aws-security-mcp 0.7.4 → 0.7.5

package/dist/bin/aws-security-mcp.js

@@ -205,7 +205,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z } from "zod";
 
 // src/version.ts
-var VERSION = "0.7.4";
+var VERSION = "0.7.5";
 
 // src/utils/aws-client.ts
 import { STSClient, GetCallerIdentityCommand } from "@aws-sdk/client-sts";
@@ -9256,8 +9256,9 @@ LOW      \u2192 P3 (Low)
 `;
 
 // src/index.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync as readFileSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
 import { join as join2, dirname } from "path";
+import { homedir as homedir2 } from "os";
 import { fileURLToPath } from "url";
 var MODULE_DESCRIPTIONS = {
   service_detection: "Detects which AWS security services (Security Hub, GuardDuty, Inspector, Config) are enabled and assesses security maturity.",
@@ -9898,6 +9899,79 @@ Deploy this as a StackSet from your Management Account to all member accounts.`
       }
     }
   );
+  server.tool(
+    "scan_and_report",
+    "Run a full security scan AND generate reports in one step. Avoids large data transfer between tools. Reports are saved to ~/.aws-security/reports/",
+    {
+      region: z.string().optional().describe("AWS region (default: server region)"),
+      org_mode: z.boolean().optional().describe("Enable multi-account org scanning"),
+      role_name: z.string().optional().describe("IAM role name for cross-account scanning"),
+      account_ids: z.array(z.string()).optional().describe("Filter to specific account IDs"),
+      reports: z.array(z.enum(["html", "hw_defense", "mlps3", "markdown", "all"])).optional().describe("Report types to generate (default: all)"),
+      lang: z.enum(["zh", "en"]).optional().describe("Language: zh or en (default: zh)")
+    },
+    async ({ region, org_mode, role_name, account_ids, reports, lang }) => {
+      try {
+        const r = region ?? defaultRegion;
+        const l = lang ?? "zh";
+        const reportTypes = reports ?? ["all"];
+        const wantAll = reportTypes.includes("all");
+        let result;
+        if (org_mode) {
+          result = await runMultiAccountScanners(allScanners, r, {
+            orgMode: true,
+            roleName: role_name ?? "AWSSecurityMCPAudit",
+            accountIds: account_ids
+          });
+        } else {
+          result = await runAllScanners(allScanners, r);
+        }
+        const baseDir = join2(homedir2(), ".aws-security", "reports", (/* @__PURE__ */ new Date()).toISOString().slice(0, 10));
+        mkdirSync2(baseDir, { recursive: true });
+        const savedFiles = [];
+        if (wantAll || reportTypes.includes("html")) {
+          const html = generateHtmlReport(result, void 0, l);
+          const p = join2(baseDir, "security-report.html");
+          writeFileSync2(p, html);
+          savedFiles.push(p);
+        }
+        if (wantAll || reportTypes.includes("hw_defense")) {
+          const html = generateHwDefenseHtmlReport(result, l);
+          const p = join2(baseDir, "hw-defense-report.html");
+          writeFileSync2(p, html);
+          savedFiles.push(p);
+        }
+        if (wantAll || reportTypes.includes("mlps3")) {
+          const html = generateMlps3HtmlReport(result, void 0, l);
+          const p = join2(baseDir, "mlps3-report.html");
+          writeFileSync2(p, html);
+          savedFiles.push(p);
+        }
+        if (wantAll || reportTypes.includes("markdown")) {
+          const md = generateMarkdownReport(result, l);
+          const p = join2(baseDir, "security-report.md");
+          writeFileSync2(p, md);
+          savedFiles.push(p);
+        }
+        saveResults(result);
+        const summary = summarizeResult(result, l);
+        const fileList = savedFiles.map((f) => `  ${f}`).join("\n");
+        return {
+          content: [{
+            type: "text",
+            text: `${summary}
+
+Reports saved:
+${fileList}
+
+Dashboard data updated.`
+          }]
+        };
+      } catch (err) {
+        return { content: [{ type: "text", text: `Error: ${err instanceof Error ? err.message : String(err)}` }], isError: true };
+      }
+    }
+  );
   server.resource(
     "security-rules",
     "security://rules",