aspex (front door)

aspex with no arguments answers the question before you ask it. It reads your MCP configs and your AI clients’ own logs, joins them, and shows one screen. On the machine this was written on:

aspex            # or, without installing anything: npx aspex

  ◆  Your AI agents, last 30 days  aspex v0.9.0

  ▸ In the last 30 days your agents made 320 tool calls to 12 MCP servers.
  ▸ 316 of those calls went to 11 servers no security scan had ever checked.
  ▸ 2 calls tripped a detection rule. Most common: cross-server data chain (2).
  ▸ 7 configured servers, overall security score 54/100. Riskiest: github (39), not used in this period.

    github                39  CRITICAL  not used
    brave-search          39  CRITICAL  not used
    playwright            90  MEDIUM    not used
    slack                 95  clean     4 calls
    +3 more

  ? In use, never scanned:
    Claude_Browser                         196 calls
    claude-in-chrome                        72 calls
    +9 more

  aspex scan for findings and fixes  ·  aspex trace for the full audit trail  ·  aspex share to post this

It took 1.9 seconds. Then the tool menu opens underneath. Arrow keys to move, Enter to run, → for each tool’s options, q to quit. Everything on that screen comes from files already on your machine. Nothing is sent anywhere.

Every command, by what it is for

You will spend most of your time in five commands. The rest support them. Start here (the five questions)


`aspex scan`	what CAN happen: servers, tools, hooks, skills, attack paths, blast radius
`aspex trace`	what DID happen, from your clients’ own logs
`aspex diff`	what CHANGED between two states or git revisions
`aspex explain`	why a path exists, what breaks it, where data could flow
`aspex simulate`	what a change would do, without touching your config

Harden


`aspex tighten`	least-privilege recommendations, each simulated
`aspex inspect`	a server’s impact before you install it

Change control


`aspex lock` · `aspex verify`	fingerprint the environment; fail on drift
`aspex history` · `aspex watch`	posture over time; re-scan on change

Investigate and integrate


`aspex explore`	the local session explorer
`aspex mcp`	expose Aspex to your coding agent (read-only)
`aspex bom`	a portable inventory of the environment
`aspex doctor` · `aspex attack`	pre-flight check; adversarial probing

New here? Follow Common workflows.

aspex share

Prints a Markdown card with the same headlines but no server names, paths, or commands - counts and score only. Paste it in Slack, a PR, or a post. If the numbers surprised you, they will surprise your team.

Just the snapshot

aspex snapshot      # no menu; good for a shell prompt, a cron job, or CI logs

Direct commands

Command	Runs
`aspex scan [...]`	`aspex scan` - audit every configured server, 140+ rules
`aspex trace [...]`	`aspex trace` - full audit trail from client logs
`aspex doctor`	`aspex scan doctor` - 2-second pre-flight
`aspex attack [...]`	`aspex-attack` - red-team a server you own (advanced)

What “never scanned” means

Connectors added through claude.ai are configured in the cloud and have no local file, so no static scanner can score them. Aspex is honest about that: they appear as in use, never scanned, with their call counts, so you know exactly how much of your agents’ activity runs through servers nobody has looked at. aspex scan inspect <url> can scan one directly.

Every command through `aspex`

aspex is the front door; you never need to know which binary owns a command.


`aspex scan`	every server, hook, skill, attack path, blast radius
`aspex trace`	what your agents actually did, from their clients’ logs
`aspex explain "…"`	deterministic yes/no security questions
`aspex lock` / `aspex verify`	the security lockfile and drift against it
`aspex diff main..HEAD`	security impact of a config change
`aspex tighten`	least-privilege recommendations
`aspex bom`	Agent Security BOM
`aspex explore`	local session explorer
`aspex mcp`	read-only MCP server for your agent
`aspex history`	posture over time
`aspex hooks`, `aspex doctor`, `aspex attack`	hooks, pre-flight, red team

Start

Concepts

Commands

Guides

Reference

aspex (front door)

Every command, by what it is for

Just the snapshot

Direct commands

What “never scanned” means

Every command through `aspex`

​Every command, by what it is for

​Share it

​Just the snapshot

​Direct commands

​What “never scanned” means

​Every command through aspex

Every command, by what it is for

Share it

Just the snapshot

Direct commands

What “never scanned” means

Every command through `aspex`