Mitigant

Connect Remote server

claude mcp add --transport http mitigant-mcp https://mcp.mitigant.io/mcp --header "apiToken: <APITOKEN>"

{
  "mcpServers": {
    "mitigant-mcp": {
      "url": "https://mcp.mitigant.io/mcp",
      "headers": {
        "apiToken": "<APITOKEN>"
      }
    }
  }
}

{
  "servers": {
    "mitigant-mcp": {
      "type": "http",
      "url": "https://mcp.mitigant.io/mcp",
      "headers": {
        "apiToken": "<APITOKEN>"
      }
    }
  }
}

Settings > Connectors > Add custom connector
URL: https://mcp.mitigant.io/mcp

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools 14 found in our last check

• list_attacks

  Browse Mitigant's attack actions -- atomic tests that each emulate one attacker technique -- that you can launch on their own against AWS, Azure or GCP. Currently 111 attack actions (AWS 49, Azure 36, GCP 26). Returns each action's attackName (show this to the user) and attackTy…

• get_attack_details

  Full description, impact, MITRE mapping, and orchestration type (PROVISIONED or INLINE -- PROVISIONED attacks create and destroy their own target rather than targeting your existing infrastructure (they may still read or use existing resources along the way), so they're the lowe…

• launch_attack

  Run an attack against a cloud account connected to Mitigant. Returns the result if it finishes within wait_seconds (default 20); otherwise it returns at once with the attackId and status RUNNING while the attack keeps running -- then poll get_attack_status with that attackId, an…

• list_cloud_accounts

  List the cloud accounts available for attack emulation -- any account not listed here cannot be attacked, so check this before guessing an account_no for launch_attack. An empty result means no accounts are onboarded for attack emulation (for that cloud, or at all), not a failur…

• list_scenarios

  List Mitigant's attack scenarios -- multi-step chains that combine several attack actions run in sequence, so treat a scenario as having the combined blast radius of every step. Currently 45 scenarios (AWS 26, Azure 12, GCP 7). Returns each scenario's scenarioName (show this to…

• get_scenario_details

  Full details for one attack scenario -- description, impact, and the step-by-step composition, by the scenario key from list_scenarios. A scenario runs several attacks in sequence; this returns every step, not just the first. Result includes scenarioName (show this to the user)…

• launch_scenario

  Run a multi-step attack chain against a cloud account connected to Mitigant. Returns the result if every step finishes within wait_seconds (default 20); a multi-step scenario usually takes longer, so expect it to return at once with the attackId and status RUNNING while it keeps…

• get_attack_status

  Get the current report for a previously launched attack, including its clean-up state. Returns the attack report plus a 'cleanup' summary with cleanUpComplete and a plain-language statement. Only tell the user the account is back to its pre-attack state when cleanup.cleanUpCompl…

• list_recent_attacks

  List your own recent attack and scenario runs for a cloud account, most recent first, each with its attackId and status. Use this to recover an attackId you no longer have -- for example when a launch_attack / launch_scenario call's connection dropped before it returned, or to c…

• get_context

  Check this account's context before planning or launching: whether it is a Mitigant DEMO account and what that allows. Call this first on a new connection. If isDemo is true, every attack or scenario with allowedOnDemo=false WILL be rejected at launch -- treat those as not runna…

• clean_up_attack

  Clean up a previously launched attack, restoring the cloud resources it changed back to their pre-attack state. Clean-up is normally AUTOMATIC after a short, deliberate inspection window (so the team can verify the attack and collect evidence first); calling this kicks it off im…

• get_attack_evidence

  Get the evidence Mitigant collected for a previously launched attack -- what the account's own logging (CloudTrail, GuardDuty) recorded about it. Returns an 'evidence' summary (counts, sources, and a plain-language statement) plus the raw records, each with an evidenceUrl that o…

• list_threat_actors

  List every real-world threat actor Mitigant's catalog tracks (name, description, references). Not scoped to a cloud service. Use this to find an actor's exact name (e.g. 'Storm-0940', 'Scattered Spider') before calling get_attacks_by_threat_actor, or to summarize what an actor i…

• get_attacks_by_threat_actor

  Find the managed attacks that demonstrate a named threat actor's real techniques, for one cloud service -- e.g. 'which Azure attacks demonstrate Scattered Spider', or to plan a red team exercise around one actor's known behavior. Get the actor's exact name from list_threat_actor…

Headers

Details

More cloud and devops servers See all

• OxyPages

  Deploy HTML pages and built web apps (React, Vue, Vite) to a live HTTPS link from your AI agent.

• Privi Call

  One number per AI agent: route MCP calls to any agent, every call sealed in an on-chain log.

• OldWeb Diagnostics

  Public DNS, HTTPS and deployment checks, plus offline email header and delivery-log tracing.

• OldWeb Logs

  Offline log parsing, CI failures, HTTP capture analysis and bounded JSON configuration validation.

• TrainRec

  Your AI assistant logs your meals and workouts, then plans your week from what you did.

• ZeroPhase

  BUD/S prep training: read today's workout, log tasks and PST results from your agent.