Find misconfigs.
Before attackers do.
Plexavo finds AWS attack paths, not just misconfigurations.
$ uv tool install plexavo
A cloud security tool you can read before you trust it.
Detection is plain Python and boto3, never AI. Every check is public, and every finding tells you what an attacker does with it and the exact command to close it.
It runs on your own AWS credentials. Nothing about your account leaves your machine.
S3 bucket "taskflow-customer-documents" is readable by anyone on the internet
- Impact
- Block Public Access is off and the bucket policy grants
s3:GetObjectto*. Every object is anonymously downloadable, including anything uploaded later. - Evidence
- get-bucket-policy-status → IsPublic: true; PublicAccessBlockConfiguration absent.
- Next step
- aws s3api put-public-access-block --bucket taskflow-customer-documents --public-access-block-configuration BlockPublicPolicy=true,RestrictPublicBuckets=true
32 checks across the six ways AWS accounts actually go wrong.
Run against real accounts, not a best-practices PDF. Each finding is something specifically true about your setup.
IAM
Privilege-escalation paths, wildcard admin, cross-account trust, root usage, dormant credentials.
Network
Security groups and RDS instances exposed to 0.0.0.0/0 when they shouldn't be.
Storage
Public S3 buckets via ACLs, bucket policies or missing Block Public Access; buckets with no access logging.
Encryption
Unencrypted EBS volumes, RDS instances and S3 buckets, including the ones auto-created for you.
Logging
CloudTrail coverage and encryption, GuardDuty status, so a break-in would not go unseen.
Usage
Permissions granted but never used, roles nobody has assumed in 90+ days. Risk sitting around for nothing.
Three commands from install to a report you can hand to anyone.
One isolated environment
uv tool install plexavo (or pipx, or pip). Nothing touches your system Python.
Point it at a profile
Run plexavo with no arguments and it walks you through picking an AWS profile and output format, then scans read-only.
Score plus fixes, HTML or PDF
A 0 to 100 security score and, per finding: Impact, Confidence, Evidence, and a copy-paste Next step.
Optional Claude narration.
Every finding ships with a free templated fix by default. Install plexavo[ai] and set your own ANTHROPIC_API_KEY and each finding is also rewritten as a full plain-English narrative. It runs in your own Anthropic account, Plexavo never sees your key, and a full scan costs a few cents.
Tested on the same account, same session, as Prowler and PMapper.
Not a paper comparison. A real, same-account run. Here's where Plexavo is genuinely different, stated honestly.
Plexavo
open-source · plain-English · 32 checks- Impact / attacker move / exact fix on every finding
- General-purpose unused-permission analysis across any service
- Reliable GuardDuty detection
- One clean install, no version-compat surprises
Prowler
mature · 400+ checks · compliance mapping- Far wider service and check coverage
- Native CIS / SOC2 / PCI / HIPAA mapping
- Findings are one terse technical line
- No "what would an attacker do" framing
PMapper
specialist · IAM graph simulation- True graph-based privilege-escalation modelling
- No severity rating at all
- No remediation guidance
- Rawest output of the three
Plexavo is an early single-developer project measured against years-mature tools. The full write-up, including its own gaps, is in the repo's docs/COMPARISON.md.
The open-source core stays free. Forever.
These are the next things being built into Plexavo. No paywall on detection. If a check exists, it is in the OSS release.
Confused-deputy check
Flag service and cross-account trust policies missing an ExternalId / SourceAccount condition.
Graph-based privesc pass
An optional deeper mode that simulates authorization instead of pattern-matching known shapes.
Per-region CloudTrail
Enumerate every region independently instead of one account-wide check.
Compliance tagging
Map the existing checks to CIS / SOC2 controls for teams asking "are we SOC2-ready".
Quick-wins summary
"These 4 Criticals trace to one root cause, fixing it clears about 60 points."
Think you can make it miss something?
Every confirmed, genuinely new finding gets fixed and shipped, and you get a permanent credit in the HALL_OF_BUGS.md. No bounty, public credit only. This adversarial testing is how the tool stays honest.
"iam:Get* / iam:List* were slipping past the 'don't flag broad grants as unused' rule." → caught, patched, regression test added, reporter credited.
Scan your account in the next five minutes.
No signup. No card. No sales call. Install it and run it against a profile you already have.
$ uv tool install plexavo