Nirmata Scanners

Find it before it ships.
Clusters, pipelines — and now agents.

Two scanners that run anywhere your code does. One checks what your infrastructure is about to do. The other finds agents you did not know you were running.

Free to scan · no cluster agent Runs in CI, locally or as a container SARIF · CycloneDX · PolicyReport

Two scanners. Two questions.

Both are command-line tools. Both publish to the same place.

Infrastructure
nctl scan

“Is this configuration allowed?” Evaluates Kyverno policies against anything you are about to deploy — no policy engine needed in the cluster.

  • Kubernetes manifests and live clusters, Terraform plans, Dockerfiles, Helm charts, GitHub Actions, arbitrary JSON Free
  • --remediate shows or patches the fix Free
  • Prompts and agent skills, checked against policy Licensed
  • Central policy sets, shared exceptions and published reports Licensed
AI inventory · early access
aibom-scanner

“What AI is in here?” Reads source and container images and produces an AI Bill of Materials — agents, tools, models, prompts, MCP servers.

  • Python, TypeScript, Go, Java, Rust, C# — 60+ frameworks and SDKs
  • Finds MCP servers in code and in .cursor/mcp.json, .claude/settings.json
  • CycloneDX AIBOM with EU AI Act and NIST AI RMF fields
  • --fail-on agents blocks the undocumented agent in the PR

Not released yet. Early access is open — tell us what you need to inventory and we will get you a build.

What you can point it at

Kubernetes
Live clusters, or manifests before they deploy.
Terraform
Plan files, checked before you apply them.
Dockerfile
Base images, users and build steps.
Helm charts
Templates rendered with your own values.
GitHub Actions
Workflow files and supply-chain risk.
Any JSON
Arbitrary resources, against your own rules.
LLM promptsAI
Pulled out of code and config, scored for risk.
Agent skillsAI
What a skill declares it is allowed to do.

Three jobs people actually use them for

Gate the pipeline

Fail the build on a violation instead of finding it in production. Exit codes are designed for CI.

nctl scan repository -o sarif --file

Manage exceptions

Pull approved exceptions from Control Hub so a known, signed-off risk does not block the same team twice.

nctl scan kubernetes --cluster --cluster-exceptions

Report for auditors

Run a named standard against a live cluster and publish the evidence, rather than exporting YAML by hand the week before.

nctl scan compliance --cluster --publish

“You cannot govern what you cannot see.”

1 · Scan

  • repo
  • container image
  • --since HEAD~1

2 · Inventory

  • agents
  • tools
  • models
  • prompts
  • MCP servers
  • guardrails

3 · Act on it

  • SARIF → GitHub Security
  • PolicyReport → kubectl
  • AIBOM → AIControls

What's free, what's licensed

Scan your own infrastructure against your own policies as much as you like. A subscription starts where policy becomes shared — central rules, approved exceptions, evidence your auditor accepts, and anything touching AI.

Free tier

  • Scan Kubernetes, Terraform, Dockerfiles, Helm, GitHub Actions and JSON
  • Run against your own policy files — -p ./policy.yaml
  • SARIF, JSON, YAML output and CI exit codes
  • --remediate show — see the fix

Licensed

  • Prompt and agent-skill scanning against policy, with risk thresholds
  • AI-assisted classification — --ai-check, --analyze
  • Central policy sets — --policy-sets
  • Shared, approved exceptions — --cluster-exceptions
  • Published reports and compliance evidence — --publish
  • aibom-scanner — AI inventory across repos and images · early access

Licensed capabilities are part of Nirmata Control Hub. Start on the free tier and turn them on with a token — no reinstall.

Scanners are control point one

The same policies keep running at admission, at the gateway and in the kernel. Scanners are where they start.

All four control points run on AIControls.

Start scanning in one command.

Install nctl and scan your first cluster free. Add a token when you need shared policy, exceptions and evidence.

Free account unlocks the licensed flags on your own clusters. No card required.