Skip to main content
Cynative is a single static binary with no dependencies. Install it, point it at an LLM provider and your cloud credentials, and you’re ready to run security research against live infrastructure — all read-only, all verified.
1

Install Cynative

The fastest way to install on macOS or Linux is Homebrew:
Install script (macOS / Linux) — downloads the latest release, verifies the SHA-256 checksum against the release checksums.txt, and installs to ~/.local/bin by default:
Windows (Scoop):
See the Installation guide for manual downloads, release signature verification, version pinning, and macOS .pkg details.
2

Configure an LLM Provider

Cynative requires an LLM provider and model. Set them via environment variables before your first run. The example below uses Anthropic:
Cynative supports almost any AI provider through the embedded Bifrost SDK, including OpenAI, Azure OpenAI, Amazon Bedrock, Google Vertex/Gemini, Groq, Ollama, vLLM, and more. A few quick alternatives:
Provider settings can also be written to ~/.cynative/config.yaml for persistence. See the providers documentation for every supported provider’s configuration reference.
3

Validate Your Setup

Run cynative doctor to validate your configuration and connector readiness without starting a research session:
Add --live-llm to also probe the configured model with a tool-less round-trip, confirming your API key and endpoint are reachable:
Fix any issues reported before continuing — doctor checks your LLM configuration, credential discovery for each connector, and action-gate policy resolution.
4

Run Your First Built-in Agent

Cynative ships 45 embedded agents for AWS, GCP, Azure, GitHub, and Kubernetes. Run one non-interactively with the -p flag:
The -p / --print flag runs a single task non-interactively and exits — ideal for scripts and CI. Without -p, Cynative opens an interactive session after the agent finishes.Each tool call waits for a single keystroke approval: y runs it once, a approves all later calls to that tool for the session, and any other key denies. Use --auto-approve to skip approvals for unattended runs:
To browse the full catalog:
5

Ask a Free-Form Question

You can ask Cynative anything in natural language. It picks up the credentials already in your shell and reasons through your live infrastructure:
More examples:
Cynative prints a short footer with timing and token usage to stderr, so redirecting stdout keeps the captured answer clean:

​
Next Steps

Agents Catalog

Browse all 45 built-in agents for AWS, GCP, Azure, GitHub, and Kubernetes — with one-line descriptions and example use cases.

Writing Your Own Agents

An agent is a single markdown file. Copy a built-in, edit the prompt, and run it under a new name — no code required.

Connectors Overview

Learn how Cynative discovers credentials, enforces read-only at three layers (network, action gate, and credential), and connects to each cloud and platform.

Configuration Reference

All configuration keys and environment variables — LLM provider settings, resource and cost controls, audit log options, and connector hardening.