cloud-audit MCP server

<!-- mcp-name: io.github.gebalamariusz/cloud-audit --> cloud-audit

English | 简体中文

What can a hijacked AI agent reach in your AWS account, and can you prove it?

Open-source, read-only AWS security scanner. 110 checks, 64 IAM privilege-escalation methods, 31 attack-chain rules, blast radius for any resource, and agent-blast for Bedrock Agents and AgentCore: what a prompt-injected or credential-stolen agent can reach, with the IAM policy simulator as the witness. Every finding ships an AWS CLI + Terraform fix. Nothing is written to your account.

30-second demo - agent-blast - Full scan - What's inside - Proof Mode - Installation - Documentation

Thirty seconds, no AWS account needed

pip install cloud-audit

cloud-audit agent-blast --demo          # a hijacked Bedrock Agent, two threat models, one screen
cloud-audit demo --save demo.json       # a full sample scan, then explore it offline:
cloud-audit blast-radius --report demo.json --resource arn:aws:iam::123456789012:role/support-bot-ticket-role
cloud-audit simulate     --report demo.json --fix aws-iam-018
cloud-audit exposure     --report demo.json

The sample account is invented. Everything derived from it (attack chains, root causes, breach cost, security graph, agent reach) is produced by the same engines a real scan uses.

With credentials, the real thing is one command and read-only. The AWS-managed SecurityAudit policy covers every check (permissions):

cloud-audit scan                         # default profile and region
cloud-audit scan --verify                # plus IAM policy-simulator proof for escalation paths
cloud-audit agent-blast --verify         # then: what your agents can reach, simulator-confirmed

agent-blast: what a hijacked AI agent can reach

An AI agent in AWS is a bundle of IAM identities: the role the agent runs as, the execution roles of the Lambda functions behind its tools, the roles of its knowledge bases, gateways and sandboxes. When the agent is hijacked, the attacker acts with those identities. agent-blast answers what that means, per agent, under two threat models:

Shortened. The full README is on GitHub.