Cloud Infrastructure Auditor MCP Guide

aws sts get-caller-identity

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowSecurityAuditReadOnly",
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketPublicAccessBlock",
        "s3:GetBucketPolicyStatus",
        "s3:ListAllMyBuckets",
        "ec2:DescribeSecurityGroups",
        "iam:ListUsers",
        "iam:ListAccessKeys"
      ],
      "Resource": "*"
    }
  ]
}

{
  "mcpServers": {
    "cloud-auditor": {
      "command": "node",
      "args": ["/opt/mcp-servers/cloud-auditor/dist/index.js"],
      "env": {
        "AWS_REGION": "us-east-1",
        "AWS_PROFILE": "security-auditor-profile"
      }
    }
  }
}

{
  "mcpServers": {
    "cloud-auditor": {
      "command": "node",
      "args": ["./dist/index.js"],
      "env": {
        "AWS_REGION": "us-east-1"
      }
    }
  }
}

[mcp_servers.cloud_auditor]
command = "node"
args = ["/opt/mcp-servers/cloud-auditor/dist/index.js"]

[mcp_servers.cloud_auditor.env]
AWS_REGION = "us-east-1"
AWS_PROFILE = "security-auditor-profile"

import { Server } from '@modelcontextprotocol/sdk/server/index.js';
import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
import { S3Client, ListBucketsCommand, GetPublicAccessBlockCommand } from '@aws-sdk/client-s3';
import { EC2Client, DescribeSecurityGroupsCommand } from '@aws-sdk/client-ec2';
import { IAMClient, ListUsersCommand, ListAccessKeysCommand } from '@aws-sdk/client-iam';

const region = process.env.AWS_REGION || 'us-east-1';
const s3 = new S3Client({ region });
const ec2 = new EC2Client({ region });
const iam = new IAMClient({ region });

const server = new Server(
  { name: 'cloud-infrastructure-auditor-mcp', version: '1.0.0' },
  { capabilities: { tools: {} } }
);

server.setRequestHandler(ListToolsRequestSchema, async () => {
  return {
    tools: [
      {
        name: 'audit_s3_public_access',
        description: 'Audit S3 buckets in account to identify missing Public Access Blocks or public exposure.',
        inputSchema: { type: 'object', properties: {} }
      },
      {
        name: 'audit_ec2_security_groups',
        description: 'Audit EC2 security groups for open ingress rules from 0.0.0.0/0 on sensitive ports (SSH 22, RDP 3389, DB 5432).',
        inputSchema: { type: 'object', properties: {} }
      },
      {
        name: 'audit_iam_key_rotation',
        description: 'Inspect active IAM user access keys to flag credentials older than 90 days.',
        inputSchema: { type: 'object', properties: {} }
      }
    ]
  };
});

server.setRequestHandler(CallToolRequestSchema, async (request) => {
  const { name } = request.params;

  try {
    if (name === 'audit_s3_public_access') {
      const { Buckets = [] } = await s3.send(new ListBucketsCommand({}));
      const findings = [];

      for (const bucket of Buckets.slice(0, 20)) {
        try {
          const block = await s3.send(new GetPublicAccessBlockCommand({ Bucket: bucket.Name }));
          const conf = block.PublicAccessBlockConfiguration;
          const isFullyProtected = conf?.BlockPublicAcls && conf?.BlockPublicPolicy && conf?.IgnorePublicAcls && conf?.RestrictPublicBuckets;

          if (!isFullyProtected) {
            findings.push({ bucket: bucket.Name, status: 'VULNERABLE: Public access block incomplete' });
          }
        } catch (err: any) {
          findings.push({ bucket: bucket.Name, status: 'WARNING: No public access block configured' });
        }
      }

      return {
        content: [{ type: 'text', text: JSON.stringify(findings, null, 2) }]
      };
    }

    if (name === 'audit_ec2_security_groups') {
      const { SecurityGroups = [] } = await ec2.send(new DescribeSecurityGroupsCommand({}));
      const openRules: any[] = [];

      for (const sg of SecurityGroups) {
        for (const rule of sg.IpPermissions || []) {
          const hasGlobalIngress = rule.IpRanges?.some(range => range.CidrIp === '0.0.0.0/0');
          if (hasGlobalIngress) {
            openRules.push({
              groupId: sg.GroupId,
              groupName: sg.GroupName,
              fromPort: rule.FromPort,
              toPort: rule.ToPort,
              protocol: rule.IpProtocol,
              risk: (rule.FromPort === 22 || rule.FromPort === 3389) ? 'CRITICAL: Open Management Port' : 'MEDIUM'
            });
          }
        }
      }

      return {
        content: [{ type: 'text', text: JSON.stringify(openRules, null, 2) }]
      };
    }

    if (name === 'audit_iam_key_rotation') {
      const { Users = [] } = await iam.send(new ListUsersCommand({ MaxItems: 25 }));
      const staleKeys = [];
      const now = Date.now();
      const ninetyDaysMs = 90 * 24 * 60 * 60 * 1000;

      for (const user of Users) {
        const { AccessKeyMetadata = [] } = await iam.send(new ListAccessKeysCommand({ UserName: user.UserName }));
        for (const key of AccessKeyMetadata) {
          if (key.Status === 'Active' && key.CreateDate) {
            const ageMs = now - new Date(key.CreateDate).getTime();
            if (ageMs > ninetyDaysMs) {
              staleKeys.push({
                user: user.UserName,
                keyId: key.AccessKeyId,
                ageDays: Math.floor(ageMs / (24 * 60 * 60 * 1000))
              });
            }
          }
        }
      }

      return {
        content: [{ type: 'text', text: JSON.stringify(staleKeys, null, 2) }]
      };
    }

    throw new Error(`Tool '${name}' is not recognized.`);
  } catch (err: any) {
    return {
      isError: true,
      content: [{ type: 'text', text: `AWS Audit Error: ${err.message}` }]
    };
  }
});

async function main() {
  const transport = new StdioServerTransport();
  await server.connect(transport);
}

main().catch((err) => {
  process.stderr.write(`Fatal auditor error: ${err.message}\n`);
  process.exit(1);
});

{
  "jsonrpc": "2.0",
  "id": "audit-sg-01",
  "method": "tools/call",
  "params": {
    "name": "audit_ec2_security_groups",
    "arguments": {}
  }
}

{
  "jsonrpc": "2.0",
  "id": "audit-sg-01",
  "result": {
    "content": [
      {
        "type": "text",
        "text": "[\n  {\n    \"groupId\": \"sg-04a18f29e19\",\n    \"groupName\": \"bastion-host-sg\",\n    \"fromPort\": 22,\n    \"toPort\": 22,\n    \"protocol\": \"tcp\",\n    \"risk\": \"CRITICAL: Open Management Port\"\n  }\n]"
      }
    ]
  }
}