Open source · Apache-2.0 · Runs in your account
Graphify for your AWS account. CirrusMapper maps every resource, relationship and permission into a Neo4j graph and serves it over MCP, so your coding agents query real infrastructure instead of guessing at it. Built with Cartography.
One CloudFormation stack. Read-only IAM. No account to create, and your graph never leaves infrastructure you own.
One stack deploys the collector, the graph and the MCP server. Nothing phones home; no third party ever sees your inventory.
Resources, relationships and policy paths become nodes and edges.
Same VPC, private by default — or behind your own ALB and auth.
Claude Code, Cursor, anything that speaks MCP — one server entry and the map is in context.
It will confidently invent a plausible subnet, a role that is too broad, or a deletion with consequences nobody wrote down. These are the three questions it can't answer from your repo.
The VPC, subnet, security group and target group a service already lives in — so a new task lands next to its database instead of somewhere unreachable.
Otherwise: a task in the wrong subnet, failing health checks for an hour.
Policies resolved into edges, several hops deep, so an agent can see what a role already grants before it attaches another one.
Otherwise: a wildcard policy, and prod backups readable from a test task.
Every dependent resource is one hop from the thing being changed — visible before the change, not discovered after it.
Otherwise: an orphaned security group removed at 2am, and a queue that stops draining.
The agent asks these through MCP tools; the graph is also yours to query directly whenever you want it.
Read the source, read the IAM policy, deploy it into a sandbox account first. It's yours.
{
"mcpServers": {
"cirrusmapper": {
"type": "http",
"url": "https://cirrusmapper.internal/mcp"
}
}
}