Give your agents curated and computed intelligence about your cloud

Defendermate curates what every vulnerability, patch and attack technique needs, and computes what that means in your cloud: verified exploitability, attack paths and mitigations, with the evidence behind each answer. Connect Claude, ChatGPT, Cursor or any MCP client.

Get started in three steps

  1. Create a free account

    You start in a sandbox with sample data, free. Connect AWS read-only when you’re ready; every account includes starting credits (pricing).

    Create a free account

  2. Connect your MCP client and sign in

    Run this, then type /mcp, pick defendermate and choose Authenticate.

    claude mcp add --transport http defendermate https://mcp.defendermate.com/mcp

  3. Ask your agent

    Ask about the sandbox right away, or about your own environment once AWS is connected.

What your agent gets back

A verdict for your environment, with the evidence behind it. In this real exchange on the sandbox, Defendermate rules out a CVE that scanners flag everywhere, then points to the one that sits on attack paths to your data.

Every answer comes from verdicts already checked against the environment, so the same question gets the same answer.

Is CVE-2023-38408 exploitable on our web container? Scanners flag it on everything with OpenSSH.

get_vulnerability_assessment CVE-2023-38408, web

Not exploitable on web.

The vulnerable OpenSSH client (8.4p1) is installed, but no ssh-agent is running and no agent socket is forwarded. Host probes confirmed both, so the attack has nothing to reach.

Then what on that container should we worry about?

get_vulnerability_attack_paths CVE-2023-38545

The curl flaw CVE-2023-38545. It is exploitable on web and sits on 4 attack paths that end in S3 buckets, the top one rated critical. Start there.

Real output from the Defendermate sandbox.

Tools your agent can call

13 tools today, all read-only, grouped by the question they answer. Build your own agents on them, or start from use cases by CTEM stage.

Exploitability

“Is this CVE exploitable here, and how do you know?”

  • list_vulnerability_assessmentsVerdicts per CVE and resource: exploitable or not exploitable.
  • get_vulnerability_assessmentThe full assessment behind a verdict: each condition checked, and the host evidence.

Attack paths

“What paths lead to our customer data, and which CVEs are on them?”

  • list_attack_pathsExposure paths for a scan, ranked by score.
  • get_attack_pathOne path, with its graph.
  • get_attack_path_vulnerabilitiesThe CVEs on a path.

Findings

“What are the riskiest findings in our latest scan?”

  • list_vulnerabilitiesCVE, configuration and policy findings, ranked by Defendermate score, with CVSS, EPSS and KEV.
  • get_vulnerabilityOne CVE: affected resources, packages, installed and fixed versions.
  • get_vulnerability_attack_pathsThe attack paths a finding sits on.

Mitigation

“How do we contain this CVE on that server before a patch ships?”

  • get_mitigation_optionsMitigation options for a CVE on a resource, with what each one targets and where it came from.

Resources

“What is this resource, and what runs on it?”

  • list_resourcesResources in a scan, ranked by score.
  • get_resourceOne resource, with its full properties.

Connections and scans

“Which accounts are connected, and when was the last scan?”

  • list_connectionsThe cloud connections your account can see.
  • list_jobsScan runs for a connection, newest first.

Coming next

On the same server, as they ship. Defendermate’s own teammates are in early access.

  • Intelligence library: what each CVE needs to be exploitable, fix state across ecosystems, CVE enrichment and the attack-technique catalog, free on every account.
  • Run: verdicts on demand, path validation, and what-if simulation.
  • Change, under your policy: mitigations as code, applied through your policy gate, with rollback.
  • Report back and subscribe: send results and approvals as evidence; get told when a verdict changes.
  • Skills: ready-made workflows for common jobs.

Safe to connect

Read-only
Every tool reads. Nothing your AI calls changes your cloud.
Your sign-in, your scope
Your AI signs in with your Defendermate account and sees only the connections that account can see.
Evidence, not guesses
Answers come from verdicts Defendermate has already checked against your environment, so the same question gets the same answer.
Nothing fired at production
Verdicts come from read-only host checks and your cloud configuration. No exploit is ever run. How data is handled

Connect your AI to Defendermate

Free account, no credit card. Your first answers in minutes.

Try it free Talk to Us