Skip to content

Nirmata Scanners

Find it before it ships.Clusters, pipelines — and now agents.

Two scanners that run anywhere your code does. One checks what your infrastructure is about to do. The other finds agents you did not know you were running.

Scan infrastructure — nctlFind your agents — early access
  • Free to scan · no cluster agent
  • Runs in CI, locally or as a container
  • SARIF · CycloneDX · PolicyReport
nctl scan kubernetes --cluster --policy-sets pss-baseline
scanning 4,218 resources across 12 namespaces…
✔ pss-baseline 3,946 pass 272 fail
✖ disallow-privileged payments/api-7f4
✖ require-run-as-nonroot checkout/worker-2b1
→ report published to Nirmata Control Hub

Two scanners. Two questions.

Both are command-line tools. Both publish to the same place.

Infrastructure

nctl scan

“Is this configuration allowed?” Evaluates Kyverno policies against anything you are about to deploy — no policy engine needed in the cluster.

  • Kubernetes manifests and live clusters, Terraform plans, Dockerfiles, Helm charts, GitHub Actions, arbitrary JSONFree
  • --remediate shows or patches the fixFree
  • Prompts and agent skills, checked against policyLicensed
  • Central policy sets, shared exceptions and published reportsLicensed
nctl docs

AI inventory · early access

aibom-scanner

“What AI is in here?” Reads source and container images and produces an AI Bill of Materials — agents, tools, models, prompts, MCP servers.

  • Python, TypeScript, Go, Java, Rust, C# — 60+ frameworks and SDKs
  • Finds MCP servers in code and in .cursor/mcp.json, .claude/settings.json
  • CycloneDX AIBOM with EU AI Act and NIST AI RMF fields
  • --fail-on agents blocks the undocumented agent in the PR

Not released yet. Early access is open — tell us what you need to inventory and we will get you a build.

Request early access

What you can point it at

  • Kubernetes

    Live clusters, or manifests before they deploy.

  • Terraform

    Plan files, checked before you apply them.

  • Dockerfile

    Base images, users and build steps.

  • Helm charts

    Templates rendered with your own values.

  • GitHub Actions

    Workflow files and supply-chain risk.

  • Any JSON

    Arbitrary resources, against your own rules.

  • LLM prompts

    AI

    Pulled out of code and config, scored for risk.

  • Agent skills

    AI

    What a skill declares it is allowed to do.

Three jobs people actually use them for

Gate the pipeline

Fail the build on a violation instead of finding it in production. Exit codes are designed for CI.

nctl scan repository -o sarif --file

Manage exceptions

Pull approved exceptions from Control Hub so a known, signed-off risk does not block the same team twice.

nctl scan kubernetes --cluster --cluster-exceptions

Report for auditors

Run a named standard against a live cluster and publish the evidence, rather than exporting YAML by hand the week before.

nctl scan compliance --cluster --publish

“You cannot govern what you cannot see.”

  1. 1 · Scan

    • repo
    • container image
    • --since HEAD~1

  2. 2 · Inventory

    • agents
    • tools
    • models
    • prompts
    • MCP servers
    • guardrails

  3. 3 · Act on it

    • SARIF → GitHub Security
    • PolicyReport → kubectl
    • AIBOM → AIControls

What's free, what's licensed

Scan your own infrastructure against your own policies as much as you like. A subscription starts where policy becomes shared — central rules, approved exceptions, evidence your auditor accepts, and anything touching AI.

Free tier

  • Scan Kubernetes, Terraform, Dockerfiles, Helm, GitHub Actions and JSON
  • Run against your own policy files — -p ./policy.yaml
  • SARIF, JSON, YAML output and CI exit codes
  • --remediate show — see the fix

Licensed

  • Prompt and agent-skill scanning against policy, with risk thresholds
  • AI-assisted classification — --ai-check, --analyze
  • Central policy sets — --policy-sets
  • Shared, approved exceptions — --cluster-exceptions
  • Published reports and compliance evidence — --publish
  • aibom-scanner — AI inventory across repos and images · early access

Licensed capabilities are part of Nirmata Control Hub. Start on the free tier and turn them on with a token — no reinstall.

Scanners are control point one

The same policies keep running at admission, at the gateway and in the kernel. Scanners are where they start.

  1. Pipeline
  2. Admission
  3. Gateway
  4. Runtime

All four control points run on AIControls.

Start scanning in one command.

Install nctl and scan your first cluster free. Add a token when you need shared policy, exceptions and evidence.

Install nctl — docsEarly access: aibom-scanner

Free account unlocks the licensed flags on your own clusters. No card required.