PerspectiveGraph — Claude Code MCP server
Turns your scanner output into one graph and answers whether someone can reach a sensitive asset from the internet. Useful when the findings pile up and the order to fix them is unclear.
claude mcp add --env API_TOKEN=<API_TOKEN> --transport stdio perspectivegraph -- docker run -i --rm -e API_TOKEN ghcr.io/luiacuaniello/perspectivegraph:v1.39.1What PerspectiveGraph does
The server merges Trivy, Semgrep, Cloud Custodian and Falco results with AWS and Kubernetes state, then looks for routes that lead from an outside entry point to something worth taking. It runs as the container ghcr.io/luiacuaniello/perspectivegraph:v1.39.1 over stdio.
You can test an AWS account without deploying anything. A static binary asks AWS's own policy evaluator which roles reach administrator, taking service control policies, permission boundaries and condition keys into account. Only iam:SimulatePrincipalPolicy and iam:ListRoles are needed, both inside SecurityAudit. Every check is a dry run and creates nothing.
Route scores are what the model concludes from the evidence handed to it, not a measured frequency — the engine has not been calibrated against field data, and it says so itself. make demo needs Docker, jq and curl, and brings up a dashboard on http://localhost:3000.
What it helps with
- find which routes from the internet reach sensitive assets
- separate findings that really open a path from scanner noise
- check which AWS roles can reach administrator
- get a fix as its own pull request instead of editing by hand
- stop a merge when the change opens a new route
Example prompts for the agent
- Show the attack routes to sensitive assets from the latest scanner run
- Check which roles in my AWS account reach administrator
- Generate a fix for the P1 route and open it as a separate pull request
How to install PerspectiveGraph
Platform CLI
claude mcp add --env API_TOKEN=<API_TOKEN> --transport stdio perspectivegraph -- docker run -i --rm -e API_TOKEN ghcr.io/luiacuaniello/perspectivegraph:v1.39.1Replace <…> with your own values
Platform CLI
codex mcp add perspectivegraph --env API_TOKEN=<API_TOKEN> -- docker run -i --rm -e API_TOKEN ghcr.io/luiacuaniello/perspectivegraph:v1.39.1Replace <…> with your own values
Config file
{
"mcpServers": {
"perspectivegraph": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"API_TOKEN",
"ghcr.io/luiacuaniello/perspectivegraph:v1.39.1"
],
"env": {
"API_TOKEN": "<API_TOKEN>"
}
}
}
}Replace <…> with your own values
Config file
{
"servers": {
"perspectivegraph": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"API_TOKEN",
"ghcr.io/luiacuaniello/perspectivegraph:v1.39.1"
],
"env": {
"API_TOKEN": "<API_TOKEN>"
}
}
}
}Replace <…> with your own values
Platform CLI
gemini mcp add -e API_TOKEN=<API_TOKEN> perspectivegraph docker run -i --rm -e API_TOKEN ghcr.io/luiacuaniello/perspectivegraph:v1.39.1Replace <…> with your own values
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about PerspectiveGraph
How do I install PerspectiveGraph in Claude Code?
With one command: `claude mcp add --env API_TOKEN=<API_TOKEN> --transport stdio perspectivegraph -- docker run -i --rm -e API_TOKEN ghcr.io/luiacuaniello/perspectivegraph:v1.39.1. Replace <API_TOKEN>` with your token.
What does PerspectiveGraph do?
It joins Trivy, Semgrep, Cloud Custodian and Falco output with AWS and Kubernetes state into a single graph, then searches it for routes from the internet to valuable assets. For a route it finds, it proposes a fix.
What permissions does the AWS account check need?
iam:SimulatePrincipalPolicy and iam:ListRoles are enough, and both sit inside SecurityAudit. The check only reads and creates nothing.
