Cloud Audit MCP Server

AWS security investigations in cloud-audit begin with scan_aws, which accepts an AWS profile, region selection, and minimum severity. The scan looks for configuration weaknesses, relates findings into attack chains, and estimates breach costs. Teams can use get_findings to narrow the latest results by severity or AWS service, while get_attack_chains provides a narrative, a priority fix, and an estimated cost for each detected path. get_health_score adds an account health score, severity counts, the number of chains, and estimated dollar exposure.

For a specific check, get_remediation returns AWS CLI instructions and Terraform HCL rather than applying changes. list_checks exposes check identifiers, categories, and services without AWS credentials. The scanner runs locally with read-only AWS access and does not need a SaaS account. Its MCP interface supports assistants including Claude Code, Cursor, and VS Code Copilot over stdio. Outside the agent workflow, the CLI can compare saved scans for regressions, export remediation as a script, and produce HTML, JSON, SARIF, or Markdown reports.