Developer quickstart
Connect your agent, fork your cloud graph, and inspect a proposed change across its consequences before touching AWS.
Before you start
You’ll need Node.js 20 or later, an MCP client, and an AWS account you are authorized to inspect. Emfirge’s MCP server runs locally over stdio and calls an Emfirge backend.
These guides describe the checked-in MCP and engine. Make sure your server exposes the branch tools before following the branch workflow; the hosted deployment and installed package may differ.
A branch is a model of infrastructure. It does not create a second AWS environment or apply a real change.
1. Connect your agent
Run the installer in your terminal. It adds Emfirge to detected supported clients, including Claude Code, Claude Desktop, Cursor, Codex, and Kiro. Restart your client after installation.
For a single client or manual setup, use Connect agent.
npx @emfirge/mcp install --privacy=strict
2. Create your cloud baseline
Ask your agent to call emfirge_setup_help. Hosted users receive their own ExternalId from emfirge_setup; self-host deployments must set EMFIRGE_EXTERNAL_ID on the server and in the MCP environment. There is no default, and scans refuse to run without it. Open the CloudFormation link, review the IAM template, and create the read-only role. The role includes two read-only CloudWatch permissions (GetMetricStatistics and GetMetricData) for in-use evidence, and two IAM Access Analyzer permissions (CheckNoPublicAccess and ValidatePolicy) used only by opt-in policy checks. Roles made with the old shared ExternalId must be redeployed. Once the stack is complete, copy RoleArn from Outputs.
Give the agent the role ARN and the AWS region containing your resources. The region is required: an empty scan in the wrong region is not evidence that your account has no risks.
emfirge_scan({
role_arn: "arn:aws:iam::123456789012:role/EmfirgeReadOnly",
region: "us-east-1"
})
The account ID above is an example. Use your actual RoleArn and region, then save the analysis_id returned by the scan.
3. Try a change on a branch
Create a named branch from the completed analysis, then add a change. Use a database ID that exists in that baseline. Changes accumulate on the branch in order.
// Tool calls made by your MCP client.
// Replace IDs with values from your own results.
emfirge_create_branch({
base_analysis_id: "<analysis_id>",
name: "reduce-db-exposure"
})
emfirge_apply_change({
branch_id: "<branch_id>",
op: "modify",
resource_type: "rds_instance",
resource_id: "<database_id>",
fields: { publicly_accessible: false }
})
emfirge_branch_diff({ branch_id: "<branch_id>" })
4. Review the consequences
Read added and removed relationships, findings, and internet reachability in the diff. Request a verdict to inspect native findings, advisory scanner findings, and cost caveats together.
Review coverage and uncertainty before taking a real action. Your own deployment workflow applies any approved change; Emfirge does not apply it.
emfirge_branch_verdict({ branch_id: "<branch_id>" })