This AWS Labs Model Context Protocol (MCP) server for CloudTrail enables your AI agents to query AWS account activity for security investigations, compliance auditing, and operational troubleshooting. It provides comprehensive access to CloudTrail events and CloudTrail Lake analytics, allowing agents to track API calls, analyze user activity, and perform advanced security analysis. This server gives AI agents seamless access to CloudTrail data through standardized MCP interfaces, eliminating the need for custom API integrations and enabling powerful security insights and audit capabilities.
This server provides the following tools for AI assistants:
Execute SQL queries against CloudTrail Lake for complex analytics and filtering. Supports Trino-compatible SQL syntax for advanced analysis
List available CloudTrail Lake Event Data Stores with their capabilities and event selectors
Get the status of a CloudTrail Lake query to monitor long-running queries
Get the results of a completed CloudTrail Lake query with pagination support for large result sets
Look up CloudTrail events based on various criteria such as username, event name, resource name, etc. Provides access to the last 90 days of management events with pagination support