Harden every server and cloud account without breaking production.
TMAegis turns CIS Benchmarks into reversible, declarative policies. Scan, get a report, fix what matters and roll back in one command if anything goes wrong.
Run your first scan
tmaegis scan --auto-detect
sudo tmaegis apply --auto-detect --dry-run
- 8,597
- Hardening rules
- 96
- Platforms and products
- 4,536
- Automated checks
- 16
- Interface languages
What you get
One engine for operating systems, databases, web servers, containers, network devices and cloud accounts.
Safe by design
A snapshot before every change, configuration validated before it replaces the live file, and a dead-man's switch that rolls back if you lose access.
Declarative rules
Every control is a readable YAML rule with an audit, a remediation and a reference. Review them, diff them and keep them in Git.
Private AI analysis
Optional AI only assesses the impact of a fix. Secrets and addresses are redacted before any API call, or run fully offline with a local model.
Agentless cloud checks
Read-only checks for AWS, Azure, Google Cloud and more. Fixes are proposed as Terraform instead of changing your account behind your back.
Plugins
Send results to Slack, Telegram or Jira, or write your own. Plugins run as plain executables or sandboxed WebAssembly.
Reports for everyone
Engineers get SARIF and JSON. Auditors get HTML, Excel and PDF. Nine formats from the same scan.
Supported platforms
Rules are matched to what is actually installed, so a scan only runs the checks that apply.
Operating systems
- Ubuntu
- Debian
- RHEL
- Rocky
- Windows Server
- macOS
- FreeBSD
- Solaris
- AIX
- IBM i
- IBM Z
- COS
Cloud
- AWS
- Azure
- Google Cloud
- Oracle Cloud
- Alibaba Cloud
- IBM Cloud
- Microsoft 365
- Google Workspace
- Power Platform
Databases
- PostgreSQL
- MySQL
- MariaDB
- MongoDB
- SQL Server
- Oracle Database
- Db2
- Redis
- Cassandra
Web servers and runtimes
- NGINX
- Apache HTTP Server
- Tomcat
- IIS
- WebSphere
Containers and orchestration
- Docker
- Kubernetes
- EKS
- AKS
- GKE
- OpenShift
Network devices
- Cisco
- Juniper
- Palo Alto
- Fortinet
- F5
- Check Point
- pfSense
- OPNsense
Applications and endpoints
- Chrome
- Edge
- Firefox
- Microsoft Office
- Zoom
- iOS
- Android
- VS Code
- GitLab
- MCP Server
How it works
Four steps, each one safe to run on its own.
- 01
Scan
Detect the host and run every rule that applies. Read-only, nothing changes.
- 02
Report
Get a ranked list of findings as HTML, PDF, Excel, SARIF or JSON.
- 03
Fix
Preview with a dry run, then apply. A snapshot is taken first and the change is verified.
- 04
Roll back
Restore any snapshot with one command, or let the dead-man's switch do it for you.
See it in action
The same engine behind a command line, a desktop app and a self-contained report. These illustrations show sample data.
Safety promises
Hardening tools break things when they are careless. TMAegis is built around not doing that.
Snapshot first
Affected files and settings are backed up before any change.
Verify before commit
Configuration is syntax-checked, for example with sshd -t or nginx -t, before it replaces the live file.
Dead-man's switch
Confirm within the timeout or the change is rolled back automatically.
Preview before you change
Preview exactly what would change, line by line, without touching the system.
Works offline
A single static binary with no runtime dependencies. No telemetry and no account.
Read-only for cloud
Cloud checks never change your account. Fixes are written as Terraform for you to review.
Quick start
From zero to a hardened host in four commands.
- 01
Get the binary
Download a release or build from source.
shellgit clone https://github.com/tmaegis/tmaegis.git cd tmaegis && make build - 02
Scan
Run a read-only audit of everything that applies to this host.
shell./bin/tmaegis scan --auto-detect - 03
Preview the fixes
See what would change without changing it.
shellsudo ./bin/tmaegis apply --auto-detect --dry-run - 04
Apply, and undo if needed
Apply the fixes. Roll back with one command.
shellsudo ./bin/tmaegis apply --auto-detect sudo ./bin/tmaegis rollback
Ready to harden something?
TMAegis is free and open source. Start with a scan, it changes nothing.