add mitigation dir to express server