Reference

FAQ

Straight answers about what Emfirge is, what it can touch, what it stores, and what it does not claim.

What is Emfirge, in one sentence?

Emfirge is the harness between AI agents and your cloud: your agent gets a branch of your live AWS, tries its changes there, and gets back a diff and a pass / warn / block verdict before anything touches production.

What are the harness, the branch, and lenses?

The harness is the product: where the agent works, what it may see, what it gets back, and what it cannot skip.

The branch is the engine: a snapshot of your AWS plus an ordered list of proposed changes, which you can fork, roll back, and compare. See Create and compare branches.

Lenses are what get measured on a branch: security, dependencies and delete safety, compliance, cost, and limits. See Lenses and coverage.

Why not just read the Terraform plan?

A plan tells you what actions will run. Emfirge tells you what those actions mean given everything else already in your account: what becomes reachable from the internet, which privilege-escalation paths open, what a deletion breaks, and what the model could not check. You can send it the plan you already have. See Plans and hand-back.

Is it a security scanner?

No. A scanner looks at what is deployed now. Emfirge judges a proposed change before it exists. Security is its first lens, and it can also scan the current state, but the product is the branch your agent works on. Checkov runs inside the verdict as an additional, advisory lens.

Can Emfirge change or delete anything in my AWS account?

No. Emfirge only has a read-only role, and every proposed change stays in its model. When you approve a change, Emfirge hands back the exact AWS API calls or the plan you sent; you or your pipeline apply them. See Safety and model limits.

What access does it need, and how do I revoke it?

The setup creates an IAM role in your account with AWS’s managed SecurityAudit policy plus a few extra read permissions, and no write permissions. The role trusts only Emfirge’s AWS account and requires your own ExternalId, which prevents confused-deputy attacks. Credentials are temporary STS tokens that expire after an hour and are never stored. To revoke access instantly, delete the CloudFormation stack. See Security model.

What do you store, and for how long?

Scan results and infrastructure snapshots are kept for 90 days, then deleted automatically. Emfirge never reads the contents of your resources, such as S3 objects, database rows, or secret values. You can delete everything for your account at any time with npx @emfirge/mcp purge --role-arn <your role ARN>. The full details are in the repository’s PRIVACY.md.

What does my AI model see?

In the default strict privacy mode, the MCP replaces recognized AWS identifiers, such as ARNs, account IDs, resource names, and IP addresses, with tokens on your machine before results reach the model. The mapping never leaves your computer. See Privacy modes.

Which AI tools does it work with?

Any MCP client. The installer sets up Claude Code, Claude Desktop, Cursor, Codex, Kiro, Cline, and Continue automatically, and you can add it to any other MCP client by hand. See Connect your agent.

Which clouds are supported?

AWS only, by design. Emfirge goes deep on one cloud before adding others. A change to a non-AWS provider in a plan is flagged with a warning, never silently passed.

What changes can a branch model today?

EC2 instances, security groups, RDS instances, S3 buckets, Lambda functions, network ACLs, and IAM roles (including trust policies) support add, modify, and delete. IAM users and NAT gateways support add, RDS snapshots and EBS volumes support add and delete, route tables support add and modify, IAM role policies support modify, and EBS snapshots support delete. More types are on the way. The full table is in Apply changes.

Does a pass mean the change is safe?

No. A pass means none of the lenses that ran found a problem. It is evidence, not a guarantee: a branch is a model, and some things, like runtime behavior or application-level dependencies, need a real run. If any check could not run, the verdict says so in coverage_warnings instead of hiding it.

What happens with a change Emfirge cannot model?

It is never treated as safe. Unmodeled deletes and risky calls block, other unmodeled changes warn, and unknown plan values are listed so your agent knows what was not checked.

How do you know the engine is right?

Every behavior is pinned by numbered laws: property-based tests that must always hold, such as “the same inputs always give the same verdict” and “a Terraform change and the equivalent AWS API call get the same verdict.” Locked incident scenarios and 92 privilege-escalation paths from pathfinding.cloud run on every CI build.

FAQ