cloud-audit: AWS security audit for agents
cloud-audit
A read-only AWS security scanner: 110 checks, attack chains and the reach of a hijacked AI agent, plus an MCP server
- 75 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Reads the configuration of the whole AWS account, including roles, policies and resources
- The report holds a map of privilege-escalation paths and suits only your own account
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/cloud-auditDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Reads the configuration of the whole AWS account, including roles, policies and resources
- The report holds a map of privilege-escalation paths and suits only your own account
This is third-party code. Review the repository files before installing.
What it does
cloud-audit scans your AWS account and reports what is reachable for an attacker. The scanner reads the account, runs 110 checks across 25 AWS services, looks for 64 IAM privilege-escalation methods, folds findings into 31 attack-chain rules and computes the blast radius of any resource. Each finding ships with an AWS CLI fix and a Terraform snippet. The `agent-blast` command answers what a hijacked Bedrock or AgentCore agent can reach. It takes the roles of the agent itself, the execution roles of its Lambda tools, knowledge bases and gateways and computes reach under two models: identity takeover and behaviour takeover through prompt injection. With the `--verify` flag the IAM policy simulator confirms the result. The `cloud-audit-mcp` server hands an agent 7 read-only tools, including `get_agent_blast`. A demo without an account runs with `cloud-audit demo --save demo.json` on an invented account.
Who it is for. Security and DevOps engineers who own AWS accounts and want to check role permissions and Bedrock AI agents.
Good fit when
- Before a release you want to know which roles can escalate through `iam:PassRole` and Lambda
- You run a Bedrock agent with Lambda tools and need to know what a prompt injection would reach
- An auditor needs a report with ready AWS CLI and Terraform fixes
- You want to see the scanner without an account: `cloud-audit agent-blast --demo`
Not a fit when
- You need an Azure or Google Cloud check: the scanner covers AWS only
- You expect a pentest with exploitation: the tool changes nothing in the account and only reads configuration
- Even read access to account metadata cannot be granted
Example request
Scan my AWS account and show which roles can escalate privileges and what the support-bot agent can reach.MCP
- Transport
- stdio
- Authentication
- API key
Limitations
The scanner reads configuration through AWS credentials and covers every check with the AWS-managed `SecurityAudit` policy. `--verify` needs the `iam:SimulatePrincipalPolicy` permission. The simulator evaluates identity policies, permission boundaries and SCPs, while target resource policies, RCPs and VPC network paths stay outside the evaluation.
Anything unread (a denied region, a tool with no IAM identity) is flagged in the report as a coverage note. A remote MCP server behind an agent gateway stays unassessed. The MCP part is installed with `claude mcp add cloud-audit -- uvx --from cloud-audit cloud-audit-mcp`.
How to disable. Run `claude mcp remove cloud-audit` and remove the AWS profile you gave the server.
FAQ
What does cloud-audit change in my AWS account?
Nothing: the scanner only reads, and the `SecurityAudit` permission is enough for all 110 checks.
How do I try cloud-audit without an AWS account?
With `cloud-audit demo --save demo.json` or `cloud-audit agent-blast --demo`: both run on an invented account.
What does agent-blast show?
For each Bedrock agent it shows what is reachable after a role takeover and after a prompt injection, confirmed by the IAM simulator with `--verify`.
How many tools does the MCP server have?
Seven, all read-only; one of them, `get_agent_blast`, returns the same report as the CLI.
Which AWS permissions does the scanner need?
The AWS-managed `SecurityAudit` policy is enough, and `--verify` adds `iam:SimulatePrincipalPolicy`.
Discussion
No questions or reviews yet.
Related
MCP serversA static scanner for vulnerabilities in AI agent code and MCP configs with 66 rules mapped to OWASP Agentic Top 10
A scanner that finds leaked keys, dangerous access and connected models in MCP configs of Claude Desktop, Cursor and VS Code.
Security scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.
A CLI for auditing agent MCP servers: inventory, evidence per server and a CI policy where unmeasured never counts as clean
A code security audit skill by Cloudflare: the agent runs recon, coverage-led hunting and independent verification of findings, then produces a structured repor
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| cloud-audit: AWS security audit for agents (this card) | no | API key | 75 | |
| Automated Security Response on AWS | no | 489 | responds to findings automatically; cloud-audit only reads and explains attack paths | |
| ClawSecCheck | no | 59 | checks the safety of an agent environment; cloud-audit checks an AWS account |
README in short
The README opens with a demo that needs no account, then explains `agent-blast`, a full scan, proof mode through the IAM simulator and installation with pip, uvx and Docker. It ends with a table of AWS permissions and a list of interfaces, including the MCP server.