Agenten stärken
Installation vom Herausgeber. Kein PlugMCP-Endpunkt.
Host a copy with our keys and logs.
Noch kein paketiertes Release in der Registry. Folgen Sie der README des Repositorys.
Remote-URL oder ein Befehl auf Ihrem Rechner? Worin sich die beiden Installationen unterscheiden
Auf PlugMCP ausführen
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
StartenVom Herausgeber
A Model Context Protocol (MCP) server that enables AI assistants to perform comprehensive AWS security analysis through natural language queries.
A Model Context Protocol server that connects AI assistants like Claude to AWS security services, allowing them to autonomously query, inspect, and analyze AWS infrastructure for security issues and misconfigurations.
AWS Security MCP bridges AI assistants like Claude with AWS security services, enabling real-time infrastructure analysis through conversational queries. The system automatically discovers and analyzes resources across multiple AWS accounts, providing security insights without requiring deep AWS CLI knowledge.
MCP Server's AWS credentials must have the following permissions:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "CrossAccountAccess",
"Effect": "Allow",
"Action": [
"sts:AssumeRole"
],
"Resource": "arn:aws:iam::*:role/aws-security-mcp-cross-account-access"
},
{
"Sid": "OrganizationDiscovery",
"Effect": "Allow",
"Action": [
"organizations:ListAccounts"
],
"Resource": "*"
}
]
}
For advanced log analysis capabilities, additional permissions are required:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AthenaQueryExecution",
"Effect": "Allow",
"Action": [
"athena:BatchGetQueryExecution",
"athena:GetQueryExecution",
"athena:GetQueryResults",
"athena:GetWorkGroup",
"athena:GetTableMetadata",
"athena:ListQueryExecutions",
"athena:StartQueryExecution",
"athena:GetQueryResultsStream",
"athena:GetDataCatalog",
"athena:ListDataCatalogs",
"athena:ListDatabases",
"athena:ListTableMetadata"
],
"Resource": "*"
},
{
"Sid": "GlueCatalogAccess",
"Effect": "Allow",
"Action": [
"glue:GetDatabase",
"glue:GetDatabases",
"glue:GetTable",
"glue:GetTables",
"glue:GetPartition",
"glue:GetPartitions",
"glue:BatchGetPartition"
],
"Resource": "*"
},
{
"Sid": "S3LogDataAccess",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::your-cloudtrail-bucket/*",
"arn:aws:s3:::your-cloudtrail-bucket",
"arn:aws:s3:::your-vpc-flow-logs-bucket/*",
"arn:aws:s3:::your-vpc-flow-logs-bucket",
"arn:aws:s3:::your-security-logs-bucket/*",
"arn:aws:s3:::your-security-logs-bucket"
]
},
{
"Sid": "AthenaResultsAccess",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::your-athena-results-bucket/*",
"arn:aws:s3:::your-athena-results-bucket"
]
}
]
}
SecurityAudit Policy (Required)
Attach the AWS managed SecurityAudit policy to your MCP Server's IAM user or IAM role:
Policy ARN: arn:aws:iam::aws:policy/SecurityAudit
This policy provides comprehensive read-only access to AWS security services and is essential for AWS Security MCP functionality. It includes permissions for:
Optional Managed Policies
arn:aws:iam::aws:policy/AmazonAthenaFullAccess (for simplified Athena log analysis)aws:
region: "us-east-1"
profile: {profileName}
.
.
.
$ aws configure sso
SSO Session Name - [email protected]
URL - https://yourDomain.awsapps.com/start/#
Region - us-east-1
export AWS_ACCESS_KEY_ID=
export export AWS_SECRET_ACCESS_KEY=
export export AWS_SESSION_TOKEN=
Run the following commands
git clone https://github.com/groovyBugify/aws-security-mcp.git
uv venv
source .venv/bin/activate
uv pip install -r requirements.txt
Configure MCP Client
# Install mcp-proxy
uv tool install mcp-proxy
# Check location of mcp-proxy
which mcp-proxy
# Add to Claude Desktop config
{
"mcpServers": {
"aws-security": {
"command": "/path/to/mcp-proxy",
"args": ["http://localhost:8000/sse"]
}
}
}
$ aws ecr get-login-password --region {region} | docker login --username AWS --password-stdin {accountID}.dkr.ecr.{region}.amazonaws.com
$ aws ecr create-repository --repository-name aws-security-mcp --region {region}
$ cd aws-security-mcp/
$ docker buildx build --platform linux/amd64 -t aws-security-mcp .
$ docker tag aws-security-mcp:latest {accountID}.dkr.ecr.{region}.amazonaws.com/aws-security-mcp:latest
$ docker push {accountID}.dkr.ecr.{region}.amazonaws.com/aws-security-mcp:latest
Deploying as AWS ECS Service
Configure MCP Client
# Install mcp-proxy
uv tool install mcp-proxy
# Check location of mcp-proxy
which mcp-proxy
# Add to Claude Desktop config
{
"mcpServers": {
"aws-security": {
"command": "/path/to/mcp-proxy",
"args": ["http://{alb}/sse"]
}
}
}
Edit config.yaml in the project root according to your needs:
aws:
region: "us-east-1"
profile: null
server:
log_level: "info"
startup_quiet: false
tool_quiet: false
cross_account:
role_name: "aws-security-mcp-cross-account-access"
auto_setup_on_startup: true
max_concurrent_assumptions: 5
Environment variables take precedence over YAML configuration:
export MCP_LOG_LEVEL=debug
export MCP_STARTUP_QUIET=false
export AWS_DEFAULT_REGION=eu-west-1
Query: "Can you share a list of running ec2 instances?"
Query: "Share all the secrets stored on env variables of Lambda functions, and share a list of functions for remediating this issue."
Query: "Check my 'prod-ecs-cluster' and share more details about the 'user-login' service, is it deployed?"
Query: "Show all GuardDuty findings from the last 7 days, and priortise based on the risk of exposure."
Query: "Analyze IAM roles with administrative privileges"
Query: "Generate blast radius analysis for IP 172.16.1.10"
Query: "Fetch more details about the ip - 172.22.141.11, and share a network map for this resource.
Query: "List all connected AWS accounts"
Query: "Refresh my AWS session"
Query: "Find resources tagged Team:Security across all accounts"
Query: "Show compliance status across organization"
AWS Security MCP implements a hub-and-spoke model for multi-account access:
organizations:ListAccounts to identify target accountsaws-security-mcp-cross-account-access role in each accountCreate this role in each target AWS account:
Role Name: aws-security-mcp-cross-account-access
Trust Policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::YOUR-MASTER-ACCOUNT-ID:root"
},
"Action": "sts:AssumeRole"
}
]
}
Permissions: Attach AWS managed policy arn:aws:iam::aws:policy/SecurityAudit
AWS Security MCP integrates with Amazon Athena to provide advanced log analysis capabilities. This feature requires pre-existing Athena tables containing your security-relevant logs.
While the MCP server can analyze any log source through Athena, the following sources are recommended to provide comprehensive security metadata to your MCP client. For optimal security coverage, we recommend implementing at least CloudTrail and VPC Flow Logs:
Recommended Log Sources:
Flexibility for Custom Log Sources
The MCP server supports querying any log type stored in S3, giving you complete flexibility to analyze custom or additional log sources. To enable analysis of any log source, ensure:
s3:GetObject and s3:ListBucket permissions for the target bucketThis architecture allows you to extend security analysis beyond standard AWS logs to include application logs, custom security events, or third-party security tool outputs.
Once tables are configured, you can perform advanced queries:
Query: "Show all failed login attempts from external IPs in the last 24 hours"
Query: "Can you share what did '[email protected]' did in past 24 hours on my aws account? and share a timeline report?"
Query: "Can you check for all the 'Access Denied/Error/Forbidden' on my PCI(123456789012) aws account and share the username and userIP of the principal, and do a reverse IP checkup if this IP is coming from my own AWS Org or external party."
Query: "Correlate GuardDuty findings with CloudTrail and VPC Flow logs events"
For production environments, use the following configuration:
server:
host: "0.0.0.0"
log_level: "error"
startup_quiet: true
tool_quiet: true
minimal_logging: true
cross_account:
max_concurrent_assumptions: 10
session_duration_seconds: 7200
FROM python:3.11-slim
WORKDIR /app
COPY . .
RUN pip install -r requirements.txt
EXPOSE 8000
CMD ["python", "aws_security_mcp/main.py", "sse"]
docker build -t aws-security-mcp .
docker run -p 8000:8000 \
-e AWS_ACCESS_KEY_ID=your_key \
-e AWS_SECRET_ACCESS_KEY=your_secret \
aws-security-mcp
GET /health/sseTool Discovery Fails
# Check AWS credentials
aws sts get-caller-identity
# Verify cross-account role exists
aws iam get-role --role-name aws-security-mcp-cross-account-access
Cross-Account Access Denied
# Test role assumption manually
aws sts assume-role \
--role-arn arn:aws:iam::TARGET-ACCOUNT:role/aws-security-mcp-cross-account-access \
--role-session-name test-session
Performance Issues
# Reduce concurrent operations
cross_account:
max_concurrent_assumptions: 3
# Enable minimal logging
server:
minimal_logging: true
Enable verbose logging for troubleshooting:
export MCP_LOG_LEVEL=debug
export MCP_STARTUP_QUIET=false
python3 aws_security_mcp/main.py sse
This project is licensed under the MIT License - see the LICENSE file for details.
A Model Context Protocol server that connects AI assistants like Claude to AWS security services, allowing them to autonomously query, inspect, and analyze AWS infrastructure for security issues and m
Übersicht
A Model Context Protocol server that connects AI assistants like Claude to AWS security services, allowing them to autonomously query, inspect, and analyze AWS infrastructure for security issues and misconfigurations.
Tools
Noch keine Tool-Liste. Remote-Server erhalten eine nach dem ersten Health-Check.
FAQ
Kopieren Sie auf dieser Seite die stdio-Konfiguration für Cursor, Claude Desktop, Claude Code oder VS Code. Sie nutzt die Installation des Herausgebers, keinen PlugMCP-Proxy.
In diesem Eintrag ist keine erforderliche Umgebungsvariable aufgeführt.
Aws Security läuft lokal über stdio.
Zuletzt geprüft: 2026-10-27. A Model Context Protocol server that connects AI assistants like Claude to AWS security services, allowing them to autonomously query, inspect, and analyze AWS infrastructure for security issues and misconfigurations.
