🛡️ Emfirge

Git branch for your cloud.

Give your AI a read-only map of AWS. Trace attack paths, test a security fix on a cloned graph, and see the result before touching production.

Get started · Read the docs · Open dashboard · npm

Your scanner finds problems. Emfirge tests the fix.

Most cloud tools hand you a list and ask you to trust the recommendation. Emfirge builds a connected graph of your account, forks it in memory, applies the proposed security change, re-runs the rules, and shows what got safer—or riskier.

🕸️ See the path	🎯 Find the chokepoint	🧪 Rehearse the fix	💬 Stay in your AI
Internet → compute → IAM → data	Prioritize what breaks the most attack paths	No write access. No production mutation.	Claude, Cursor, Kiro, Cline, Continue, Codex

~20 AWS service types · 58 graph-aware rules · 17 rule families · 7 MCP tools

Start in 30 seconds

Terminal

npx @emfirge/mcp install

Then ask your assistant:

text

Scan my AWS account using role
arn:aws:iam::123456789012:role/EmfirgeReadOnly in us-east-1

No role yet? Say “help me set up Emfirge.” You will get a one-click CloudFormation link for a read-only IAM role.

Try it now with no setup: use demo role arn:aws:iam::194722410583:role/EmfirgeReadOnly in us-east-1.

Free: 5 scans per AWS account per day. No signup. No API key.

Ask questions your cloud can finally answer

text

Show me the worst attack path from the internet.
What is the blast radius if this instance is compromised?
Which resource should I fix first?
Will closing SSH remove the path without adding new security findings?
Check this account against CIS AWS Foundations 1.5.

One graph. Seven tools.

Tool	Answer
`emfirge_scan`	What does my AWS risk look like?
`emfirge_get_findings`	What is wrong and how do I fix it?
`emfirge_attack_paths`	How could an attacker reach my data?
`emfirge_verify_fix`	What changes if I apply this security fix?
`emfirge_simulate_breach`	What happens after this resource is compromised?
`emfirge_check_compliance`	Which CIS AWS 1.5 or SOC 2 controls fail?
`emfirge_setup_help`	How do I create the read-only role?

Proof, not a prompt

text

Scan AWS → build graph → fork graph → apply mutation → re-run rules → show delta

The score, findings, attack paths, and fix verification come from deterministic graph analysis—not an LLM guessing what might happen. Your AI explains the evidence; Emfirge produces it.

Built for trust

Read-only AWS access through a role you own and can revoke anytime.
One-hour STS credentials protected by an ExternalId and never stored.
Local tokenization of recognized AWS identifiers before MCP results reach your LLM in strict mode.
No production changes during scans, breach simulations, or fix verification.
Source available for the MCP, scanner engine, rules, scoring, and docs.

Emfirge proves the simulated security delta against your latest scan; it does not yet prove application connectivity. Some graph-derived labels may also remain visible in strict mode. See How it works and Privacy for the exact boundaries.

Go deeper when you are ready

Quickstart · How the fork works · MCP tools · Privacy · Security · Self-hosting · Contributing

Stop guessing in production.

Fork the graph. Follow the path. Prove the security delta.

Install Emfirge · Star the repo