Emfirge

Privacy-first AWS security in your AI: attack paths & fix simulation, IDs never sent to the LLM.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Not yet automatically verified

We haven't yet run this listing's install command through our automated sandbox check. This isn't a red flag — we're steadily working through the catalog.

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "emfirge": {
      "command": "npx",
      "args": [
        "-y",
        "@emfirge/mcp"
      ]
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Documentation Overview

🛡️ Emfirge

Git branch for your cloud.

Give your AI a read-only map of AWS. Trace attack paths, test a security fix on a cloned graph, and see the result before touching production.

Get started · Read the docs · Open dashboard · npm

Your scanner finds problems. Emfirge tests the fix.

Most cloud tools hand you a list and ask you to trust the recommendation. Emfirge builds a connected graph of your account, forks it in memory, applies the proposed security change, re-runs the rules, and shows what got safer—or riskier.

🕸️ See the path	🎯 Find the chokepoint	🧪 Rehearse the fix	💬 Stay in your AI
Internet → compute → IAM → data	Prioritize what breaks the most attack paths	No write access. No production mutation.	Claude, Cursor, Kiro, Cline, Continue, Codex

~20 AWS service types · 58 graph-aware rules · 17 rule families · 7 MCP tools

Start in 30 seconds

Terminal

npx @emfirge/mcp install

Then ask your assistant:

text

Scan my AWS account using role
arn:aws:iam::123456789012:role/EmfirgeReadOnly in us-east-1

No role yet? Say “help me set up Emfirge.” You will get a one-click CloudFormation link for a read-only IAM role.

Try it now with no setup: use demo role arn:aws:iam::194722410583:role/EmfirgeReadOnly in us-east-1.

Free: 5 scans per AWS account per day. No signup. No API key.

Ask questions your cloud can finally answer

text

Show me the worst attack path from the internet.
What is the blast radius if this instance is compromised?
Which resource should I fix first?
Will closing SSH remove the path without adding new security findings?
Check this account against CIS AWS Foundations 1.5.

One graph. Seven tools.

Tool	Answer
`emfirge_scan`	What does my AWS risk look like?
`emfirge_get_findings`	What is wrong and how do I fix it?
`emfirge_attack_paths`	How could an attacker reach my data?
`emfirge_verify_fix`	What changes if I apply this security fix?
`emfirge_simulate_breach`	What happens after this resource is compromised?
`emfirge_check_compliance`	Which CIS AWS 1.5 or SOC 2 controls fail?
`emfirge_setup_help`	How do I create the read-only role?

Proof, not a prompt

text

Scan AWS → build graph → fork graph → apply mutation → re-run rules → show delta

The score, findings, attack paths, and fix verification come from deterministic graph analysis—not an LLM guessing what might happen. Your AI explains the evidence; Emfirge produces it.

Built for trust

Read-only AWS access through a role you own and can revoke anytime.
One-hour STS credentials protected by an ExternalId and never stored.
Local tokenization of recognized AWS identifiers before MCP results reach your LLM in strict mode.
No production changes during scans, breach simulations, or fix verification.
Source available for the MCP, scanner engine, rules, scoring, and docs.

Emfirge proves the simulated security delta against your latest scan; it does not yet prove application connectivity. Some graph-derived labels may also remain visible in strict mode. See How it works and Privacy for the exact boundaries.

Go deeper when you are ready

Quickstart · How the fork works · MCP tools · Privacy · Security · Self-hosting · Contributing

Stop guessing in production.

Fork the graph. Follow the path. Prove the security delta.

Install Emfirge · Star the repo

Read the full README →View source on GitHub →

Related MCP Servers

View all in Cloud Platforms View all alternatives

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about Emfirge

Add the following block to your claude_desktop_config.json under mcpServers: "mcpServers": { "emfirge": { "command": "npx", "args": ["-y", "Emfirge"] } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/emfirge?style=directory)](https://allmcps.com/mcp/emfirge)

HTML Embed

<a href="https://allmcps.com/mcp/emfirge"><img src="https://allmcps.com/api/badge/emfirge?style=directory" alt="Emfirge on AllMCPs" /></a>

Technical Specs & Signals

CategoryCloud Platforms

37Quality signal: Fair · 37/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership10/20

Documentation & tools16/30

Adoption & activity2/15

Community engagement0/10

A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.

★ Spotlight Slot

Feature Your MCP Server

Get maximum visibility for your server across our directory, search results, and detail pages.

Spotlight Your Server

Own this project?

This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge — proof is checked automatically, then reviewed by our team.

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in ☁️ Cloud Platforms →Best MCP servers for Cloud Platforms →Alternatives to Emfirge →Install in Claude Desktop Install in Cursor Install in VS Code

Documentation Overview

🛡️ Emfirge

Git branch for your cloud.

Give your AI a read-only map of AWS. Trace attack paths, test a security fix on a cloned graph, and see the result before touching production.

Get started · Read the docs · Open dashboard · npm

Your scanner finds problems. Emfirge tests the fix.

🕸️ See the path	🎯 Find the chokepoint	🧪 Rehearse the fix	💬 Stay in your AI
Internet → compute → IAM → data	Prioritize what breaks the most attack paths	No write access. No production mutation.	Claude, Cursor, Kiro, Cline, Continue, Codex

~20 AWS service types · 58 graph-aware rules · 17 rule families · 7 MCP tools

Start in 30 seconds

Terminal

npx @emfirge/mcp install

Then ask your assistant:

text

Scan my AWS account using role
arn:aws:iam::123456789012:role/EmfirgeReadOnly in us-east-1

No role yet? Say “help me set up Emfirge.” You will get a one-click CloudFormation link for a read-only IAM role.

Try it now with no setup: use demo role arn:aws:iam::194722410583:role/EmfirgeReadOnly in us-east-1.

Free: 5 scans per AWS account per day. No signup. No API key.

Ask questions your cloud can finally answer

text

Show me the worst attack path from the internet.
What is the blast radius if this instance is compromised?
Which resource should I fix first?
Will closing SSH remove the path without adding new security findings?
Check this account against CIS AWS Foundations 1.5.

One graph. Seven tools.

Tool	Answer
`emfirge_scan`	What does my AWS risk look like?
`emfirge_get_findings`	What is wrong and how do I fix it?
`emfirge_attack_paths`	How could an attacker reach my data?
`emfirge_verify_fix`	What changes if I apply this security fix?
`emfirge_simulate_breach`	What happens after this resource is compromised?
`emfirge_check_compliance`	Which CIS AWS 1.5 or SOC 2 controls fail?
`emfirge_setup_help`	How do I create the read-only role?

Proof, not a prompt

text

Scan AWS → build graph → fork graph → apply mutation → re-run rules → show delta

The score, findings, attack paths, and fix verification come from deterministic graph analysis—not an LLM guessing what might happen. Your AI explains the evidence; Emfirge produces it.

Built for trust

Read-only AWS access through a role you own and can revoke anytime.
One-hour STS credentials protected by an ExternalId and never stored.
Local tokenization of recognized AWS identifiers before MCP results reach your LLM in strict mode.
No production changes during scans, breach simulations, or fix verification.
Source available for the MCP, scanner engine, rules, scoring, and docs.

Emfirge proves the simulated security delta against your latest scan; it does not yet prove application connectivity. Some graph-derived labels may also remain visible in strict mode. See How it works and Privacy for the exact boundaries.

Go deeper when you are ready

Quickstart · How the fork works · MCP tools · Privacy · Security · Self-hosting · Contributing

Stop guessing in production.

Fork the graph. Follow the path. Prove the security delta.

Install Emfirge · Star the repo