The choice of services is the product: trail plus config for the who and when, Athena for data events at volume, GuardDuty and IAM Access Analyzer for what already looked wrong, and Network Access Analyzer for whether the path was even open. Authentication is a named AWS profile, so the permissions it has are the permissions you already granted that profile — scope it read-only before pointing an agent at it.
A Python server aimed at incident responders. It fronts the AWS services an investigation actually touches, so a question like "what did this IP do last week" resolves across several of them at once rather than one console at a time.
- CloudTrail management event logs for API activity, and Amazon Athena for SQL queries over those logs
- CloudWatch for operational logs and ad hoc analysis
- Amazon GuardDuty findings for threat detection and investigation
- AWS Config for resource configuration history and compliance state
- VPC Flow Logs for network traffic metadata
- Network Access Analyzer for reachability across security groups, NACLs and VPCs, and IAM Access Analyzer for policy and resource-based access findings
- Together they answer who did what, when and where; whether data events touched a given bucket; and whether a path is actually reachable
An AWS profile with read access to those services, named in `AWS_PROFILE`. Install uv, clone the repository, create the virtual environment, then launch with `uv --directory <path> run server.py`. The Python package is `aws-ireveal-mcp`, version 0.1.0.
Build from source — clone the repository and build it, then point your client at the binary