MCP tools

emfirge_branch_verdict

Evaluate an isolated infrastructure branch across the documented consequence lenses, including security findings and proposed changes.

Parameters

branch_id: string · required

MCP ask / arguments
{ "branch_id": "branch_456" }

Returns

The response is JSON shaped for the operation. The fields and semantics are described below.

JSON response
{
  "verdict": "warn", "native_added": [], "native_removed": [], "scanner_added": [], "scanner_removed": [],
  "score_before": 72, "score_after": 70, "score_delta": -2, "newly_internet_reachable": [], "no_longer_internet_reachable": [],
  "scanner_available": false, "scanner_status": { "checkov": "disabled", "trivy": "disabled", "cloudsplaining": "disabled" },
  "coverage_warnings": ["borrowed scanners are disabled on this verdict (native rules only) — this verdict is NOT full coverage"],
  "cost_delta_monthly_usd": 12.5, "cost_unknown_notes": [], "introduces_privilege_escalation": false,
  "limits_introduced": [], "limits_resolved": [], "summary": "verdict=warn; ..."
}

Validation, behavior, and limits

verdict is block, warn, or pass. The response reports native_added, native_removed, scanner_added, scanner_removed, score_before, score_after, score_delta, newly_internet_reachable, no_longer_internet_reachable, cost_delta_monthly_usd, cost_unknown_notes, introduces_privilege_escalation, limits_introduced, limits_resolved, and summary.

scanner_status gives each borrowed scanner’s outcome, scanner_available says whether any scanner ran, and coverage_warnings explains missing or disabled lenses. Non-empty warnings mean degraded coverage and the result must not be presented as complete coverage or a safety guarantee.

block flags a modeled blocking risk; warn flags a modeled concern; pass means no modeled blocking or warning condition was found by the available analysis. None guarantees safe deployment or application behavior.

Based on the Emfirge MCP and engine source.View source
Documentation