Plexar

Runtime Security Posture Assessment for Kubernetes

GitHub | Apache 2.0 | Go

Plexar measures infrastructure exposure on Kubernetes clusters – not just “what CVEs exist” but “what can actually be exploited, through what paths, with what blast radius.”

Key Capabilities

  • Runtime CVE Filtering – Inspects /proc/1/maps via kubectl exec to identify which vulnerable packages are actually loaded in memory. No eBPF required. Works on air-gapped, FIPS-hardened, CRI-O environments where eBPF-based tools can’t deploy. Typical noise reduction: 60-80%.

  • Composite Risk Scoring – 0-100 score per pod combining CVE severity (35%), blast radius (25%), policy gaps (20%), permissions (10%), and workload sensitivity (10%). Workload-type multipliers for agents, databases, and auth services.

  • Blast Radius Analysis – Per-pod analysis of how many services are reachable if compromised, using NetworkPolicy and service topology data.

  • Delegation Chain Security – Traces AI agent and MCP server delegation paths. Checks scope attenuation at each hop (blast radius monotonicity), RBAC privilege changes, and authentication boundaries.

  • Attack Path / Exploit Chains – Combines CVE + network reachability + RBAC to identify scored chains to high-value targets.

  • Compliance Mapping – Automated mapping to SOC 2, PCI DSS v4.0, HIPAA, CIS Kubernetes Benchmark v1.8, and EU Cyber Resilience Act.

  • NetworkPolicy Generator – Auto-generates least-privilege NetworkPolicy YAML from observed traffic patterns.

  • MCP Server – 6 tools for AI agent integration: scan namespace, get pod risk, check compliance, classify workloads, find critical CVEs, audit RBAC.

Production Validation

Tested on a 102-pod enterprise appliance (CRI-O, air-gapped, FIPS-hardened):

  • 43,243 total CVEs reduced to 15,481 confirmed in-use (64.2% noise reduction)
  • 27 critical exploit chains identified
  • 75 distinct remediations from 18,381 CVE instances (99.6% reduction)
  • Delegation chain analysis revealed RBAC scope widening through 3-hop agent chain

Quick Start

# Download
git clone https://github.com/plexar-io/plexar.git
cd plexar && go build -o plexar .

# Scan a namespace
./plexar scan -n production

# Multi-namespace scan
./plexar scan -n ns1,ns2,ns3

# JSON output
./plexar scan -n production -o json > results.json

# Serve dashboard
./plexar serve --load results.json -p 8080

More projects coming soon.