cloudtrail_describe_trailsLABSCO SUMMARY
Scoped to investigation, which is why the service list is the one it is.
The choice of services is the product: trail plus config for the who and when, Athena for data events at volume, GuardDuty and IAM Access Analyzer for what already looked wrong, and Network Access Analyzer for whether the path was even open. Authentication is a named AWS profile, so the permissions it has are the permissions you already granted that profile — scope it read-only before pointing an agent at it.
What it is
A Python server aimed at incident responders. It fronts the AWS services an investigation actually touches, so a question like "what did this IP do last week" resolves across several of them at once rather than one console at a time.
What you get
- CloudTrail management event logs for API activity, and Amazon Athena for SQL queries over those logs
- CloudWatch for operational logs and ad hoc analysis
- Amazon GuardDuty findings for threat detection and investigation
- AWS Config for resource configuration history and compliance state
- VPC Flow Logs for network traffic metadata
- Network Access Analyzer for reachability across security groups, NACLs and VPCs, and IAM Access Analyzer for policy and resource-based access findings
- Together they answer who did what, when and where; whether data events touched a given bucket; and whether a path is actually reachable
Requirements
An AWS profile with read access to those services, named in AWS_PROFILE. Install uv, clone the repository, create the virtual environment, then launch with uv --directory <YOUR_PATH_TO_AWS_IREVEAL_MCP> run server.py. The Python package is aws-ireveal-mcp, version 0.1.0.
Setup effort
Build from source — clone the repository, then follow the steps on this page and add the configuration for your client
USE CASES
01
Tracing what an IP address did
Ask for activity by that address over a window and let it pull from the trail rather than filtering in the console.
02
Checking whether a sensitive bucket was touched
Query data events for buckets matching a name over the last week.
03
Turning GuardDuty findings into next steps
Ask for remediations for the high-risk findings from the last couple of days.
04
Explaining a compliance failure
Identify non-compliant resources, get the violated rule explained, and take a suggested fix.
25 tools
Listed in project docs. Your client may show a different list.
cloudtrail_lookup_eventsathena_create_cloudtrail_tableathena_query_eventscloudwatch_describe_log_groupscloudwatch_list_log_streamscloudwatch_filter_log_eventsec2_describe_flow_logsguardduty_list_detectorsguardduty_list_findingsguardduty_get_findingsguardduty_get_finding_statisticsconfig_describe_recorder_statusconfig_list_discovered_resourcesconfig_get_resource_config_historyconfig_describe_compliance_by_resourceconfig_describe_config_rulesnetworkinsights_list_scopesnetworkinsights_list_analysesnetworkinsights_get_findingsnetworkinsights_start_analysisaccessanalyzer_list_analyzersaccessanalyzer_get_analyzeraccessanalyzer_list_findingsaccessanalyzer_get_findingBEFORE YOU INSTALL
What to know first
Tools you get
25 tools named in the project's documentation.
Requires
- uv on PATH
- AWS_PROFILE in your environment
Where it runs
The documented client runs the server on your machine.
INSTALLATION
Connect your client
Clone the repository, then follow the steps on this page and add the configuration for your client. This one is built from source rather than installed with a single command.
Server setup
Setup
TERMINAL
curl -Ls https://astral.sh/uv/install.sh | sh
git clone https://github.com/Brucedh/aws-ireveal-mcp.git
cd aws-ireveal-mcp
uv venv
source .venv/bin/activateuv
TERMINAL
uv --directory <YOUR_PATH_TO_AWS_IREVEAL_MCP> run server.pyMCP Clients
Any MCP client
ANY MCP CLIENT · JSON
{
"mcpServers": {
"aws-ireveal": {
"command": "uv",
"args": [
"--directory",
"<YOUR_PATH_TO_AWS_IREVEAL_MCP>",
"run",
"server.py"
],
"env": {
"AWS_PROFILE": "<YOUR_PROFILE>"
}
}
}
}
