AWS MCP Server

Instructions

Implementation Reference

• src/index.ts:511-535 (registration)

  Registration of the list_cloudtrail_changes tool in the ListToolsRequestSchema handler, including description and input schema definition.
  name: "list_cloudtrail_changes", description: "Lists write/mutation events (Create, Update, Delete) for a specific resource or service.", inputSchema: { type: "object", properties: { resource_id: { type: "string", description: "Optional: The Resource ID or Name (e.g., sg-12345, my-bucket)." }, lookup_key: { type: "string", enum: ["ResourceName", "ResourceType", "EventName", "Username"], description: "The attribute to lookup by (default: ResourceName if resource_id provided)." }, lookup_value: { type: "string", description: "The value for the lookup key (required if resource_id is omitted)." }, days: { type: "number", description: "Lookback period in days (default: 7)." } } } },
• src/index.ts:1815-1864 (handler)

  Handler implementation for list_cloudtrail_changes tool. Queries CloudTrail events using LookupEventsCommand, filters for write/mutation events based on EventName patterns, and returns relevant event details.
  if (name === "list_cloudtrail_changes") { const resourceId = (args as any)?.resource_id; const lookupKey = (args as any)?.lookup_key || (resourceId ? "ResourceName" : undefined); const lookupValue = resourceId || (args as any)?.lookup_value; const days = (args as any)?.days || 7; if (!lookupKey || !lookupValue) { return { content: [{ type: "text", text: "Please provide a resource_id OR a lookup_key and lookup_value." }], isError: true }; } const startTime = new Date(Date.now() - days * 24 * 60 * 60 * 1000); const command = new LookupEventsCommand({ LookupAttributes: [{ AttributeKey: lookupKey, AttributeValue: lookupValue }], StartTime: startTime, MaxResults: 50 }); const response = await cloudTrailClient.send(command); // Filter for mutations (not ReadOnly) // Note: 'ReadOnly' field in event isn't always populated in LookupEvents response types directly in all SDK versions, // but we can infer or it is often there. Some events don't have it. // We'll primarily rely on showing the event name and letting user see. // But we can try to filter if resource JSON is parsed. const events = response.Events?.map(e => { let isReadOnly = true; // Try to guess read-only if not explicit. // Usually "Get", "Describe", "List" are read. "Create", "Update", "Delete", "Put", "Modify" are write. const name = e.EventName || ""; if (name.startsWith("Get") || name.startsWith("Describe") || name.startsWith("List")) { isReadOnly = true; } else { isReadOnly = false; } // If Resources tag is present, it's useful return { EventTime: e.EventTime, EventName: e.EventName, Username: e.Username, EventSource: e.EventSource, ResourceName: e.Resources?.[0]?.ResourceName, IsAssumedReadOnly: isReadOnly }; }).filter(e => !e.IsAssumedReadOnly) || []; // Show only changes return { content: [{ type: "text", text: JSON.stringify(events, null, 2) }] }; }