awslabs.cloudtrail-mcp-server

v0.0.15 suspicious
5.0
Medium Risk

An AWS Labs Model Context Protocol (MCP) server for cloudtrail

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package shows moderate risk due to its capability to harvest AWS credentials, which could lead to unauthorized access if misused. While there are no immediate signs of malicious activity, the credential harvesting feature warrants further scrutiny.

  • Credential risk due to potential harvesting of AWS credentials
  • No network or shell risks detected
Per-check LLM notes
  • Network: No network calls detected, which is normal for packages not requiring external API interactions.
  • Shell: No shell execution patterns detected, indicating the package does not execute external commands.
  • Obfuscation: The observed pattern is a standard method for extending package paths and does not indicate malicious obfuscation.
  • Credentials: The code snippet indicates potential harvesting of AWS credentials from environment variables, which could be used for unauthorized access if not properly secured.
  • Metadata: The author has only one package, suggesting it might be a new or less active account, but no other red flags are present.

📦 Package Quality Overall: Medium (6.6/10)

✦ High Test Suite 9.0

Test suite present — 7 test file(s) found

  • Test runner config found: conftest.py
  • Test runner config found: pyproject.toml
  • 7 test file(s) detected (e.g. __init__.py)
◈ Medium Documentation 7.0

Some documentation present

  • Documentation URL: "docs" -> https://awslabs.github.io/mcp/servers/cloudtrail-mcp-server/
  • Detailed PyPI description (7884 chars)
○ Low Contributing Guide 2.0

No contributing guide or governance files found

  • No CONTRIBUTING, CODE_OF_CONDUCT, or governance files found
◈ Medium Type Annotations 5.0

Partial type annotation coverage

  • 11 type-annotated function signatures detected in source
✦ High Multiple Contributors 10.0

Active multi-contributor project

  • 42 unique contributor(s) across 100 commits in awslabs/mcp
  • Active community — 5 or more distinct contributors

🔬 Heuristic Checks

✓ Outbound Network Calls

No suspicious network call patterns found

⚠ Code Obfuscation score 2.0

Found 1 obfuscation pattern(s)

  • amespace packages. __path__ = __import__('pkgutil').extend_path(__path__, __name__) # Copyright Amazon.com, In
✓ Shell / Subprocess Execution

No shell execution patterns detected

⚠ Credential Harvesting score 2.5

Found 1 credential access pattern(s)

  • if aws_profile := os.environ.get('AWS_PROFILE'): return boto3.Session(profile_name
✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

Email domain looks legitimate: amazon.com>

✓ Suspicious Page Links

All external links appear legitimate

✓ Git Repository History

Repository awslabs/mcp appears legitimate

⚠ Maintainer History score 2.0

1 maintainer concern(s) found

  • Author "Amazon Web Services" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with awslabs.cloudtrail-mcp-server 
Build a simple Python application using the awslabs.cloudtrail-mcp-server package to demonstrate its core features.

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!