Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/badchars/cloud-audit-mcp/claude-mdgit clone --depth 1 https://github.com/badchars/cloud-audit-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/badchars/cloud-audit-mcp/claude-md)<a href="https://agentmods.dev/instructions/badchars/cloud-audit-mcp/claude-md"><img src="https://agentmods.dev/badge/instructions/badchars/cloud-audit-mcp/claude-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00757 | $0.00757 |
| Opus 5 | $0.00378 | $0.00378 |
| Sonnet 5 | $0.00151 | $0.00151 |
| Haiku 4.5 | $0.00076 | $0.00076 |
Grade A, and why
cloud-audit-mcp CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cloud Audit MCP
Project Context
Bu proje hackbrowser-mcp'den sonra ikinci MCP projesi olarak planlandı. hackbrowser-mcp browser-based security testing yapıyor (39 tool, multi-container Firefox, injection testing). cloud-audit-mcp ise AWS/Azure/GCP misconfiguration detection yapacak — AI agent'a cloud API'lerini MCP üzerinden vererek.
Neden MCP?
Prowler, ScoutSuite, CloudSploit gibi araçlar var ama hepsi CLI/dashboard. Hiçbiri AI agent'a MCP üzerinden kontrol vermiyor. Fark: Prowler çalıştırırsın 200 sayfalık rapor gelir, sen okursun. Cloud audit MCP'de agent direkt cloud API'lerini çağırır, bulguları önceliklendirir, fix önerir.
Hedef Kullanım
User: "AWS hesabımda en kritik 5 misconfiguration'ı bul ve nasıl fix edileceğini söyle"
Agent: → AWS API'lerini çağırır (S3, IAM, SG, CloudTrail, RDS)
→ Bulguları severity'ye göre sıralar
→ Her biri için fix komutu verir
Taranacak Alanlar
AWS:
- S3 bucket public access, ACL, policy
- IAM: MFA, over-permissive policies, privilege escalation paths
- Security Groups: 0.0.0.0/0 açık portlar
- Lambda: env var'larda plaintext secret
- CloudTrail: logging açık mı?
- RDS/ElastiCache: public access
- EBS: unencrypted volumes
Azure:
- Storage account anonymous access
- NSG kuralları
- Managed Identity over-permission
- Key Vault access policy
GCP:
- Service account key export
- Firewall rules
- BigQuery public dataset
- Cloud Storage bucket ACL
Technical Stack
- Runtime: Bun + TypeScript (hackbrowser-mcp ile aynı)
- Protocol: MCP (stdio transport)
- SDK: @modelcontextprotocol/sdk
- Cloud SDKs: @aws-sdk/, @azure/identity + @azure/arm-, @google-cloud/*
- Architecture: hackbrowser-mcp pattern'i takip et — tools.ts (Zod schema), mcp-server.ts (stdio), ayrı provider dosyaları
Related Projects
- hackbrowser-mcp: https://github.com/badchars/hackbrowser-mcp — Browser-based security testing MCP (kardeş proje)
- recon0: https://github.com/badchars/recon0 — Bug bounty recon pipeline
- vuln-research: LLM-powered vulnerability analysis (Bun + TypeScript)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 75 lines · 757 tokens per session scan A 84e04002c6d0
cloud-audit-mcp CLAUDE.md is an instructions file published in the GitHub repository badchars/cloud-audit-mcp (21 stars, last pushed 5mo ago), licensed MIT. It adds 757 tokens to every session, about $0.0038 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
terraform-review-agent AGENTS.md
Instructions for infiniumtek/terraform-review-agent, covering agents.md, 1. project, 3. layout, 4. setup & hard rules and 5. required env vars (.env.example).
claude-aws-cost-saver CLAUDE.md
Instructions for prajapatimehul/claude-aws-cost-saver, covering aws cost optimization system, quick start, list all checks, view specific check and see required aws cli commands.
nix-ai AGENTS.md
AGENTS.md instructions for dryvist/nix-ai, a project described as: Your AI coding toolkit, declared in Nix — Claude, Gemini, Copilot, 15+ MCP servers, one flake.
cynative CLAUDE.md
Claude Code instructions for cynative/cynative, a project described as: Open-source framework for security agents with live, read-only access to your infrastructure. Audit AWS, GCP, Azure, Kubernetes, GitHub and GitLab as one system for privilege escalation, public exposure, leaked credentials and more, with agents…
cynative AGENTS.md
AGENTS.md instructions for cynative/cynative, covering agents.md, commands, architecture, conventions and ci and release.
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.