get_edges

Graph · From docs/MCP_TOOLS.md on GitHub

Category graph · sensitivity confidential · capabilities read_state · readOnly true, destructive false, idempotent true, openWorld false · outputSchema yes · timeout: layer default (300 s)

Searches the raw edge list. All filters combine with AND, and the result pages like any list tool.

Argument	Type	Default	Constraints	Description
source	string	""		Source asset ref (or 'internet').
target	string	""		Target asset ref.
edge_types	string[] or null	null		Only these EdgeType values.
relationship	string	""		Exact relationship / RelationType.
cross_account_only	boolean	false		Only edges whose two endpoints are mapped assets in different accounts.
internet_only	boolean	false		Only ingress edges from the internet (0.0.0.0/0, ::/0, or the Azure Internet / Any / * sources).
port	integer or null	null	0..65535	Edges allowing this port.
limit	integer	50	1..500	Maximum items to return.
cursor	string	""		Opaque cursor from a previous call's next_cursor; empty = first page.
dataset	string	""		Dataset name (see list_datasets). Empty = the active dataset.

internet_only keeps ingress edges whose source or cidr stands for the internet: 0.0.0.0/0, ::/0, or the Azure Internet, Any and * sources. port keeps edges whose ports list contains the port or whose port_range opens it, parsed by cloudg.graph.ports like the reachability findings: comma lists, lo-hi ranges and Azure * are understood, an empty port list on a TCP, UDP or all-protocol filter rule means every port, and ICMP rules open no ports. cross_account_only keeps edges whose two ends are assets in different accounts. source and target take references, including internet.

Every rule that opens SSH to the internet:

Called with the arguments below, get_edges returned this structuredContent.

{"internet_only": true, "port": 22}

{
  "dataset": "sample",
  "total": 1,
  "offset": 0,
  "returned": 1,
  "next_cursor": null,
  "truncated": false,
  "items": [
    {
      "id": "e-inet-sgadmin",
      "source": "0.0.0.0/0",
      "source_name": "0.0.0.0/0",
      "target": "sg-admin",
      "target_name": "sg-admin",
      "edge_type": "SECURITY_GROUP_RULE",
      "relationship": null,
      "port_range": "22",
      "protocol": "TCP",
      "cidr": "0.0.0.0/0",
      "ports": [
        22
      ],
      "direction": "ingress"
    }
  ]
}

Cross-account trust:

Called with the arguments below, get_edges returned this structuredContent.

{"edge_types": ["IAM_TRUST"], "cross_account_only": true}

{
  "dataset": "sample",
  "total": 2,
  "offset": 0,
  "returned": 2,
  "next_cursor": null,
  "truncated": false,
  "items": [
    {
      "id": "e-app-deploy",
      "source": "app-role",
      "source_name": "app-role",
      "target": "deploy-role",
      "target_name": "deploy-role",
      "edge_type": "IAM_TRUST",
      "relationship": "CROSS_ACCOUNT_TRUST",
      "cross_account": true
    },
    {
      "id": "e-vendor-deploy",
      "source": "acct-vendor",
      "source_name": "vendor-co",
      "target": "deploy-role",
      "target_name": "deploy-role",
      "edge_type": "IAM_TRUST",
      "relationship": "CROSS_ACCOUNT_TRUST",
      "cross_account": true
    }
  ]
}

Paging over all edges:

Called with the arguments below, get_edges returned this structuredContent.

{"limit": 2}

{
  "dataset": "sample",
  "total": 56,
  "offset": 0,
  "returned": 2,
  "next_cursor": "c2.45682a5c230e",
  "truncated": true,
  "items": [
    {
      "id": "e-org-ou",
      "source": "org",
      "source_name": "sample-org",
      "target": "ou-workloads",
      "target_name": "Workloads",
      "edge_type": "CONTAINS",
      "relationship": null
    },
    {
      "id": "e-ou-prod",
      "source": "ou-workloads",
      "source_name": "Workloads",
      "target": "acct-prod",
      "target_name": "prod",
      "edge_type": "CONTAINS",
      "relationship": null
    }
  ]
}

A source or target that resolves to nothing fails with the usual "No asset matches" error.