Skip to main content
Glama
Sign In
deenesjakoruzh
AWS‑IReveal‑MCP

AWS‑IReveal‑MCP

by Brucedh
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

AWS‑IReveal‑MCP

AWS‑IReveal‑MCP is a Model Context Protocol (MCP) server designed to give security teams and incident responders a unified interface to AWS services useful for investigation. By connecting AWS‑IReveal‑MCP to any MCP client (such as Claude Desktop or Cline), you can invoke queries and analyses across multiple AWS services without leaving your LLM‑driven workspace.

Features

AWS‑IReveal‑MCP integrates with the following AWS services and functionalities:

  • CloudTrail — Management event logs for API activity

  • Amazon Athena — SQL queries over CloudTrail logs

  • CloudWatch — Operational logs and ad hoc analysis

  • Amazon GuardDuty — Threat detection and finding investigation

  • AWS Config — Resource configuration history and compliance status

  • VPC Flow Logs — Network traffic metadata for forensic analysis

  • Network Access Analyzer — Reachability checks across SG/NACL/VPC

  • IAM Access Analyzer — Policy and resource‑based access findings

Together, these services let you

  • Trace “who did what, when, and where” (CloudTrail, Config)

  • Examine detailed data events (Athena)

  • Search and visualize logs (CloudWatch, VPC Flow Logs)

  • Surface security alerts (GuardDuty, IAM Access Analyzer)

  • Verify network reachability and configuration (Network Access Analyzer)

Example Prompts

  • analyze activity by IP x.x.x.x in the last 5 days

  • analyze activity by role 'sysadmin' in the last 24 hours

  • investigate suspicious activity on cloudtrail in the last 7 days on us-west-2

  • is there any data event on buckets with name containing 'customers' in the last 7 days?

  • investigate cloudwatch logs related to Bedrock

  • propose remediations for GuardDuty findings with high risk happened in the last 2 days

  • identify non-compliant resources, explain violated rules, and suggest remediation

Related MCP server: mcp-server-wazuh

Installation

Prerequisites

  • Install UV with:

curl -Ls https://astral.sh/uv/install.sh | sh

  • Clone the repo and set up the environment (this will install the required dependencies):

git clone https://github.com/Brucedh/aws-ireveal-mcp.git
cd aws-ireveal-mcp
uv venv
source .venv/bin/activate

Configuration

Add the following configuration to your MCP client's settings file:

{
  "mcpServers": {
    "aws-ireveal": {
      "command": "uv",
      "args": [
        "--directory",
        "/path_to_your/aws-ireveal-mcp",
        "run",
        "server.py"
      ],
      "env": {
        "AWS_PROFILE": "<YOUR_PROFILE>"
      }
    }
  }
}

Available Tools

25 tools
accessanalyzer_get_analyzerB
Retrieve details of a specific analyzer by name.

Parameters:
    aws_region (str): The AWS region - use 'us-east-1' if not specified.
    analyzer_name (str): The name of the analyzer to retrieve.

Returns:
    str: JSON-formatted details of the analyzer.

Inputs: aws_region (required), analyzer_name (required). Returns: result

accessanalyzer_get_findingA
Retrieve detailed information about a single finding.

Parameters:
    aws_region (str): The AWS region - use 'us-east-1' if not specified.
    analyzer_arn (str): The ARN of the analyzer.
    finding_id (str): The ID of the finding to retrieve.

Returns:
    str: JSON-formatted details of the finding.

Inputs: aws_region (required), analyzer_arn (required), finding_id (required). Returns: result

accessanalyzer_list_analyzersB
List all IAM Access Analyzer analyzers in the specified region.

Parameters:
    aws_region (str): The AWS region - use 'us-east-1' if not specified.

Returns:
    str: JSON-formatted list of analyzers.

Inputs: aws_region (required). Returns: result

accessanalyzer_list_findingsA
List findings for an analyzer, with optional filter.
filter: {'resourceType': {'eq': ['AWS::S3::Bucket']}, ...}

Parameters:
    aws_region (str): The AWS region - use 'us-east-1' if not specified.
    analyzer_arn (str): The ARN of the analyzer to list findings for.
    filter (dict, optional): Filter criteria for findings.
    max_results (int): Maximum number of findings to return.

Returns:
    str: JSON-formatted list of findings.

Inputs: aws_region (required), analyzer_arn (required), filter, max_results. Returns: result

athena_create_cloudtrail_tableA
Create an Athena table for CloudTrail logs with partition projection.

<IMPORTANT>
Before using this tool ask the user for OUTPUT bucket, unless it is provided.
This is necessary to create the table correctly. If the API fails, interrupt the process and ask the user for the OUTPUT BUCKET.
</IMPORTANT>

Parameters:
  cloudtrail_bucket (str): The S3 bucket for CloudTrail logs - you can retrieve it using the 'cloudtrail_describe_trails' tool.
  is_org_trail (bool): Indicates if the trail is for the organization.
  account_id (str): Your AWS account ID - you can retrieve it.
  output_bucket (str): Ask the user if not specified, S3 bucket URI (e.g. 's3://my-athena-query-results/') for query results - different from cloudtrail_bucket.
  output_region (str): The AWS region for the output bucket - use 'us-east-1' if not specified.
  partition_region (str): The region of the events to be queried. It is used to create the S3 path for the Athena table.
  database (str): Athena database name to be used.

Returns:
  str: An empty result if successful, or an error message if there was an issue.

Inputs: cloudtrail_bucket (required), is_org_trail (required), account_id (required), output_bucket (required), +3 more. Returns: result

athena_query_eventsA
Query Athena for granular granular searches on CloudTrail logs.

<IMPORTANT>
Before calling this tool, you must call the athena_create_cloudtrail_table tool to create the table.
If the user asks for a different region, you must call the athena_create_cloudtrail_table tool to create the table in that region.
</IMPORTANT>

Parameters:
  aws_region: The AWS region - use 'us-east-1' if not specified.
  start_time: ISO string of the start time
  end_time: ISO string of the end time
  database: Athena database name to be used - use 'default' if not specified.
  output_bucket: S3 bucket URI (e.g. 's3://my-athena-query-results/') for query results - different from cloudtrail_bucket.
  event_names: List of event names to filter on (e.g. ["GetObject", "DeleteObject"])
  principal_id: Optional principal ID to filter on. Use the percent sign (%) as a wildcard character.
  user_arn: Optional user ARN to filter on. Use the percent sign (%) as a wildcard character. This is the ARN of the user performing the action.
  user_name: Optional user name to filter on. This is the name of the user performing the action.
  role_name: Optional role name to filter on. This is the name of the role assumed by the user performing the action.
  ip_address: Optional IP address to filter on. Use the percent sign (%) as a wildcard character. This is the IP address of the user performing the action.
  bucket_name: Optional bucket name to filter on. Use the percent sign (%) as a wildcard character.
  limit: Maximum number of results to return (default is 50).

Returns:
  str: JSON-formatted result of the Athena query.

Inputs: aws_region (required), start_time (required), end_time (required), database (required), +9 more. Returns: result

cloudtrail_describe_trailsB

Describe all CloudTrail trails configured in the AWS account.

Inputs: no named parameters.

cloudtrail_lookup_eventsA
Lookup CloudTrail events using filters.

If the user request falls into one of these scenarios, use the Athena tools instead:
- EventName is a data event (e.g. GetObject, DeleteObject, PutObject);
- the user wants to filter by role name;
- the user wants to filter by principal ID;
- the user wants to filter by IP address;
- the user wants to filter by bucket name;
- the user wants to filter by file object in buckets;
- the user wants to filter using regex;
When filtering for EventName, note that the event name is case-sensitive and must match the exact name of the event.
If you want to use operators like 'equals', 'not equals', 'contains', etc., you must use the Athena tools instead.

<IMPORTANT>
Call datetime.datetime.now() to get the current date and time before providing the start and end times.
If the user asks for events happened in the last 7 days, run 'datetime.datetime.now() - datetime.timedelta(days=7)' to get the start date.
Print out the start and end times to the user.
</IMPORTANT>

Parameters:
  aws_region (str): The AWS region - use 'us-east-1' if not specified.
  attribute_key (str): The name of the event to search for.
    Valid attributes keys: EventId | EventName | ReadOnly | Username | ResourceType | ResourceName | EventSource | AccessKeyId
  attribute_value (str): The value of the event to search for.
    If no key-value pair is provided, use 'ReadOnly'='false'.
  start_time (str): start timestamp with format 'YYYY-MM-DD HH:MM:SS' (e.g. '2025-04-10 12:45:50').
    If not provided, use 'datetime.datetime.now() - datetime.timedelta(days=7)' to get the start date.
  end_time (str): end timestamp with format 'YYYY-MM-DD HH:MM:SS' (e.g. '2025-04-11 12:45:50').
    If not provided, use 'datetime.datetime.now()' to get the end date.
  max_results (int): Maximum number of events to return.

Returns:
    list: A list of CloudTrail events matching the specified criteria.

Inputs: aws_region (required), attribute_key (required), attribute_value (required), start_time (required), +2 more.

cloudwatch_describe_log_groupsA
Describes available CloudWatch log groups in the specified region.

Parameters:
  aws_region (str): The AWS region - use 'us-east-1' if not specified.
  log_group_name_pattern (str): The pattern to filter log group names.
    Pattern: [\.\-_/#A-Za-z0-9]*
    If you specify a string for this parameter, the operation returns only log groups that have names that match the string based on a case-sensitive substring search. 
    For example, if you specify Foo, log groups named FooBar, aws/Foo, and GroupFoo would match, but foo, F/o/o and Froo would not match.
    Thus, if you don't find any results with uppercase letters, try using lowercase letters.

Returns:
  str: JSON-formatted list of log groups.

Inputs: aws_region (required), log_group_name_pattern (required), limit. Returns: result

cloudwatch_filter_log_eventsA
Filters log events in a specified CloudWatch log group using FilterLogEvents API.

Parameters:
  aws_region (str): The AWS region - use 'us-east-1' if not specified.
  log_group (str): The name of the log group.
  start_time (str): ISO formatted start timestamp (e.g. '2025-04-10T00:00:00Z').
  end_time (str): ISO formatted end timestamp (e.g. '2025-04-11T00:00:00Z').
  filter_pattern (str): A filter pattern to match events.
  limit (int): Maximum number of log events to return.

**Supported regex syntax:**
  - When using regex to search and filter log data, you must surround your expressions with %.
  - Filter patterns with regex can only include the following:
  - Alphanumeric characters - An alphanumeric character is a character that is either a letter (from A to Z or a to z) or a digit (from 0 to 9).
  - Supported symbol characters - These include: '_', '#', '=', '@','/', ';', ',', and '-'. For example, %something!% would be rejected since '!' is not supported.
  - Supported operators - These include: '^', '$', '?', '[', ']', '{', '}', '|', '', '*', '+', and '.'.
  - The ( and ) operators are not supported. You cannot use parentheses to define a subpattern.
  - Multi-byte characters are not supported.

Returns:
  str: JSON-formatted list of matching log events.

Inputs: aws_region (required), log_group (required), start_time (required), end_time (required), +2 more. Returns: result

cloudwatch_list_log_streamsB
Lists log streams in a specified CloudWatch log group.

Parameters:
  aws_region (str): The AWS region - use 'us-east-1' if not specified.
  log_group (str): The name of the log group.
  limit (int): Maximum number of log streams to return.

Returns:
  str: JSON-formatted list of log streams.

Inputs: aws_region (required), log_group (required), limit. Returns: result

config_describe_compliance_by_resourceB
List compliance summaries for resources, optionally filtered by type.

Parameters:
  aws_region (str): The AWS region - use 'us-east-1' if not specified.
  resource_type (str): optional AWS resource type filter.

Returns:
  JSON list of ComplianceByResource objects.

Inputs: aws_region (required), resource_type. Returns: result

config_describe_config_rulesA
Describe one or more AWS Config rules, or all rules if none specified.

Parameters:
  aws_region (str): The AWS region - use 'us-east-1' if not specified.
  rule_names (list): optional list of Config rule names.

Returns:
  JSON list of ConfigRule objects.

Inputs: aws_region (required), rule_names. Returns: result

config_describe_recorder_statusB
Describe status of AWS Config recorder(s).

Parameters:
  aws_region (str): The AWS region - use 'us-east-1' if not specified.

Returns:
  JSON list of ConfigurationRecorderStatus objects.

Inputs: aws_region (required). Returns: result

config_get_resource_config_historyA
Fetch configuration snapshots for a resource between two ISO timestamps.

Parameters:
  aws_region (str): The AWS region - use 'us-east-1' if not specified.
  resource_type (str): e.g. 'AWS::S3::Bucket'.
  resource_id (str): the resource's ARN or ID.
  start_time (str): ISO timestamp, e.g. '2025-04-01T00:00:00Z'.
  end_time   (str): ISO timestamp.
  limit (int): Maximum number of configuration items to return.

Returns:
  JSON list of ConfigurationItem objects.

Inputs: aws_region (required), resource_type (required), resource_id (required), start_time (required), +2 more. Returns: result

config_list_discovered_resourcesA
List resource identifiers that AWS Config has discovered.

Parameters:
  aws_region (str): The AWS region - use 'us-east-1' if not specified.
  resource_type (str): e.g. 'AWS::EC2::Instance'.

Returns:
  JSON list of resourceIdentifier objects.

Inputs: aws_region (required), resource_type (required). Returns: result

ec2_describe_flow_logsA
Describe one or more VPC Flow Logs.
If no filter is provided, returns all Flow Logs in the region.

Parameters:
  aws_region (str): The AWS region - use 'us-east-1' if not specified.
  flow_log_ids (list[str], optional): List of Flow Log IDs to describe.
  resource_ids (list[str], optional): List of resource IDs to filter by.
  resource_type (str, optional): Type of resource to filter by (e.g. 'VPC', 'NetworkInterface', 'Subnet').
  max_results (int, optional): Maximum number of results to return.

Returns:
    str: JSON-formatted list of Flow Logs.

Inputs: aws_region (required), flow_log_ids, resource_ids, resource_type, +1 more. Returns: result

guardduty_get_findingsA
Get detailed information for the specified GuardDuty findings.

Parameters:
  aws_region (str): The AWS region - use 'us-east-1' if not specified.
  detector_id (str): The GuardDuty detector ID.
  finding_ids (list): A list of finding IDs for which to retrieve details.

<IMPORTANT>
The server may crash when the response is too large. To avoid this, pass only max 2 finding IDs at a time. 
The finding_ids list should contain a maximum of 2 IDs.
If guardduty_list_findings returns more than 2 IDs, you should call this tool max 5 times. 
Then, proceed with your analysis, but remember to notify the user that there may be additional findings not retrieved.
</IMPORTANT>

Returns:
  str: JSON-formatted details of the findings.

Inputs: aws_region (required), detector_id (required), finding_ids (required). Returns: result

guardduty_get_finding_statisticsB
Get summary statistics for GuardDuty findings for a given detector.

Parameters:
  aws_region (str): The AWS region - use 'us-east-1' if not specified.
  detector_id (str): The GuardDuty detector ID.

Returns:
  str: JSON-formatted statistics about the findings.

Inputs: aws_region (required), detector_id (required). Returns: result

guardduty_list_detectorsB
List all GuardDuty detector IDs in the specified AWS region.

Parameters:
  aws_region (str): The AWS region - use 'us-east-1' if not specified.

Returns:
  str: JSON-formatted list of detector IDs.

Inputs: aws_region (required). Returns: result

guardduty_list_findingsA
List GuardDuty finding IDs for a given detector.

Optionally, you can supply a list of finding IDs to retrieve specific findings or a minimum severity threshold to filter findings.

Parameters:
  aws_region (str): The AWS region - use 'us-east-1' if not specified.
  detector_id (str): The GuardDuty detector ID.
  finding_ids (list, optional): Specific finding IDs to query.
  severity_threshold (float, optional): If provided, returns only findings with severity greater than this value.

<IMPORTANT>
After calling this tool, you should call guardduty_get_findings multiple times with the finding_ids returned by this tool.
</IMPORTANT>

Returns:
  str: JSON-formatted list of finding IDs.

Inputs: aws_region (required), detector_id (required), finding_ids, severity_threshold. Returns: result

networkinsights_get_findingsB
Retrieve all findings for a given analysis.

Parameters:
    aws_region (str): The AWS region - use 'us-east-1' if not specified.
    analysis_id (str): The ID of the analysis to retrieve findings for.
    max_results (int): Maximum number of findings to return.

Returns:
    JSON list of NetworkInsightsAccessScopeAnalysisFinding objects.

Inputs: aws_region (required), analysis_id (required), max_results. Returns: result

networkinsights_list_analysesB
Describe analyses for one or more scopes.

Parameters:
    aws_region (str): The AWS region - use 'us-east-1' if not specified.
    scope_id (str): The ID of the access scope to filter by.
    analysis_ids (list[str]): List of analysis IDs to filter by.

Returns:
    JSON list of NetworkInsightsAccessScopeAnalysis objects.

Inputs: aws_region (required), scope_id, analysis_ids. Returns: result

networkinsights_list_scopesB
Describe all Network Access Scopes in the region.

Parameters:
    aws_region (str): The AWS region - use 'us-east-1' if not specified.

Returns:
    JSON list of NetworkInsightsAccessScope objects.

Inputs: aws_region (required). Returns: result

networkinsights_start_analysisA
Start a Network Access Scope analysis.

Parameters:
aws_region (str): AWS region - use 'us-east-1' if not specified.
scope_id (str): The NetworkInsightsAccessScopeId to analyze.
dry_run (bool): If True, checks permissions without starting.
tag_specifications (list): TagSpecification dicts for annotating the analysis.
client_token (str): Idempotency token for the request.

Returns:
str: JSON representation of the NetworkInsightsAccessScopeAnalysis object.

Inputs: aws_region (required), scope_id (required), dry_run, tag_specifications, +1 more. Returns: result

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A3.6/5.0

    Scored across 25 tools

    Disambiguation4/5

    Most tools are clearly distinct by AWS service and operation, but there is some overlap between cloudtrail_lookup_events and athena_query_events, as both query CloudTrail logs with different capabilities. The descriptions help clarify when to use each, but an agent might initially be confused about which tool to select for certain log queries.

    Naming Consistency5/5

    All tool names follow a consistent pattern of service_verb_noun (e.g., accessanalyzer_get_analyzer, cloudtrail_describe_trails). This makes it easy to understand the service and action at a glance, with no deviations in naming conventions across the set.

    Tool Count3/5

    With 25 tools, the count feels heavy for a single server, but it covers multiple AWS security and monitoring services (Access Analyzer, CloudTrail, Athena, CloudWatch, Config, EC2, GuardDuty, Network Insights). While comprehensive, it may overwhelm agents with its breadth, bordering on too many for a cohesive set.

    Completeness4/5

    The tool set provides good coverage for security analysis across AWS services, with CRUD-like operations for each service (e.g., list, get, describe, query). Minor gaps exist, such as missing update or delete operations for some resources, but agents can perform core workflows without major dead ends.

    Maintenance

    ActivityInactive
    ResponsivenessOutdated data

    Resources

    Related MCP Connectors

    Related MCP Servers

    Appeared in Searches