Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@emfirge Show me the worst attack path from the internet."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Emfirge is the harness between AI agents and your cloud. Your agent gets a branch — a Git-style copy of a model of your live AWS — tries changes there, and gets back a diff and a pass / warn / block verdict before anything touches production. Emfirge is read-only and never applies changes. Security is the first lens; cost and limits signals are early lenses.
Get started · Read the docs · npm
MCP version: 0.2.3
Capability | What it provides |
Graph analysis | Connected resource context rather than isolated checks. |
Attack paths | Routes from public-facing resources toward internal resources and chokepoints. |
Modeled branches | Isolated add, modify, and delete changes with diff, verdict, rollback, and comparison. |
Privacy modes | Local |
Related MCP server: AWS Infrastructure MCP Server
npx @emfirge/mcp installThen ask your assistant to scan using a read-only role and region. Example placeholder only:
Scan with arn:aws:iam::123456789012:role/EmfirgeReadOnly in us-east-1The account ID above is intentionally non-existent example data. Use your own role when running a real scan.
Tool | Purpose |
| Scan an AWS account and return risk score, finding counts, and |
| Return findings for a scan, optionally filtered by severity. |
| Return internet-to-resource paths, chokepoints, and orphaned resources. |
| Walk a natural-language scenario through entry, pivot, impact, and blast radius. |
| Simulate a supported finding fix and return score and finding deltas. |
| Return CIS AWS Foundations 1.5 or SOC 2 per-control status. |
Tool | Purpose |
| Create an isolated branch from a completed analysis. |
| Apply an add, modify, or delete change to the branch model, not AWS. |
| Compare the branch model with its base analysis. |
| Return advisory |
| Remove the most recent modeled change. |
| Truncate a branch to a selected existing change count. |
| Discard an isolated branch. |
| List branches, optionally by base analysis. |
| Compare branches and rank modeled outcomes safest-first. |
Tool | Purpose |
| Return a CloudFormation deploy URL for a read-only IAM role. |
The MCP supports strict (default), balanced, and off modes. In strict, recognized AWS identifiers are tokenized locally before results reach the LLM; the mapping stays on the local machine. The backend receives the data needed to perform the requested analysis. Credentials in presigned report URLs are scrubbed before URLs are returned. Review outputs under your own data-handling policy.
npx @emfirge/mcp privacy
npx @emfirge/mcp privacy strict|balanced|offread-only scan → fork graph → apply modeled change → diff → re-run lenses → advisory verdictA non-empty coverage_warnings field means the verdict is degraded and must not be described as complete coverage. A pass is not a guarantee of safety or application connectivity.
{
"mcpServers": {
"emfirge": {
"command": "npx",
"args": ["-y", "@emfirge/mcp"],
"env": { "EMFIRGE_PRIVACY": "strict" }
}
}
}See the MCP README and documentation for usage details.
The MCP package is licensed under Apache-2.0. The engine is licensed under AGPL-3.0.
This server cannot be deployed
AWS cloud security scanners for AI agents — S3, IAM, EC2, EKS, RDS, CloudTrail, CloudWatch Logs
Threat modeling, code/cloud/pipeline scanning, shadow-AI discovery, compliance checks and fixes.
IaC attack-path auditor: finds internet-to-crown-jewel chains in Terraform/CFN/K8s.
Attack paths, scan findings and shadow AI for AI-native apps and their clouds; vet MCP servers.
