Skip to main content
Glama
Sign In
aws-security-mcp

aws-security-mcp

by jowhee327
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Hybrid

scan_secret_exposure

Detect exposed secrets and credentials across AWS, Huawei Cloud, Alibaba Cloud, and Azure regions using a read-only scan that never modifies resources.

Instructions

Run Secret Exposure security scanner only. Read-only. Does not modify any AWS resources.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "scan_secret_exposure"
  }
}

Input Schema

NameRequiredDescriptionDefault
regionNoAWS region to scan (default: server region)
providerNoCloud provider to scan (default: aws). With huaweicloud, `region` is a Huawei Cloud region ID (e.g. cn-north-4); omit it or pass "all" to scan every region project of the account. Huawei Cloud Phase 1 is single-account (org_mode falls back to the current account with a warning). With alicloud (EXPERIMENTAL — not yet validated against a live account), region is an Alibaba Cloud region ID (e.g. cn-hangzhou); omit or "all" to scan every region; single-account only in this phase. With azure (EXPERIMENTAL — not yet validated against a live account), the China cloud (21Vianet) is the default; set AZURE_CLOUD=global for public cloud. region is an Azure subscription ID; omit or "all" to scan every visible subscription.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changedv0.10.0
    • changedInput schema / properties / provider / description
      Previous value: -"Cloud provider to scan (default: aws). With huaweicloud, `region` is a Huawei Cloud region ID (e.g. cn-north-4); omit it or pass \"all\" to scan every region project of the account. Huawei Cloud Phase 1 is single-account (org_mode falls back to the current account with a warning)."New value: +"Cloud provider to scan (default: aws). With huaweicloud, `region` is a Huawei Cloud region ID (e.g. cn-north-4); omit it or pass \"all\" to scan every region project of the account. Huawei Cloud Phase 1 is single-account (org_mode falls back to the current account with a warning). With alicloud (EXPERIMENTAL — not yet validated against a live account), region is an Alibaba Cloud region ID (e.g. cn-hangzhou); omit or \"all\" to scan every region; single-account only in this phase. With azure (EXPERIMENTAL — not yet validated against a live account), the China cloud (21Vianet) is the default; set AZURE_CLOUD=global for public cloud. region is an Azure subscription ID; omit or \"all\" to scan every visible subscription."
    • changedInput schema / properties / provider / enum
      Previous value: -[
-  "aws",
-  "huaweicloud"
-]New value: +[
+  "aws",
+  "huaweicloud",
+  "alicloud",
+  "azure"
+]
  2. Changed1 schema field changedv0.9.0
    • addedInput schema / properties / provider
      Added value: +{
+  "description": "Cloud provider to scan (default: aws). With huaweicloud, `region` is a Huawei Cloud region ID (e.g. cn-north-4); omit it or pass \"all\" to scan every region project of the account. Huawei Cloud Phase 1 is single-account (org_mode falls back to the current account with a warning).",
+  "enum": [
+    "aws",
+    "huaweicloud"
+  ],
+  "type": "string"
+}
  3. First observedv0.7.6

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full disclosure burden. It does cover the key safety point (read-only, no resource modification), but omits what the scan needs in the way of permissions/credentials, whether it can be long-running or rate-limited, and what it returns. The claim that it modifies no "AWS resources" is also narrower than the schema, which supports huaweicloud, alicloud and azure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences with the purpose front-loaded and the safety assurance immediately after; no wasted words. It is arguably over-terse for a multi-cloud scanner, but not verbose or poorly ordered.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a scanner whose parameters are fully documented in the schema and that has no output schema, the description leaves gaps an agent would care about: what findings look like, whether results are persisted or need save_results, and why it is multi-cloud when the text says "AWS resources." Adequate but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the provider enum is exhaustively documented in the schema, including region semantics and experimental caveats per cloud. The description adds no parameter meaning at all, which is acceptable given the schema, but nothing beyond baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb plus a named scanner ("Run Secret Exposure security scanner") and the word "only" signals it is the single-scanner counterpart to broader scan tools. It does not name the alternative explicitly, so sibling differentiation rests on inference from the sibling list rather than on the text itself.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"only" implies this is the narrow, single-purpose tool versus the aggregate scanners (scan_all, scan_and_report), which is useful implied routing. However, it never states when to prefer it over those siblings, nor any prerequisites such as configured credentials or account context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools