Integrate
MCP tool reference
The typed interface your agent uses to fork infrastructure, explore changes, and inspect their consequences across the documented lenses.
Using the tools
Emfirge runs as an MCP server that your agent invokes over the local stdio connection. Each tool below is a registered operation; select its linked page for the full parameter and response details.
Persist the analysis_id and branch_id returned by your own calls. Do not substitute IDs from screenshots or examples. A compatible engine is required for branch operations.
Setup and account
| Tool | What it does |
|---|---|
| emfirge_setup_help | Return the CloudFormation setup link and read-only role instructions. |
| emfirge_login | Sign in to Emfirge with GitHub or Google in your browser. |
| emfirge_logout | Sign out of Emfirge on this device. |
| emfirge_link_project | Link your browser sign-in to an existing API-key project. |
Scan and inspect
| Tool | What it does |
|---|---|
| emfirge_scan | Collect an AWS account and region and return an analysis_id. |
| emfirge_get_findings | Retrieve findings from a scan, optionally filtered by severity. |
| emfirge_attack_paths | Read modeled internet-to-internal paths, critical resources, orphans, and graph statistics. |
| emfirge_simulate_breach | Evaluate a graph-based scenario without executing a real exploit. |
| emfirge_verify_fix | Simulate one supported rule remediation against an analysis. Not every rule has a fix mutation. |
| emfirge_check_compliance | Retrieve mapped CIS AWS Foundations 1.5 or SOC 2 control results. These checks do not constitute certification. |
Branch lifecycle
| Tool | What it does |
|---|---|
| emfirge_create_branch | Create an isolated branch from a completed analysis. |
| emfirge_get_branch | Read a branch’s metadata, status, revision, and ordered change log without the base snapshot. |
| emfirge_fork_branch | Copy an open branch into a new independent branch with the same base and changes. |
| emfirge_apply_change | Append an add, modify, or delete mutation to the branch model. |
| emfirge_list_branches | List branches, optionally filtered by their base analysis. |
| emfirge_rollback_branch | Remove the most recent change from a branch in the current backend. |
| emfirge_rollback_branch_to_count | Keep only the first N changes of a branch, optionally rejecting stale state. |
| emfirge_discard_branch | Mark a branch as discarded without changing AWS. |
Diff and verdict
| Tool | What it does |
|---|---|
| emfirge_branch_diff | Compare a branch against its base: resources, relationships, findings, and reachability. |
| emfirge_branch_verdict | Evaluate the branch with native findings, optional scanner results, and cost notes. |
| emfirge_compare_branches | Compare modeled changes and outcomes for one or more branches. |
Plans and hand-back
| Tool | What it does |
|---|---|
| emfirge_plan_verdict | Check a Terraform plan, CloudFormation change set, AWS API calls, or AWS CLI commands on a branch and return the verdict and hash-bound hand-back. |
| emfirge_branch_handback | Return the exact AWS API calls for a branch, bound to its state by hash; optionally verify them. |
| emfirge_in_use_evidence | Estimate, then after approval read, CloudTrail and CloudWatch evidence for resources a branch deletes. |
| emfirge_policy_checks | Estimate, then after approval ask AWS IAM Access Analyzer whether changed S3 bucket policies and role trust policies are public. |
Based on the Emfirge MCP and engine source.View source