One map of your platform. The few paths that matter.
Basalt reads your code, your infrastructure and your AWS account, joins them into one graph, and reports only the chains that lead somewhere sensitive. Each one comes with evidence and a fix.
How it works
Four steps, all read-only. A first scan of a typical startup platform needs no agent installed and no code changes.
Connect
A read-only AWS role assumed with an ExternalId, and the CLI on your repositories. Or run everything on your own machine. A GitHub App is rolling out.
Map
Code is parsed, never executed. Agents, tools, MCP servers, credentials, roles, policies, compute and data stores become nodes; what each can reach becomes an edge.
Find paths
The engine walks from entry points to sensitive data and scores each chain by exposure, exploitability, privilege and data sensitivity. Findings with the same root cause are grouped.
Fix and prove
Each path names the smallest change that breaks it. The CLI can apply it on a branch and open the pull request after you approve; the next scan shows the path closed.
One map, three ways to use it
Scan the platform, check every pull request before it merges, and test whether a path can really be exploited. Each one is labeled with where it stands today.
Scan
Maps code and cloud into one graph and walks it from every entry point to sensitive data. You get the few chains that hold up, not a list of loose issues.
- Agents and tools in LangChain, LangGraph, LlamaIndex, CrewAI, AutoGen, the OpenAI and Anthropic SDKs, PydanticAI, Vercel AI SDK and Mastra, plus MCP configs for Claude, Cursor, VS Code and Windsurf.
- IAM roles, policies and trust, Lambda, ECS and EC2, S3, DynamoDB and Secrets Manager, from Terraform or from the live account through a read-only role with an ExternalId.
- Five path rules today, each finding backed by file, line or ARN, with the smallest fix that breaks it. See the rules
basalt scanandbasalt scan-awsin text or JSON,basalt checkto fail a build that opens a new path, and the web app with a security report for your customers.
Parses Python, TypeScript and JavaScript, Java, Rust and C++. Code is read, never executed.
$ basalt scan ./platform code 3 agents · 11 tools · 2 MCP servers infra 7 roles · 9 data stores paths 2 critical · 1 high · 1 medium CRITICAL SupportBot can read customer data Function URL → support-api → SupportBot → read_file → support-bot → s3://customer-exports fix scope s3:GetObject to tickets/* at infra/iam.tf:22, support_bot/tools.py:8
Bug watch
Runs the same engine on every pull request and reports only the attack paths that touch the files it changes, before they reach your main branch.
- Triggered by GitHub App webhooks when a pull request is opened, reopened, marked ready for review or gets new commits.
- Posts a GitHub check (passed or issues) and, if you want, a comment with each path, its severity, the files involved and the confidence.
- You choose the lowest severity worth a comment, or run it as a check only. A commit that was already checked is not checked twice.
- Deterministic: no AI model in the loop, so it runs on every pull request on every plan.
Rolling out with the GitHub App. An AI review on top of the deterministic check is in development and not live yet.
■ Basalt bug watch — issues 1 path touches files in this pull request basalt commentedBasalt bug watch — 1 highThese attack paths touch fileschanged in this PR: ■ HIGH · Any AWS account can assume ci-deploy Trust allows "AWS": "*" with no ExternalId; the role can read prod/database. Where: infra/iam/ci.tf confidence: high
Red team
Takes the paths a scan found and tries them against a target you name, to tell the ones that can really be exploited from the ones that cannot. It is automated validation of attack paths, not a pentest.
- Runs only after an owner signs a written authorization with the target, environment and time window. Staging by default.
- Proof is a canary you plant, such as an object, a row or a file. Without the canary the verdict is inconclusive, never exploited.
- Safe HTTP methods only unless you opt in, a rate limit per target, capped turns and attempts, and a kill switch.
- Technique families mapped to the OWASP Top 10 for LLM applications: prompt injection, excessive tool agency, data disclosure, open trust and over-privileged roles.
Open to design partners. Live campaigns are switched on per account.
auth signed by an ownerscope staging · 09:00–18:00target GET only · 2 req/s · kill switchcanary s3://customer-exports/canary.txt path SupportBot → read_file → s3://customer-exports 01 direct injection blocked 02 indirect injection inconclusive 03 excessive agency canary hit verdict exploited · proof: canary
Path types
The rules the engine runs today, and the ones coming next. A rule only reports a chain it can back with evidence.
Exposed agent reaches data
A public Lambda function URL runs an agent whose tool uses a role that can read or write a sensitive store. Untrusted input can steer the agent into that tool.
Role open to any account
A trust policy lets any AWS principal assume a role. Critical when the role is admin or reaches sensitive data, high otherwise.
Sensitive store open to the internet
A bucket that looks sensitive by name or tag allows anonymous reads through its policy.
Plain-text credential
A key or token written in an MCP config, a connection string or a function's environment, and the components that use it. The value is never stored.
Coding assistant with a shell
An MCP server in the repository gives Claude, Cursor or VS Code shell access or the whole file system. Content the assistant reads can steer it.
Coming next
- Public workload reaches data without an agent (API Gateway, Lambda URL or a public route to an over-privileged role)
- Leaked credential followed to everything it can reach
- Privilege escalation inside the account
A finding you can act on
Severity, the full chain, what an attacker would reach, the cause, the fix and the evidence. When a policy condition or boundary could change the answer, the step is marked uncertain.
SupportBot can be prompted to read customer data
Impact
Read access to s3://customer-exports (tagged pii, customer-data) from a public function URL.
Cause
Role support-bot allows s3:GetObject on *; tool read_file accepts any path.
Fix
Scope the policy to tickets/* and limit the tool to one directory.
Evidence
What we don't do
Basalt stays focused on paths with evidence. For the rest, keep the tools you already have.
- Dependency CVEs and container image scanning: use Dependabot, Trivy or your current scanner.
- Hundreds of checklist rules: a misconfiguration only shows up when it is part of a real path.
- Writes to your cloud account: fixes land as code changes you review.
- Testing without permission: scan and bug watch are static and send no traffic to your apps or agents. Red team only runs against a target an owner authorized in writing.
See your own paths.
Join the waitlist, or talk to us if a security review is on the calendar.