Automated Emulation with Caldera MCP Server!

Update for 11/16/25: Caldera MCP Server plugin!

Added the Caldera MCP server plugin, Bountyhunter plugin. Added automated download of emu plugin payloads. Caldera now has the capability to use the MCP server as a wrapper to the Caldera API, helping give context to LLMs for building new abilities, operation planners, and a CTI with RAG integration. See this MITRE blog for more information.

Overview

Automated Emulation is a simple terraform template creating a customizable and automated Breach and Attack Simulation lab. It automically builds the following resources hosted in AWS:

• One Linux server deploying Caldera and VECTR (vectr.io).
• Linux Server: The latest Caldera 5.3 with Magma VueJS web application.
• One Windows Client (Windows Server 2022) auto-configured for Caldera agent deployment, and other Red & Blue tools.
• Windows Client: Atomic Red Team (ART) automated deployment.
• Windows Client: Sysmon automated deployment.
• Caldera MCP server plugin installed.
• Exposes an MLflow server for observability, tracing, and debug of Caldera LLM inference calls.
• Caldera Bountyhunter plugin installed.
• Caldera EMU plugin: Auto-downloads payloads. This CALDERA Plugin converts Adversary Emulation Plans from the Center for Threat Informed Defense.

See the Features and Capabilities section for more details.

Requirements and Setup

Tested with:

• Mac OS 13.4
• terraform 1.5.7

Clone this repository:

git clone https://github.com/iknowjason/AutomatedEmulation

Credentials Setup:

Generate an IAM programmatic access key that has permissions to build resources in your AWS account. Setup your .env to load these environment variables. You can also use the direnv tool to hook into your shell and populate the .envrc. Should look something like this in your .env or .envrc:

export AWS_ACCESS_KEY_ID="VALUE"
export AWS_SECRET_ACCESS_KEY="VALUE"

Build and Destroy Resources

Run terraform init

Change into the AutomatedEmulation working directory and type:

terraform init

Run terraform plan or apply

terraform apply -auto-approve

or

terraform plan -out=run.plan
terraform apply run.plan

Destroy resources

terraform destroy -auto-approve

View terraform created resources

The lab has been created with important terraform outputs showing services, endpoints, IP addresses, and credentials. To view them:

terraform output

Features and Capabilities

Important Firewall and White Listing

By default when you run terraform apply, your public IPv4 address is determined via a query to ifconfig.so and the terraform.tfstate is updated automatically. If your location changes, simply run terraform apply to update the security groups with your new public IPv4 address. If ifconfig.me returns a public IPv6 address, your terraform will break. In that case you'll have to customize the white list. To change the white list for custom rules, update this variable in sg.tf:

locals {
  src_ip = "${chomp(data.http.firewall_allowed.response_body)}/32"
  #src_ip = "0.0.0.0/0"
}

Caldera

Caldera Linux Server

Caldera is built on an Ubuntu Linux 22.04 AMI automatically with SSL support for admin console. The following local project files are important for customization:

• bas.tf: The terraform file that builds the Linux server and all terraform variables for Caldera.
• files/bas/bootstrap.sh.tpl: The boostrap script for Caldera and other services.
• files/bas/local.yml.tpl: The Caldera configuration file that is automatically deployed
• files/bas/caldera.service: The caldera service file that is automatically installed
• files/bas/abilities/: A local directory with custom abilities that will automatic

... View full README on GitHub