aws-security-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| region | No | AWS region to scope scans (defaults to configured region) |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| prompts | {
"listChanged": true
} |
| resources | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| scan_allA | Run all security scanners in parallel (including service detection). Read-only. Does not modify any AWS resources. Supports multi-account org scanning. |
| detect_servicesB | Run Security Service Detection security scanner only. Read-only. Does not modify any AWS resources. |
| scan_secret_exposureA | Run Secret Exposure security scanner only. Read-only. Does not modify any AWS resources. |
| scan_ssl_certificateB | Run SSL Certificate security scanner only. Read-only. Does not modify any AWS resources. |
| scan_dns_danglingA | Run Dangling DNS security scanner only. Read-only. Does not modify any AWS resources. |
| scan_network_reachabilityA | Run Network Reachability security scanner only. Read-only. Does not modify any AWS resources. |
| scan_iam_privilege_escalationA | Run IAM Privilege Escalation security scanner only. Read-only. Does not modify any AWS resources. |
| scan_public_access_verifyA | Run Public Access Verify security scanner only. Read-only. Does not modify any AWS resources. |
| scan_tag_complianceA | Run Tag Compliance security scanner only. Read-only. Does not modify any AWS resources. |
| scan_idle_resourcesA | Run Idle Resources security scanner only. Read-only. Does not modify any AWS resources. |
| scan_disaster_recoveryA | Run Disaster Recovery security scanner only. Read-only. Does not modify any AWS resources. |
| scan_security_hub_findingsA | Run Security Hub Findings security scanner only. Read-only. Does not modify any AWS resources. |
| scan_guardduty_findingsA | Run GuardDuty Findings security scanner only. Read-only. Does not modify any AWS resources. |
| scan_inspector_findingsA | Run Inspector Findings security scanner only. Read-only. Does not modify any AWS resources. |
| scan_trusted_advisor_findingsA | Run Trusted Advisor Findings security scanner only. Read-only. Does not modify any AWS resources. |
| scan_config_rules_findingsA | Run Config Rules Findings security scanner only. Read-only. Does not modify any AWS resources. |
| scan_access_analyzer_findingsB | Run Access Analyzer Findings security scanner only. Read-only. Does not modify any AWS resources. |
| scan_patch_compliance_findingsA | Run Patch Compliance Findings security scanner only. Read-only. Does not modify any AWS resources. |
| scan_imdsv2_enforcementA | Run IMDSv2 Enforcement security scanner only. Read-only. Does not modify any AWS resources. |
| scan_waf_coverageA | Run WAF Coverage security scanner only. Read-only. Does not modify any AWS resources. |
| scan_rms_compliance_findingsB | Run RMS Compliance Findings (Huawei Cloud) security scanner only. Read-only. Does not modify any AWS resources. |
| scan_ecr_image_cveA | Deep-scan ECR image layers for critical/high CVEs missed by ECR Basic/Inspector Enhanced scanning (unmanaged binaries, distro secdb gaps). Reports gap/confirmed/reverse-gap classification against official scan results. Read-only. |
| scan_groupA | Run a predefined group of security scanners for a specific scenario (e.g., MLPS compliance, network defense). Read-only. Supports multi-account org scanning. |
| list_groupsA | List available scan groups with descriptions. Read-only. |
| generate_reportA | Generate a Markdown security report from scan results. Read-only. Does not modify any AWS resources. |
| generate_mlps3_reportA | Generate a GB/T 22239-2019 等保三级 compliance pre-check report from scan results. Best used with scan_group mlps3_precheck results. Read-only. |
| generate_html_reportC | Generate a professional HTML security report. Save the output as an .html file. |
| generate_mlps3_html_reportC | Generate a professional HTML MLPS Level 3 compliance report (等保三级). Save as .html file. |
| get_ai_summary_promptA | Return a report-type-tailored prompt (with a grounded findings digest) that the CALLING AI should run to produce an AI security summary. Then pass the generated text back via the |
| generate_hw_defense_reportB | Generate an HTML report organized by HW Defense (护网) SOP checklist categories. Save as .html file. |
| generate_maturity_reportB | Generate a security maturity assessment report from scan_all results. Requires service_detection module output. Read-only. |
| save_resultsA | Saves scan results to local disk or S3 for dashboard display. Does not modify any AWS resources. |
| list_modulesA | List available security scan modules with descriptions. Read-only. Does not modify any AWS resources. |
| list_org_accountsA | List all accounts in the AWS Organization. Useful for discovering accounts before multi-account scanning. Read-only. |
| get_setup_templateA | Returns the CloudFormation StackSet template for deploying the cross-account security audit IAM role. Read-only. |
| scan_and_reportA | Run a full security scan AND generate reports in one step. Avoids large data transfer between tools. Reports are saved to ~/.aws-security/reports/ |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| security-scan | Run a full AWS security scan workflow: scan all modules, generate a report, and summarize findings. |
| analyze-finding | Deep analysis of a specific security finding. |
| hw_defense_checklist | 护网行动完整检查清单 — 包含自动化扫描项和人工检查项 |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| security-rules | Describes all 20 scan modules and their check rules |
| risk-scoring | Describes the risk scoring model and severity/priority mapping |
TDQS
Scored across 36 tools
Each tool clearly targets a distinct operation: list modules/groups/accounts, run specific scanners per security domain, generate specific report types, or save/setup. Even the many scan_* tools are each named for a unique security check (e.g., scan_ssl_certificate vs scan_dns_dangling), and their descriptions explicitly state what they scan. The grouping tools (scan_all, scan_group, scan_and_report) are distinct in their purpose and input/output.
Tool names follow a consistent verb_noun pattern: list_* for listing, scan_* for scanning, generate_* for report generation, and get_* for retrieval. Exceptions like save_results and get_setup_template still follow the verb_noun structure. All names use snake_case consistently.
With 36 tools, this is on the heavier side, but the broad scope of AWS security scanning justifies the count. Each scanner represents a distinct security domain, and report generation tools cover different formats and compliance frameworks. However, the sheer number might overwhelm an agent, especially since many scan_* tools are repetitive in pattern.
The tool surface covers the full lifecycle: listing available modules/groups, discovering org accounts, running individual scans, running grouped scans, generating multiple report types (Markdown, HTML, MLPS, HW defense, maturity), and saving results. Minor gaps include lack of a get_results or delete_report tool, but for a security scanning server, the coverage is quite complete.