kxn — The Security Layer for AI Agents

Why kxn

Everything you need to scan, detect, and remediate — in one binary.

One command, full scan

Point kxn at any URI and get instant compliance results. SSH servers, databases, Kubernetes, cloud resources, HTTP endpoints.

Unique AI agent native

Built for AI agents from day one. MCP server, OpenAI/Anthropic tool schemas, 9 supported agents. Agents scan, validate, and remediate autonomously.

New CVE detection

Local NVD + CISA KEV + EPSS database. Scan installed packages against 29K+ CVEs in <1ms. Offline. Air-gap compatible.

736+ compliance rules

CIS Benchmarks, NIST 800-53, PCI-DSS, SOC-2, ISO 27001, OWASP API Top 10. All in TOML — readable, versionable, extensible.

14 native + 3000+ Terraform providers

SSH, PostgreSQL, MySQL, MongoDB, Kubernetes, GitHub, HTTP, gRPC natively. Plus any Terraform provider via gRPC bridge — AWS, Azure, GCP, Cloudflare, Vault...

Reactive compliance

Webhook server receives cloud events (Azure Event Grid, AWS EventBridge) and scans resources in real-time as they are created or modified.

Auto-remediation

Two-step remediation: list violations, then apply selected fixes. SQL (ALTER SYSTEM, SET GLOBAL) and shell (sshd_config, sysctl) supported.

30 backends

14 alert destinations (Slack, PagerDuty, Jira, Teams...) + 16 save backends (PostgreSQL, Kafka, Elasticsearch, S3...). All via URI.

AI Agent Integration

Any AI agent can scan, validate, and remediate infrastructure security.

Claude Desktop

Claude Code

Cursor

Gemini CLI

Windsurf

OpenCode

Codex

Cline / Roo Code

GitHub Copilot

    # Setup for your AI agent

    kxn init --client claude-code

    # Export tool schemas for any agent framework

    kxn tools                  # OpenAI function calling format

    kxn tools -f anthropic     # Anthropic tool use format

    # Agent workflow: deploy → scan → remediate

    kxn ssh://root@server -o json     # 0 violations → continue

    kxn kubernetes://cluster -o json  # 2 CRITICAL → alert + rollback

Providers

14 native providers + 3000+ via Terraform gRPC bridge.

SSH

12 resource types

PostgreSQL

12 types

MySQL

14 types

MongoDB

12 types

Kubernetes

26 types

GitHub

25 types

HTTP/HTTPS

TLS, headers, timing

gRPC

health, reflection

CVE

NVD, KEV, EPSS

AWS

Terraform

Azure

Terraform

GCP

Terraform

Cloudflare

Terraform

Vault

Terraform

Quick Start

Install and scan in 30 seconds.

    # Install

    brew install kexa-io/tap/kxn

    # Or download binary (macOS, Linux, Windows)

    curl -fsSL https://github.com/kexa-io/kxn/releases/latest/download/kxn-x86_64-apple-darwin.tar.gz | tar xz

    # Scan

    kxn ssh://root@server

    kxn postgresql://user:pass@host:5432

    kxn mysql://user:pass@host:3306

    kxn mongodb://user:pass@host:27017

    # Output formats

    kxn ssh://root@server -o json

    kxn ssh://root@server -o csv

    kxn ssh://root@server -o html > report.html

    kxn ssh://root@server -o minimal

    # CVE detection

    kxn cve-update                           # sync 29K+ CVEs

    kxn ssh://root@server                    # includes package CVE scan

    # Continuous monitoring with alerts

    kxn monitor ssh://root@server --alert slack://hooks.slack.com/T/B/x

kxn vs alternatives

The only tool that scans SSH, databases, K8s, cloud, and HTTP in one binary.

Feature	kxn	Trivy	Prowler	Kubescape	Wiz
SSH/VM compliance	Yes	-	-	-	-
Database audit (PG/MySQL/Mongo)	Yes	-	-	-	-
Kubernetes CIS	Yes	Partial	-	Yes	Yes
Cloud (AWS/Azure/GCP)	3000+ TF	Partial	Yes	-	Yes
CVE packages	NVD+KEV+EPSS	Yes	-	-	Yes
AI agent native	9 agents	-	-	-	-
Single binary	35 MB	Yes	Python	Go+deps	SaaS
Self-hosted / air-gap	Yes	Yes	Yes	Yes	No
Auto-remediation	SQL+Shell	-	-	-	Yes
Price	Free (BSL)	Free	Free	Free	$50K+/yr

The security layer for AI agents

Why kxn

One command, full scan

Unique AI agent native

New CVE detection

736+ compliance rules

14 native + 3000+ Terraform providers

Reactive compliance

Auto-remediation

30 backends

AI Agent Integration

Providers

Quick Start

kxn vs alternatives

Ready to scan?