subimage-mcp

Plugin subimage-mcp from marketplace subimage in subimagesec/skills. Commands read from the repo's manifest — 6 days ago.

Skills (14)

• build-cypher-query

  Build and run a Cypher query against the SubImage Neo4j graph only when the user request requires graph traversal, relationships, identity/access, reachability, ownership, blast radius, root cause, or absence validation, and no dedicated MCP tool can answer directly.

• create-custom-rule

  Design, validate, and save a tenant-local SubImage custom Cypher rule, or fix and update an existing one, with `subimageCreateCustomRule` and `subimageUpdateCustomRule`. Use when the user asks to "create a rule", "write a Cypher rule for X", "add a custom finding", "edit my custom rule", "fix my fai

• identify-iac-repositories

  Identify and rank CodeRepository nodes that manage Infrastructure as Code (Terraform, OpenTofu, Pulumi, CloudFormation, CDK, Bicep, Helm, Kustomize, GitOps) in the SubImage graph. Use when the user asks to "find our IaC repos", "which repositories manage infrastructure", "where is our Terraform", "r

• improve-subimage-coverage

  Audit the current repo for cloud / SaaS providers that are NOT yet wired into SubImage, then list the security rules with findings and surface the top actionable ones grouped by tag. Use when the user asks to "improve SubImage coverage", "what should I connect to SubImage", "audit SubImage coverage"

• inventory-via-cypher

  Answer flat resource-inventory questions - list, count, filter, sort, or paginate ONE resource type - by mapping the requested type to its Neo4j ontology label, or to the provider-native label when the user names a specific product, then running a single Cypher query. Use when the user asks "list",

• investigate-container

  Investigate containers, images, and Kubernetes/EKS clusters in SubImage. Three modes - trace an image's provenance (registry, running workloads, source repo, CVEs); audit a cluster's internet exposure (services, ingress, public-IP nodes); or reconcile EKS node counts (filter terminated EC2 still lin

• investigate-cve

  Investigate a specific CVE in SubImage end-to-end (severity, KEV status, affected resources, fixability) and offer to pivot into attack-path exploration on the impacted assets. Use when the user mentions a CVE id ("CVE-2024-3094", "what's affected by CVE-2023-44487"), asks to "investigate this CVE",

• investigate-iam

  Audit IAM privilege in SubImage end-to-end: enumerate admin-equivalent identities, map assume-role and cross-account trust chains, and resolve PermissionSet effective permissions. Use when the user asks "who has admin access", "show privilege escalation paths", "audit IAM permissions", "what can ass

• investigate-ip

  Resolve who owns an IP address or domain across all cloud resource types in SubImage (EC2, EIP, ENI, Route53/DNS, CloudFront, ELB, GCP, Azure), trace the DNS resolution chain, and - for public IPs - add external attribution (ASN, geo, VPN/proxy/Tor) via Spur. Use when the user asks "who owns this IP

• investigate-package

  Trace a package or dependency in SubImage from CVE or issue to package node, image, layer history, base-image versus application origin, and practical reachability. Use when the user asks "where does this package come from", "is this from the base image", "is this installed package exploitable", "tr

• investigate-public-exposure

  Determine why a SubImage asset, domain, bucket, CDN distribution, load balancer, Kubernetes workload, serverless function, database, public IP, or cloud storage resource is publicly reachable. Use when the user asks "why is this public", "what exposes this asset", "is this exposed by CloudFront/S3",

• review-attack-path

  Walk a SubImage attack path step by step, identify the most sensitive impacted assets, propose the fastest remediation, hunt for credible n+1 extensions the engine has not yet modeled, and optionally simulate what-if scenarios. Use when the user asks to "review this attack path", "explain this attac

• signals-via-cypher

  Answer questions about findings, compliance posture, vulnerabilities, CVEs, packages, and attack paths by querying the Signal nodes that hold them in Neo4j. Use when the user asks what is failing a rule, how a framework scores, which CVEs or packages are present, what is exploitable or KEV-listed, o

• triage-new-findings

  Triage SubImage security findings by listing the rules that have findings, grouping them by tag/theme, and recommending the next investigation steps. Use when the user asks to "triage findings", "what's new in SubImage today", "summarize my open findings", "any urgent findings", or wants a daily/wee

Similar plugins