Mitigant

ONLINE Mitigant answered an MCP connection on 25 Oct 2026 and introduced itself as mitigant-mcp-server 0.1.0 (MCP protocol 2025-06-18).

10 tools offered to AI assistants

• list_attacks · Browse Mitigant's attack actions -- atomic tests that each emulate one attacker technique -- that you can launch on their own against AWS, Azure or GCP. Currently 111 attack actions (AWS 49, Azure 36, GCP 26). Returns each action's attackNa
• get_attack_details · Full description, impact, MITRE mapping, and orchestration type (PROVISIONED or INLINE -- PROVISIONED attacks create and destroy their own target rather than targeting your existing infrastructure (they may still read or use existing resour
• launch_attack · Run an attack against a cloud account connected to Mitigant and return the result once it finishes. This performs real actions on real cloud infrastructure -- it is not a simulation. Confirm with the user before calling: if their request co
• list_cloud_accounts · List the cloud accounts available for attack emulation -- any account not listed here cannot be attacked, so check this before guessing an account_no for launch_attack. An empty result means no accounts are onboarded for attack emulation (f
• list_scenarios · List Mitigant's attack scenarios -- multi-step chains that combine several attack actions run in sequence, so treat a scenario as having the combined blast radius of every step. Currently 45 scenarios (AWS 26, Azure 12, GCP 7). Returns each
• get_scenario_details · Full details for one attack scenario -- description, impact, and the step-by-step composition, by the scenario key from list_scenarios. A scenario runs several attacks in sequence; this returns every step, not just the first. Result include
• launch_scenario · Run a multi-step attack chain against a cloud account connected to Mitigant and return the result once every step finishes. This performs real actions on real cloud infrastructure, as several attacks in sequence -- it is not a simulation, a
• get_attack_status · Get the current report for a previously launched attack, including its clean-up state. Returns the attack report plus a 'cleanup' summary with cleanUpComplete and a plain-language statement. Only tell the user the account is back to its pre
• clean_up_attack · Clean up a previously launched attack, restoring the cloud resources it changed back to their pre-attack state. Clean-up is normally AUTOMATIC after a short, deliberate inspection window (so the team can verify the attack and collect eviden
• get_attack_evidence · Get the evidence Mitigant collected for a previously launched attack -- what the account's own logging (CloudTrail, GuardDuty) recorded about it. Returns an 'evidence' summary (counts, sources, and a plain-language statement) plus the raw r

What "online" means: the server answered an MCP connection at the time of the check. It is not a guarantee of security, quality or continuous uptime. How we test: we open an MCP session and ask for the tool list, as an AI assistant would. We never run a tool and never send a key. Checked every few days. Method

Is this your server? Monitoring Pro: a check every 30 minutes and an email within the hour when it stops answering. Launch offer: $39.99 once, for life.