emfirge_simulate_breach
Run a natural-language what-if against the modeled cloud graph to trace entry → pivot → impact, blast radius, and follow-up moves.
Parameters
analysis_id: string · required; query: string (3–500 characters) · required
{
"query": "what gets exposed if NAME_132 opens port 80",
"analysis_id": "7f3c9a2e-4b1d-4c8a-9f2e-1a2b3c4d5e6f"
}
Returns
The response is JSON shaped for the operation. The fields and semantics are described below.
{
"verdict": "Full data exfiltration path exists. 1 database, 1 S3 bucket, 1 secret reachable from the internet in 7 hops.",
"severity": "critical", "summary": "An attacker can reach your data stores in 7 hops…",
"stages": [
{ "order": 1, "caption": "Attacker lands on EC2: NAME_138 via open security group", "node_ids": ["NAME_138", "NAME_139", "NAME_140"], "color": "red" },
{ "order": 2, "caption": "EC2: NAME_138 assumes IAM Role: AppServerRole, credential theft possible", "node_ids": ["iam-role-AppServerRole"], "color": "red" },
{ "order": 3, "caption": "IAM role accesses RDS: acme-prod-customers, data exfiltration risk", "node_ids": ["acme-prod-customers"], "color": "amber" }
],
"blast_radius": { "total": 23, "by_type": { "EC2": 7, "SG": 5, "RDS": 1, "S3": 1 } },
"follow_up": "What specific data can be exfiltrated from the exposed storage?", "category": "attack_surface"
}
Validation, behavior, and limits
query accepts scenarios such as ‘what gets exposed if NAME_132 opens port 80’ or ‘show the worst attack path’; tokens like NAME_132 are expanded locally.
The response includes verdict, severity, summary, stages, blast_radius, follow_up, and category. Each stage has order, caption, node_ids, and color (red or amber); entry→pivot→impact is conveyed by order and color, not a phase field.
blast_radius is an object with total and a by_type tally. follow_up is one suggested next question. In MCP mode the backend skips its prose summary (the host LLM writes it), so the result is deterministic and returns in a few seconds. It is read-only and does not execute an exploit or change AWS.