# gebalamariusz/cloud-audit [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/gebalamariusz/cloud-audit  
**GitHub Stars:** 74  
**Views:** 3  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/gebalamariusz-cloud-audit

## Description
Open-source AWS security scanner with attack chain detection, breach cost estimation, and copy-paste remediation (CLI + Terraform). 47 checks, 16 attack chain rules. First free standalone AWS security MCP server.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "cloud-audit": {
    "command": "uvx",
    "args": ["--from","cloud-audit","cloud-audit"]
  }
}
```

## Documentation

## What gebalamariusz/cloud-audit MCP server does

The gebalamariusz/cloud-audit MCP server provides read-only AWS security analysis for account resources and identities. The repository describes 110 checks, 64 IAM privilege-escalation methods, and 31 attack-chain rules. Findings include the affected identity, action, resource, risk context, and remediation examples in AWS CLI and Terraform form.

Its scope includes ordinary AWS security findings as well as analysis of AI-agent infrastructure. For Bedrock Agents, it examines the resource role, action-group Lambdas and their execution roles, knowledge bases, and related S3 data sources. For AgentCore, it examines runtime and gateway roles, authorizers, policy engines, targets, credential providers, code interpreter roles, and browser execution roles where those resources are available.

## How it works

The scanner reads AWS configuration and IAM policy data using list and get operations. It keeps policy actions, resources, effects, and the presence of conditions for analysis rather than assuming that a condition grants or denies access. It then follows trust relationships, checks privilege-escalation methods, and matches data, secret, lateral-movement, code-execution, and model-invocation permissions against concrete resources.

The `agent-blast` capability models two situations: identity takeover, where an attacker has the agent role's credentials, and behaviour takeover, where prompt injection causes the agent's tools to act under their execution roles. It reports reachable action-resource pairs, escalation paths, and cross-component exposure. The analysis can use the IAM policy simulator with `--verify` to provide evidence for escalation paths.

## Setup and configuration

Install the command-line package with:

```bash
pip install cloud-audit
```

A demo mode works without an AWS account and can save a sample report for offline exploration. With AWS credentials, `cloud-audit scan` runs a default-profile, default-region scan. The documented examples also include `cloud-audit scan --verify` and `cloud-audit agent-blast --verify` for simulator-backed analysis.

The AWS-managed `SecurityAudit` policy is identified as covering every documented check.

## Tools and capabilities

- Run full read-only AWS scans.
- Analyze Bedrock Agent and AgentCore exposure with `agent-blast`.
- Calculate blast radius for a resource or identity.
- Simulate a reported finding using its identifier.
- Review exposure from a saved report.
- Generate AWS CLI and Terraform remediation examples.
- Explore reports offline from demo or saved scan data.

## Limitations and notes

The gebalamariusz/cloud-audit MCP server does not write changes to the AWS account during scanning. Its agent reach results are an upper bound based on the tools' roles; the tool implementation may use fewer permissions for particular inputs.

IAM policy simulation evaluates identity policies, permissions boundaries, and SCPs. Conditions are flagged rather than guessed, and some remote MCP targets may have an unknown backend identity and therefore remain unassessed.

The focus of gebalamariusz/cloud-audit MCP server is therefore best understood from the documented AWS audit and agent-reach capabilities rather than assumed client features.

_Full upstream README: https://allmcps.com/mcp/gebalamariusz-cloud-audit/readme_