A
licenseA
qualityD
maintenanceA community MCP server for Cisco Secure Access that exposes the Secure Access REST API to AI clients as a curated catalog of tools for Admin, Deployments, Investigate, Policies, and Reports.
42
1
Apache 2.0
Cymulate MCP Tools
by lyonzin
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Cymulate MCP Tools Launch a BAS assessment on my endpoints"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
cymulate-mcp-tools
Community MCP (Model Context Protocol) server for the Cymulate security validation platform. Exposes 100% of the Cymulate REST API (337 endpoints, OpenAPI v2.0.62) via 100 first-class semantic tools + 1 generic REST fallback + 5 utility tools = 106 total.
Covers BAS (Breach & Attack Simulation), Exposure Validation, Exposure Analytics, Attack Surface Management, Advanced Scenarios (Purple Team), Findings, Auto Remediation, Environments/Agents, and Platform administration.
Status
Unmaintained since 2026-08-07. Last tested against Cymulate API v2.0.62 (OpenAPI 3.1.1). The original author no longer uses the Cymulate platform. Issues will remain open; community PRs are welcome and will be reviewed on a best-effort basis. Fork freely.
This is a community MCP — not affiliated with, endorsed by, or supported by Cymulate Ltd. All trademarks belong to their respective owners. Verify your Cymulate Terms of Service permits third-party API clients before use.
Related MCP server: usap-skills
Coverage vs official Cymulate MCP
This project | Official Cymulate MCP | |
Endpoints covered | 337 / 337 (100%) | ~130 / 337 (39%) |
First-class tools | 100 | 118 |
Generic REST fallback | ✅ | ❌ |
BAS full coverage (all 11 modules) | ✅ | Partial |
Auto Remediation | ✅ | ❌ |
ASM | ✅ | ❌ |
Advanced Scenarios (Purple Team) | ✅ | Partial |
HTTP Streamable transport | ✅ | STDIO only |
Rate-limit awareness in responses | ✅ | ❌ |
OpenAPI self-inspection tools | ✅ | ❌ |
How it works
sequenceDiagram
autonumber
participant U as User
participant C as Claude/MCP Client
participant S as cymulate-mcp
participant V as Zod Validator
participant X as CymulateClient
participant A as Cymulate REST API
U->>C: "Launch BAS assessment on endpoint module"
C->>S: tools/call: cymulate_bas_launch { module: "endpoint", ... }
S->>V: validate input schema
V-->>S: parsed & type-safe args
S->>X: POST /v1/edr/start (adds x-token header)
X->>A: HTTPS request
A-->>X: 200 OK + assessment_id + X-RateLimit-* headers
X-->>S: mapped response (semantic errors on 4xx/5xx)
S-->>C: structured result + rate-limit warning if remaining < 10
C-->>U: renders resultWhen to use which tool
flowchart TD
Start[Need to call Cymulate API] --> Q1{Common lifecycle<br/>operation?}
Q1 -->|Yes: launch/stop/status/report| BAS[cymulate_bas_* — 7 unified tools<br/>module enum: endpoint, waf, web_gateway, ...]
Q1 -->|Yes: EV/EA/ASM/Findings/etc.| FC[Use first-class semantic tool<br/>see CATALOG.md — 100 tools]
Q1 -->|No — rare/new endpoint| Q2{Know the path?}
Q2 -->|Yes| GENERIC[cymulate_api_call<br/>generic REST fallback]
Q2 -->|No — need to discover| INSPECT[cymulate_api_list_endpoints<br/>then cymulate_api_describe_endpoint<br/>then cymulate_api_call]
BAS --> Done[Response with rate-limit awareness]
FC --> Done
GENERIC --> Done
INSPECT --> DoneSetup
Requirements
Node.js ≥ 20
A Cymulate account with API access enabled (generate an API key in the Cymulate console → Settings → API Keys)
Install
git clone https://github.com/lyonzin/cymulate-mcp-tools.git
cd cymulate-mcp-tools
npm install
cp .env.example .env
# Edit .env: set CYMULATE_API_KEY
npm run buildRun
# STDIO (for MCP clients like Claude Code, Cursor, Continue)
npm start
# HTTP Streamable (for remote hosting)
npm run start:http
# Listens on http://127.0.0.1:9494/mcp by defaultRegister with an MCP client
Claude Code (CLI)
claude mcp add cymulate node /absolute/path/to/cymulate-mcp-tools/dist/index.jsThen set the API key in the shell that spawns Claude, or edit ~/.claude.json:
{
"mcpServers": {
"cymulate": {
"type": "stdio",
"command": "node",
"args": ["/absolute/path/to/cymulate-mcp-tools/dist/index.js"],
"env": {
"CYMULATE_API_KEY": "your_key_here",
"CYMULATE_API_BASE": "https://api.us-app.cymulate.com"
}
}
}
}Cursor / Continue / other MCP clients
Same JSON shape as above — most MCP clients accept a mcpServers map. Point command to node and args to the built dist/index.js.
HTTP mode (remote MCP host)
Start the server in HTTP mode:
MCP_TRANSPORT=http MCP_HTTP_PORT=9494 npm startThen register the endpoint URL in your MCP client instead of a local command.
Environment variables
Variable | Default | Required | Purpose |
| — | ✅ | API key from Cymulate console |
|
| REST API base URL (change for EU tenant: | |
|
|
| |
|
| HTTP bind host (only in | |
|
| HTTP bind port | |
|
| Per-request timeout | |
|
| Retries on 429/5xx | |
|
|
|
Tool catalog (18 categories, 106 tools total)
Full list with descriptions in CATALOG.md. Condensed:
# | Category | Tools | Purpose |
1 | BAS Attack Simulation (unified) | 7 | Launch/stop/status/report across 11 BAS modules via |
2 | Immediate Threats | 5 | Threat catalog, IOCs, MITRE mapping, SIEM detection |
3 | Full Kill-Chain (FKC) | 4 | FKC scenarios + campaigns, agent selection |
4 | Attack Surface Management (ASM) | 5 | Scan trigger, history, findings |
5 | Advanced Scenarios (Purple Team) | 6 | Template CRUD, actions catalog |
6 | EV — Launched Assessments | 6 | List, create, get, delete, filters |
7 | EV — Scheduled Assessments | 6 | Schedule CRUD + configurations |
8 | EV — Templates + Smart Templates | 8 | Template CRUD + smart templates |
9 | EV — Scenarios | 5 | Scenario CRUD |
10 | EV — Threats | 5 | Threat listing + auto-run schedules |
11 | EV — Resources | 4 | Resource CRUD + filters |
12 | EV — Input Configs + Groups + Pre-Reqs + WAF | 9 | Assessment prerequisites, template grouping |
13 | Exposure Analytics (EA) | 8 | CVEs, exposures, remediation tasks + export |
14 | Findings + Auto Remediation | 6 | Findings search + auto-remediation apply |
15 | Environments + Agents | 8 | Env CRUD, agent listing (connected/all), hashes |
16 | Platform (SSO/Score/MITRE/Trace/Activity) | 5 | Admin dashboards, MITRE ATT&CK coverage |
17 | General Info | 3 | Activity center, users, integrations |
18 | Utility & Fallback | 6 |
|
Naming convention: cymulate_<domain>_<action>[_<subject>].
Architecture
Dual transport in one binary — STDIO for local MCP clients, HTTP Streamable for remote hosting. Select via
MCP_TRANSPORT.Zod schemas everywhere — input validated before touching the API. Type-safe.
Rate-limit awareness — client parses
X-RateLimit-Remainingon every response; tools return a warning when < 10 remaining.Semantic error mapping — 401/403/404/429/5xx get MCP-native error codes, not raw HTTP noise.
OpenAPI spec cached in memory —
cymulate_openapi_specandcymulate_api_describe_endpointserve from cache after cold start.Idempotency + destructive hints — every tool declares
readOnlyHint/idempotentHint/destructiveHintin MCP annotations for client-side confirmation prompts.
Development
npm run dev # tsx watch mode
npm run typecheck # tsc --noEmit
npm run build # tsc → dist/
npm run clean # rimraf distSmoke test against real tenant
node scripts/smoke.mjs # probes 27 endpoints, reports pass/fail by group
node scripts/mcp-probe.mjs # boots MCP server, verifies tools/listContributing
Community PRs welcome. Because the project is unmaintained by the original author:
Please include a reproducible test case (a
smoke.mjs-style probe against the changed area is ideal).If Cymulate's API drifts (new endpoints, breaking changes), open an issue with the OpenAPI diff — a maintainer from the community can pick it up.
Fork freely if you need faster iteration.
License
MIT — see LICENSE.
Disclaimer
This is an independent, community project. It is not affiliated with, endorsed by, or supported by Cymulate Ltd. "Cymulate" is a trademark of Cymulate Ltd. Verify your Cymulate Terms of Service permits third-party API clients before using this software.
Available Tools
120 toolscymulate_advanced_create_assessmentCreate Advanced Scenarios assessmentC
Create a new Advanced Scenarios (Purple Team) assessment.
Inputs: payload (required).
cymulate_advanced_get_assessment_resultGet Advanced Scenarios assessment resultBRead-onlyIdempotent
Get results for a specific Advanced Scenarios assessment.
Inputs: assessment_id (required).
cymulate_advanced_get_dashboardGet Advanced Scenarios dashboardBRead-onlyIdempotent
Get Advanced Scenarios / Purple Team dashboard data.
Inputs: no named parameters.
cymulate_advanced_get_findingsGet Advanced Scenarios findingsBRead-onlyIdempotent
Get findings from a specific Advanced Scenarios assessment.
Inputs: assessment_id (required).
cymulate_advanced_get_templateGet Advanced Scenarios templateCRead-onlyIdempotent
Get details of a specific Advanced Scenarios template.
Inputs: template_id (required).
cymulate_advanced_launch_assessmentLaunch Advanced Scenarios assessmentB
Launch a previously-created Advanced Scenarios assessment.
Inputs: assessment_id (required), options.
cymulate_advanced_list_assessmentsList Advanced Scenarios assessmentsBRead-onlyIdempotent
List all Advanced Scenarios assessments.
Inputs: no named parameters.
cymulate_advanced_list_templatesList Advanced Scenarios templatesARead-onlyIdempotent
List Purple Team / Advanced Scenarios templates available.
Inputs: no named parameters.
cymulate_agents_change_environmentMove Cymulate agent to a different environmentAIdempotent
Move a Cymulate agent to a target environment. Uses PUT /v1/agents/change-environment with query params id (agent ID) and envId (target environment ID). Requires the target environment to already exist; use cymulate_env_list to discover env IDs. Requires permission on both source and target envs.
Inputs: agent_id (required), environment_id (required).
cymulate_agents_get_hashesGet agent hashesARead-onlyIdempotent
Get hashes of installed agents (useful for integrity verification).
Inputs: no named parameters.
cymulate_agents_list_allList all agentsARead-onlyIdempotent
List all Cymulate agents (connected + disconnected).
Inputs: no named parameters.
cymulate_agents_list_connectedList currently connected agentsARead-onlyIdempotent
List all connected Cymulate agents.
Inputs: no named parameters.
cymulate_api_callGeneric Cymulate REST API callA
Fallback tool to reach any of the 337 Cymulate REST endpoints not covered by first-class tools. Use when a first-class tool does not exist for the endpoint you need.
Inputs: path (required), method (required), body, query.
cymulate_asm_get_findings_by_idGet ASM findings by assessment IDARead-onlyIdempotent
Get all findings for a specific ASM assessment.
Inputs: assessment_id (required).
cymulate_asm_get_history_idsList ASM assessment history IDsARead-onlyIdempotent
Get list of ASM assessment IDs from history.
Inputs: no named parameters.
cymulate_asm_get_latest_findingsGet latest ASM findingsARead-onlyIdempotent
Get all findings for the latest ASM assessment.
Inputs: no named parameters.
cymulate_asm_get_technicalGet ASM technical reportARead-onlyIdempotent
Get detailed technical output from the latest ASM assessment.
Inputs: no named parameters.
cymulate_asm_launch_scanLaunch ASM assessmentB
Trigger a new Attack Surface Management assessment (external recon).
Inputs: options.
cymulate_bas_get_executive_reportGet BAS executive report by IDBRead-onlyIdempotent
Get executive report for a specific assessment by ID.
Inputs: module (required), assessment_id (required).
cymulate_bas_get_latest_resultsGet latest BAS results (executive)BRead-onlyIdempotent
Get the latest executive report results for the selected BAS module.
Inputs: module (required).
cymulate_bas_get_latest_technicalGet latest BAS technical reportBRead-onlyIdempotent
Get the latest technical report for the selected BAS module.
Inputs: module (required).
cymulate_bas_get_technical_reportGet BAS technical report by IDARead-onlyIdempotent
Get technical (detailed) report for a specific assessment. Use for SIEM/detection engineering.
Inputs: module (required), assessment_id (required).
cymulate_bas_get_templateGet BAS template by IDARead-onlyIdempotent
Get details for a specific template of the selected BAS module.
Inputs: module (required), template_id (required).
cymulate_bas_launchLaunch BAS assessmentB
Launch a Breach & Attack Simulation assessment on the selected module. Requires template_id for most modules; module-specific fields may go in options.
Inputs: module (required), options, template_id.
cymulate_bas_list_history_idsList BAS assessment history IDsARead-onlyIdempotent
List historical assessment IDs for the selected BAS module. Prefer this over the module-specific /ids endpoint.
Inputs: module (required).
cymulate_bas_list_templatesList BAS templatesBRead-onlyIdempotent
List templates available for the selected BAS module.
Inputs: module (required).
cymulate_bas_statusGet BAS assessment statusARead-onlyIdempotent
Get current status of the BAS module (running/idle/last-run info).
Inputs: module (required).
cymulate_bas_stopStop BAS assessmentADestructiveIdempotent
Stop a running BAS assessment on the selected module.
Inputs: module (required).
cymulate_debug_last_requestInspect last HTTP requestARead-onlyIdempotent
Return the last HTTP request/response for debugging. Useful when a call failed and you want to see the wire.
Inputs: no named parameters.
cymulate_ea_cves_exportExport CVEsCRead-onlyIdempotent
Export CVEs (typically CSV or JSON download).
Inputs: query.
cymulate_ea_cves_getGet CVE detailARead-onlyIdempotent
Get details for a specific CVE from Exposure Analytics.
Inputs: cve_id (required).
cymulate_ea_cves_listList CVEs (Exposure Analytics)BRead-onlyIdempotent
List CVEs from Exposure Analytics with optional filters.
Inputs: query.
cymulate_ea_exposures_exportExport exposuresCRead-onlyIdempotent
Export exposures from Exposure Analytics.
Inputs: query.
cymulate_ea_exposures_getGet exposure detailARead-onlyIdempotent
Get details for a specific exposure.
Inputs: exposure_id (required).
cymulate_ea_tasks_exportExport EA tasksCRead-onlyIdempotent
Export Remediation Plan tasks.
Inputs: query.
cymulate_ea_tasks_getGet EA task detailARead-onlyIdempotent
Returns drawer-level task detail (status history, severity, CVEs, mitigation type) for a single remediation task.
Inputs: task_id (required).
cymulate_ea_tasks_get_exposuresList exposures for a taskARead-onlyIdempotent
Traverses the exposures associated with the task rule filter — returns all exposures linked to a remediation task.
Inputs: task_id (required), query.
cymulate_ea_tasks_get_filtersGet EA task filtersBRead-onlyIdempotent
Get filter options for Remediation Plan tasks.
Inputs: filters.
cymulate_ea_tasks_get_mitigationsList mitigations for a taskARead-onlyIdempotent
Returns actionable mitigations derived from the task rule filter — Sigma/KQL/XQL/policy suggestions Cymulate ships for the task.
Inputs: task_id (required), query.
cymulate_ea_tasks_listList EA remediation tasksCRead-onlyIdempotent
List Remediation Plan tasks from Exposure Analytics.
Inputs: query.
cymulate_ea_validations_create_templateCreate validation templateC
Create a validation template in Exposure Analytics.
Inputs: payload (required).
cymulate_env_createCreate Cymulate environmentC
Create a new Cymulate environment.
Inputs: payload (required).
cymulate_env_deleteDelete Cymulate environmentCDestructiveIdempotent
Delete a Cymulate environment.
Inputs: environment_id (required).
cymulate_env_getGet Cymulate environment by IDBRead-onlyIdempotent
Get a specific Cymulate environment.
Inputs: environment_id (required).
cymulate_env_get_connectorsList available connectors and instancesARead-onlyIdempotent
Returns all available connectors with integrationSettingId + instances with clientIntegrationId. Use these values when creating or updating rules on an environment.
Inputs: no named parameters.
cymulate_env_get_rulesList rules for an environmentARead-onlyIdempotent
List rules defined for a specific environment.
Inputs: environment_id (required).
cymulate_env_get_test_pointsList available test pointsARead-onlyIdempotent
Returns test points grouped by type (agents, mailboxes, sites) with id/name/status. Use these values when assigning test points in create or update environment requests. Optionally pass environment_id to include test points already assigned to that environment.
Inputs: environment_id.
cymulate_env_listList Cymulate environmentsCRead-onlyIdempotent
List all Cymulate environments.
Inputs: filters.
cymulate_env_list_assetsList assets across environmentsCRead-onlyIdempotent
List assets across Cymulate environments.
Inputs: filters.
cymulate_env_list_v1List environments (v1 fallback)ARead-onlyIdempotent
List all environments via v1 endpoint. Simpler than msplatform/v2 (no permission gate). Returns id, name, agents[], urls[] per environment. Preferred for read-only discovery.
Inputs: no named parameters.
cymulate_env_updateUpdate environment metadataA
Update an existing Cymulate environment (name, tier, owners, testPoints, rules). testPoints is required in the update payload (replaces full assignment).
Inputs: payload (required), environment_id (required).
cymulate_ev_assess_prereqs_getGet assessment pre-requirementsARead-onlyIdempotent
Get pre-requirement checks for a scheduled-assessment task.
Inputs: task_id (required).
cymulate_ev_assess_prereqs_relaunchRe-run assessment pre-requirementsC
Re-run post-assessment pre-requirement checks for a launched assessment.
Inputs: assessment_id (required).
cymulate_ev_input_configs_createCreate EV input configurationD
Create an input configuration.
Inputs: payload (required).
cymulate_ev_input_configs_deleteDelete EV input configurationCDestructiveIdempotent
Delete an EV input configuration.
Inputs: config_id (required).
cymulate_ev_input_configs_getGet EV input configuration by IDCRead-onlyIdempotent
Get a specific EV input configuration.
Inputs: config_id (required).
cymulate_ev_input_configs_listList EV input configurationsCRead-onlyIdempotent
List all EV input configurations.
Inputs: query.
cymulate_ev_input_configs_updateUpdate EV input configurationC
Update an EV input configuration.
Inputs: payload (required), config_id (required).
cymulate_ev_launched_createCreate/launch new EV assessmentC
Create a new launched Exposure Validation assessment.
Inputs: payload (required).
cymulate_ev_launched_deleteDelete launched EV assessmentCDestructiveIdempotent
Delete a specific launched EV assessment.
Inputs: assessment_id (required).
cymulate_ev_launched_getGet launched EV assessment by IDBRead-onlyIdempotent
Get a specific launched Exposure Validation assessment.
Inputs: assessment_id (required).
cymulate_ev_launched_get_configurationsGet launched EV configurationsBRead-onlyIdempotent
Get the launched-assessment configurations available.
Inputs: no named parameters.
cymulate_ev_launched_get_filtersGet launched EV filtersARead-onlyIdempotent
Get filters available for launched EV assessments.
Inputs: no named parameters.
cymulate_ev_launched_listList launched EV assessmentsCRead-onlyIdempotent
List all launched Exposure Validation assessments.
Inputs: query.
cymulate_ev_resources_createCreate EV resourceC
Create a new EV resource.
Inputs: payload (required).
cymulate_ev_resources_getGet EV resource by IDCRead-onlyIdempotent
Get a specific EV resource.
Inputs: resource_id (required).
cymulate_ev_resources_get_filtersGet EV resource filtersBRead-onlyIdempotent
Get filters available for EV resources.
Inputs: no named parameters.
cymulate_ev_resources_listList EV resourcesCRead-onlyIdempotent
List Exposure Validation resources (assets, payloads, etc).
Inputs: query.
cymulate_ev_scenarios_createCreate EV scenarioC
Create a new Exposure Validation scenario.
Inputs: payload (required).
cymulate_ev_scenarios_deleteDelete EV scenarioCDestructiveIdempotent
Delete an EV scenario.
Inputs: scenario_id (required).
cymulate_ev_scenarios_getGet EV scenario by IDCRead-onlyIdempotent
Get a specific EV scenario.
Inputs: scenario_id (required).
cymulate_ev_scenarios_list_actionsList EV scenario actionsARead-onlyIdempotent
List all available EV scenario actions (building blocks for scenarios).
Inputs: no named parameters.
cymulate_ev_scenarios_updateUpdate EV scenarioC
Update an existing EV scenario.
Inputs: payload (required), scenario_id (required).
cymulate_ev_scheduled_createCreate scheduled EV assessmentC
Schedule a new Exposure Validation assessment.
Inputs: payload (required).
cymulate_ev_scheduled_deleteDelete scheduled EV assessmentCDestructiveIdempotent
Delete a scheduled EV assessment.
Inputs: schedule_id (required).
cymulate_ev_scheduled_getGet scheduled EV assessment by IDCRead-onlyIdempotent
Get a specific scheduled EV assessment.
Inputs: schedule_id (required).
cymulate_ev_scheduled_get_configurationsGet scheduled EV configurationsBRead-onlyIdempotent
Get scheduled-assessment configurations available.
Inputs: no named parameters.
cymulate_ev_scheduled_listList scheduled EV assessmentsCRead-onlyIdempotent
List all scheduled Exposure Validation assessments.
Inputs: query.
cymulate_ev_scheduled_updateUpdate scheduled EV assessmentC
Update a scheduled EV assessment.
Inputs: payload (required), schedule_id (required).
cymulate_ev_smart_templates_createCreate smart templateC
Create a new EV smart template.
Inputs: payload (required).
cymulate_ev_smart_templates_getGet smart template by IDCRead-onlyIdempotent
Get a specific EV smart template.
Inputs: template_id (required).
cymulate_ev_smart_templates_listList smart templatesARead-onlyIdempotent
List all EV smart templates.
Inputs: query.
cymulate_ev_template_groups_getGet EV template group by IDCRead-onlyIdempotent
Get a specific EV template group.
Inputs: group_id (required).
cymulate_ev_template_groups_listList EV template groupsARead-onlyIdempotent
List all EV template groups.
Inputs: no named parameters.
cymulate_ev_templates_createCreate EV templateC
Create a new EV template.
Inputs: payload (required).
cymulate_ev_templates_deleteDelete EV templateBDestructiveIdempotent
Delete an EV template.
Inputs: template_id (required).
cymulate_ev_templates_getGet EV template by IDBRead-onlyIdempotent
Get a specific EV template.
Inputs: template_id (required).
cymulate_ev_templates_listList EV templatesBRead-onlyIdempotent
List all Exposure Validation templates.
Inputs: query.
cymulate_ev_templates_updateUpdate EV templateC
Update an existing EV template.
Inputs: payload (required), template_id (required).
cymulate_ev_threats_create_auto_runCreate scheduled threat auto-runC
Create a scheduled auto-run for EV threats.
Inputs: payload (required).
cymulate_ev_threats_getGet EV threat by IDBRead-onlyIdempotent
Get a specific EV threat.
Inputs: threat_id (required).
cymulate_ev_threats_get_filtersGet EV threats filtersARead-onlyIdempotent
Get available filter options for the EV threats catalog.
Inputs: no named parameters.
cymulate_ev_threats_get_scheduled_auto_runsList scheduled threat auto-runsARead-onlyIdempotent
List existing scheduled auto-runs for EV threats.
Inputs: no named parameters.
cymulate_ev_threats_listList EV threatsBRead-onlyIdempotent
List all Exposure Validation threats in the catalog.
Inputs: query.
cymulate_findings_get_filtersGet findings filter optionsARead-onlyIdempotent
Get available filter options for the Findings page.
Inputs: filters.
cymulate_findings_get_infoGet finding detailsBRead-onlyIdempotent
Get detailed information about a specific finding.
Inputs: finding_id (required).
cymulate_findings_searchSearch Cymulate FindingsBRead-onlyIdempotent
Search findings across the platform with filters (severity, module, MITRE tag, date range, etc). Filters go in the request body.
Inputs: filters, pagination.
cymulate_fkc_campaign_list_templatesList Full Kill-Chain Campaign templatesARead-onlyIdempotent
List available Full Kill-Chain Campaign templates (multi-APT).
Inputs: no named parameters.
cymulate_fkc_scenarios_get_detectionGet FKC Scenarios detection resultsBRead-onlyIdempotent
Get detection results for a specific FKC Scenarios payload.
Inputs: assessment_id (required).
cymulate_fkc_scenarios_get_templateGet FKC Scenario templateBRead-onlyIdempotent
Get details of a specific Full Kill-Chain Scenarios template.
Inputs: template_id (required).
cymulate_fkc_scenarios_list_templatesList Full Kill-Chain Scenarios templatesARead-onlyIdempotent
List available Full Kill-Chain Scenarios templates (single-APT).
Inputs: no named parameters.
cymulate_healthCymulate API health checkARead-onlyIdempotent
Ping the Cymulate API to verify auth and connectivity. Returns rate-limit info from the last response.
Inputs: no named parameters.
cymulate_immediate_threats_catalogList Immediate Threats catalogARead-onlyIdempotent
List available Immediate Threats templates (the IOC-of-the-day feed).
Inputs: no named parameters.
cymulate_immediate_threats_create_customCreate custom Immediate ThreatA
Upload a custom Immediate Threat with your own IOCs. Body should follow the Cymulate custom-threat schema.
Inputs: payload (required).
cymulate_immediate_threats_get_detectionGet Immediate Threats detection resultsARead-onlyIdempotent
Get detection results (SIEM matches) for a specific Immediate Threats assessment.
Inputs: assessment_id (required).
cymulate_immediate_threats_get_ioc_listList Immediate Threats with IOCsBRead-onlyIdempotent
Get assessments that have IOCs (indicators of compromise) available.
Inputs: no named parameters.
cymulate_immediate_threats_get_latest_idsList latest Immediate Threats assessment IDsARead-onlyIdempotent
Get list of IDs from the latest Immediate Threats assessments (recent runs).
Inputs: no named parameters.
cymulate_info_activity_centerGet Activity CenterARead-onlyIdempotent
Get Activity Center summary (recent assessment activity across modules).
Inputs: no named parameters.
cymulate_info_integrations_statusGet integrations statusARead-onlyIdempotent
Get status of platform integrations.
Inputs: no named parameters.
cymulate_info_users_listList platform usersCRead-onlyIdempotent
List Cymulate platform users.
Inputs: query.
cymulate_killchain_designerKill Chain Designer — compose full-attack Cymulate FKC Campaign / Advanced AssessmentARead-onlyIdempotent
LOCAL composition tool. Does NOT call the Cymulate API. Composes a full-chain adversary emulation (11 phases from initial access to impact) as a Cymulate Full Kill-Chain Campaign OR Advanced Scenarios assessment. Enriches each phase via knowledge-rag queries pulling realistic tradecraft from LOLBAS, hacktricks, RTFM, and Falcon detection queries. Produces Mermaid diagram of the full chain, MITRE mapping per stage, and detection points per stage. HARD BLOCK: creates a NEW campaign/assessment only. NEVER modifies default Cymulate templates. Never auto-submits — always presents to operator for review first.
Inputs: actor_profile (required), campaign_name (required), target_environment (required), skip_phases, +3 more.
cymulate_platform_activity_logsGet platform activity logsCRead-onlyIdempotent
Get platform activity logs.
Inputs: query.
cymulate_platform_mitre_dashboardGet MITRE ATT&CK dashboardBRead-onlyIdempotent
Get MITRE ATT&CK dashboard data (coverage heatmap).
Inputs: query.
cymulate_platform_score_by_controlGet score by security controlARead-onlyIdempotent
Get the most recent scores per security control type.
Inputs: no named parameters.
cymulate_platform_sso_getGet SSO configurationARead-onlyIdempotent
Retrieve the current SSO configuration for the platform.
Inputs: no named parameters.
cymulate_platform_trace_logGet trace logARead-onlyIdempotent
Get the trace log from the latest module assessment.
Inputs: no named parameters.
cymulate_remediation_applyApply auto-remediation to findingBDestructive
Auto-remediate a finding to the selected integration(s).
Inputs: finding_id (required), integrations (required), options.
cymulate_remediation_bulk_applyBulk auto-remediationADestructive
Auto-remediate multiple findings in a single call.
Inputs: payload (required).
cymulate_remediation_list_integrationsList auto-remediation integrations for findingARead-onlyIdempotent
List integrations available to auto-remediate a specific finding.
Inputs: finding_id (required).
cymulate_ttp_designerTTP Designer — compose a realistic Cymulate scenario for one MITRE techniqueARead-onlyIdempotent
LOCAL composition tool. Does NOT call the Cymulate API. Returns a structured directive the assistant uses to: (1) query the operator knowledge-rag for real tradecraft (LOLBAS, hacktricks, RTFM, Falcon detection queries), (2) fill a Cymulate scenario/template payload with commands that ACTUALLY trigger EDR/SIEM (not synthetic defaults), (3) produce Mermaid diagram + expected IOCs + detection rules. HARD BLOCK: this tool produces NEW scenarios/templates only. NEVER use this output to modify or delete Cymulate default templates. Always POST to /v2/scenario/create or /v1/purple-team/templates.
Inputs: intent (required), evasion_level, output_format, stack_context, +5 more.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
C2.9/5.0
Scored across 120 tools
Disambiguation3/5
With 120 tools, there are many overlapping list/get operations for different modules (e.g., env_list vs env_list_v1, multiple get_filters, multiple get_history_ids). However, descriptions are specific enough to differentiate most tools, and the fallback cymulate_api_call is explicitly a catch-all. Some ambiguity remains, but it is mitigated by clear documentation.
Naming Consistency4/5
Most tools follow a consistent cymulate_<module>_<resource>_<action> pattern, but there are notable exceptions like cymulate_health, cymulate_debug_last_request, cymulate_ttp_designer, and cymulate_killchain_designer. Versioned names (cymulate_env_list_v1) and compound actions (cymulate_ev_launched_get_configurations) also deviate slightly. Overall, the conventions are predictable but not perfectly uniform.
Tool Count1/5
120 tools is far beyond the reasonable scope for an MCP server, even for a comprehensive API wrapper. This overwhelms agents and makes selection harder. The calibration explicitly marks 50+ tools as an extreme mismatch.
Completeness5/5
The server covers nearly every domain of the Cymulate platform—EV, EA, BAS, Advanced, ASM, Immediate Threats, FKC, environments, agents, remediation, and platform analytics. CRUD operations exist for major resources, and the fallback cymulate_api_call ensures no endpoint is unreachable. The tool surface is thorough and has no obvious dead ends.
Maintenance
ActivityInactive
ResponsivenessOutdated data
Related MCP Connectors
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
Find, document and execute authenticated API calls across 1000+ apps via one MCP server
An MCP server that provides an API to LLMs to manage their JumpCloud resources.
MEOK MCP Hardening MCP — automated security red-team for any MCP server. Maps OWASP LLM Top 10
Related MCP Servers
- AlicenseAqualityBmaintenanceExposes 79 cybersecurity skills and 12 orchestrator agents over MCP, with a typed 11-field output contract, an enforced resolvable-evidence gate (no verdict without a resolvable source), and human-approval gating for every mutating action. Apache-2.0, stdlib-only.85Apache 2.0
- FlicenseNot gradedqualityCmaintenanceMCP server for ConnectSecure vulnerability management, exposing 285 read-only tools to query assets, vulnerabilities, Active Directory, and more via natural language.-
- FlicenseNot gradedqualityCmaintenanceMCP server for Field Effect MDR (Covalence) that exposes organization, endpoint device, and active response reporting endpoints as tools, enabling security management via natural language.-