How do I install Emfirge?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Emfirge need an API key?

The publisher lists these environment variables: EMFIRGE_PRIVACY, EMFIRGE_BASE_URL.

What transport does Emfirge use?

Emfirge runs locally over stdio.

When was Emfirge last checked?

Last checked 2026-11-10. Git branch for your cloud. Understand AWS risk, prove fixes, and ship safer changes.

Emfirge MCP server

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Add to Cursor Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Local command

npx -y @emfirge/[email protected]

Credentials from the publisher

EMFIRGE_PRIVACY — Tokenization mode: strict (default), balanced, or off
EMFIRGE_BASE_URL — Backend URL — override to point at a self-hosted backend

Claude Code has no install link for a local command. Copy the command below and run it in a terminal.

shClaude Code

1EMFIRGE_PRIVACY=<value> EMFIRGE_BASE_URL=<value> claude mcp add io.github.theanshsonkar-emfirge -- npx -y @emfirge/mcp@0.2.1

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "io.github.theanshsonkar-emfirge": {4      "command": "npx",5      "args": [6        "-y",7        "@emfirge/[email protected]"8      ],9      "env": {10        "EMFIRGE_PRIVACY": "<value>",11        "EMFIRGE_BASE_URL": "<value>"12      }13    }14  }15}

claude_desktop_config.json

Local · npmPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
Version: 0.2.1
API key

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

🛡️ Emfirge

Give your agent a branch of your cloud.

AI agents are starting to change real infrastructure. Emfirge is the harness that lets them try first, on a branch of your live AWS, judged by lenses that show what the change would actually do.

Get started · Docs · npm

Built by Ansh Sonkar

Your agent wants to "clean up unused databases"

Without Emfirge, it calls DeleteDBInstance and you learn from your on-call channel what that database was for.

With Emfirge, the agent does it on a branch first:

you    ▸ Clean up the unused databases in us-east-1.

agent  ▸ I tried it on a branch first. Verdict: BLOCK

         ✗ recently_used
           CloudWatch metrics show a deleted resource was used in the last 90 days
           → orders-db

         ✗ data_store_deleted_no_recovery_point
           Deleted data store has no recovery point
           → orders-db

         Branch #2, deleting only legacy-reports-db, passes.
         Want the exact API call for that one?

Nothing touched production. The agent changed its plan, and the hand-back it gives you is bound by hash to the verdict it passed.

Simplified output. The reason codes and messages are the engine's real ones.

Three layers

🧰 The harness: the product

Where the agent works, what it may see, what it gets back, and what it can't skip.

Read-only, always. Emfirge never writes to your cloud. You or your pipeline apply the approved change.
Private by default. AWS identifiers are tokenized on your machine before the LLM sees them.
No silent passes. A change Emfirge can't model can't pass. A missing check is reported, not hidden.

🌿 The branch: the engine

A Git-style copy of a model of your live AWS: a base snapshot plus an ordered list of changes.

Git-style operations. Fork, roll back, compare and discard, like you would with code.
Many ways in. Feed it typed changes, a Terraform plan, a CloudFormation change set, AWS API calls or AWS CLI commands. The same change gives the same answer whichever way it comes in.
A two-sided diff. See what was added and removed, what became reachable from the internet, and the cost before and after.

🔍 Lenses: what gets measured

Each lens judges the branch from one angle, and together they produce a single pass / warn / block.

	Lens	Asks
✅	Security	Does this expose something, or open a privilege-escalation path?
✅	Dependencies	What breaks if this is removed? Is it still in use? Can it be recovered?
✅	Compliance	Which CIS 1.5 and SOC 2 controls flip? (control lists from Prowler's published data; uncovered controls are never `pass`)
🟡	Cost	What does it cost before and after? (AWS's published Price List, us-east-1 only; no LCUs)
🟡	Limits	Will it hit an AWS quota? (early: AWS default quotas)
🔜	Yours	Bring your own evaluator, run against the same branch contract.

Try it

npx @emfirge/mcp install

Then tell your assistant:

Help me set up Emfirge, then scan arn:aws:iam::123456789012:role/EmfirgeReadOnly in us-east-1

The account ID is a placeholder. Setup gives you a one-click CloudFormation link for a read-only role, and you can delete the stack any time to revoke access.

The installer sets up Claude Desktop, Claude Code, Cursor, Kiro, Cline, Continue and Codex, and you can configure any other MCP client by hand. You can also use the API or the branch CLI. See all the tools in the MCP README.

Built to be trusted

Every behaviour of the engine is pinned by a numbered law, a property test that must always hold. There are 48 so far, for example:

L1: an empty branch scores exactly like the live scan. L7: the same snapshot and changes always give the same verdict. L9: your identifiers never appear in free-text output. L12: evidence can make a verdict stricter, never looser. L21: a Terraform security-group rule and the equivalent AWS API call get the same verdict.

The checks come from public sources rather than hand-written lists: pathfinding.cloud escalation paths, policy_sentry IAM data, AWS schemas, Prowler's compliance data, and the AWS Price List. Checkov runs on each branch verdict as an advisory scanner (it warns, it does not block on its own); Trivy is off. Every CI run publishes a scorecard.

What Emfirge does not claim: a branch is a model of your cloud, so a pass is evidence, not a guarantee. If any part of the check was skipped, the verdict says so. Today Emfirge is a safe workspace, not a gate that blocks a live apply.

Resource type	Add	Modify	Delete
EC2 instance, security group, RDS instance, S3 bucket, Lambda function, network ACL	✅	✅	✅
IAM role (including trust policy)	✅	✅	✅
IAM user, NAT gateway	✅
RDS snapshot	✅		✅
EBS volume	✅		✅
EBS snapshot			✅
Route table	✅	✅
IAM role policy		✅

The live GET /branches/capabilities endpoint is the authoritative list, and GET /branches/field-catalog lists every settable field with the AWS API member it stands for. Most resource types also carry tags; a tag change replaces the complete user tag set. Anything not modeled degrades the verdict rather than passing.

Path	What it is	License
`backend/`	The engine: collector, graph, branches, input adapters, lenses, verdict, hand-back	AGPL-3.0
`mcp/`	`@emfirge/mcp`, the MCP server and CLI	Apache-2.0
`site/`	Docs at emfirge.cloud/docs	AGPL-3.0
`iam-role.yaml`	The read-only customer role	AGPL-3.0

Built by

Emfirge is designed and built by Ansh Sonkar (@theanshsonkar): the engine, the branch model, the lenses and the MCP.

Building with AI agents on AWS, or want to talk about Emfirge? Email [email protected].

Contributing · Security · Privacy

Add this server

Host a copy with our keys and logs.

Server facts

Tools

Questions

How do I install Emfirge?

Does Emfirge need an API key?

What transport does Emfirge use?

When was Emfirge last checked?

Documentation

🛡️ Emfirge

Give your agent a branch of your cloud.

Your agent wants to "clean up unused databases"

Three layers

🧰 The harness: the product

🌿 The branch: the engine

🔍 Lenses: what gets measured

Try it

Built to be trusted

Built by