⌁
IaC without usage
Terraform describes what exists, but not always how the application binds to those resources at runtime.
In development
Minimum authorization, with evidence.
MIRA is a local-first least-privilege analyzer for cloud workloads. It correlates Infrastructure-as-Code, application code, and provider authorization semantics to produce explainable permission recommendations — not broad managed roles or guesswork.
Local-first
MCP-native
Evidence-backed
Read-only by default
Least privilege fails when evidence is incomplete.
Cloud deployments routinely receive excessive permissions because IaC, application code, and deployment tooling each tell only part of the story. MIRA joins those signals into an explainable authorization path.
◇
Code without identity
SDK calls show API usage, but often not which cloud identity or resource ARN they should attach to.
◎
Hidden deploy rights
Discovery, delegation, and PassRole requirements are easy to miss — and easy to over-grant when guessed.
How MIRA works
MIRA models authorization as an evidence-backed path from identity through operation to provider permission and scope. Deterministic analysis comes first; LLMs may enrich explanations but never act as the IAM authority.
IaC + codeTerraform plan, app usage
→
Binding engineResources ↔ operations
→
Permission KBScoped policies + provenance
MCP tools for authorization intelligence
MIRA exposes MCP 2.0 tools designed for coding agents and security automation. Analysis stays local; tools recommend and explain — they do not apply policies or mutate cloud state.
analyze_infrastructure
Parse IaC and return resources, identities, and initial permission requirements.
analyze_code_permissions
Derive runtime cloud operations from application evidence and configuration bindings.
get_deployment_permissions
Minimum provisioning, discovery, and delegation permissions for deploy identities.
get_runtime_permissions
Workload identity permissions scoped to evidenced resources.
explain_permission
Provenance and rationale for any recommended permission.
generate_least_privilege_policy
Produce provider-native least-privilege policy output with full evidence chains.
What MIRA delivers
MIRA is cloud authorization intelligence, not a static IAM policy generator. It correlates infrastructure intent with application behavior and identity relationships.
↗
Identity separation
Distinct permission sets for deploy, runtime, delegation, discovery, and operational actions.
🛡
Resource scoping
Scope to concrete ARNs when evidence permits; keep uncertainty explicit when it does not.
⚡
Conservative findings
Distinguish missing, excess, and unobserved — never treat “not seen” as “unnecessary.”
Designed for local-first security.
Proprietary code and IaC can be analyzed without mandatory upload. Credentials stay out of language models. Generated policies require explicit downstream approval before anyone applies them.
- Local-first STDIO MCP transport
- Read-only analysis by default
- No secrets exposed to LLMs
- Evidence before inference
- No auto-apply of policies
- STRICT and SAFE analysis modes
- Explainable provenance chains
- Prefer UNOBSERVED over false excess
Roadmap
MIRA is being built as a local analyzer first. Each phase ships a usable slice of the product.
Phase 1 — Local AWS analyzer
MCP server and CLI on your machine. Terraform plan JSON in, evidence-backed permission recommendations out, starting with S3, Lambda, and EC2/VPC.
MCP server and CLI on your machine. Terraform plan JSON in, evidence-backed permission recommendations out, starting with S3, Lambda, and EC2/VPC.
Phase 2 — Broader AWS coverage
Extend the same provenance model across more AWS services once the core reasoning chain is proven.
Extend the same provenance model across more AWS services once the core reasoning chain is proven.
Phase 3 — Workflow integration
Bring MIRA into existing engineering loops: CORA context, CI/CD review, and coding-agent workflows.
Bring MIRA into existing engineering loops: CORA context, CI/CD review, and coding-agent workflows.
Phase 4 — Multi-cloud
Add Azure and GCP after the AWS path is solid — same evidence rules, same local-first runtime.
Add Azure and GCP after the AWS path is solid — same evidence rules, same local-first runtime.
Part of the Horizon Labs family
MIRA sits alongside sibling security intelligence tools that share a local-first, evidence-first philosophy.
CORA
What does this codebase do and how is it related?
MIRA
What is the minimum authorization required to deploy and operate safely?
VERA
What must be remediated and how can remediation be orchestrated?
KIRA
May this agent perform this operation, without holding the credential?