# PerspectiveGraph

Turns your scanner output into one graph and answers whether someone can reach a sensitive asset from the internet. Useful when the findings pile up and the order to fix them is unclear.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 9
- Author: luiacuaniello
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/luiacuaniello/perspectivegraph
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/perspectivegraph

## What it does

The server merges Trivy, Semgrep, Cloud Custodian and Falco results with AWS and Kubernetes state, then looks for routes that lead from an outside entry point to something worth taking. It runs as the container `ghcr.io/luiacuaniello/perspectivegraph:v1.39.1` over stdio.

You can test an AWS account without deploying anything. A static binary asks AWS's own policy evaluator which roles reach administrator, taking service control policies, permission boundaries and condition keys into account. Only `iam:SimulatePrincipalPolicy` and `iam:ListRoles` are needed, both inside `SecurityAudit`. Every check is a dry run and creates nothing.

Route scores are what the model concludes from the evidence handed to it, not a measured frequency — the engine has not been calibrated against field data, and it says so itself. `make demo` needs Docker, `jq` and `curl`, and brings up a dashboard on `http://localhost:3000`.

## Requirements
- Needs: Docker
- Environment variables: `API_TOKEN` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env API_TOKEN=<API_TOKEN> --transport stdio perspectivegraph -- docker run -i --rm -e API_TOKEN ghcr.io/luiacuaniello/perspectivegraph:v1.39.1
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add perspectivegraph --env API_TOKEN=<API_TOKEN> -- docker run -i --rm -e API_TOKEN ghcr.io/luiacuaniello/perspectivegraph:v1.39.1
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "perspectivegraph": {
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "-e",
                "API_TOKEN",
                "ghcr.io/luiacuaniello/perspectivegraph:v1.39.1"
            ],
            "env": {
                "API_TOKEN": "<API_TOKEN>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "perspectivegraph": {
            "type": "stdio",
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "-e",
                "API_TOKEN",
                "ghcr.io/luiacuaniello/perspectivegraph:v1.39.1"
            ],
            "env": {
                "API_TOKEN": "<API_TOKEN>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e API_TOKEN=<API_TOKEN> perspectivegraph docker run -i --rm -e API_TOKEN ghcr.io/luiacuaniello/perspectivegraph:v1.39.1
```
Replace <…> with your own values

## When to use it
- find which routes from the internet reach sensitive assets
- separate findings that really open a path from scanner noise
- check which AWS roles can reach administrator
- get a fix as its own pull request instead of editing by hand
- stop a merge when the change opens a new route

## Example prompts
- Show the attack routes to sensitive assets from the latest scanner run
- Check which roles in my AWS account reach administrator
- Generate a fix for the P1 route and open it as a separate pull request

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md