Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@AWS MCP Audit collect a snapshot of our EC2 and S3 resources and run security checks"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A contractor-friendly read-only AWS assessment tool (MCP server) that inventories an AWS environment, runs deterministic security/ops checks, and generates actionable reports plus a cost/usage snapshot.
uv sync
uv run python -m aws_mcp_audit.serverRelated MCP server: emfirge
Put this in %APPDATA%\Claude\claude_desktop_config.json and adjust the directory path:
{
"mcpServers": {
"aws-mcp-audit": {
"command": "uv",
"args": [
"--directory",
"C:\\D_Drive\\Dev\\aws-mcp-audit",
"run",
"python",
"-m",
"aws_mcp_audit.server"
]
}
}
}aws_whoami(auth?)
collect_snapshot(scope, auth?) -> snapshot_id
run_checks(snapshot_id) -> finding_set_id
cost_signals(snapshot_id)
cost_explorer_summary(days=30, auth?) (optional permissions)
generate_report(snapshot_id, finding_set_id, format="md|pdf")
All tools accept an optional auth object:
{ "mode": "default" }or (contractor-run):
{
"mode": "assume_role",
"role_arn": "arn:aws:iam::123456789012:role/ContractorAuditReadOnly",
"external_id": "client-specific-external-id",
"session_name": "aws-mcp-audit",
"region_name": "us-east-1"
}Artifacts are stored locally under ./data/snapshots/<snapshot_id>/:
snapshot.json
findings.json
cost.json (tier-1 signals)
cost_explorer.json (if enabled)
report.md / report.pdf
See terraform/ContractorAuditReadOnly/ for a simple module that creates a read-only role with ExternalId.
Inputs: auth. Returns: object
Inputs: scope (required), auth. Returns: object
Inputs: days, top_n, auth. Returns: object
Inputs: days, top_n, auth. Returns: object
Inputs: days, granularity, auth. Returns: object
Inputs: snapshot_id (required). Returns: object
Inputs: snapshot_id (required), finding_set_id, format, auth. Returns: object
Inputs: snapshot_id (required). Returns: object
Inputs: finding_set_id (required), severity_min. Returns: object
Inputs: snapshot_id (required). Returns: object
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 10 tools
The tools have distinct names suggesting different AWS audit functions, but without descriptions, there is potential ambiguity in overlapping areas like cost analysis (cost_explorer_by_region, cost_explorer_by_service, cost_explorer_summary_tool, cost_signals) and snapshot handling (collect_snapshot, get_snapshot_summary). An agent might struggle to choose between similar-sounding tools without clear purpose differentiation.
Most tools follow a consistent snake_case pattern with descriptive verb-noun combinations (e.g., collect_snapshot, generate_report, list_findings). However, there are minor deviations like aws_whoami (which uses a command-like name) and cost_explorer_summary_tool (which includes 'tool' redundantly), slightly breaking the pattern.
With 10 tools, this server is well-scoped for AWS audit purposes, covering areas like identity (aws_whoami), cost analysis, reporting, snapshot management, and compliance checks. The count is neither too sparse nor overwhelming, allowing for comprehensive audit workflows without unnecessary complexity.
The tool set appears to cover key audit aspects such as cost analysis, snapshot collection, report generation, and findings listing, but without descriptions, it's unclear if there are gaps in CRUD operations or lifecycle coverage. For example, tools for updating or deleting findings might be missing, potentially limiting agent effectiveness in full audit management.
Cloud cost, inventory and governance on AWS/Azure/GCP. Read-only by default, optional scoped writes
AWS Cost Explorer cost, forecast, and anomaly reporting through user-connected IAM credentials.
AWS pricing and cost estimates with no signup, plus read-only idle-resource scans of your account.
Lowers your AWS bill by helping you clean up and optimize your setup
