Map your cloud and Kubernetes architecture. Live.
MeshReader replaces stale Visio diagrams with a living map of your real infrastructure — AWS (EC2, EKS, RDS, S3, IAM) and Kubernetes services, pods, and identities — correlated into one graph across Cloud → Kubernetes → Application → Identity → Data, then enriched with real CVE scans, risk, and the attack paths that run through it.
- AWS + Kubernetes
- Syft + Grype CVEs
- SOC 2 · PCI · HIPAA
- Open source
Isolated workspace provisions in minutes — no card required. Or self-host on GitHub.
Connect your estate in minutes.
Every other tool shows you one layer — a cloud inventory, a Kubernetes map, an SBOM, or an IAM analyzer — and you stitch them in your head. MeshReader connects them into one graph, however your infrastructure reaches it.
In-cluster agent
A lightweight agent watches the Kubernetes API, scans every workload image, and streams posture to your isolated workspace over gRPC with a per-tenant relay key.
Agentless cloud & kubeconfig
Grant a read-only AWS role or kubeconfig and MeshReader polls your cloud accounts and clusters from the control plane — EC2, EKS, RDS, S3, IAM, and workloads. No install.
Schema import
Paste or upload a Syft SBOM, a Grype report, or a MeshReader snapshot. It normalizes and renders instantly, with no cluster access at all.
From cloud & cluster to a living map, in four steps.
Discover
Cloud assets and Kubernetes services, pods, and identities are read straight from AWS and the Kubernetes API — no stale diagrams.
Scan
Syft builds an SBOM of each image; Grype matches CVEs; cloud misconfigurations and over-permissive IAM surface as findings in the same model.
Correlate
The layers are stitched by real identity keys — providerID, IRSA role ARNs, LB DNS, policy resources — into one map where cross-layer edges are first-class.
Map & expose
The whole estate renders as a live architecture graph, and the engine ranks the exact attack paths through it — internet to sensitive data, worst-first.
One graph, every layer.
Live architecture map
One graph of your real AWS + Kubernetes estate — EC2, EKS, RDS, S3, IAM, services, pods — spanning Cloud → Kubernetes → Application → Identity → Data. Group by layer, trace across it.
Cross-layer attack paths
Ranked kill-chains from a public load balancer through a pod’s CVE to the IAM role and the S3 bucket of PII it can read.
Real CVEs & SBOM
Syft + Grype scan your actual images; cloud misconfig and IAM findings flow into the same scanner-agnostic model.
Explainable risk
A 0–100 score per node from Impact × Exploitability — deterministic, never a hardcoded number.
Compliance & attestation
Continuous SOC 2, PCI-DSS, HIPAA, GDPR and NIST evaluation with a signed attestation ledger and exposure tickets + SLAs.
Isolated per-tenant workspace
Every customer gets a dedicated, isolated stack. Sign up and it provisions automatically in minutes.
What is MeshReader?
MeshReader is a cloud and Kubernetes architecture mapper. It reads your liveAWS and Kubernetes estate and correlates it into one navigable map — replacing stale Visio diagrams and CMDB guesswork with a living picture of how everything actually connects. On top of that map it layers Application Security Posture Management (ASPM): it answers not just which CVEs exist, but how an attacker actually reaches your data across cloud, cluster, application, and identity — turning a noisy stream of vulnerability data into a clear, navigableunified security graph.
The unified security graph
MeshReader’s differentiator is a single graph that connects Cloud → Kubernetes → Application → Identity → Data, where the edges between layers are first-class. Native Go collectors pull your AWS estate — EC2, EKS, ELB, RDS, S3, Lambda, IAM — alongside Kubernetes discovery, and a correlation engine stitches them by real identity keys: a node’s providerID to its EC2 instance, anIRSA ServiceAccount to the IAM role it assumes, a role policy to the S3 bucket it can read. The result is one traversal you can watch: internet → load balancer → pod (with a CVE) → ServiceAccount → IAM role → the bucket of customer PII behind it.
Live cloud & Kubernetes discovery
MeshReader meets your infrastructure where it is. A lightweight in-cluster agent watches the Kubernetes API and pushes over gRPC, or connect a read-only AWS role orkubeconfig and MeshReader polls agentlessly from the control plane. Prefer to try it cold? Import a Syft SBOM or Grype report and work entirely offline. Discovery is always read-only.
Real vulnerability scanning with Syft and Grype
For every workload, MeshReader runs Syft to generate a complete software bill of materials (SBOM) and Grype to match those packages against currentCVE data. The result is the real dependency inventory of each container image and the actual vulnerabilities affecting it — not a stale, hardcoded list. Because the finding model isscanner-agnostic, adapters for Trivy, Snyk, or OSV slot into the same schema, so you can standardize on one posture view across many tools and avoid vendor lock-in.
Risk you can actually reason about
A vulnerability count is not a priority list. MeshReader computes a 0–100 risk score per service by decomposing risk into Impact — data sensitivity (PII, PCI) multiplied by finding severity — and Exploitability — whether a service is internet-facing and how it connects to others. The scoring is deterministic and explainable, so an internet-exposed gateway with critical CVEs ranks above an internal cache with the same packages. Risk weights map to your own policy, making MeshReader a practical tool for DevSecOps teams triaging real software supply chainexposure.
One picture, every signal
Everything renders as an interactive service dependency graph, a sortable table, and a per-service detail panel showing risk, violations, dependencies, and classifiers. You see how a critical CVE in one library propagates through the services that depend on it — turning container vulnerability scanning into genuine, cloud-native situational awareness. MeshReader is open source and built on a clean protobuf object model you own, so you can extend the collector, add scanners, or re-weight risk to fit your environment.
Hosted and isolated, or self-hosted
MeshReader fits naturally into DevSecOps and platform-engineering workflows. As ahosted multi-tenant service, signing up provisions an isolated workspacefor your organization — its own data plane and database, with strict tenant isolation — in minutes, with self-serve accounts, roles, and team invites. Prefer to run it yourself? The full stack — agent, ingestion, and static frontend — is open source and self-hostable anywhere Kubernetes runs (EKS, GKE, AKS, or local kind/k3d), using standard read-only RBAC, so you keep full control of your data and software supply chain visibility.
Get started in minutes
The fastest way to evaluate MeshReader is schema-import mode: paste a Syft SBOM or a Grype report and the risk graph renders immediately in your browser, with nothing to install. When you're ready for live data, deploy the in-cluster agent and watch your real services, dependencies, and CVEs populate continuously as your cluster changes. Going from a first scan to a prioritized, navigable view of yourKubernetes security posture is a matter of minutes — not a procurement cycle — which makes MeshReader equally useful for a quick audit or as a permanent part of your continuous security monitoring.
Frequently asked questions
What is MeshReader?
MeshReader is a cloud and Kubernetes architecture mapper. It discovers your live AWS and Kubernetes estate — EC2, EKS, RDS, S3, IAM, services, pods, and identities — and correlates them into one navigable map, replacing stale Visio diagrams with a living picture of how everything actually connects. It then enriches that map with real vulnerability scans, computed risk, and the attack paths that run through it.
What makes the unified security graph different?
Most tools stop at one layer — a cloud asset inventory, a Kubernetes map, an SBOM, or an IAM analyzer. MeshReader connects them: the cross-layer edges are first-class, so you can trace one chain from a public load balancer, through the EKS pod and the CVE in its image, to the ServiceAccount, the IAM role it assumes, and the S3 bucket of customer PII it can reach.
How does MeshReader discover my estate?
Several ways: an in-cluster agent that watches the Kubernetes API and pushes over gRPC, agentless polling via a read-only AWS STS role or kubeconfig from the control plane, or a static schema import of a Syft SBOM, Grype report, or MeshReader snapshot.
Is it hosted and multi-tenant?
Yes. Sign up and MeshReader provisions an isolated workspace for your organization — its own data plane and database — with strict tenant isolation. You can also self-host the open-source stack.
Which scanners does it use?
Syft generates the SBOM and Grype matches it against CVE data by default. The finding model is scanner-agnostic, so Trivy, Snyk, or OSV adapters — and native cloud/IAM misconfiguration findings — plug into the same schema.
How is the risk score calculated?
Risk decomposes into Impact (data sensitivity × finding severity) and Exploitability (internet-facing exposure + connections), computed per node from real findings — never a hardcoded number.
Can I try it without connecting anything?
Yes. Use schema import to paste a Syft SBOM or Grype report and the graph renders instantly in your browser, no cluster or cloud access required.
Map the path to your data.
Create your workspace and connect a cluster or cloud account — or explore the live demo graph first.