Log inSubmit server
Cloud Audit logo

Cloud Audit

by gebalamariusz

Read-only AWS security scanning with agent reach analysis, attack-chain detection, IAM simulation, and remediation output.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Cloud Audit

Pick your client, then add it in one click or paste the config.

STDIOPython
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "gebalamariusz-cloud-audit": {
      "command": "uvx",
      "args": [
        "--from",
        "cloud-audit",
        "cloud-audit"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

uvx --from cloud-audit cloud-audit

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 1mo ago.

Overview

The gebalamariusz/cloud-audit MCP server connects security analysis to AWS account data through a read-only scanner. It evaluates IAM identities, Bedrock Agents, AgentCore components, permissions, privilege-escalation paths, attack chains, and resource reach, with optional IAM policy-simulator verification. Reach for it when you need to assess what compromised agents or AWS identities could access without changing the account.

Use cases

  • Scan AWS accounts for security findings
  • Assess what a hijacked Bedrock Agent can reach
  • Trace IAM privilege-escalation and attack-chain paths
  • Review a resource's blast radius from a saved report
  • Generate AWS CLI and Terraform remediation steps

Key features

  • Read-only AWS security scanning
  • Bedrock Agent and AgentCore reach analysis
  • IAM privilege-escalation detection
  • Attack-chain and blast-radius analysis
  • IAM policy-simulator verification
  • AWS CLI and Terraform remediation output

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

26/26 checks healthy over the last 91d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 4d ago via OSV.dev · cloud-audit (PyPI)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars74Stargazers on the source repository.
Last commit25d agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.
Directory activity3 viewsConfig copies, upvotes, and views on AllMCPs.

How Cloud Audit works

What gebalamariusz/cloud-audit MCP server does

The gebalamariusz/cloud-audit MCP server provides read-only AWS security analysis for account resources and identities. The repository describes 110 checks, 64 IAM privilege-escalation methods, and 31 attack-chain rules. Findings include the affected identity, action, resource, risk context, and remediation examples in AWS CLI and Terraform form.

Its scope includes ordinary AWS security findings as well as analysis of AI-agent infrastructure. For Bedrock Agents, it examines the resource role, action-group Lambdas and their execution roles, knowledge bases, and related S3 data sources. For AgentCore, it examines runtime and gateway roles, authorizers, policy engines, targets, credential providers, code interpreter roles, and browser execution roles where those resources are available.

How it works

The scanner reads AWS configuration and IAM policy data using list and get operations. It keeps policy actions, resources, effects, and the presence of conditions for analysis rather than assuming that a condition grants or denies access. It then follows trust relationships, checks privilege-escalation methods, and matches data, secret, lateral-movement, code-execution, and model-invocation permissions against concrete resources.

The agent-blast capability models two situations: identity takeover, where an attacker has the agent role's credentials, and behaviour takeover, where prompt injection causes the agent's tools to act under their execution roles. It reports reachable action-resource pairs, escalation paths, and cross-component exposure. The analysis can use the IAM policy simulator with --verify to provide evidence for escalation paths.

Setup and configuration

Install the command-line package with:

Terminal
pip install cloud-audit

A demo mode works without an AWS account and can save a sample report for offline exploration. With AWS credentials, cloud-audit scan runs a default-profile, default-region scan. The documented examples also include cloud-audit scan --verify and cloud-audit agent-blast --verify for simulator-backed analysis.

The AWS-managed SecurityAudit policy is identified as covering every documented check.

Tools and capabilities

  • Run full read-only AWS scans.
  • Analyze Bedrock Agent and AgentCore exposure with agent-blast.
  • Calculate blast radius for a resource or identity.
  • Simulate a reported finding using its identifier.
  • Review exposure from a saved report.
  • Generate AWS CLI and Terraform remediation examples.
  • Explore reports offline from demo or saved scan data.

Limitations and notes

The gebalamariusz/cloud-audit MCP server does not write changes to the AWS account during scanning. Its agent reach results are an upper bound based on the tools' roles; the tool implementation may use fewer permissions for particular inputs.

IAM policy simulation evaluates identity policies, permissions boundaries, and SCPs. Conditions are flagged rather than guessed, and some remote MCP targets may have an unknown backend identity and therefore remain unassessed.

The focus of gebalamariusz/cloud-audit MCP server is therefore best understood from the documented AWS audit and agent-reach capabilities rather than assumed client features.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Cloud Audit

gebalamariusz/cloud-audit is an MCP server that connects to AWS account security data and analyzes IAM permissions, Bedrock Agents, and AgentCore resources. Its main tools and commands include read-only scanning, agent-blast reach analysis, blast-radius review, exposure reporting, and simulator-backed verification with remediation output.

Install it with `pip install cloud-audit`.

The AWS-managed `SecurityAudit` policy is documented as covering every check. Scanning is read-only and uses list/get operations; the material does not provide a complete custom policy or environment-variable configuration.

It does not name Cursor or document an MCP transport, server command, or client-specific setup, so compatibility cannot be established from the available documentation.

With `--verify`, it evaluates identity policies, attached permissions boundaries, and SCPs for escalation paths. It does not evaluate target resource-based policies, RCPs, or VPC endpoint policies, so the resulting reach assessment is not a complete authorization decision.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewCloud Audit AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/gebalamariusz-cloud-audit?style=directory)](https://allmcps.com/mcp/gebalamariusz-cloud-audit)
HTML Embed
<a href="https://allmcps.com/mcp/gebalamariusz-cloud-audit"><img src="https://allmcps.com/api/badge/gebalamariusz-cloud-audit?style=directory" alt="Cloud Audit on AllMCPs" /></a>