aws-ireveal-mcp by Brucedh - MCP Server

AWS‑IReveal‑MCP is a specialized server designed to streamline the process of security investigations and incident response by integrating multiple AWS services into a single interface. This server allows security teams to efficiently query and analyze data across various AWS services without leaving their LLM-driven workspace. By leveraging the capabilities of AWS services such as CloudTrail, Amazon Athena, CloudWatch, Amazon GuardDuty, AWS Config, VPC Flow Logs, Network Access Analyzer, and IAM Access Analyzer, AWS‑IReveal‑MCP provides comprehensive insights into security events and configurations. This integration enables users to trace activities, examine data events, visualize logs, surface security alerts, and verify network configurations, all from a unified platform. The server is particularly useful for tracing user activities, investigating suspicious events, and ensuring compliance with security policies.

Features

Integration with AWS services like CloudTrail, Athena, and GuardDuty for comprehensive security analysis.
Unified interface for querying and analyzing data across multiple AWS services.
Ability to trace user activities and investigate suspicious events.
Visualization of logs and network traffic metadata for forensic analysis.
Verification of network reachability and configuration compliance.

Usages

usage with Claude Desktop

{
  "mcpServers": {
    "aws-ireveal": {
      "command": "uv",
      "args": [
        "run",
        "/path/to/aws-ireveal-mcp/server.py"
      ],
      "env": {
        "AWS_PROFILE": "<YOUR_PROFILE>"
      }
    }
  }
}

usage with Cline

{
  "mcpServers": {
    "aws-ireveal": {
      "command": "uv",
      "args": [
        "run",
        "/path/to/aws-ireveal-mcp/server.py"
      ],
      "env": {
        "AWS_PROFILE": "<YOUR_PROFILE>"
      }
    }
  }
}