AWS MCP Audit

Implementation Reference

• src/aws_mcp_audit/server.py:137-160 (handler)

  The handler function for the 'run_checks' MCP tool, decorated with @mcp.tool for automatic registration. It loads the snapshot JSON, runs multiple imported check functions to generate findings, saves the findings, and returns a summary with finding_set_id (matching snapshot_id) and the count of findings.
  @mcp.tool def run_checks(snapshot_id: str) -> Dict[str, Any]: p = os.path.join(snapshot_dir(DATA_DIR, snapshot_id), "snapshot.json") snap = read_json(p) findings: List[Dict[str, Any]] = [] # Exposure findings.extend([f.__dict__ for f in check_sg_world_open(snap)]) findings.extend([f.__dict__ for f in check_public_instances(snap)]) findings.extend([f.__dict__ for f in check_unassociated_eips(snap)]) findings.extend([f.__dict__ for f in check_unattached_ebs(snap)]) # Telemetry signals findings.extend([f.__dict__ for f in check_cloudtrail_present(snap)]) findings.extend([f.__dict__ for f in check_cloudwatch_alarm_signal(snap)]) # Data protection findings.extend([f.__dict__ for f in check_unencrypted_ebs(snap)]) findings.extend([f.__dict__ for f in check_rds_public_or_low_backup(snap)]) # Health findings.extend([f.__dict__ for f in check_unhealthy_targets(snap)]) save_findings(DATA_DIR, snapshot_id, findings) # v1: 1:1 mapping of finding_set_id to snapshot_id return {"finding_set_id": snapshot_id, "count": len(findings)}
• src/aws_mcp_audit/server.py:137-137 (registration)

  The @mcp.tool decorator registers the run_checks function as an MCP tool.
  @mcp.tool