Nirmata Scanners

Find it before it ships. Clusters, pipelines — and now agents.

Two scanners that run anywhere your code does. One checks what your infrastructure is about to do. The other finds agents you did not know you were running.

• Free to scan · no cluster agent
• Runs in CI, locally or as a container
• SARIF · CycloneDX · PolicyReport

Command Line Example

$nctl scan kubernetes --cluster --policy-sets pss-baseline
scanning 4,218 resources across 12 namespaces…
✔ pss-baseline 3,946 pass272 fail
✖ disallow-privileged payments/api-7f4
✖ require-run-as-nonroot checkout/worker-2b1
→ report published to Nirmata Control Hub
$aibom scan . --output sarif --fail-on agents
1,284 files · python, typescript, go
✔7 agents23 tools4 models2 MCP servers
⚠ shadow-ai billing-svc/agent.py:41 unpinned model
⚠ mcp-inventory .cursor/mcp.json undeclared server
✖ --fail-on agents triggered — exit 1

Two scanners. Two questions.

Both are command-line tools. Both publish to the same place.

Infrastructure

nctl scan

“Is this configuration allowed?” Evaluates Kyverno policies against anything you are about to deploy — no policy engine needed in the cluster.

• Kubernetes manifests and live clusters, Terraform plans, Dockerfiles, Helm charts, GitHub Actions, arbitrary JSON Free
• --remediate shows or patches the fix Free
• Prompts and agent skills, checked against policy Licensed
• Central policy sets, shared exceptions and published reports Licensed

nctl docs →

AI inventory · early access

aibom-scanner

“What AI is in here?” Reads source and container images and produces an AI Bill of Materials — agents, tools, models, prompts, MCP servers.

• Python, TypeScript, Go, Java, Rust, C# — 60+ frameworks and SDKs
• Finds MCP servers in code and in .cursor/mcp.json, .claude/settings.json
• CycloneDX AIBOM with EU AI Act and NIST AI RMF fields
• --fail-on agents blocks the undocumented agent in the PR

Not released yet. Early access is open — tell us what you need to inventory and we will get you a build.

What you can point it at

Kubernetes

Live clusters, or manifests before they deploy.

Terraform

Plan files, checked before you apply them.

Dockerfile

Base images, users and build steps.

Helm charts

Templates rendered with your own values.

GitHub Actions

Workflow files and supply-chain risk.

Any JSON

Arbitrary resources, against your own rules.

LLM prompts

Acute Pulled out of code and config, scored for risk.

Agent skills

Acute What a skill declares it is allowed to do.

Three jobs people actually use them for

Gate the pipeline

Fail the build on a violation instead of finding it in production. Exit codes are designed for CI.

`nctl scan repository -o sarif --file`

Manage exceptions

Pull approved exceptions from Control Hub so a known, signed-off risk does not block the same team twice.

`nctl scan kubernetes --cluster --cluster-exceptions`

Report for auditors

Run a named standard against a live cluster and publish the evidence, rather than exporting YAML by hand the week before.

`nctl scan compliance --cluster --publish`

What's free, what's licensed

Scan your own infrastructure against your own policies as much as you like. A subscription starts where policy becomes shared — central rules, approved exceptions, evidence your auditor accepts, and anything touching AI.

Free tier

• Scan Kubernetes, Terraform, Dockerfiles, Helm, GitHub Actions and JSON
• Run against your own policy files — -p ./policy.yaml
• SARIF, JSON, YAML output and CI exit codes
• --remediate show — see the fix

Licensed

• Prompt and agent-skill scanning against policy, with risk thresholds
• AI-assisted classification — --ai-check, --analyze
• Central policy sets — --policy-sets
• Shared, approved exceptions — --cluster-exceptions
• Published reports and compliance evidence — --publish
• aibom-scanner — AI inventory across repos and images · early access

Licensed capabilities are part of Nirmata Control Hub. Start on the free tier and turn them on with a token — no reinstall.

Scanners are control point one

The same policies keep running at admission, at the gateway and in the kernel. Scanners are where they start.

1. Pipeline
2. Admission
3. Gateway
4. Runtime

Start scanning in one command.

Install nctl and scan your first cluster free. Add a token when you need shared policy, exceptions and evidence.

Install nctl — docs→ Early access: aibom-scanner→

Free account unlocks the licensed flags on your own clusters. No card required.