)
       ↓
     any network destination

  Required conditions
     ✓ external content enters the agent's context
       via brave-search, github, playwright; also any pasted document or prompt
     ✓ a server can read credentials (~/.ssh, ~/.aws, keychains)
       filesystem (read, inferred): reads credential files such as ~/.ssh and ~/.aws (root /Users/steven)
     ✓ a server can send data off this machine
       playwright (network, inferred) reaches any network destination

  Not proven
     ✗ no runtime evidence that credentials (~/.ssh, ~/.aws, keychains) was transmitted; payloads are not in the logs
     ✗ whether an instruction to do so ever reached the agent

  Confidence: MEDIUM

aspex lock          # write .aspex.lock, commit it
aspex verify        # exit 1 on drift: NEW TOOL, DESCRIPTION CHANGED, SCOPE EXPANDED, NEW ATTACK PATH