Troubleshooting
Resolve common setup, scanning, and branch issues with a focused check.
Emfirge tools do not appear
Confirm Node.js 20 or later is available to your desktop client. Run npx @emfirge/mcp status, check the client’s MCP configuration, and restart the client.
If scan tools appear but branch tools do not, the installed MCP version may not match this source. Use matching MCP and engine builds.
Access denied or 403
Review the IAM role ARN, trusted account, and ExternalId. Ask your agent to call emfirge_setup_help to inspect the setup flow. Confirm that the role’s permissions allow the collection calls required by your backend.
The scan is empty
Confirm the region with the account owner. Emfirge requires an explicit region because most resources are regional. Also check collection permissions. An empty result does not establish that the entire AWS account has no risks.
Analysis or branch not found
Use the exact ID returned by the tool and the same backend that created it. For an analysis, run a new scan if its stored record is no longer available. For branch-route errors, check client/backend version compatibility.
A change is rejected
Check that the branch is open, the resource type is supported, and the target resource exists for modify/delete. Unknown fields are rejected. See Apply changes for the contract.
Timeouts and limits
The scan client uses a streaming backend endpoint and waits up to 240 seconds. Check backend health and account size after a timeout. For a 429 response, follow the limit and reset information returned by your backend.
Scanner unavailable
A verdict may still return native results when Checkov is unavailable. Inspect scanner_available; verify the engine’s scanner installation and serialization support before treating scanner coverage as complete.