IAM Sentinel MCP Server

Why

Cloud IAM scanners (Wiz, Snyk, GitHub Advanced Security) send your policies to their cloud. Regulated teams can't do that. IAM Sentinel finds privilege-escalation paths, wildcards, PassRole/roleAssignment abuse, public bindings, and data-exfil grants with a deterministic rule engine — reproducible and auditable, not an LLM guess — entirely on your infrastructure.

• 🔒 Air-gapped — no telemetry, no outbound calls (except an optional local model).

• 🎯 Deterministic — version-stamped findings from a rule engine, not hallucinations.

• 🔌 In your IDE — native stdio MCP server for Cursor / Claude Code.

• 🧾 Auditable — every scan persisted with actor, timestamp, SHA-256, and rule-pack version.

• 🖥️ Runs anywhere — CPU-only core; a GPU is only for the optional written remediation.

Quickstart

git clone https://github.com/Pratikchandrathakur/IAM-Sentinel && cd iam-sentinel
cp .env.example .env          # set API keys (Community tier needs no license)
docker compose up -d --build
open http://127.0.0.1:8080     # dashboard · API at /api/... · health at /api/health

Audit a policy (provider auto-detected):

curl -s http://127.0.0.1:8080/api/audit/iam -H "X-API-Key: $KEY" \
  -H "Content-Type: application/json" \
  -d '{"policy_json":"{\"Statement\":[{\"Effect\":\"Allow\",\"Action\":\"*\",\"Resource\":\"*\"}]}"}' | jq

No GPU / macOS? Set LLM_NARRATIVE_ENABLED=false — you still get every deterministic finding. Full per-OS steps in INSTALL.md.

Use it inside your IDE (MCP)

{ "mcpServers": { "iam-sentinel": {
    "command": "python3", "args": ["/abs/path/to/iam-sentinel/mcp_stdio.py"],
    "env": { "AUTH_ENABLED": "false", "LLM_NARRATIVE_ENABLED": "false" }
}}}

Then ask your assistant: "Audit this IAM policy with iam-sentinel."

CI/CD guardrails — block privilege escalation on every PR

Scan the IAM inside a Terraform plan (or raw policy files) and fail the build when a new escalation path appears. Findings show inline on the PR via SARIF. No server needed.

# .github/workflows/iam-guardrails.yml  (see examples/github-actions/)
- run: terraform show -json tf.plan > plan.json
- uses: Pratikchandrathakur/IAM-Sentinel@v1
  with: { tfplan: plan.json, fail-on: HIGH }

Or run the gate locally / in any CI (pure stdlib, offline):

python3 guardrails.py --tfplan plan.json --fail-on HIGH     # exit 1 = blocking findings
python3 guardrails.py policies/*.json --format sarif > iam.sarif

It extracts IAM from Terraform plans (AWS aws_iam_policy/roles, Azure azurerm_role_definition, GCP custom roles/bindings) — no HCL parsing, using the resolved plan JSON.

No model required. Every scan returns a full deterministic remediation report (fixes + least-privilege skeleton) with zero external services. The optional local LLM is pure polish. Custom rules are a config drop-in — see custom_rules.example.json (no code change).

What it detects

• AWS — 19 escalation techniques (Rhino/PMapper): AttachUserPolicy, PutRolePolicy, CreateAccessKey, PassRole+compute, UpdateAssumeRolePolicy, …; wildcards, NotAction traps, wildcard principals, unconditioned AssumeRole, data-exfil grants.

• Azure — roleAssignments/write, elevateAccess, Microsoft.Authorization/*, wildcard actions, scope breadth.

• GCP — primitive roles, allUsers bindings, setIamPolicy / serviceAccountTokenCreator / actAs.

Pricing

Open-core. Run it free; upgrade for seats, history, and enterprise controls (offline-licensed).

See the website or email krisprogrammer1@gmail.com for a pilot.

Tests

python3 tests/test_iam_engine.py    # + test_multicloud / test_store / test_mcp / test_auth / ...

License

Business Source License 1.1 (see LICENSE). Source is open; Community use is free (single user / evaluation). Team, CI/CD, and organization-wide production use requires a commercial subscription — contact krisprogrammer1@gmail.com. Converts to Apache-2.0 on 2030-07-25. You may not resell it or offer it as a competing hosted service.