About AWS Security
AWS Security is an MCP server in the Cloud category: mCP Server for AWS security scanning.
Install
claude mcp add aws-security -- npx -y aws-security-mcpnpx -y aws-security-mcpThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Tools (34)
detect_servicesDetect enabled AWS security services and assess maturity
Parameters not published.
generate_html_reportGenerate a professional HTML report
Parameters not published.
generate_hw_defense_reportGenerate an HW Defense HTML report (SOP-organized, findings grouped by CVE/control-ID)
Parameters not published.
generate_maturity_reportGenerate a security maturity assessment
Parameters not published.
generate_mlps3_html_reportGenerate a MLPS Level 3 HTML compliance report
Parameters not published.
generate_mlps3_reportGenerate a MLPS Level 3 compliance report
Parameters not published.
generate_reportGenerate a Markdown report from scan results
Parameters not published.
get_setup_templateGet CloudFormation StackSet template for cross-account audit role
Parameters not published.
list_groupsList available scan groups
Parameters not published.
list_modulesList available scan modules with descriptions
Parameters not published.
Show all 34 tools
list_org_accountsList all accounts in AWS Organization
Parameters not published.
save_resultsSave scan results for the dashboard
Parameters not published.
scan_access_analyzer_findingsCheck if Access Analyzer is enabled (findings via Security Hub)
Parameters not published.
scan_allRun all 20 security scanners in parallel (supports org_mode)
Parameters not published.
scan_and_reportRun full scan + generate all reports in one step. Saves HTML/MLPS/HW/MD reports to `~/.aws-security/reports/`. Avoids large data transfer
Parameters not published.
scan_config_rules_findingsCheck if Config is enabled (findings via Security Hub)
Parameters not published.
scan_disaster_recoveryAssess disaster recovery readiness
Parameters not published.
scan_dns_danglingDetect dangling DNS records (subdomain takeover risk)
Parameters not published.
scan_ecr_image_cveDeep-scan ECR image layers for critical/high CVEs missed by ECR Basic/Inspector Enhanced scanning; reports gap/confirmed/reverse-gap vs official results
Parameters not published.
scan_groupRun a predefined group of scanners for a specific scenario
Parameters not published.
scan_guardduty_findingsCheck if GuardDuty is enabled (findings via Security Hub)
Parameters not published.
scan_iam_privilege_escalationDetect IAM privilege escalation paths
Parameters not published.
scan_idle_resourcesFind unused/idle resources
Parameters not published.
scan_imdsv2_enforcementCheck EC2 instances for IMDSv2 enforcement
Parameters not published.
scan_inspector_findingsCheck if Inspector is enabled (findings via Security Hub)
Parameters not published.
scan_network_reachabilityAnalyze true network reachability (SG + NACL rules)
Parameters not published.
scan_patch_compliance_findingsAggregate findings from SSM Patch Compliance
Parameters not published.
scan_public_access_verifyVerify actual public accessibility of resources
Parameters not published.
scan_secret_exposureCheck Lambda env vars and EC2 userData for exposed secrets
Parameters not published.
scan_security_hub_findingsAggregate findings from AWS Security Hub
Parameters not published.
scan_ssl_certificateCheck ACM certificates for expiry and failed status
Parameters not published.
scan_tag_complianceCheck resources for required tags
Parameters not published.
scan_trusted_advisor_findingsAggregate findings from AWS Trusted Advisor
Parameters not published.
scan_waf_coverageCheck internet-facing ALBs for WAF Web ACL protection
Parameters not published.
Ask AI
Ask AI about AWS Security
Powered by Claude · Grounded in docs
Security checks
6 checks have not been run yet.