Skip to main content
Glama
lyonzin

Cymulate MCP Tools

by lyonzin

Kill Chain Designer — compose full-attack Cymulate FKC Campaign / Advanced Assessment

cymulate_killchain_designer
Read-onlyIdempotent

Designs Cymulate kill-chain campaigns/assessments across 11 phases, enriching each with MITRE mapping, detection points, and Mermaid diagrams from tradecraft for operator review.

Instructions

LOCAL composition tool. Does NOT call the Cymulate API. Composes a full-chain adversary emulation (11 phases from initial access to impact) as a Cymulate Full Kill-Chain Campaign OR Advanced Scenarios assessment. Enriches each phase via knowledge-rag queries pulling realistic tradecraft from LOLBAS, hacktricks, RTFM, and Falcon detection queries. Produces Mermaid diagram of the full chain, MITRE mapping per stage, and detection points per stage. HARD BLOCK: creates a NEW campaign/assessment only. NEVER modifies default Cymulate templates. Never auto-submits — always presents to operator for review first.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
skip_phasesNoPhases to skip (e.g. ["reconnaissance", "impact"]) — useful if scoping to specific chain segment
actor_profileYesAdversary to emulate. Each profile brings its own biases (evasion style, tooling, timing).
campaign_nameYesCampaign name — will be prefixed with "custom-" to avoid collision with defaults
custom_stagesNoOnly used if actor_profile=custom. List the phases you want, in order.
output_formatNofkc_campaign = Full Kill-Chain Campaign (POST /v1/apt-wrapper/start) — best for multi-stage. advanced_assessment = Purple Team assessment (POST /v1/purple-team/assessment) — more flexible.fkc_campaign
include_mermaidNo
target_environmentYesTarget environment context
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description exceeds the annotations by disclosing critical behavioral traits: it makes no API calls, enriches via knowledge-rag queries, produces specific outputs (Mermaid diagram, MITRE mapping, detection points), and has hard blocks against modifying defaults or auto-submitting. This is rich, non-obvious context beyond the readOnly/idempotent hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with the most critical distinction ('LOCAL composition tool. Does NOT call the Cymulate API'). Every sentence provides valuable behavioral or output context, with no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (7 parameters, nested objects, no output schema), the description adequately covers outputs (Mermaid diagram, MITRE mapping, detection points) and key constraints. It could clarify how the composed result is returned or delivered to the operator, but the provided context is sufficient for effective use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is high (86%), so parameters are largely self-explanatory. The description adds no direct parameter-level semantics beyond what the schema already provides, but it does contextualize the overall composition workflow, keeping it at the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as a local composition tool for building full-chain adversary emulation campaigns, with a specific verb 'composes' and distinct resource types (FKC Campaign or Advanced Assessment). It differentiates from sibling API-calling tools by explicitly stating it does NOT call the Cymulate API.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear contextual guidance: it is a local composition tool, never auto-submits, and presents results for operator review first. It implies exclusion of API-triggering workflows but does not explicitly name alternative tools for those cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/lyonzin/cymulate-mcp-tools'

If you have feedback or need assistance with the MCP directory API, please join our Discord server