plexavo 0.4.3

See your cloud. Secure what matters.

Turn AWS configuration data into clear, actionable security intelligence.

Plexavo is an open-source cloud security tool that audits AWS accounts for real-world misconfigurations, using your own local AWS credentials the same way aws s3 ls does, so nothing about your account ever leaves your machine.

Each scan produces a 0–100 security score and a plain-English report: what's wrong, what an attacker would actually do with it, and the exact command to fix it.

✦ What it checks

32 checks across 6 categories, run against real AWS accounts:

See docs/*-TEST-MATRIX.md for how each check was verified.

⚡ Installation

Every path below installs Plexavo into its own isolated environment.

macOS & Linux

curl -LsSf https://astral.sh/uv/install.sh | sh   # skip if you have uv
uv tool install plexavo

Prefer pipx? pipx install plexavo works the same way.

Windows

uv/pipx still work, but the PATH launcher is unsigned and Windows Smart App Control blocks it. Run Plexavo through Python instead:

Option 1, uv (recommended)

uv tool install plexavo
Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
if (!(Test-Path $PROFILE)) { New-Item -ItemType File -Path $PROFILE -Force }
Add-Content $PROFILE 'function plexavo { & "$env:APPDATA\uv\tools\plexavo\Scripts\python.exe" -m plexavo @args }'

Open a new terminal. plexavo now works like it does on macOS/Linux, routed through uv's signed Python instead of the blocked launcher.

Option 2, plain venv

py -m venv plexavo-venv
.\plexavo-venv\Scripts\Activate.ps1
python -m pip install plexavo
python -m plexavo

Use python -m for everything here too. The venv's own pip.exe and plexavo.exe are unsigned as well, only python.exe is signed.

AI narration (optional)

Want each finding rewritten as a full narrative? Install "plexavo[ai]" instead of plexavo, and set ANTHROPIC_API_KEY. See Cost.

🚀 Using Plexavo

Run it with no arguments and it walks you through everything: picking an AWS profile, choosing HTML or PDF, then scanning and showing your score with every finding.

plexavo             # macOS/Linux, and Windows Option 1
python -m plexavo   # Windows Option 2

Running it on a schedule

Plexavo can also run unattended from cron or a GitHub Actions workflow, and flag a run when something regresses so you get notified without opening a report. See docs/automation.md.

🤖 Using it from Claude Code

Using Claude Code? Install the plexavo-scan plugin, then just ask: "scan my AWS account for security issues using Plexavo." It relays exactly what Plexavo found, shows Plexavo's own fix commands word for word, and never runs one itself: you do. It only reads your AWS profile names, never your credentials. Don't have Plexavo installed yet? It notices, and with a click on a yes/no choice at each step installs uv and Plexavo for you, including the Windows Smart App Control workaround.

/plugin marketplace add plexavo/Plexavo
/plugin install plexavo-scan@plexavo

Prefer not to add a marketplace? Save plexavo-scan/SKILL.md to ~/.claude/skills/plexavo-scan/SKILL.md (%USERPROFILE%\.claude\skills\plexavo-scan\SKILL.md on Windows) instead, same skill, just without automatic updates.

📊 The report

Reports are generated as HTML, PDF, or both. Every finding gets a free, template-based fix by default, no key, no cost. Full AI-written narration kicks in automatically once an ANTHROPIC_API_KEY is detected, see Cost.

💰 Cost

Detection and the free templates always cost nothing. Live AI only runs with --explain, using your own ANTHROPIC_API_KEY in your own Anthropic account.

Plexavo never sees your key and never calls the API without it. A full scan with --explain typically costs a few cents.

🤝 Contributing

git clone https://github.com/plexavo/plexavo.git
cd plexavo
uv pip install -e .

See CONTRIBUTING.md for the pattern used to add a new check.

🧨 Break Plexavo

Think you can make Plexavo miss something, or give confusing guidance?

Report it →

Every confirmed, genuinely new finding gets fixed and shipped, and you get a permanent credit in the Hall of Bugs.

No bounty. Public credit only.

🔐 Security

Found a vulnerability in the tool itself, not a misconfiguration in your own AWS account (that's the tool working correctly)?

See SECURITY.md for a private reporting path.

📄 License

AGPL-3.0, see LICENSE.

Use, run, and modify it freely. If you run a modified version as a hosted service, you're required to publish those modifications too.