Cloud security that runs on your machine.

Osprey reads your AWS account through read-only APIs and reports the handful of findings that are actually exploitable together — the analysis enterprises buy a CNAPP for, without the CNAPP. No vendor backend, no data egress, no telemetry. 

# with the AWS credentials you already have
osprey scan aws

# or through a dedicated read-only role
osprey onboard | aws cloudformation deploy --stack-name osprey-audit \
  --template-file /dev/stdin --capabilities CAPABILITY_NAMED_IAM
osprey scan aws --profile osprey-audit

A useful report in under five minutes, with zero configuration beyond the credentials on your laptop.

Findings are noise. Combinations are incidents.

A public bucket is a ticket. An over-permissive role is a ticket. A critical CVE is a ticket. An internet-facing instance whose role can pass any role, running an image with that CVE, is an account takeover — and no single-purpose scanner will tell you, because each one only sees its own third of it.

Osprey joins them. It builds an identity graph from IAM, resource and trust policies, marks what is reachable from the internet, folds in CSPM and CVE findings, and runs 25 deterministic rules over the result. No model decides what is true.

The privacy contract

Your cloud metadata never leaves your machine. The only outbound calls are to your cloud provider, your chosen LLM endpoint, GitHub when you ask for a pull request, and the upstream endpoints a scanner engine needs when you opt into one. There is no telemetry — and no vendor endpoint for it to go to.

This is architecture, not policy. There are no servers to host, nothing to breach, and nothing to subpoena.

What it does

Toxic-combination engine

25 built-in rules joining exposure, identity and vulnerability signals. Deterministic and offline: the same input always produces the same output.

IAM graph and escalation paths

A property graph of principals, policies and resources built from read-only API calls, with privilege-escalation paths implemented from published technique classes.

Pinned scanner engines

Prowler for CSPM, Trivy for container images and Terraform — run as subprocesses at pinned versions, verified by SHA-256. No scanner code is linked into the binary.

Local console and desktop app

One embedded interface, served on 127.0.0.1. Open it in a browser, install it as an app, or run the packaged desktop build on the operating system's own webview.

Unattended worker

Rescans on a schedule and alerts only on findings that appeared or were fixed, plus fifteen high-risk CloudTrail events. Read-only and alert-only, by Helm chart.

AI review, on your key

OpenAI, Anthropic or a local Ollama. The model reads a pseudonymized digest — no ARNs, account ids or addresses — and returns a ranked reading. It analyses; it never drives.

What it deliberately does not do

Pricing

OSS core

FreeApache-2.0

  • Every CLI scan: CSPM, IAM graph, containers, IaC
  • Deterministic toxic-combination rules
  • HTML and OCSF-aligned JSON reports
  • Kubernetes worker with Slack and Teams alerts

Pro

$199per user, per year

  • Everything in the OSS core
  • Local console and desktop app
  • AI review on your own key or a local model
  • One-click Terraform pull requests
  • Multi-account views

You pay your own cloud-API and model-token costs. The vendor runs no servers, so there is nothing to mark up.