badchars/cloud-audit-mcp

Cloud security audit tools for AI agents.

Prowler gives you a 200-page PDF.
This gives your AI agent direct access to cloud APIs — it reads, correlates, and fixes.

The Problem • How It's Different • Quick Start • What The AI Can Do • Tools • Checks • Architecture

The Problem

Cloud security tools haven't changed in a decade. You run Prowler, wait 30 minutes, get a 200-page report, and then you have to read it, understand it, prioritize it, and fix it. Every. Single. Time.

Traditional workflow:
  prowler aws --compliance cis_3.0       →  200 findings, 40 pages
  you read the report                    →  2 hours
  you figure out what matters            →  30 minutes
  you write the fix commands             →  1 hour
  you run them                           →  30 minutes
  ─────────────────────────────────────
  Total: 4+ hours of your time

cloud-audit-mcp eliminates the human bottleneck. Your AI agent calls the cloud APIs directly, understands what it finds, chains checks together, and tells you exactly what to fix — in seconds.

With cloud-audit-mcp:
  You: "Check my AWS account for critical misconfigurations and fix them"

  Agent: → calls aws_check_s3_public, aws_check_iam_policies, aws_check_ec2_imds...
         → correlates: "This Lambda has admin role AND secrets in env vars"
         → prioritizes: "3 critical, 5 high — here's the impact of each"
         → "Run these 3 commands to fix the critical ones"

How It's Different

Every existing tool is designed for humans to read reports. cloud-audit-mcp is designed for AI agents to take action.

Quick Start

Install

git clone https://github.com/badchars/cloud-audit-mcp.git
cd cloud-audit-mcp
bun install

Connect to your AI agent

claude mcp add cloud-audit bun run /path/to/cloud-audit-mcp/src/index.ts

{
  "mcpServers": {
    "cloud-audit": {
      "command": "bun",
      "args": ["run", "/path/to/cloud-audit-mcp/src/index.ts"],
      "env": {
        "AWS_PROFILE": "your-profile"
      }
    }
  }
}

Set up cloud credentials

The MCP server uses your existing cloud credentials. No extra API keys needed.

# AWS — any of these:
aws configure                              # interactive setup
export AWS_PROFILE=my-profile              # named profile
export AWS_ACCESS_KEY_ID=...               # explicit keys

# Azure
export AZURE_SUBSCRIPTION_ID=...           # required
az login                                   # interactive login (recommended)
# or: AZURE_TENANT_ID + AZURE_CLIENT_ID + AZURE_CLIENT_SECRET

# GCP
export GCP_PROJECT_ID=my-project           # required
gcloud auth application-default login      # interactive login (recommended)
# or: GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json

Start auditing

You: "Check my AWS account for critical security issues"

That's it. The agent handles the rest.

What The AI Can Do

Targeted Security Audit

You: "I'm worried about data exposure in our S3 buckets and Lambda functions"

Agent: → aws_check_s3_public
         Found 2 public buckets: "staging-assets" and "client-uploads"
       → aws_check_s3_objects
         "client-uploads" contains 847 .sql files and 12 .pem files
       → aws_check_lambda_env
         Lambda "process-uploads" has DATABASE_URL with plaintext credentials
       → "Critical: Your upload pipeline has public S3 + Lambda with DB creds.
          An attacker could download SQL dumps AND get your database password.
          Fix: 1) Block public access  2) Move creds to Secrets Manager"

Multi-Cloud Posture Review

You: "Audit all three cloud accounts and give me the top 10 issues"

Agent: → cloud_run_all {provider: "aws"}     (13 checks)
       → cloud_run_all {provider: "azure"}   (13 checks)
       → cloud_run_all {provider: "gcp"}     (8 checks)
       → cloud_audit_summary
       → cloud_audit_report
       → "34 total findings across 3 clouds.
          Top 3 critical:
          1. AWS: IAM policy allows privilege escalation via CreatePolicyVersion
          2. Azure: SQL Server firewall allows 0.0.0.0/0
          3. GCP: 4 instances have cloud-platform scope (full API access)"

Privilege Escalation Detection

You: "Can anyone escalate privileges in our AWS account?"

Agent: → aws_check_iam_policies
         Found PassRole + CreateFunction combo on role "dev-deploy-role"
         Found CreatePolicyVersion on user "ci-bot"
       → aws_check_lambda_permissions
         "ci-bot" has UpdateFunctionCode on all Lambda functions
       → "Two escalation paths:
          1. dev-deploy-role can create a Lambda with any role → admin
          2. ci-bot can inject code into any Lambda AND create policy versions
          Both should be restricted immediately."

Pre-Pentest Cloud Recon

You: "We have a pentest next week. What would an attacker find?"

Agent: → aws_check_ec2_imds        → 12 instances with IMDSv1 (SSRF → creds)
       → aws_check_ec2_snapshots   → 3 unencrypted public snapshots
       → aws_check_api_gateway     → 7 endpoints with no auth
       → aws_check_secrets_manager → 1 secret with Principal: "*"
       → "Attacker's likely path: public API Gateway → SSRF on EC2 →
          IMDSv1 credential theft → access SecretsManager secret →
          pivot to production database. Priority fixes: IMDSv2 + API auth"

Azure Container Security

You: "Check our Azure container infrastructure"

Agent: → azure_check_acr       → Admin user enabled on 2 registries
       → azure_check_functions → 3 Function Apps with anonymous auth
       → azure_check_keyvault  → Key Vault allows all networks
       → azure_check_webapp    → SCM basic auth enabled, 5 connection strings with passwords
       → "Your container supply chain is exposed:
          ACR admin creds can push malicious images,
          Functions run without auth, and Key Vault is network-open."

GCP Kubernetes Audit

You: "How secure are our GKE clusters?"

Agent: → gcp_check_kubernetes   → Legacy ABAC enabled, no Workload Identity
       → gcp_check_metadata     → 8 nodes with cloud-platform scope
       → gcp_check_iam_keys     → 3 SA keys older than 365 days
       → gcp_check_iam_delegation → Token Creator role on 2 SAs
       → "Your GKE setup has multiple escalation paths:
          Pods use node SA with full cloud-platform scope → can access all GCP APIs.
          Workload Identity not configured → any pod can steal node credentials.
          Recommendation: Enable Workload Identity + restrict scopes."

Tools Reference (38 tools)

AWS (13 tools)

Azure (13 tools)

GCP (8 tools)

Meta (4 tools)

Check Registry (60+ checks)

Every check maps to industry standards where applicable.

Architecture

cloud-audit-mcp/
├── src/
│   ├── index.ts                 Entry point + ToolContext builder
│   ├── types/
│   │   └── index.ts             CheckResult, Severity, ToolDef, ToolContext
│   ├── protocol/
│   │   ├── mcp-server.ts        MCP server (stdio transport)
│   │   └── tools.ts             38 tool definitions (Zod schemas)
│   ├── aws/                     13 tools, 10 files
│   │   ├── client.ts            Lazy SDK factory (cached per region)
│   │   ├── s3.ts                S3-001, S3-002, S3-003
│   │   ├── iam.ts               IAM-001, IAM-002, IAM-003
│   │   ├── ec2.ts               EC2-001, EC2-002, EC2-003
│   │   ├── lambda.ts            LAMBDA-001, LAMBDA-002, LAMBDA-003
│   │   ├── ecr.ts               ECR-001, ECR-002
│   │   ├── secrets.ts           SM-001
│   │   ├── dynamodb.ts          DYNAMO-001, DYNAMO-002
│   │   ├── apigw.ts             APIGW-001
│   │   └── sagemaker.ts         SAGE-001
│   ├── azure/                   13 tools, 11 files
│   │   ├── client.ts            DefaultAzureCredential factory
│   │   ├── storage.ts           STOR-001, STOR-002, STOR-003
│   │   ├── automation.ts        AUTO-001, AUTO-002, AUTO-003
│   │   ├── vm.ts                VM-001, VM-002, VM-004, VM-005
│   │   ├── ad.ts                AAD-001, AAD-002
│   │   ├── logic.ts             LOGIC-001
│   │   ├── functions.ts         FUNC-001, FUNC-002
│   │   ├── keyvault.ts          KV-001, KV-002
│   │   ├── acr.ts               ACR-001, ACR-002
│   │   ├── sql.ts               SQL-001, SQL-002
│   │   └── webapp.ts            WEBAPP-001, WEBAPP-002, WEBAPP-003
│   ├── gcp/                     8 tools, 6 files
│   │   ├── client.ts            ADC factory
│   │   ├── storage.ts           GCS-001, GCS-002, GCS-003
│   │   ├── metadata.ts          META-001, META-002, META-003
│   │   ├── iam.ts               IAM-001g, IAM-002g, IAM-003g, IAM-004g
│   │   ├── kubernetes.ts        K8S-001, K8S-002, K8S-003, K8S-004
│   │   └── gcr.ts               GCR-001
│   └── meta/                    4 tools
│       ├── list-checks.ts       Check registry (60+ entries)
│       ├── summary.ts           Finding aggregation
│       ├── report.ts            Markdown/JSON report generation
│       └── run-all.ts           Run all provider checks
└── knowledge/                   Security check knowledge base (8 files)

Design Decisions

How It Works

┌──────────────────────────────────────────────────────────────┐
│                        AI Agent                               │
│                                                               │
│  "Check S3 for public access"                                │
│         │                                                     │
│         ▼                                                     │
│  ┌─────────────┐    ┌──────────────┐    ┌──────────────┐     │
│  │  MCP Client  │───▶│  MCP Server  │───▶│  Tool Router │     │
│  │  (stdio)     │    │  (38 tools)  │    │  (Zod valid) │     │
│  └─────────────┘    └──────────────┘    └──────┬───────┘     │
│                                                 │             │
│         ┌───────────────────┬───────────────────┤             │
│         ▼                   ▼                   ▼             │
│  ┌─────────────┐    ┌─────────────┐    ┌─────────────┐      │
│  │  AWS Module  │    │ Azure Module│    │  GCP Module  │      │
│  │  (SDK v3)    │    │  (ARM SDK)  │    │  (Cloud SDK) │      │
│  └──────┬──────┘    └──────┬──────┘    └──────┬──────┘      │
│         │                   │                   │             │
│         ▼                   ▼                   ▼             │
│  ┌─────────────────────────────────────────────────────┐     │
│  │              CheckResult[] (uniform format)          │     │
│  │  { checkId, severity, status, resource, remediation }│     │
│  └──────────────────────┬──────────────────────────────┘     │
│                         │                                     │
│                         ▼                                     │
│  ┌─────────────────────────────────────────────────────┐     │
│  │           Findings Store (session-scoped)            │     │
│  │  → cloud_audit_summary → cloud_audit_report          │     │
│  └─────────────────────────────────────────────────────┘     │
└──────────────────────────────────────────────────────────────┘

Related Projects

Limitations

• Read-only — does not modify cloud resources (by design)
• Requires existing cloud credentials (AWS profiles, Azure CLI, gcloud ADC)
• Azure AD checks (AAD-001, AAD-002) require Microsoft Graph API (stubbed)
• GCP IAM checks use REST API calls (not all exposed via SDK)
• Session findings are in-memory only (lost on restart)

For authorized security testing and cloud posture assessment only.
Always ensure you have proper authorization before auditing cloud accounts.

MIT License • Built with Bun + TypeScript • Part of Agentic AI for Offensive Cybersecurity