security_coverage

Graph · From docs/MCP_TOOLS.md on GitHub

Category graph · sensitivity confidential · capabilities read_state · readOnly true, destructive false, idempotent true, openWorld false · outputSchema no · timeout: layer default (300 s)

Which security services are enabled per account and region, and which workloads nothing watches. services_by_account_region maps account to region to service to an enabled flag, built from every asset whose metadata has a security_service key (GuardDuty detectors, Security Hub, Inspector and so on, whatever the collectors recorded). gaps lists account/region: service strings for services recorded as disabled. workloads_without_vulnerability_scanning lists EC2 instances, container registries and Lambda functions that no enabled VULNERABILITY_SCANNER asset MONITORS (items have name, arn, type, account_id, region); Azure and GCP compute types are not checked. internet_facing_without_waf lists internet-exposed load balancers, API gateways and CloudFront distributions without an incoming PROTECTS edge (name, arn, type, account_id). Each list is {total, returned, truncated, items} capped at limit.

Argument	Type	Default	Constraints	Description
limit	integer	50	1..500	Cap on each of the three lists.
dataset	string	""		Dataset name (see list_datasets). Empty = the active dataset.

Called with the arguments below, security_coverage returned this structuredContent.

{}

{
  "dataset": "sample",
  "services_by_account_region": {
    "111111111111": {
      "us-east-1": {
        "guardduty": true,
        "securityhub": false,
        "inspector": true
      }
    }
  },
  "gaps": {
    "total": 1,
    "returned": 1,
    "truncated": false,
    "items": [
      "111111111111/us-east-1: securityhub"
    ]
  },
  "workloads_without_vulnerability_scanning": {
    "total": 4,
    "returned": 4,
    "truncated": false,
    "items": [
      {
        "name": "web-2",
        "arn": "arn:aws:ec2:us-east-1:111111111111:instance/i-0web2",
        "type": "EC2",
        "account_id": "111111111111",
        "region": "us-east-1"
      },
      {
        "name": "bastion",
        "arn": "arn:aws:ec2:us-east-1:111111111111:instance/i-0bast",
        "type": "EC2",
        "account_id": "111111111111",
        "region": "us-east-1"
      },
      "... 2 more"
    ]
  },
  "internet_facing_without_waf": {
    "total": 1,
    "returned": 1,
    "truncated": false,
    "items": [
      {
        "name": "public-api",
        "arn": "arn:aws:apigateway:us-east-1::/restapis/a1b2c3",
        "type": "API_GATEWAY",
        "account_id": "111111111111"
      }
    ]
  }
}