Feature Release: Introducing the Mitigant MCP Server

Today we are releasing the Mitigant MCP server, giving AI agents like Claude Code and Kiro seamless access to Mitigant Cloud Attack Emulation (CAE). Cloud security teams can now run safe, tested attacks and manage the full attack lifecycle from the agent they already use, across red/purple teaming, evidence collection and detection validation.

Agentic Adversary Emulation

Attackers are already using agents to cheaply orchestrate sophisticated campaigns at machine speed. The recent Microsoft report on Storm-0940 demonstrated this: the attackers used ARTEX, an AI autonomous penetration testing system, to run attacks that in several cases reached privileged access in less than three hours. In one campaign, sign-in attempts peaked at 2,900 per minute; in a separate supply-chain compromise, the actor targeted over 2,250 cloud tenants.

However, defenders are not able to use these offensive security frameworks for enterprise use-cases, especially in cloud environments, for several reasons e.g. lack of safety measures and predictability. Furthermore, many of these frameworks are not built for enterprise requirements such as rate limit constraints, failure handling, clear target scoping, automated cleanup, comprehensive reporting and re-testing regimes.

The Mitigant MCP Server

The Mitigant MCP server addresses these limitations by creating a bridge for AI agents to connect to Mitigant CAE to leverage the rich, curated attack catalog, mapped to MITRE ATT&CK and ATLAS. 

Agent-Managed Attack Lifecycle

Running an attack is a single action. Enterprise offensive security, in particular for cloud infrastructure, is a lifecycle involving researching, goal selection, planning and scoping, technique selection, safe execution, evidence collection, cleaning up, and repeatable retesting.

In application security testing, safety is rarely the main concern: web applications are targeted without involving the underlying infrastructure, therefore safety and cleanup are not required. This is different for cloud testing: attacks often alter infrastructure hence safe execution, reversibility and cleanup are non-negotiable. AI agents can launch attacks on the fly, but most offensive agentic systems are not able to reliably manage the attack lifecycle. 

The Mitigant MCP addresses these limitations by allowing agents to use their inherent reasoning and orchestration capabilities while Mitigant ensures safety, reversibility, evidence collection, environmental context and automatic cleanup. Essentially, the MCP server enables agents to coordinate the whole attack lifecycle rather than hinging on fragile, unpredictable attacks.

Use Cases

There are several opportunities the Mitigant MCP brings to agentic security operations. Teams can use agents to easily search, select, and execute attacks for several use cases, including the following:

• Detection Validation: Agents validate whether threat detection mechanisms work end to end, from log ingestion and SIEM configuration to detection rules and alerting. For example, an agent can take a detection rule, such as a Sigma rule, select the cloud attacks that test it and run them, so the team can confirm in its SIEM which detections fired.
• Red/Purple Teaming: Agents plan and carry out red/purple team exercises, from a single technique to a full adversary emulation, and report how defenses held up. For example, an agent can plan and run a short red team exercise against a chosen cloud account, as shown in the walkthrough below.
• Security Control Validation: Agents validate whether preventive, detective and compliance controls work as intended, and turn findings into evidence of real, exploitable risk. For example, an agent can take a findings report and test which findings are actually exploitable.
• Incident Response Readiness: SOC teams can use agents to run realistic breach scenarios that test response readiness across people, processes and technology. For example, an agent can run a multi-step attack scenario during a tabletop exercise and document how the response unfolded.

Quick Walkthrough: Red Team Exercise

Let us walk through a simple example, as demonstrated by the video in Figure 1. A red team operator wants to run a quick red team exercise against an AWS account. He sends the prompt in Figure 2 to Claude Code and works through it with an AI agent connected to Mitigant MCP.

‍

Figure 1: Mitigant MCP Server Demonstration

The agent proposes a plan, and as the human operator approves each step in natural language, the agent pulls the matching S3 attacks from Mitigant and runs three safe, MITRE ATT&CK-mapped attacks: Disable S3 Logging (T1562.008), Public S3 Bucket (T1619), and Malicious Bucket Replication (T1530). Each attack is automatically cleaned up afterwards, and the evidence is provided from AWS CloudTrail. 

Plan a quick red team exercise for my AWS account targeting S3

Figure 2: Prompt Sent By the A Red Team Operator to Claude Code Connected to Mitigant MCP

What's Next

The features released with the MCP server are just the beginning. Here are powerful capabilities we are bringing to agents through the MCP:

• Cloud penetration testing: Mitigant already automates cloud penetration testing, identifying which cloud exposures are actually exploitable, validating the attack paths, and producing evidence-backed reports. Unlike application penetration testing, this targets the cloud control plane where real risk now concentrates. Exposing it through the MCP brings cloud penetration testing to agents and moves it from a once-a-year engagement to a continuous capability, run whenever the cloud changes.
• Threat exposure analysis: intelligent analysis of cloud accounts with agents to identify and prioritize real exposures. Mitigant already does this for findings imported from the tooling teams run today.
• Privilege escalation paths: Privilege escalation analysis to identify and validate potential paths attackers could use and subsequently recommend hardening measures.
• Threat-Informed Defense: Mitigant attacks are already mapped to their corresponding threat actors, such as Scattered Spider. Exposing this through the MCP lets security teams apply Threat-Informed Defense strategies in natural language.

Try the Mitigant MCP Server 

Security teams, especially those defending cloud infrastructure, can now validate their defenses continuously and safely, through the AI agents they already use. Agents like Claude Code and Kiro bring the reasoning and orchestration; what they lack is everything that makes an attack safe and enterprise-ready. 

The Mitigant MCP server gives teams that, turning a single risky attack into a managed attack lifecycle that goes well beyond running and planning attacks: safe, reversible execution, environmental context, evidence collection, automatic cleanup, comprehensive reporting, repeatable retesting, etc. 

The more capable agents become, the more their teams can do with them. Attackers already run agents; now defenders can too, against the environments they defend. Connect an agent in a few minutes and run a first attack: get a demo environment. 

‍