AWS MCP Audit Server

This MCP server inventories an AWS environment, runs deterministic security and operations checks, and generates actionable reports along with a cost and usage snapshot for contractor audits. It provides a read‑only assessment workflow you can run locally or via an MCP client to produce structured artifacts for review.

How to use

You run the MCP server through your MCP client, which will start the read‑only AWS assessment workflow. Start by syncing your MCP environment, then launch the Python module that implements the server. The process produces artifacts you can review locally and share with stakeholders.

How to install

Prerequisites you need before installing and running:
- Python or an environment that can execute the server module
- An MCP client that can run stdio MCP servers (e.g., uvx)
- Access permissions to the AWS account you are auditing (read-only preferred)

Configuration and usage notes

To run the server locally via a standard MCP client, you will use two runtime configurations. The first starts the MCP client’s synchronization phase. The second runs the server module to perform the AWS audit and produce reports.

Tools and outputs

The server exposes the following tools and actions as part of the audit workflow:

• aws_whoami(auth?)
• collect_snapshot(scope, auth?) -> snapshot_id
• run_checks(snapshot_id) -> finding_set_id
• cost_signals(snapshot_id)
• cost_explorer_summary(days=30, auth?) (optional permissions)
• generate_report(snapshot_id, finding_set_id, format="md|pdf")

Artifacts you will receive

Artifacts are stored locally under ./data/snapshots/<snapshot_id>/ and include:

• snapshot.json
• findings.json
• cost.json (tier-1 signals)
• cost_explorer.json (if enabled)
• report.md / report.pdf

Security and access considerations

Operate with read-only AWS access when possible. Use role-based access control and, if needed, assume a restricted role with an ExternalId for contractor audits. Keep all credentials and tokens secure and rotate them per your organizational policy.

Available tools

aws_whoami

Identifies the AWS identity context and account being audited.

collect_snapshot

Creates a snapshot of the current AWS environment for a defined scope and returns snapshot_id.

run_checks

Runs deterministic security/ops checks against the collected snapshot and returns finding_set_id.

cost_signals

Generates tier-1 cost and usage signals for the snapshot.

cost_explorer_summary

Summarizes cost data over a specified window using Cost Explorer data (requires appropriate permissions).

generate_report

Produces a formatted report (markdown or PDF) from snapshot, findings, and cost data.