First-run hand-holding. Checks what is configured, tests connections, and gives the exact next step for anything missing, including where in the Tenable and AWS UIs the credentials live.

Defaults to demo, which makes no network calls. Pass tenable, aws or all to test live connectivity -- those probe remote endpoints and can be slow on a captive-portal network.

Never asks for a secret in conversation: keys go in the environment or a .env file next to the server. Safe to run repeatedly; run it again after each fix until everything you need says READY.

Load findings, assets and attack paths from a source and build the engine.

Greedy weighted max-coverage over synthesized actions. Returns the shortlist.

Each chokepoint's value is marginal: what it eliminates GIVEN everything ranked above it is done. Finding-risk coverage and attack-path disruption are reported as two separate numbers, never blended.

Feed a pre-flight gate from an MCP server you already have connected.

Chokepoint Finder holds no EDR, SIEM or ITSM credentials and never will. This is how it sees that telemetry anyway: your agent queries whatever server provides it -- CrowdStrike, SentinelOne, Splunk, Sentinel, ServiceNow, a CTI platform -- and relays the answer here with its provenance. The same composition the execution path uses, applied to evidence intake.

The trust rules do not soften for relayed data. Stale, partial or truncated input still reads UNKNOWN and still holds the gate, and every verdict built on it prints the source, the collection time and the fact that it was relayed rather than pulled directly.

Calls that establish, refresh, replace, or extend coverage require confirm=true after the agent presents the evidence to a human. The only unconfirmed update accepted is an additive detection or freeze inside already-covered scope; that path preserves the established coverage and freshness, so it can only make a decision more cautious. Never self-attest.

Send an empty items list ONLY when the source genuinely returned nothing. If the query failed, say so by omitting this call entirely: an unsupplied channel reads UNKNOWN and holds, which is the safe answer. Reporting a failed query as "nothing found" is the one input that could widen what the agent is willing to do.

Evidence gates before acting: EDR silence, change freeze, blast radius.

Verdicts: PROCEED, REQUIRES_STAGING (sound, but too wide for one window -- canary-first waves are supplied), HOLD_PARTIAL (act on clean assets, hold the rest), HOLD. Evidence that is missing, stale, partial or failed reads as UNKNOWN and produces HOLD: this gate never clears what it cannot see.

Ticket-ready remediation payload for a chokepoint: summary, justification, change plan, rollback note. Paste into Jira/ServiceNow or hand to a ticketing MCP. Generates text only; it opens nothing.

Typed, ordered workflow for executing a chokepoint through the operator's connected MCP servers.

Chokepoint Finder holds no write credentials by design and executes nothing itself. Each step names a capability (aws-ec2, ssm-patch, ci-cd, tenable, ticketing); route it to whatever connected MCP server provides it. Steps marked MUTATES change state outside this process and need an explicit operator go quoting the plan hash. A HOLD pre-flight yields no plan, only the evidence. Held assets are excluded from every step.

Record that the plan's steps were executed (through other MCP servers, by the operator's agent), arming verification with expected retirements.

This tool mutates nothing outside the finder's own accounting. It refuses without explicit confirmation, refuses a plan hash that does not match the current plan, refuses a HOLD verdict outright, and excludes assets held by pre-flight.

Re-query the authoritative source and diff against the baseline.

Fails closed. A re-query that errors, times out, comes back truncated, partial or stale returns UNKNOWN or ERROR and explicitly refuses to conclude anything about remediation -- it never reports clean. Only a non-simulated, final-wave VERIFIED result permits closing a change record. In demo mode the re-query is a labelled simulation, stated in the status and closure-decision lines.

The four-beat walkthrough on the deterministic simulated estate: the wall, the collapse, the refusal, and wave-by-wave proof.