Critical Infrastructure Interdependency MCP Server

> View on ApifyForge | Use on Apify Store

---

Quick Start

Add to your MCP client (Claude Desktop, Cursor, Windsurf):

{
  "mcpServers": {
    "critical-infrastructure-interdependency-mcp": {
      "url": "https://ryanclinton--critical-infrastructure-interdependency-mcp.apify.actor/mcp"
    }
  }
}

---

Critical infrastructure cascade analysis for AI agents — this MCP server maps cross-sector interdependencies across energy, telecom, water, cyber, transport, and financial networks and simulates how failures propagate through them. Connect any MCP-compatible AI agent to 8 specialized tools that run 6 mathematical algorithms on real data from 14 live sources.

The server builds a 6-layer multiplex hypergraph from OpenStreetMap infrastructure data, DNS records, vulnerability databases, and seismic/weather/disaster feeds, then applies BTW sand-pile cascade simulation, Voronoi geographic co-location risk, Critical Path Method recovery estimation, and supra-Laplacian algebraic connectivity indexing to produce actionable resilience intelligence. No setup required beyond an API token — connect via the Model Context Protocol /mcp endpoint.

What data can you access?

| Data Point | Source | Coverage |
|-----------|--------|----------|
| 📍 Physical infrastructure nodes | OSM POI Search | Global OpenStreetMap (airports, substations, water plants, data centers) |
| 🌐 DNS records and IP topology | DNS Record Lookup | Any domain — A, MX, NS, CNAME records |
| 🛰️ Internet host exposure | Censys Search | Full IPv4 scan data including open ports and banners |
| 🔒 SSL certificate chains | crt.sh Search | Certificate Transparency logs for any domain |
| 💻 Website technology fingerprints | Website Tech Stack Detector | CMS, frameworks, CDN, hosting for any URL |
| 🌍 IP geolocation | IP Geolocation Lookup | Global IP-to-coordinate resolution for network topology |
| ⚠️ CVE vulnerabilities | NVD CVE Search | Full NVD database with CVSS scores |
| 🚨 Actively exploited vulnerabilities | CISA KEV Catalog | Known Exploited Vulnerabilities with remediation deadlines |
| 🌋 Seismic events | USGS Earthquake Search | Global earthquake catalog with magnitude and coordinates |
| 🌩️ Weather alerts | NOAA Weather Alerts | US National Weather Service active warnings |
| 🏚️ US disaster declarations | FEMA Disaster Search | Presidential disaster declarations by state |
| 🌊 Flood warnings | UK Flood Monitoring | England and Wales Environment Agency flood data |
| 🌏 Global disaster alerts | GDACS | UN-affiliated real-time global disaster notifications |
| 📌 Geocoding | Nominatim | OpenStreetMap geocoder — any city, state, or country |

Why use Critical Infrastructure Interdependency MCP Server?

Infrastructure resilience analysis has traditionally required specialized GIS software, proprietary vulnerability databases, and custom simulation code that takes weeks to build. Consulting firms charge $50,000–$200,000 for a single regional infrastructure assessment. Emergency management agencies run tabletop exercises that miss quantitative cascade dynamics entirely.

This MCP server automates the entire pipeline — from raw infrastructure discovery through cascade simulation to recovery timeline estimation — in a single AI agent conversation. An analyst can model the impact of a Category 4 hurricane on Texas's power grid in one tool call, identify the three substations whose failure would cascade to financial services, and estimate restoration time using the Critical Path Method, all without leaving their AI assistant.

- Scheduling — run weekly resilience snapshots to track how infrastructure changes affect algebraic connectivity over time
- API access — trigger assessments programmatically from Python, JavaScript, or any HTTP client integrating with Apify
- Proxy rotation — underlying data collection actors use Apify's built-in proxy infrastructure for reliable large-scale discovery
- Monitoring — get Slack or email alerts when resilience index drops below threshold after infrastructure changes
- Integrations — connect results to Zapier, Make, Google Sheets, or push structured findings directly into GRC platforms via webhooks

Features

- 6-layer multiplex hypergraph construction — builds an InfraNode/InfraEdge network across energy, telecom, water, cyber, transport, and financial sectors from real OSM POI data, DNS records, and geocoded coordinates
- Hardcoded sector dependency weights — inter-layer edges encode empirical coupling strengths: telecom-to-energy at 0.9, financial-to-cyber at 0.9, cyber-to-telecom at 0.95, water-to-energy at 0.85
- BTW sand-pile cascade simulation — implements the Bak-Tang-Wiesenfeld self-organized criticality model where each node topples when load z_i exceeds threshold z_c = 1.0, redistributing load to neighbors as z_neighbor += z_i / degree(i), tracking avalanche size distributions and power-law exponent
- SOC detection — measures criticality exponent and flags systems exhibiting self-organized critical behavior where small perturbations can trigger large-scale collapse
- Graph product cyber-physical coupling — constructs the tensor product of the cyber attack graph (AG) and physical dependency graph (PG) to identify exploit chains that cascade from CVE vulnerabilities into physical infrastructure damage
- Voronoi geographic co-location risk — tessellates the region into Voronoi cells, overlays earthquake/flood/weather/disaster hazard data, and computes per-cell risk as: sectors_present × hazard_probability × (1 − Shannon_entropy_diversity)
- CPM recovery timeline estimation — runs forward/backward pass on a dependency DAG respecting sector restoration order (energy → water → telecom → transport → cyber → financial) with default recovery hours (energy: 72h, water: 48h, telecom: 24h), producing critical path and zero-slack bottleneck nodes
- Supra-Laplacian algebraic connectivity — computes lambda_2 (Fiedler value) of the supra-Laplacian matrix across all 6 layers; classifies resilience as CRITICAL / LOW / MODERATE / HIGH / VERY_HIGH based on the Fiedler vector
- Multi-metric critical node identification — scores nodes by composite: cascade impact 40% + algebraic connectivity drop on removal 30% + degree centrality 30%
- Haversine distance calculations — uses exact spherical geometry for geographic proximity edges and impact zone determination (radius in km from region center)
- Parallel actor orchestration — runs up to 14 underlying actors concurrently via runActorsParallel, reducing total wall time from 20+ minutes to 3–5 minutes per tool call
- Spending limit enforcement — every tool call checks Actor.charge() event limit before running, halting cleanly if the per-run budget is reached
- Keyword-based sector classification — classifies OSM POI nodes into sectors using 60+ infrastructure keywords across 6 domains (e.g., "substation", "data center", "aqueduct", "clearing house")

Use cases for critical infrastructure interdependency analysis

Emergency management and disaster preparedness

State and federal emergency managers use model_natural_disaster_impact to simulate how an earthquake, flood, or hurricane would disable regional infrastructure before the event occurs. The tool combines real USGS seismic data and NOAA weather alerts with the OSM infrastructure network, runs BTW cascade simulation from directly impacted nodes, and estimates total restoration time via CPM — producing a structured briefing that quantifies percentage of network affected and identifies bottleneck restoration tasks.

Critical infrastructure protection and investment prioritization

Facility security officers and infrastructure investment analysts use identify_critical_nodes to rank every node in a region by its composite criticality score. Rather than protecting everything equally, the multi-metric scoring (cascade impact, algebraic connectivity drop, degree centrality) identifies the 5–10 nodes whose failure would most destabilize the entire cross-sector network — enabling targeted hardening investments.

Cyber-physical threat modeling for ICS/OT security

ICS security teams and APT red teams use assess_cyber_physical_attack to map how vulnerabilities in SCADA systems, ICS software, or internet-exposed control systems translate into physical infrastructure damage. The graph product attack surface model traces maximum-weight exploit chains from NVD CVEs and CISA KEV entries through Censys-discovered exposed hosts into physical dependency nodes, identifying the most exploitable cyber entry point and most vulnerable physical asset.

Infrastructure resilience auditing and regulatory compliance

Utilities, telecoms, and financial institutions subject to NERC CIP, TSA Pipeline Security directives, or DORA requirements use generate_resilience_assessment to produce a full quantitative resilience report. The assessment combines all 6 algorithms — hypergraph construction, cascade simulation, cyber-physical coupling, geographic co-location risk, CPM recovery estimation, and supra-Laplacian algebraic connectivity — into a single structured output with findings, recommendations, and a System Resilience Index.

Insurance underwriting and catastrophe risk modeling

Catastrophe risk modelers at insurance and reinsurance firms use compute_geographic_correlation to identify geographic areas where multiple infrastructure sectors cluster within the same hazard zone. The Voronoi tessellation with Shannon entropy diversity index surfaces co-location risks that traditional property cat models miss — a data center next to a substation in a FEMA flood zone has a fundamentally different risk profile than isolated assets.

Post-incident recovery planning

Incident commanders and infrastructure restoration teams use estimate_recovery_timeline after a failure event to determine the critical path back to full operation. The CPM forward/backward pass respects physical dependencies (you cannot restore financial systems before power and telecom are restored) and identifies zero-slack bottleneck nodes that will determine total restoration time if delayed.

How to use this MCP server for infrastructure analysis

1. Connect the server to your AI agent — add the MCP endpoint URL to your client configuration. For Claude Desktop, paste the JSON block from the "How to connect" section below into your claude_desktop_config.json. No API key required in the config — the server handles authentication.

2. Start with a region — in your agent conversation, ask it to call build_infrastructure_network with a city, state, or country name such as "Houston, Texas" or "Netherlands". Optionally provide known infrastructure domain names to enrich the cyber layer.

3. Run the analysis tools — ask your agent to call simulate_cascade_failure, compute_geographic_correlation, identify_critical_nodes, or model_natural_disaster_impact for the same region. Each tool builds the network fresh or accepts output from a prior build_infrastructure_network call.

4. Review structured results — each tool returns a JSON report with network statistics, ranked findings, sector breakdowns, and geographic coordinates. Ask your agent to summarize findings, generate a risk briefing, or export the structured data.

How to connect this MCP server

Claude Desktop

{
  "mcpServers": {
    "critical-infrastructure-interdependency": {
      "url": "https://critical-infrastructure-interdependency-mcp.apify.actor/mcp"
    }
  }
}

Cursor

{
  "mcpServers": {
    "critical-infrastructure-interdependency": {
      "url": "https://critical-infrastructure-interdependency-mcp.apify.actor/mcp"
    }
  }
}

Windsurf / Codeium

{
  "mcpServers": {
    "critical-infrastructure-interdependency": {
      "url": "https://critical-infrastructure-interdependency-mcp.apify.actor/mcp"
    }
  }
}

MCP tools reference

| Tool | Description | Typical cost |
|------|-------------|-------------|
| build_infrastructure_network | Build 6-layer multiplex hypergraph from OSM POI, DNS, tech stack, geocoding, and IP geolocation data. Returns supra-adjacency matrix and per-layer statistics. | $150–200 |
| simulate_cascade_failure | Run BTW sand-pile cascade simulation with configurable trigger nodes or sectors. Returns avalanche size distribution, criticality exponent, and SOC flag. | $150–250 |
| assess_cyber_physical_attack | Model cyber-to-physical attack surface via graph product of CVE/KEV/Censys attack graph and physical dependency graph. Returns exploit chains and most vulnerable assets. | $200–350 |
| compute_geographic_correlation | Voronoi tessellation with multi-hazard overlay (earthquake, flood, weather, disaster). Returns high-risk cells ranked by correlation risk score. | $150–300 |
| estimate_recovery_timeline | CPM forward/backward pass on dependency DAG. Returns total recovery hours, critical path nodes, sector restoration order, and zero-slack bottlenecks. | $150–200 |
| identify_critical_nodes | Rank nodes by composite score: cascade impact (40%) + algebraic connectivity drop (30%) + degree centrality (30%). Returns top-N with explanatory reasons. | $150–250 |
| model_natural_disaster_impact | Full pipeline: hazard data + infrastructure network + cascade simulation + CPM recovery for a specified disaster type and impact radius. | $200–400 |
| generate_resilience_assessment | Comprehensive audit running all 6 algorithms across all 14 data sources. Returns System Resilience Index, findings, and prioritized recommendations. | $300–400 |

Tool input parameters

| Tool | Parameter | Type | Required | Default | Description |
|------|-----------|------|----------|---------|-------------|
| All tools | region | string | Yes | — | City, state, or country name (e.g., "Houston, Texas") |
| build_infrastructure_network | domains | string[] | No | — | Infrastructure domain names for cyber layer enrichment |
| build_infrastructure_network | sectors | string[] | No | all 6 | Focus sectors: energy, telecom, water, cyber, transport, financial |
| build_infrastructure_network | radius_km | number | No | 100 | Search radius from region center in kilometers |
| simulate_cascade_failure | trigger_nodes | string[] | No | — | Specific node IDs to trigger (from build_infrastructure_network) |
| simulate_cascade_failure | trigger_sector | string | No | — | Trigger the 3 highest-criticality nodes in this sector |
| simulate_cascade_failure | max_cascade_steps | number | No | 50 | Maximum cascade propagation iterations |
| assess_cyber_physical_attack | domains | string[] | Yes | — | Target domains or IPs to scan for cyber attack surface |
| assess_cyber_physical_attack | cve_keywords | string | No | "SCADA ICS critical infrastructure" | CVE search keywords for vulnerability query |
| compute_geographic_correlation | include_earthquakes | boolean | No | true | Include USGS earthquake overlay |
| compute_geographic_correlation | include_weather | boolean | No | true | Include NOAA weather alert overlay |
| compute_geographic_correlation | include_floods | boolean | No | true | Include FEMA/UK Flood/GDACS overlay |
| compute_geographic_correlation | days_lookback | number | No | 30 | Days of historical hazard data to include |
| estimate_recovery_timeline | failed_node_ids | string[] | No | all nodes | Specific failed node IDs from cascade output |
| estimate_recovery_timeline | failed_sectors | string[] | No | — | Assume all nodes in these sectors have failed |
| estimate_recovery_timeline | scenario | string | No | — | Scenario description for context in output |
| identify_critical_nodes | top_n | number | No | 10 | Number of top critical nodes to return |
| model_natural_disaster_impact | disaster_type | string | No | "all" | earthquake, flood, hurricane, wildfire, or "all" |
| model_natural_disaster_impact | impact_radius_km | number | No | 100 | Radius of disaster impact zone in km |
| generate_resilience_assessment | domains | string[] | No | — | Infrastructure domains for cyber layer |
| generate_resilience_assessment | cve_keywords | string | No | "SCADA ICS critical infrastructure" | CVE search keywords |

Output example

The following is representative output from model_natural_disaster_impact for a major urban region:

{
  "region": "Houston, Texas",
  "disasterType": "earthquake",
  "impactZone": {
    "center": { "lat": 29.7604, "lon": -95.3698 },
    "radiusKm": 100,
    "directlyImpactedNodes": 34,
    "cascadeAdditionalNodes": 18,
    "totalAffectedNodes": 52,
    "totalNetworkNodes": 67,
    "percentageAffected": 78
  },
  "cascadeAnalysis": {
    "totalAvalanches": 12,
    "maxAvalancheSize": 19,
    "isSelfOrganizedCritical": true,
    "affectedSectors": ["energy", "water", "telecom", "transport", "financial"]
  },
  "recoveryEstimate": {
    "totalRecoveryHours": 218.4,
    "totalRecoveryDays": 9.1,
    "criticalPathLength": 8,
    "sectorRecoveryOrder": [
      { "sector": "energy",    "startHour": 0,   "endHour": 68.2 },
      { "sector": "water",     "startHour": 0,   "endHour": 51.7 },
      { "sector": "telecom",   "startHour": 68.2, "endHour": 89.5 },
      { "sector": "transport", "startHour": 68.2, "endHour": 97.1 },
      { "sector": "cyber",     "startHour": 89.5, "endHour": 101.8 },
      { "sector": "financial", "startHour": 101.8,"endHour": 110.3 }
    ],
    "bottleneckNodes": ["node-4", "node-11", "node-23"]
  },
  "geographicRisk": {
    "highRiskCells": 7,
    "maxCorrelationRisk": 3.84
  },
  "hazardData": {
    "earthquakes": 14,
    "weatherAlerts": 6,
    "femaDisasters": 9,
    "gdacsAlerts": 3,
    "floodWarnings": 5
  }
}

Representative output from identify_critical_nodes:

{
  "region": "Rotterdam, Netherlands",
  "networkSize": { "nodes": 71, "edges": 184 },
  "resilienceIndex": {
    "algebraicConnectivity": 0.12,
    "resilience": "LOW",
    "networkPartitionRisk": 0.73
  },
  "criticalNodes": [
    {
      "nodeId": "node-3",
      "nodeName": "Pernis Oil Refinery Power Substation",
      "sector": "energy",
      "criticalityScore": 0.891,
      "reasons": ["Triggers avalanche size 23 in BTW cascade", "Removal reduces lambda_2 by 0.047", "Degree centrality 0.31 across all layers"]
    },
    {
      "nodeId": "node-17",
      "nodeName": "Rotterdam Port Fiber Exchange",
      "sector": "telecom",
      "criticalityScore": 0.764,
      "reasons": ["Cascade impact to 4 sectors", "Inter-layer hub: telecom/cyber/financial", "Zero slack in CPM recovery path"]
    }
  ],
  "sectorBreakdown": [
    { "sector": "energy",    "criticalCount": 4, "avgCriticality": 0.781 },
    { "sector": "telecom",   "criticalCount": 3, "avgCriticality": 0.694 },
    { "sector": "water",     "criticalCount": 2, "avgCriticality": 0.612 },
    { "sector": "cyber",     "criticalCount": 1, "avgCriticality": 0.587 },
    { "sector": "transport", "criticalCount": 2, "avgCriticality": 0.541 },
    { "sector": "financial", "criticalCount": 1, "avgCriticality": 0.498 }
  ]
}

Output fields

| Field | Type | Description |
|-------|------|-------------|
| region | string | Input region name |
| network.totalNodes | number | Total infrastructure nodes across all 6 layers |
| network.totalEdges | number | Total intra-layer + inter-layer edges |
| network.interLayerEdges | number | Cross-sector dependency edges in supra-adjacency matrix |
| network.layers | object | Per-sector node count, edge count, and density |
| nodes[].id | string | Unique node identifier (e.g., "node-14") |
| nodes[].name | string | Infrastructure name from OSM or geocoder |
| nodes[].sector | string | Sector: energy / telecom / water / cyber / transport / financial |
| nodes[].criticality | number | Node criticality 0–1 from composite scoring |
| nodes[].lat | number | Latitude coordinate |
| nodes[].lon | number | Longitude coordinate |
| simulation.isSelfOrganizedCritical | boolean | True if avalanche sizes follow power law |
| simulation.criticalityExponent | number | Power-law exponent of avalanche size distribution |
| simulation.maxAvalancheSize | number | Largest cascade observed across all triggers |
| avalanches[].affectedSectors | string[] | Sectors reached by this cascade event |
| attackSurface.productGraphNodes | number | Nodes in cyber × physical product graph |
| attackSurface.attackSurfaceArea | number | Aggregate attack surface metric |
| criticalPaths[].exploitChain | string[] | Ordered CVE/host IDs forming the attack path |
| criticalPaths[].physicalCascade | string[] | Physical node IDs affected downstream |
| criticalPaths[].combinedRisk | number | Composite cyber + physical risk score |
| geoCorrelation.highRiskCells | number | Voronoi cells with correlation risk above threshold 1.0 |
| geoCorrelation.maxCorrelationRisk | number | Peak risk value across all cells |
| recovery.totalRecoveryHours | number | CPM-estimated total restoration time |
| recovery.criticalPath | string[] | Zero-slack node IDs determining total recovery time |
| recovery.bottleneckNodes | string[] | Nodes that extend total recovery if delayed |
| recovery.sectorRecoveryOrder | object[] | Start/end hours per sector in restoration sequence |
| resilienceIndex.algebraicConnectivity | number | Lambda_2 Fiedler value of supra-Laplacian |
| resilienceIndex.resilience | string | CRITICAL / LOW / MODERATE / HIGH / VERY_HIGH |
| resilienceIndex.networkPartitionRisk | number | Probability-like score of network splitting under stress |
| findings | string[] | Auto-generated warnings and recommendations from combined analysis |

How much does critical infrastructure analysis cost?

This MCP server uses pay-per-event pricing — you pay per tool call. Platform compute costs are included.

| Scenario | Tool | Cost per call | Typical monthly |
|----------|------|---------------|-----------------|
| Quick regional snapshot | identify_critical_nodes | ~$0.04 | $0.04 |
| Disaster impact simulation | model_natural_disaster_impact | ~$0.04 | $0.04 |
| Full resilience audit | generate_resilience_assessment | ~$0.04 | $0.04 |
| Weekly monitoring (1 region) | Any single tool × 4 | ~$0.04 | $0.16 |
| Multi-region program (10 regions) | generate_resilience_assessment × 10 | ~$0.04 | $0.40 |

Each tool call charges a single platform event. The underlying actors (OSM, USGS, NVD, etc.) consume Apify compute credits during data collection — the $0.04 event fee covers the MCP server's orchestration layer, while underlying actor runs draw from your platform credit balance.

You can set a maximum spending limit per run to control costs. The server stops cleanly when your budget is reached. The Apify Free plan includes $5 of monthly platform credits — enough for dozens of analysis tool calls at no cost.

Critical infrastructure analysis using the API

Python

from apify_client import ApifyClient
client = ApifyClient("YOUR_API_TOKEN")
run = client.actor("ryanclinton/critical-infrastructure-interdependency-mcp").call(run_input={})
print(f"MCP server running at: https://critical-infrastructure-interdependency-mcp.apify.actor/mcp")

print(f"Actor run ID: {run['id']}")

print(f"Status: {run['status']}")

JavaScript

import { ApifyClient } from "apify-client";
const client = new ApifyClient({ token: "YOUR_API_TOKEN" });
const run = await client.actor("ryanclinton/critical-infrastructure-interdependency-mcp").call({});
console.log(MCP server running at: https://critical-infrastructure-interdependency-mcp.apify.actor/mcp);

console.log(Actor run ID: ${run.id});

console.log(Status: ${run.status});

cURL

```bash