AWS‑IReveal‑MCP

Provides a unified interface to AWS services for security investigations and incident response.

AWS‑IReveal‑MCPis a Model Context Protocol (MCP) server designed to give security teams and incident responders a unified interface to AWS services useful for investigation. By connecting AWS‑IReveal‑MCP to any MCP client (such as Claude Desktop or Cline), you can invoke queries and analyses across multiple AWS services without leaving your LLM‑driven workspace.

AWS‑IReveal‑MCP integrates with the following AWS services and functionalities:

- CloudTrail— Management event logs for API activity
- Amazon Athena— SQL queries over CloudTrail logs
- CloudWatch— Operational logs and ad hoc analysis
- Amazon GuardDuty— Threat detection and finding investigation
- AWS Config— Resource configuration history and compliance status
- VPC Flow Logs— Network traffic metadata for forensic analysis
- Network Access Analyzer— Reachability checks across SG/NACL/VPC
- IAM Access Analyzer— Policy and resource‑based access findings

- Trace “who did what, when, and where” (CloudTrail, Config)
- Examine detailed data events (Athena)
- Search and visualize logs (CloudWatch, VPC Flow Logs)
- Surface security alerts (GuardDuty, IAM Access Analyzer)
- Verify network reachability and configuration (Network Access Analyzer)

- analyze activity by IP x.x.x.x in the last 5 days
- analyze activity by role 'sysadmin' in the last 24 hours
- investigate suspicious activity on cloudtrail in the last 7 days on us-west-2
- is there any data event on buckets with name containing 'customers' in the last 7 days?
- investigate cloudwatch logs related to Bedrock
- propose remediations for GuardDuty findings with high risk happened in the last 2 days
- identify non-compliant resources, explain violated rules, and suggest remediation

curl -Ls https://astral.sh/uv/install.sh | sh

- Clone the repo and set up the environment (this will install the required dependencies):

git clone https://github.com/Brucedh/aws-ireveal-mcp.git cd aws-ireveal-mcp uv venv source .venv/bin/activate

Add the following configuration to your MCP client's settings file:

{ "mcpServers": { "aws-ireveal": { "command": "uv", "args": [ "--directory", "/path_to_your/aws-ireveal-mcp", "run", "server.py" ], "env": { "AWS_PROFILE": "<YOUR_PROFILE>" } } } }

This AWS Labs Model Context Protocol (MCP) server for CloudTrail enables your AI agents to query AWS account activity for security investigations, compliance auditing, and operational troubleshooting.

Integrates with Alibaba Cloud APIs to manage resources like ECS, Cloud Monitor, and OOS.

Interact with your AWS environment using natural language to query and manage resources. Requires local AWS credentials.

Interact with your AWS environment using natural language. Requires local AWS credentials.

Execute AWS CLI commands through the Model Context Protocol (MCP). Requires AWS credentials configured on the host.

An MCP server that enables AI assistants to interact with AWS security services.

36 enterprise MCP tools for AWS security, infrastructure generation, AI workflows, and AI agent governance.

Integrate with Tailscale's CLI and API for automated network management and monitoring.

Civilian situational awareness for AI deployments — real-time risk dashboards, multi-source threat correlation, anomaly detection, and automated alerting for critical infrastructure and enterprise AI systems.

MCP server to Automate Exposure Management