Cloud AuditBLOCK
Fast, opinionated AWS security scanner. Curated checks. Zero noise. Copy-paste fixes.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
cloud-audit
English | 简体中文
What can a hijacked AI agent reach in your AWS account, and can you prove it?
Open-source, read-only AWS security scanner. 110 checks, 64 IAM privilege-escalation methods, 31 attack-chain rules, blast radius for any resource, and agent-blast for Bedrock Agents and AgentCore: what a prompt-injected or credential-stolen agent can reach, with the IAM policy simulator as the witness. Every finding ships an AWS CLI + Terraform fix. Nothing is written to your account.
30-second demo - agent-blast - Full scan -
d407f5b512cbOBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add cloud-audit -- uvx cloud-audit==2.5.0
Exposed tools (7)
6 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
get_agent_blast | read | What can a hijacked AI agent reach in this AWS account? |
get_attack_chains | read | Get all detected attack chains from the last scan. |
get_findings | read | Get findings from the last scan, optionally filtered. |
get_health_score | read | Get the current health score and risk exposure summary. |
get_remediation | read | Get remediation details (CLI command + Terraform code) for a specific check. |
list_checks | read | List all available security checks (no AWS credentials needed). |
scan_aws | write | Run an AWS security scan and return a summary. |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (7 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (13)
f"at 169.254.169.254 and steal IAM role credentials."
verify = False
"AML.T0086": "Exfiltration via AI Agent Tool Invocation",
NodeStatus = Literal["external", "safe", "compromised", "exploited", "stolen", "exfiltrated"]
"actionTitle": "Data exfiltrated from storage",
status="exfiltrated",
f"can access the database from the internet, exfiltrate "
.cloud-audit.example.yml
.pre-commit-hooks.yaml
│ access IMDS credentials, and gain full admin access to the │
assets/blast-audit-boardroom.png
assets/blast-audit-counterfactual.png
assets/blast-audit-hero.png
Gates applied: no_behavioural_pass.
d407f5b512cbfull audit observations/trust-audit/mcp-server/gebalamariusz__cloud-audit-1.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | d407f5b512cb | BLOCK | D | 69 | first audit |
Questions
What is the Cloud Audit MCP server?
Fast, opinionated AWS security scanner. Curated checks. Zero noise. Copy-paste fixes.
What tools does Cloud Audit expose?
7 in total: 6 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Cloud Audit safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does Cloud Audit need?
No credential environment variables were found in its source, so it appears to need none.
How does Cloud Audit run?
It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as cloud-audit.
How current is this page?
The grade is for one exact copy of the source (d407f5b512cb), read on 2026-10-07. The repository is watched and re-audited when it changes.