MCP Server

Active

MIT

cloud-audit MCP Server

io.github.gebalamariusz/cloud-audit

AWS security scanner that finds attack chains, IAM escalation paths, and prioritized fixes.

What is the cloud-audit MCP server?

The cloud-audit MCP server is an open-source AWS security scanner that detects attack chains, IAM privilege escalation routes, and data perimeter issues across 110 checks in 25 AWS services. It correlates individual findings into exploitable paths, ranks fixes by impact, and ships AWS CLI and Terraform remediation with every finding—all read-only, with no infrastructure or agents required.

cloud-audit scans your AWS account to identify security risks and attack paths. It goes beyond individual findings by correlating them into attack chains (MITRE ATT&CK-based), detecting IAM privilege escalation across 64 methods, and ranking fixes by how many chains they break. You get a remediation plan with copy-paste AWS CLI and Terraform code, compliance framework checks (CIS, SOC 2, ISO 27001, HIPAA, NIS2, BSI C5), and a what-if simulator to preview fix impact before applying changes.

How to install cloud-audit

Copy-paste configuration for popular MCP clients.

transport: stdio

Config generated by PluginBench — verify against the source before use.

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "cloud-audit": {
      "command": "uvx",
      "args": [
        "cloud-audit",
        "--from",
        "cloud-audit",
        "cloud-audit-mcp"
      ]
    }
  }
}

Tools & capabilities

Tools this server exposes to the agent.

scan_aws — Scan your AWS account and return security findings, attack chains, and remediation recommendations.
get_findings — Retrieve detailed security findings from the most recent scan.
get_attack_chains — Get detected attack chains that correlate individual findings into exploitable paths.
get_remediation — Fetch remediation steps and fixes (AWS CLI and Terraform) for specific findings.
get_health_score — Retrieve your AWS security posture health score.
list_checks — List all 110 available security checks across 25 AWS services.

Use cases

Identify IAM privilege escalation paths and lateral movement routes in your AWS account
Detect internet-exposed resources and attack chains that could lead to account takeover
Generate compliance reports against CIS AWS, SOC 2, ISO 27001, HIPAA, NIS2, and BSI C5 frameworks
Preview the impact of security fixes before applying them using the simulate feature
Export security findings to GitHub Code Scanning (SARIF) or HTML reports for stakeholder review

cloud-audit MCP server FAQ

What is cloud-audit?

cloud-audit is an open-source AWS security scanner that finds attack chains, IAM privilege escalation routes, and data perimeter issues. It correlates individual findings into exploitable paths, ranks fixes by impact, and provides AWS CLI and Terraform remediation for every finding.

Is cloud-audit free?

Yes, cloud-audit is free and open-source under the MIT license. Commercial support (audit reviews, remediation assistance, architecture review) is available separately.

How do I install cloud-audit as an MCP server?

Run: `claude mcp add cloud-audit -- uvx --from cloud-audit cloud-audit-mcp`. You can also install via pip (`pip install cloud-audit`) or Docker (`docker run ghcr.io/gebalamariusz/cloud-audit scan`).

What AWS permissions does cloud-audit need?

cloud-audit is read-only and requires only the AWS-managed `SecurityAudit` policy. It never modifies your infrastructure.

Does cloud-audit support compliance frameworks?

Yes. It supports CIS AWS v3.0, SOC 2 Type II (stable), and ISO 27001:2022, HIPAA, NIS2, and BSI C5:2020 (beta) via the `--compliance` flag.

Can I see the impact of a fix before applying it?

Yes. Use `cloud-audit simulate --fix <fix-id>` to preview how a fix changes your security score and how many attack chains it breaks, all without modifying your account.

README (reference)

Source of truth, from the repository.

<img src="assets/logo-nobg.png" alt="cloud-audit logo" width="200">  <h1 align="center">cloud-audit</h1> <a href="README.md">English</a> | <a href="README_zh-CN.md">简体中文</a> Find AWS attack paths, IAM escalation routes, and the fixes that matter most. Open-source, read-only AWS security scanner. It correlates findings into attack chains, ranks fixes by how many chains they break, and ships an AWS CLI + Terraform fix with every finding. No agent, no infrastructure, nothing written to your account. <a href="https://pypi.org/project/cloud-audit/"><img src="https://img.shields.io/pypi/v/cloud-audit?style=flat" alt="PyPI version"></a> <a href="https://pypi.org/project/cloud-audit/"><img src="https://img.shields.io/pypi/pyversions/cloud-audit?style=flat" alt="Python versions"></a> <a href="https://github.com/gebalamariusz/cloud-audit/actions/workflows/ci.yml"><img src="https://github.com/gebalamariusz/cloud-audit/actions/workflows/ci.yml/badge.svg" alt="CI"></a> <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-yellow?style=flat" alt="License: MIT"></a> <a href="https://ghcr.io/gebalamariusz/cloud-audit"><img src="https://img.shields.io/badge/Docker-GHCR-blue?style=flat&logo=docker" alt="Docker"></a> <a href="https://haitmg.pl/cloud-audit/"><img src="https://img.shields.io/badge/Docs-haitmg.pl-blue?style=flat" alt="Documentation"></a> <a href="#quick-start">Quick Start</a> - <a href="#what-you-get">What You Get</a> - <a href="#installation">Installation</a> - <a href="#whats-checked">What's Checked</a> - <a href="https://haitmg.pl/cloud-audit/">Documentation</a>

Quick Start

pip install cloud-audit
cloud-audit scan          # uses your default AWS credentials and region

No AWS account handy? Run a full sample report offline:

cloud-audit demo

cloud-audit is read-only. It never modifies your infrastructure; SecurityAudit is enough (permissions).

Example Output

+---- Attack Chains (5 detected) -----------------------------------+
|  CRITICAL  Internet-Exposed Admin Instance                        |
|            i-0abc123 - public SG + admin IAM role + IMDSv1        |
|  CRITICAL  IAM Privilege Escalation via iam:PassRole              |
|            ci-deploy-role - 3-step path to admin                  |
|  CRITICAL  CI/CD to Admin Takeover                                |
|            github-deploy - OIDC without sub + admin policy        |
+-------------------------------------------------------------------+

+---- Remediation Plan ---------------------------------------------+
|  Fix 4 root causes, break 22 attack chains                        |
|  Quick wins (effort LOW, 14 chains):                              |
|    1. Restrict SG ingress on sg-0abc123   -> breaks 8 chains      |
|    2. Add OIDC sub condition              -> breaks 6 chains      |
+-------------------------------------------------------------------+

Preview a fix before you touch anything:

cloud-audit simulate --fix aws-vpc-002
# Score 34 -> 58 (+24)  |  Chains broken 8 of 22  |  Findings resolved 11

What You Get

Attack chains // 31 rules correlate individual findings into exploitable paths (MITRE ATT&CK + pathfinding.cloud). docs
Root-cause fixes // groups findings by shared cause and ranks them: "fix 4 things, break 22 chains," with a what-if simulate to preview impact. docs
IAM privilege escalation // 64 methods across 9 categories, including lateral movement through the AssumeRole graph. docs
Blast radius // walk outward from any resource to see what an attacker reaches; export JSON to the live visualizer. docs
Proof Mode // scan --verify checks each escalation path against the IAM policy simulator (read-only) and flags the ones the principal can actually perform. docs
Data perimeter // resource-policy checks for confused-deputy and cross-org exposure, evaluating condition values (not just their presence). docs
AgentCore security // checks for Amazon Bedrock AgentCore AI agents: network mode, MMDSv2, memory encryption, gateway authorizer. docs
Threat Feed // 10 detectors for active-abuse patterns from 2025-2026 incidents, each with a primary-source citation. docs
Remediation on every finding // copy-paste AWS CLI + reviewable Terraform you apply yourself; security findings also carry a USD breach-cost estimate with sources.
Trend & drift // cloud-audit diff catches ClickOps drift between scans; cloud-audit trend tracks posture over time.

<a href="https://blast-audit.haitmg.pl/"> <img src="assets/blast-audit-boardroom.png" alt="blast-audit visualizer - executive briefing view" width="760"> </a> Drop a <code>cloud-audit blast-radius --format json</code> export into the open visualizer at <a href="https://blast-audit.haitmg.pl/">blast-audit.haitmg.pl</a> - everything runs in your browser.

Reports

cloud-audit scan --format html  -o report.html    # client-ready
cloud-audit scan --format sarif -o results.sarif  # GitHub Code Scanning
cloud-audit scan --format json  -o report.json    # machine-readable
cloud-audit scan --format markdown -o report.md   # PR comments

CI/CD

- run: pip install cloud-audit
- run: cloud-audit scan --format sarif --output results.sarif
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif

--quiet exits with a code only: 0 clean, 1 findings, 2 error. Gate on severity with --min-severity high. Ready-made workflows: basic scan, daily diff, post-deploy.

Installation

pip install cloud-audit                              # pip (recommended)
pipx install cloud-audit                             # isolated
docker run ghcr.io/gebalamariusz/cloud-audit scan   # Docker

Docker with credentials:

docker run -v ~/.aws:/home/cloudaudit/.aws:ro ghcr.io/gebalamariusz/cloud-audit scan

AWS Permissions

Read-only. Attach the AWS-managed SecurityAudit policy (covers every check, including IAM escalation analysis):

aws iam attach-role-policy --role-name auditor \
  --policy-arn arn:aws:iam::aws:policy/SecurityAudit

cloud-audit never modifies your infrastructure. simulate runs locally against scan data and makes no AWS calls.

What's Checked

110 checks across 25 AWS services - IAM, S3, EC2, VPC, RDS, KMS, CloudTrail, GuardDuty, Lambda, Secrets Manager, Bedrock, SageMaker, Bedrock AgentCore, DynamoDB, and more. Run cloud-audit list-checks, or see the full check reference.

6 compliance frameworks via scan --compliance <id>: CIS AWS v3.0 and SOC 2 Type II (stable), plus ISO 27001:2022, HIPAA, NIS2, and BSI C5:2020 (beta). docs

MCP server for AI agents - 6 read-only tools (scan_aws, get_findings, get_attack_chains, get_remediation, get_health_score, list_checks):

claude mcp add cloud-audit -- uvx --from cloud-audit cloud-audit-mcp

<details> <summary>Common flags and configuration</summary>

cloud-audit scan -R                                      # show remediation inline
cloud-audit scan --profile prod --regions eu-central-1   # profile / region
cloud-audit scan --regions all                           # all enabled regions
cloud-audit scan --role-arn arn:aws:iam::...:role/audit  # cross-account
cloud-audit scan --export-fixes fixes.sh                 # export all fixes

Configure defaults in .cloud-audit.yml (regions, min_severity, exclude_checks, time-boxed suppressions). Environment variables (CLOUD_AUDIT_REGIONS, CLOUD_AUDIT_MIN_SEVERITY, ...) override the file; CLI flags override everything. See the configuration guide.

</details>

Documentation

Full documentation at haitmg.pl/cloud-audit: getting started, attack chains, IAM escalation, blast radius, Proof Mode, data perimeter, AgentCore, compliance, and the full check reference.

Commercial Support

cloud-audit is free and stays free. If you want a human on the findings, the author offers professional services:

Scanner output review (free) - send your cloud-audit / Prowler / Security Hub output, get a short written review of what actually matters and what to fix first
AWS security audit - full account audit with a prioritized report and ready-to-apply fixes
Remediation support - Terraform and IAM changes, verified against your workloads
Palo Alto VM-Series on AWS - architecture and security review (GWLB/TGW, HA, routing)

Details: haitmg.pl/cloud-audit-support or email kontakt@haitmg.pl.

Development

git clone https://github.com/gebalamariusz/cloud-audit.git
cd cloud-audit
pip install -e ".[dev]"
pytest -q && ruff check src/ tests/ && mypy src/

See CONTRIBUTING.md to add a check. Past releases in CHANGELOG.md.

License

MIT - Mariusz Gebala / HAIT

Related MCP servers

Data Studio

Active

Unified MCP server for SQL and NoSQL databases, powered by dockit and sqlkit desktop apps

Rust

Apache-2.0

View repository →

io.github.geekmarine/mcp-defi-router

Active

Autonomous DeFi router for multi-hop execution, MEV risk mitigation, and transaction calldata.

TypeScript

View repository →

io.github.geekmarine/mcp-domain-auditor

DNS resolution, HTTP security headers, and SPF/DMARC email hygiene audits.

View repository →

io.github.geekmarine/mcp-email-auditor

Active

Validates domain email MX records and DNS status via Cloudflare DNS-over-HTTPS.

TypeScript

View repository →

io.github.geekmarine/mcp-ip-geolocation

Resolves IP autonomous system numbers (ASN) and geographic coordinates.

View repository →

io.github.geekmarine/mcp-ssl-inspector

Active

Audits TLS/SSL handshake latency, HSTS headers, and HTTPS availability on the edge.

TypeScript

View repository →