Run all security scanners in parallel (including service detection). Read-only. Does not modify any AWS resources. Supports multi-account org scanning.

Run Security Service Detection security scanner only. Read-only. Does not modify any AWS resources.

Run Secret Exposure security scanner only. Read-only. Does not modify any AWS resources.

Run SSL Certificate security scanner only. Read-only. Does not modify any AWS resources.

Run Dangling DNS security scanner only. Read-only. Does not modify any AWS resources.

Run Network Reachability security scanner only. Read-only. Does not modify any AWS resources.

Run IAM Privilege Escalation security scanner only. Read-only. Does not modify any AWS resources.

Run Public Access Verify security scanner only. Read-only. Does not modify any AWS resources.

Run Tag Compliance security scanner only. Read-only. Does not modify any AWS resources.

Run Idle Resources security scanner only. Read-only. Does not modify any AWS resources.

Run Disaster Recovery security scanner only. Read-only. Does not modify any AWS resources.

Run Security Hub Findings security scanner only. Read-only. Does not modify any AWS resources.

Run GuardDuty Findings security scanner only. Read-only. Does not modify any AWS resources.

Run Inspector Findings security scanner only. Read-only. Does not modify any AWS resources.

Run Trusted Advisor Findings security scanner only. Read-only. Does not modify any AWS resources.

Run Config Rules Findings security scanner only. Read-only. Does not modify any AWS resources.

Run Access Analyzer Findings security scanner only. Read-only. Does not modify any AWS resources.

Run Patch Compliance Findings security scanner only. Read-only. Does not modify any AWS resources.

Run IMDSv2 Enforcement security scanner only. Read-only. Does not modify any AWS resources.

Run WAF Coverage security scanner only. Read-only. Does not modify any AWS resources.

Deep-scan ECR image layers for critical/high CVEs missed by ECR Basic/Inspector Enhanced scanning (unmanaged binaries, distro secdb gaps). Reports gap/confirmed/reverse-gap classification against official scan results. Read-only.

Run a predefined group of security scanners for a specific scenario (e.g., MLPS compliance, network defense). Read-only. Supports multi-account org scanning.

List available scan groups with descriptions. Read-only.

Generate a Markdown security report from scan results. Read-only. Does not modify any AWS resources.

Generate a GB/T 22239-2019 等保三级 compliance pre-check report from scan results. Best used with scan_group mlps3_precheck results. Read-only.

Generate a professional HTML security report. Save the output as an .html file.

Generate a professional HTML MLPS Level 3 compliance report (等保三级). Save as .html file.

Return a report-type-tailored prompt (with a grounded findings digest) that the CALLING AI should run to produce an AI security summary. Then pass the generated text back via the ai_summary parameter of the matching report tool (or scan_and_report). The server performs no LLM calls. Use this to make each summary specific to the report type (dashboard / security scan / HW Defense 护网 / MLPS3 等保).

Generate an HTML report organized by HW Defense (护网) SOP checklist categories. Save as .html file.

Generate a security maturity assessment report from scan_all results. Requires service_detection module output. Read-only.

Saves scan results to local disk or S3 for dashboard display. Does not modify any AWS resources.

List available security scan modules with descriptions. Read-only. Does not modify any AWS resources.

List all accounts in the AWS Organization. Useful for discovering accounts before multi-account scanning. Read-only.

Returns the CloudFormation StackSet template for deploying the cross-account security audit IAM role. Read-only.

Run a full security scan AND generate reports in one step. Avoids large data transfer between tools. Reports are saved to ~/.aws-security/reports/