Metadata-Version: 2.4
Name: aws-india-compliance
Version: 0.2.1
Summary: MCP server to assess AWS infrastructure against India's DPDP Act 2023, RBI Master Direction, and SEBI CSCRF
Project-URL: Homepage, https://github.com/aws-samples/sample-aws-india-compliance-mcp
Project-URL: Repository, https://github.com/aws-samples/sample-aws-india-compliance-mcp
Project-URL: Issues, https://github.com/aws-samples/sample-aws-india-compliance-mcp/issues
Project-URL: Documentation, https://github.com/aws-samples/sample-aws-india-compliance-mcp#readme
Author-email: Paramanand Mallik <paramanandmallik@gmail.com>
License-Expression: Apache-2.0
License-File: LICENSE
Keywords: aws,compliance,data-protection,dpdp,india,mcp,rbi,regulatory,sebi
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Financial and Insurance Industry
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Libraries
Classifier: Typing :: Typed
Requires-Python: >=3.10
Requires-Dist: boto3>=1.26.0
Requires-Dist: defusedxml>=0.7.1
Requires-Dist: mcp>=1.23.0
Requires-Dist: python-docx>=1.0.0
Description-Content-Type: text/markdown

# AWS India Compliance MCP Server

[![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
[![AWS](https://img.shields.io/badge/AWS-Samples-orange)](https://github.com/aws-samples)
[![MCP](https://img.shields.io/badge/MCP-Server-green)](https://modelcontextprotocol.io)
[![Python](https://img.shields.io/badge/Python-3.10+-yellow)](https://python.org)
[![PyPI](https://img.shields.io/pypi/v/aws-india-compliance)](https://pypi.org/project/aws-india-compliance/)
[![Tests](https://img.shields.io/badge/tests-28%20passing-brightgreen)]()

An MCP server that assesses AWS infrastructure against four Indian regulatory frameworks:

- **DPDP Act 2023** (Digital Personal Data Protection) + Rules 2025
- **RBI Master Direction** on IT Governance 2023
- **SEBI CSCRF 2024** (Cybersecurity and Cyber Resilience Framework)
- **CERT-In Directions 2022** (Incident reporting, log retention, NTP sync)

Works with Kiro, Claude Desktop, Cursor, or any MCP-compatible client.

**Important:** This tool provides automated assessment guidance based on
  published regulatory frameworks. It does not constitute legal advice or
  compliance certification. Organizations should consult qualified compliance
  and legal professionals for definitive regulatory compliance determinations.

**Cost notice:** The MCP server itself performs read-only API calls at no additional charge beyond standard AWS API request pricing. However, deploying conformance packs generated by this tool creates AWS Config rules in your account, which may incur [AWS Config pricing](https://aws.amazon.com/config/pricing/) charges. You are responsible for any costs incurred in your AWS account.

## Quick start

### 1. Add to your MCP client

No installation required. Add to your MCP config and `uvx` handles the rest:

```json
{
  "mcpServers": {
    "aws-india-compliance": {
      "command": "uvx",
      "args": ["aws-india-compliance@latest"]
    }
  }
}
```

This works if your default AWS credentials are already configured (via `~/.aws/credentials`, environment variables, or an active SSO session).

If you use a named profile, pass it explicitly:

```json
{
  "mcpServers": {
    "aws-india-compliance": {
      "command": "uvx",
      "args": ["aws-india-compliance@latest"],
      "env": {
        "AWS_PROFILE": "my-sso-profile"
      }
    }
  }
}
```

Add the config to your MCP client's settings file:
- **Kiro**: `.kiro/settings/mcp.json`
- **Claude Desktop**: `claude_desktop_config.json`
- **Claude Code**: `~/.claude/mcp.json`

**Requires [`uv`](https://docs.astral.sh/uv/getting-started/installation/) installed. On macOS: `brew install uv`**

### 2. Configure AWS credentials

The server needs read-only AWS access. Use **AWS IAM Identity Center (SSO)** — this is the recommended approach for teams.

**First-time SSO setup:**
```bash
aws configure sso
```
Follow the prompts:
- SSO session name: `my-sso` (any name)
- SSO start URL: your org's SSO URL (e.g., `https://d-xxxxxxxxxx.awsapps.com/start`)
- SSO region: `us-east-1` (or wherever your Identity Center is)
- It opens a browser — sign in and authorize
- Select the account and role (e.g., `ReadOnlyAccess`)
- CLI profile name: `my-sso-profile` (remember this)

**Login before each session:**
```bash
aws sso login --profile my-sso-profile
```
This opens a browser for authentication. Once approved, your CLI has temporary credentials for ~8 hours.

**Verify it works:**
```bash
aws sts get-caller-identity --profile my-sso-profile
```

**Alternative: static credentials (not recommended for teams)**
If you have long-lived access keys in `~/.aws/credentials`, those work too — but SSO is preferred for security.

### 3. Verify

Ask your MCP client:
> "List the DPDP control domains"

If it returns 10 domains, you're set. To scan your AWS account:
> "Scan my AWS account in ap-south-1 for DPDP and RBI compliance"

### Alternative: install from source (for development)

```bash
git clone https://github.com/aws-samples/sample-aws-india-compliance-mcp.git
cd sample-aws-india-compliance-mcp
pip install -e .
```

Then configure your MCP client to use the local install:
```json
{
  "mcpServers": {
    "aws-india-compliance": {
      "command": "aws-india-compliance",
      "env": {
        "AWS_PROFILE": "my-sso-profile"
      }
    }
  }
}
```

## Prerequisites

- Python 3.10+
- AWS Config recorder enabled in target accounts/regions
- IAM credentials with read-only access (see IAM policy below)
- For org-wide scans: a Config Aggregator (auto-discovered, or pass name explicitly)

## Tools (7)

The server follows a **compact summary + drill-down** pattern: `scan_aws_account` returns a compact summary (~2-3K tokens), and `get_compliance_gaps` provides paginated access to full gap details. Maintainer tools (regulatory updates, mapping management) are CLI-only and not exposed via MCP.

| Tool | Purpose |
|---|---|
| `scan_aws_account` | Discover resources via AWS Config, assess against all frameworks. Returns a compact summary with posture scores, gap counts, and top critical findings. Use `get_compliance_gaps` to drill into details. Supports tag filtering, exception rules, SEBI entity tiering, and `save_to_file` to persist results. |
| `scan_control_tower` | Enumerate enabled guardrails across OUs, recommend missing ones per framework including CERT-In. Per-OU breakdown with domain coverage. |
| `get_compliance_gaps` | Drill into compliance gaps from the most recent scan. Filter by framework, risk level, or domain. Paginated (default 20 per page, max 50). |
| `search_regulatory_text` | Search regulatory text from government sources. Falls back to bundled mappings when sites are unreachable. |
| `list_control_domains` | List domains for a framework: `dpdp` (10), `rbi` (7), `sebi` (6), or `certin` (4). |
| `generate_conformance_pack` | Generate a deployable AWS Config conformance pack YAML for a compliance framework. |
| `format_report` | Generate a production-grade DOCX (default) or Markdown report from scan results. Uses cached scan data if no input provided. Defaults to `save_to_file=True`. |

## Sample prompts

Try these with any MCP-compatible client (Kiro, Claude Desktop, Cursor, etc.):

| What you want to do | Example prompt |
|---|---|
| Scan a single AWS account | "Scan my AWS account in ap-south-1 for DPDP and RBI compliance" |
| Scan your entire AWS organization | "Scan my AWS organization for compliance" |
| Scan with SEBI framework | "Scan my AWS account as a SEBI MII entity" |
| Drill into scan gaps | "Show me all critical DPDP gaps" or "Show RBI gaps page 2" |
| Assess Control Tower guardrails | "Scan my Control Tower and check guardrail coverage" |
| Search regulatory text | "What does DPDP say about breach notification timelines?" |
| List control domains | "List the SEBI CSCRF control domains" |
| Generate a formatted report | "Format my last scan as a Word document" |
| Save report to disk | "Scan my AWS account and save the report to file" |
| Generate a conformance pack | "Generate an AWS Config conformance pack for RBI" |
| Filter by tags | "Scan my account but only resources tagged Environment=Production" |
| Exclude resources | "Scan my account excluding resources tagged Team=Legacy" |
| Assess as Significant Data Fiduciary | "Scan my AWS account — we are a Significant Data Fiduciary under DPDP" |

## Key features

### Confidence scoring
Every compliance gap includes a confidence level:
- **High** — Direct technical check verifiable from AWS Config (e.g., encryption disabled, public access enabled)
- **Medium** — Interpretive mapping from regulatory requirement to AWS control (e.g., data localization)
- **Low** — Organizational requirement where infrastructure is only a proxy (e.g., DPO appointment, consent tracking)

Each gap also carries `evidence` (triggering property values), `checked_at` (ISO 8601 timestamp), and `confidence_rationale`.

### CERT-In Directions 2022
Four control domains assessed:
1. Incident Reporting Readiness (GuardDuty + EventBridge + SNS pipeline)
2. Log Retention — 180 days (CloudWatch LogGroup retention check)
3. NTP Synchronization (advisory — AWS uses Amazon Time Sync by default)
4. Reportable Incident Awareness (Security Hub enablement)

### Per-account breakdown
Org-wide scans group gaps by AWS account ID with individual DPDP, RBI, and SEBI posture scores per account.

### Resource-level compliance tracking
Per-domain resource compliance percentages (e.g., "dpdp:6 — 482 checked, 320 passed, 66.4%").

### Exception management
- Auto-suppression of `AWSControlTowerExecution` roles (by design)
- Custom exception rules via `resource_pattern` (fnmatch) and `exclude_tag`
- Suppressed gaps tracked separately with suppression reason

### Tag-based filtering
- `filter_tags`: Include only resources matching ALL specified tag key-value pairs
- `exclude_tags`: Exclude resources matching ANY specified tag key-value pair

### SEBI entity tiering
- **MII** tier: C-SOC readiness checks (GuardDuty + Security Hub + Detective), BYOK verification
- **qualified_re** tier: BYOK check, skip C-SOC
- **other_re** tier: Baseline SEBI checks only

### Nuanced data localization
- Storage resources outside India → high-risk gap (RBI 2018 Circular)
- Compute resources outside India → medium-risk advisory (processing may be permissible)
- Global services (IAM, CloudFront, Route53, WAFv2) → excluded from localization checks
- `DataClassification` tag value included in gap description when present

### Report formatting
The `format_report` tool generates production-grade compliance reports:

**DOCX** (default): Word document suitable for sharing with auditors. Features:
- Professional cover page with scan metadata and confidentiality notice
- Color-coded posture scores (green/orange/red based on thresholds)
- Dark blue styled table headers with alternating row shading
- Risk-level cell coloring (red for critical, orange for high, yellow for medium)
- Confidence-level cell coloring (green for high, orange for medium, red for low)
- Landscape orientation with full-width tables
- Control Tower section with guardrails, per-OU breakdown, and recommendations
- Phased remediation timeline
- Disclaimer page

**Markdown** (`output_format="markdown"`): Structured text report for chat display and quick review.

**Output behavior:**
- `save_to_file=True` (default): Persists the report to the `reports/` directory and returns the file path.
- `save_to_file=False`: Returns content inline. Markdown as text, DOCX as base64-encoded string.

If no `report_json` or `report_path` is provided, `format_report` automatically uses the cached results from the most recent `scan_aws_account` call.

### Regulatory monitoring (CLI-only)
Regulatory monitoring tools are not exposed via MCP — they are used by maintainers via CLI or GitHub Actions:
1. **Staleness** — Flags frameworks where `last_verified` exceeds threshold (default 30 days)
2. **Content hashing** — Fetches regulatory source pages and compares SHA-256 hashes against baselines
3. **New circular detection** — Scans RBI and SEBI circular listing pages for publications matching compliance keywords

Run `scripts/check_regulatory_updates.py` or use the GitHub Actions workflow for scheduled checks.

## How scanning works

1. AWS Config Advanced Query pulls resource configurations in a single API call. If no aggregator name is provided, the scanner auto-discovers organization-level aggregators for org-wide coverage.
2. The scanner extracts compliance-relevant properties per resource type (encryption, public access, logging, retention, key rotation, TLS enforcement, VPC flow logs, security group rules, secrets rotation, backup plans, etc.).
3. Fallback API checks cover Security Hub, GuardDuty, CloudTrail, WAF, AWS Backup, and Amazon Inspector.
4. The assessment engine evaluates each resource against applicable DPDP, RBI, SEBI, and CERT-In control domains.
5. `scan_aws_account` returns a **compact summary** (~2-3K tokens) with posture scores, gap counts, top critical findings, and a remediation timeline. Full gap details are cached in memory.
6. Use `get_compliance_gaps` to **drill down** — filter by framework, risk level, or domain with pagination.

This pattern keeps initial responses fast and token-efficient while allowing detailed exploration on demand.

For org-wide scans, the scanner auto-discovers organization-level Config Aggregators via `DescribeConfigurationAggregators`. If one is found, it's used automatically — no need to pass a name. You can still pass an explicit `aggregator_name` to override auto-discovery (e.g., `aws-controltower-ConfigAggregatorForOrganizations`). The aggregator must be configured in the management or delegated admin account.

## Resource checks

| Resource | What gets checked |
|---|---|
| S3 | Encryption at rest, lifecycle policies, Block Public Access, versioning, access logging, Object Lock (audit buckets), TLS enforcement (bucket policy) |
| RDS | Storage encryption, public accessibility, Multi-AZ, audit logging, SSL enforcement |
| DynamoDB | KMS encryption, TTL, point-in-time recovery |
| Lambda | Secrets in environment variables, dead letter queue |
| EC2 | Public IP assignment, IMDSv2 enforcement, EBS encryption |
| EKS | Secrets envelope encryption, API server endpoint visibility, control plane logging |
| ECS | Container Insights |
| CloudTrail | Log file validation, KMS encryption, CloudWatch Logs integration |
| KMS | Automatic key rotation for customer-managed keys, BYOK verification (SEBI) |
| API Gateway | WAF association |
| CloudFront | WAF association, access logging |
| SQS/SNS | Encryption at rest |
| SageMaker | Direct internet access, KMS encryption, VPC configuration, consent tracking for ML data |
| IAM Roles | Overprivileged policies (AdministratorAccess, PowerUserAccess, IAMFullAccess) |
| VPC | Flow Logs enablement and destination |
| Security Groups | Open SSH (22) and RDP (3389) to 0.0.0.0/0 |
| Secrets Manager | Automatic rotation configuration |
| AWS Backup | Backup plan existence, Vault Lock status |
| Amazon Inspector | Enablement status (SEBI VAPT requirement) |

RBI-regulated scans additionally flag resources deployed outside ap-south-1 and ap-south-2 per the RBI Data Localization Circular 2018, with nuanced classification (storage vs compute vs global services).

## Control domains

**DPDP Act (10 domains):** Lawful Processing, Data Minimization, Privacy Notices, Data Principal Rights, Breach Notification, Reasonable Security Safeguards, Data Retention Limits, Cross-Border Data Transfer, Children's Data Protection, Significant Data Fiduciary Obligations.

**RBI Master Direction (7 domains):** IT Governance, IT Infrastructure, IT Risk Management, Information Security, Cyber Security, Business Continuity/DR, Information Systems Audit.

**SEBI CSCRF (6 domains):** Cyber Governance, Cyber Risk Identification, Cyber Protection, Cyber Detection, Cyber Response, Cyber Recovery.

**CERT-In Directions (4 domains):** Incident Reporting Readiness, Log Retention (180 days), NTP Synchronization, Reportable Incident Awareness.

## Regulatory version tracking

| Framework | Version | Source |
|---|---|---|
| DPDP Act | As enacted August 11, 2023 + Rules 2025 (Nov 14, 2025) | dpdpact.in |
| RBI Master Direction | DoS.CO.CSITE.SEC.3/31.01.015/2023-24 (April 7, 2023) | rbi.org.in |
| SEBI CSCRF | Circular SEBI/HO/ITD/ITD-SEC-1/P/CIR/2024/113 (August 20, 2024) | sebi.gov.in |
| CERT-In Directions | Directions dated April 28, 2022 | cert-in.org.in |

Control mappings are maintained in `control_mappings.json` with `manifest_version`, `last_verified` dates, and source URLs per framework. Mappings are updated via new PyPI releases when regulatory changes occur.

## Security

This server performs read-only operations. It does not modify AWS resources.

**Input validation:**
- AWS region format validated via regex (`^[a-z]{2}(-[a-z]+-\d+)?$`)
- Config Aggregator name validated (`^[a-zA-Z0-9_-]{1,256}$`)
- Report file paths constrained to `reports/` directory (path traversal blocked)
- `top_k` parameter capped at 50
- Error messages sanitized to avoid leaking filesystem paths

**Transport:** stdio by default (local process, no network exposure). For remote deployment over HTTP, set `MCP_API_KEY` and use OAuth 2.1 or equivalent authentication.

**Credentials:** Use IAM roles or SSO profiles. Do not hardcode credentials in config files or source code.

**Data handling:** No persistence, no telemetry. Scan results are cached in memory for drill-down via `get_compliance_gaps` and discarded on process exit. Large scan reports are saved to `reports/` (gitignored) only when `save_to_file=True`. Logs (stderr, INFO level) contain resource ARNs and type identifiers but not credential material or data values.

**XML parsing:** draw.io templates are parsed with `defusedxml`, which blocks XXE, DTD processing, and entity expansion.

**Outbound network:** HTTPS-only calls to regulatory sites (dpdpact.in, rbi.org.in, sebi.gov.in, cert-in.org.in). Domain allowlist enforced. Response size capped at 5 MB. Rate-limited to 10 requests/minute per domain. 30-second timeout.

### Minimum IAM policy

Least-privilege policy covering org-wide Config queries, Control Tower enumeration, and fallback service detection checks.

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ConfigAdvancedQuery",
      "Effect": "Allow",
      "Action": [
        "config:SelectAggregateResourceConfig",
        "config:SelectResourceConfig",
        "config:DescribeConfigurationAggregators"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SecurityServiceDetection",
      "Effect": "Allow",
      "Action": [
        "securityhub:DescribeHub",
        "guardduty:ListDetectors",
        "cloudtrail:DescribeTrails",
        "wafv2:ListWebACLs"
      ],
      "Resource": "*"
    },
    {
      "Sid": "BackupAssessment",
      "Effect": "Allow",
      "Action": [
        "backup:ListBackupPlans",
        "backup:ListBackupVaults"
      ],
      "Resource": "*"
    },
    {
      "Sid": "InspectorAndShield",
      "Effect": "Allow",
      "Action": [
        "inspector2:BatchGetAccountStatus",
        "shield:DescribeSubscription"
      ],
      "Resource": "*"
    },
    {
      "Sid": "NetworkSecurityDetection",
      "Effect": "Allow",
      "Action": [
        "network-firewall:ListFirewalls"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DataProtectionDetection",
      "Effect": "Allow",
      "Action": [
        "access-analyzer:ListAnalyzers",
        "macie2:GetMacieSession"
      ],
      "Resource": "*"
    },
    {
      "Sid": "IdentityCaller",
      "Effect": "Allow",
      "Action": [
        "sts:GetCallerIdentity"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ControlTowerScan",
      "Effect": "Allow",
      "Action": [
        "controltower:ListLandingZones",
        "controltower:GetLandingZone",
        "controltower:ListEnabledControls"
      ],
      "Resource": "*"
    },
    {
      "Sid": "OrganizationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "organizations:ListRoots",
        "organizations:ListOrganizationalUnitsForParent"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DenyDestructiveActions",
      "Effect": "Deny",
      "Action": [
        "config:Delete*",
        "config:Stop*",
        "config:Put*",
        "controltower:Delete*",
        "controltower:Disable*",
        "organizations:Delete*",
        "organizations:Remove*",
        "guardduty:Delete*",
        "securityhub:Disable*",
        "cloudtrail:Delete*",
        "cloudtrail:Stop*",
        "inspector2:Disable*",
        "backup:Delete*",
        "macie2:Disable*"
      ],
      "Resource": "*"
    }
  ]
}
```

**20 Allow actions** (vs ~12,000 in `ReadOnlyAccess`). The Deny statement is a safety net preventing destructive operations even if this role is used alongside broader policies.

For org-wide scans, this policy must be attached in the **management account** (or delegated admin) where the Config Aggregator resides.

## Conformance packs

The project includes a conformance pack generator that produces deployable AWS Config conformance pack YAML templates from `control_mappings.json`. Each pack maps AWS-managed Config rules to regulatory control domains.

A pre-built DPDP Act conformance pack is available at `conformance-packs/DPDP-Act-Conformance-Pack.yaml`. Deploy it with:

```bash
aws configservice put-conformance-pack \
  --conformance-pack-name DPDP-Act-2023-Conformance-Pack \
  --template-body file://conformance-packs/DPDP-Act-Conformance-Pack.yaml
```

To generate packs programmatically for any framework:

```python
from aws_india_compliance.conformance_pack import generate_conformance_pack

result = generate_conformance_pack(framework="dpdp")  # or "rbi", "sebi", "certin"
print(result["yaml_content"])
```

Options:
- `framework`: `"dpdp"`, `"rbi"`, `"sebi"`, or `"certin"`
- `include_domains`: List of domain numbers to include (default: all)
- `exclude_domains`: List of domain numbers to exclude
- `pack_name_prefix`: Custom prefix for the conformance pack name

Framework-specific parameter overrides are applied automatically (e.g., CERT-In uses 180-day log retention, DPDP uses 365-day).

## Cleanup

The MCP server runs as a local process and requires no teardown. If you deployed conformance packs to your account, remove them with:

```bash
# List deployed conformance packs
aws configservice describe-conformance-packs --query 'ConformancePackDetails[].ConformancePackName'

# Delete a specific conformance pack
aws configservice delete-conformance-pack --conformance-pack-name DPDP-Act-2023-Conformance-Pack
```

This removes the Config rules created by the pack. No other AWS resources are created by this project.

## Project structure

```
src/aws_india_compliance/
  server.py              # MCP server — 7 user-facing tools (compact summary + drill-down)
  admin.py               # CLI-only maintainer tools (regulatory update workflow)
  assessment.py          # Compliance assessment engine (confidence scoring, resource tracking, exceptions)
  aws_scanner.py         # AWS Config query + fallback API checks (Backup, Inspector)
  control_tower.py       # Control Tower scanner + per-OU guardrail mapping
  parsers.py             # CloudFormation/Terraform/draw.io parsers
  knowledge.py           # Live regulatory text search + content hash monitoring
  domains.py             # Domain definitions + manifest loader + staleness check
  report_formatter.py    # Markdown report generator (account scan + Control Tower)
  docx_formatter.py      # DOCX report generator with color coding
  conformance_pack.py    # AWS Config conformance pack YAML generator
  control_mappings.json  # Versioned control-to-AWS mapping manifest (DPDP, RBI, SEBI, CERT-In)
scripts/
  check_regulatory_updates.py  # CI script for GitHub Actions workflow
conformance-packs/       # Pre-built conformance pack templates
tests/                   # 28 tests covering all modules
reports/                 # Scan report output (gitignored)
```

## Tests

```bash
PYTHONPATH=src python3 -m pytest tests/ -v
```

28 tests covering assessment logic, scanner component extraction, Control Tower gap analysis, domain definitions, manifest integrity, and all three parsers.

## Environment variables

| Variable | Default | Purpose |
|---|---|---|
| `AWS_PROFILE` | — | AWS SSO profile name |
| `LOG_LEVEL` | `INFO` | Logging level (DEBUG, INFO, WARNING, ERROR) |
| `REGULATORY_CACHE_TTL` | `0` | Seconds to cache regulatory site responses. 0 = no caching. |
| `STALENESS_THRESHOLD_DAYS` | `30` | Days after last_verified before staleness warnings appear (CLI monitoring only). |
| `MCP_TRANSPORT` | `stdio` | Transport mode: `stdio` for local, `streamable-http` for remote |
| `MCP_HOST` | `127.0.0.1` | Host for HTTP transport |
| `MCP_PORT` | `8000` | Port for HTTP transport (validated 1-65535) |
| `REPORT_DIR` | `reports/` | Directory for persisted reports (only used when `save_to_file=True`). Defaults to `cwd/reports` when not set. |

**Disclaimer:** This is a sample tool for educational and assessment purposes.
  It performs read-only operations and does not modify AWS resources.
  Users should validate compliance findings against their specific regulatory
  requirements and consult qualified compliance professionals.

## License

Apache 2.0
