# Aws Ireveal Mcp

> MCP server for incident response in AWS

- **Type:** MCP server
- **Install:** `agentstack add mcp-sysdiglabs-aws-ireveal-mcp`
- **Verified:** Pending review
- **Seller:** [sysdiglabs](https://agentstack.voostack.com/s/sysdiglabs)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [sysdiglabs](https://github.com/sysdiglabs)
- **Source:** https://github.com/sysdiglabs/aws-ireveal-mcp

## Install

```sh
agentstack add mcp-sysdiglabs-aws-ireveal-mcp
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# AWS‑IReveal‑MCP

**AWS‑IReveal‑MCP** is a Model Context Protocol (MCP) server designed to give security teams and incident responders a unified interface to AWS services useful for investigation. By connecting AWS‑IReveal‑MCP to any MCP client (such as Claude Desktop or Cline), you can invoke queries and analyses across multiple AWS services without leaving your LLM‑driven workspace.

## Features

AWS‑IReveal‑MCP integrates with the following AWS services and functionalities:

- **CloudTrail** — Management event logs for API activity  
- **Amazon Athena** — SQL queries over CloudTrail logs  
- **CloudWatch** — Operational logs and ad hoc analysis  
- **Amazon GuardDuty** — Threat detection and finding investigation  
- **AWS Config** — Resource configuration history and compliance status  
- **VPC Flow Logs** — Network traffic metadata for forensic analysis  
- **Network Access Analyzer** — Reachability checks across SG/NACL/VPC  
- **IAM Access Analyzer** — Policy and resource‑based access findings  

Together, these services let you  
- Trace “who did what, when, and where” (CloudTrail, Config)  
- Examine detailed data events (Athena)  
- Search and visualize logs (CloudWatch, VPC Flow Logs)  
- Surface security alerts (GuardDuty, IAM Access Analyzer)  
- Verify network reachability and configuration (Network Access Analyzer)  

### Example Prompts

- analyze activity by IP x.x.x.x in the last 5 days
- analyze activity by role 'sysadmin' in the last 24 hours
- investigate suspicious activity on cloudtrail in the last 7 days on us-west-2
- is there any data event on buckets with name containing 'customers' in the last 7 days?
- investigate cloudwatch logs related to Bedrock
- propose remediations for GuardDuty findings with high risk happened in the last 2 days
- identify non-compliant resources, explain violated rules, and suggest remediation

## Installation

### Prerequisites

- Install UV with:
```bash
curl -Ls https://astral.sh/uv/install.sh | sh
```
- Clone the repo and set up the environment (this will install the required dependencies):
```bash
git clone https://github.com/sysdiglabs/aws-ireveal-mcp.git
cd aws-ireveal-mcp
uv venv
source .venv/bin/activate
```

### Configuration
Add the following configuration to your MCP client's settings file:

```
{
  "mcpServers": {
    "aws-ireveal": {
      "command": "uv",
      "args": [
        "--directory",
        "/path_to_your/aws-ireveal-mcp",
        "run",
        "server.py"
      ],
      "env": {
        "AWS_PROFILE": ""
      }
    }
  }
}
```

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [sysdiglabs](https://github.com/sysdiglabs)
- **Source:** [sysdiglabs/aws-ireveal-mcp](https://github.com/sysdiglabs/aws-ireveal-mcp)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: flagged — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-sysdiglabs-aws-ireveal-mcp
- Seller: https://agentstack.voostack.com/s/sysdiglabs
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.