Plexavo is an open-source cloud security tool that audits AWS accounts
for real-world misconfigurations. It runs entirely with your own local
AWS credentials, the same way you'd run aws s3 ls, so nothing about
your account is ever handed to anyone else. Each scan produces a 0-100
security score and a plain-English report: what's wrong, what an
attacker would actually do with it, and the exact command to fix it.
Detection is pure Python/boto3, never AI. Claude only rewrites already-found technical findings into something a non-security founder can read, and it's entirely optional. See Cost.
32 checks across 6 categories, run against real AWS accounts:
- IAM: privilege escalation paths, wildcard admin, cross-account trust, root usage, dormant credentials
- Network: security groups and RDS instances exposed to the internet
- Storage: public S3 buckets, via ACLs, bucket policies, or missing Block Public Access; buckets with no access logging configured
- Encryption: unencrypted EBS volumes, RDS instances, S3 buckets
- Logging: CloudTrail coverage and encryption, GuardDuty status
- Usage: permissions granted but never used, roles nobody has assumed in 90+ days
See the docs/*-TEST-MATRIX.md files for exactly how each check was
verified.
Every path below installs Plexavo into its own isolated environment.
curl -LsSf https://astral.sh/uv/install.sh | sh # skip if you have uv
uv tool install plexavoPrefer pipx? pipx install plexavo works the
same way.
uv/pipx still work, but the launcher they put on your PATH is
unsigned, and Windows Smart App Control blocks it. Run Plexavo through
Python instead, two options:
Option 1, uv (recommended)
uv tool install plexavo
Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
if (!(Test-Path $PROFILE)) { New-Item -ItemType File -Path $PROFILE -Force }
Add-Content $PROFILE 'function plexavo { & "$env:APPDATA\uv\tools\plexavo\Scripts\python.exe" -m plexavo @args }'Open a new terminal. plexavo now works exactly like it does on
macOS/Linux, routed through uv's signed Python instead of the blocked
launcher.
Option 2, plain venv
py -m venv plexavo-venv
.\plexavo-venv\Scripts\Activate.ps1
python -m pip install plexavo
python -m plexavoUse python -m for everything here too. The venv's own pip.exe and
plexavo.exe are unsigned as well, only python.exe is signed.
Want each finding rewritten as a full narrative? Install "plexavo[ai]"
instead of plexavo, and set ANTHROPIC_API_KEY. See Cost.
Run it with no arguments and it walks you through everything: picking an AWS profile, choosing HTML or PDF, then scanning and showing your score with every finding.
plexavo # macOS/Linux, and Windows Option 1
python -m plexavo # Windows Option 2
Plexavo can also run unattended from cron or a GitHub Actions workflow,
and flag a run when something regresses so you get notified without
opening a report. See docs/automation.md.
Reports are generated as HTML, PDF, or both. Every finding gets a free,
template-based fix by default, no key, no cost. Full AI-written
narration is offered automatically only when an ANTHROPIC_API_KEY is
detected, see Cost.
Severity, confidence, and evidence are always shown as separate signals. A low-confidence Critical never reads the same as a high-confidence Medium.
Detection and the free templates always cost nothing. Live AI only runs
with --explain, using your own ANTHROPIC_API_KEY in your own
Anthropic account. Plexavo never sees your key and never calls the API
without it. A full scan with --explain typically costs a few cents.
git clone https://github.com/plexavo/plexavo.git
cd plexavo
uv pip install -e .See CONTRIBUTING.md for the pattern used to add a
new check.
Think you can make Plexavo miss something, or give confusing guidance? Report it. Every confirmed, genuinely new finding gets fixed and shipped, and you get a permanent credit in the Hall of Bugs. No bounty, public credit only.
Found a vulnerability in the tool itself, not a misconfiguration in your
own AWS account (that's the tool working correctly)? See
SECURITY.md for a private reporting path.
AGPL-3.0, see LICENSE. Use, run, and modify it freely. If
you run a modified version as a hosted service, you're required to
publish those modifications too.