Open-source read-only AWS security scanner detecting attack chains with remediation via CLI and Terraform.
Quick Install
Automated & IDE SetupCopy the AI prompt to install this server into Claude Code, Cursor, or another agent โ or use 1-click editor setup below.
Not yet automatically verified
We haven't yet run this listing's install command through our automated sandbox check. This isn't a red flag โ we're steadily working through the catalog.
Manual Client & Custom JSON ConfigExpand JSON โพ
Client Config & Setup
Choose your client or environment
Target File:
๐ก Paste the JSON block into your client's configuration file under mcpServers, then restart the application.
Overview
Use cases
Detect AWS attack paths and privilege escalation routes
Estimate breach costs and prioritize fixes
Generate remediation plans with CLI and Terraform code
Visualize blast radius of compromised resources
Track security posture trends and configuration drift
Key features
47 security checks and 16 attack chain detection rules
IAM privilege escalation analysis across 64 methods
Proof mode verifying escalation paths with IAM policy simulator
Data perimeter checks for resource-policy exposures
Threat feed with active-abuse pattern detectors
Exportable reports in HTML, SARIF, and JSON formats
Capabilities & Tool Schemas
Inspect callable tools, capabilities, and parameters exposed to AI agents by Cloud Audit.
Extracted Tool Capabilities
47 security checks and 16 attack chain detection rules
IAM privilege escalation analysis across 64 methods
Proof mode verifying escalation paths with IAM policy simulator
Data perimeter checks for resource-policy exposures
Threat feed with active-abuse pattern detectors
Exportable reports in HTML, SARIF, and JSON formats
Documentation Overview
cloud-audit
What can a hijacked AI agent reach in your AWS account, and can you prove it?
Open-source, read-only AWS security scanner. 110 checks, 64 IAM privilege-escalation methods, 31 attack-chain
rules, blast radius for any resource, and agent-blast for Bedrock Agents and AgentCore:
what a prompt-injected or credential-stolen agent can reach, with the IAM policy simulator as the witness.
Every finding ships an AWS CLI + Terraform fix. Nothing is written to your account.
30-second demo - agent-blast - Full scan - What's inside - Proof Mode - Installation - Documentation
Thirty seconds, no AWS account needed
The sample account is invented. Everything derived from it (attack chains, root causes, breach cost, security graph, agent reach) is produced by the same engines a real scan uses.
With credentials, the real thing is one command and read-only. The AWS-managed SecurityAudit
policy covers every check (permissions):
agent-blast: what a hijacked AI agent can reach
An AI agent in AWS is a bundle of IAM identities: the role the agent runs as, the execution roles of
the Lambda functions behind its tools, the roles of its knowledge bases, gateways and sandboxes.
When the agent is hijacked, the attacker acts with those identities. agent-blast answers what
that means, per agent, under two threat models:
| Threat model | What the attacker has | What is in reach |
|---|---|---|
| Identity takeover | the credentials of a role the agent runs as (sandbox escape, metadata-service read, leaked session) | the full role: privilege-escalation methods, AssumeRole hops, data |
| Behaviour takeover | nothing but a prompt (indirect prompt injection through a document, a ticket, a web page) | what the agent's tools can do, bounded by the tools' own execution roles |
Real output for the sample agent (cloud-audit agent-blast --demo -a support-bot):
The story the output tells: the support bot itself is harmless, but a document that tricks it into
calling create-ticket runs code under a role that can pass an admin role to a new Lambda. The
search-docs tool, meant to read product docs, can also read the production database secret and
write into the backups bucket. Every line names the identity, the action and the resource, so the
fix is a policy statement, not a debate.
The same engine covers AgentCore. For the sample gateway (--demo -a tools-gw) the headline is a
cross-agent one:
What agent-blast reads (all list/get, no charge):
- Bedrock Agents: the agent resource role, every action group at the
DRAFTversion resolved to its Lambda and the Lambda's execution role, knowledge bases resolved to their S3 data-source buckets. - AgentCore: runtime role and network mode, gateway role with authorizer, policy engine and every target (Lambda, remote MCP server, API Gateway, OpenAPI, Smithy) with its credential provider, code interpreter and browser execution roles.
- IAM policies of exactly those identities (inline, attached, group), kept raw: action, resource,
effect, whether a
Conditionis present. Conditions are flagged, never guessed. The simulator decides.
Then, per identity: the 64 privilege-escalation methods, AssumeRole hops through the trust graph,
and every data, secret, lateral, code-execution and model-invocation grant matched against concrete
resources. A knowledge-base bucket is always a concrete target, even behind s3:* on *, and
write access to it is reported as RAG poisoning. Anything the scanner could not read (a denied
region, a tool without an IAM identity) is a coverage note, never a silent pass.
--verify asks iam:SimulatePrincipalPolicy about every concrete pair, with the context an attacker
really has (no MFA on the session, TLS transport), and marks each reach PROVEN, DENIED (with the
policy layer that denied: SCP, permissions boundary) or not asserted. Output formats: tree,
json, markdown. The MCP server exposes the same report as get_agent_blast.
A full scan
cloud-audit scan runs 110 read-only checks across 25 AWS services, correlates the findings into
attack chains, ranks the fixes by how many chains they break and prices the exposure. This is the
sample account (cloud-audit demo), rendered by the same code as a real scan and trimmed for length:
Related MCP Servers
Adoption & maintenance
Factual signals from GitHub, npm, and our automated checks โ not a rating.
GitHub stars
72
Stargazers on the source repository.
Last commit
4d ago
Most recent push to the default branch.
Directory activity
1 views
Config copies, upvotes, and views on AllMCPs.
Reviews
No reviews yet โ be the first to share how this listing worked for you.
Frequently Asked Questions about Cloud Audit
AllMCPs Directory Badge
Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.
Badge Style:
Live Dynamic SVG Preview
Markdown (GitHub README)
[](https://allmcps.com/mcp/gebalamariusz-cloud-audit)HTML Embed
<a href="https://allmcps.com/mcp/gebalamariusz-cloud-audit"><img src="https://allmcps.com/api/badge/gebalamariusz-cloud-audit?style=directory" alt="Cloud Audit on AllMCPs" /></a>Technical Specs & Signals
CategorySecurity
11/11 checks healthy over the last 34d
52Quality signal: Good ยท 52/100How this signal is calculated โพ
Server availabilityNot measured
Not scored for repo-hosted servers โ we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.
Verified ownership10/20
Documentation & tools22/30
Adoption & activity7/15
Community engagement0/10
A guidance signal from public completeness & health data โ not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.
Supply-chain signal
No high-severity advisories surfaced by our automated scan.
Critical 0High 0Medium 0Low 0
Scanned 28d ago via OSV.dev ยท --from (PyPI)
Own this project?
This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge โ proof is checked automatically, then reviewed by our team.
Free dofollow backlink: add your website and place the AllMCPs badge on it โ no claim needed. We detect it automatically and keep it verified as long as the badge stays live.
Claim & get free dofollowShare & Embed
Add our SVG badge (dark/light directory styles) or embeddable widget to your site.