emfirge_verify_fix
Simulate fixing a finding on a clone of the graph without applying any change.
Parameters
analysis_id: string · required; rule_id: string · required; resource_id: string · required
{
"rule_id": "EC2-002",
"resource_id": "NAME_132",
"analysis_id": "7f3c9a2e-4b1d-4c8a-9f2e-1a2b3c4d5e6f"
}
Returns
The response is JSON shaped for the operation. The fields and semantics are described below.
{
"can_simulate": true,
"findings_removed": [{ "rule_id": "EMFIRGE-EC2-002", "severity": "Critical" /* … full finding object … */ }],
"findings_added": [], "toxic_combos_resolved": ["SSH_OPEN_NO_GUARDDUTY"], "toxic_combos_created": [],
"score_before": 3, "score_after": 3, "score_delta": 0, "safe_to_apply": true
}
Validation, behavior, and limits
The clone applies the rule mutation, rebuilds, re-runs every rule, and returns score delta plus findings that resolve. findings_removed and findings_added are arrays of full finding objects, not counts; score_before and score_after are 0–100 posture scores where higher is safer.
safe_to_apply is advisory: true means the cloned branch showed no new modeled security finding and no score worsening. Say ‘no modeled security regression’ or ‘no new exposure detected’; this does not establish live safety, deployment, or application connectivity.
rule_id accepts full or short form such as EMFIRGE-EC2-002 or EC2-002. resource_id accepts a raw ID or NAME_### token, which is expanded locally. Deterministic simulation covers EC2-002, EC2-003, EC2-009, S3-001, S3-002, S3-003, RDS-002, RDS-003, RDS-004, RDS-006, WAF-001, GUARD-001, and CW-001. Other findings return guidance; MCP does not open pull requests. The real scan and AWS are not mutated.