DevOps & Cloud Code Auditor

DevOps & Cloud Code Auditor (MCP Server)

A production-ready Model Context Protocol (MCP) Server providing AI coding assistants (Claude Desktop, Cursor, Windsurf, Cline) with automated static analysis tools to prevent production outages, cloud cost leaks, and security vulnerabilities.

🌟 Capabilities & Audited Rule Sets

This server inspects codebases across three mission-critical engineering vectors:

1. Cloud Cost Leaks (Terraform / HCL / AWS):
   • EBS_GP2: Identifies legacy gp2 EBS volumes (gp3 provides equal durability with ~20% baseline cost reduction and higher baseline IOPS).
   • PUBLIC_IP: Flags unneeded associate_public_ip_address = true incurring hourly AWS IPv4 charges ($0.005/hr/IP).
   • CW_NO_RETENTION: Catches aws_cloudwatch_log_group missing retention policies (preventing infinite unbudgeted log ingestion costs).
   • S3_NO_LIFECYCLE: Detects S3 buckets lacking Glacier lifecycle transitions.
   • RDS_MULTIAZ_NONPROD & RDS_PROVISIONED_IOPS_NONPROD: Flags doubled database infrastructure costs on development and staging environments.
2. PostgreSQL Migration Table Lock Hazards:
   • INDEX_NOT_CONCURRENT: Detects CREATE INDEX missing CONCURRENTLY (which acquires an EXCLUSIVE lock and halts table writes in production).
   • NOT_NULL_VOLATILE_DEFAULT: Catches ADD COLUMN ... NOT NULL DEFAULT <func()> rewriting every table row under an ACCESS EXCLUSIVE lock.
   • FK_NO_INDEX: Flags unindexed foreign key constraints causing cascading table-level sequential lock scans on parent updates/deletes.
   • FOR_UPDATE_UNBOUNDED: Catches SELECT ... FOR UPDATE missing LIMIT or SKIP LOCKED, preventing deadlocks.
3. OWASP & Full-Stack Next.js API Security:
   • NEXT_PUBLIC_SECRET_LEAK: Flags sensitive tokens and private API keys prefixed with NEXT_PUBLIC_ that leak into public client browser bundles.
   • NEXTJS_SERVER_ACTION_NO_AUTH: Flags Next.js 14/15 Server Actions exporting mutations without explicit session auth verification.
   • SQLI_RAW_INTERPOLATION: Identifies raw SQL query templates using string interpolation instead of parameterized inputs.
   • SSRF_UNVALIDATED_FETCH: Catches external fetch calls consuming user inputs without protocol/hostname validation.

🛠️ MCP Tools Exposed

This server implements the official Model Context Protocol specification (tools/list and tools/call):

1. audit_devops_repository

Clones a public Git repository shallowly without executing hooks, performs AST and regex static syntax audits, and returns structured findings and a formatted Markdown report.

• Parameters:
  • repository_url (string, required): Public Git URL of the repository to audit (e.g. https://github.com/example/cloud-infra).
  • sub_directory (string, optional): Specific subdirectory within the repository to inspect (e.g. terraform/ or prisma/migrations/).
• Returns:
  • status: "success" | "error"
  • total_findings: Number of detected issues
  • findings: Array of detailed vulnerability records (file, line number, rule ID, severity, message, fix code)
  • markdown_report: Human-readable summary table

2. audit_devops_code

Directly audits a raw code snippet of Terraform (HCL), PostgreSQL migration (SQL), or Next.js API/Server Action code.

• Parameters:
  • code (string, required): The source code string to audit.
  • file_type (string, optional, default: "auto"): One of "terraform", "postgres", "nextjs", or "auto".
• Returns: Structured JSON findings with exact drop-in code fixes.

3. audit_local_devops_directory

Audits a local filesystem directory on the host machine before submitting a Pull Request or deploying to staging.

• Parameters:
  • directory_path (string, required): Absolute filesystem path to the target folder.
• Returns: Structured JSON findings and severity breakdown.

🚀 Client Configuration & Quickstart

1. Claude Desktop Setup

Add the server to your claude_desktop_config.json:

{
  "mcpServers": {
    "devops-code-auditor": {
      "command": "python3",
      "args": ["/path/to/devops-code-auditor/server.py"]
    }
  }
}

2. Cursor IDE / Windsurf Setup

In Cursor, navigate to Settings → Features → MCP → Add New MCP Server:

• Name: devops-code-auditor
• Type: command
• Command: python3 /absolute/path/to/devops-code-auditor/server.py

3. Docker Execution

Run the isolated container via Docker:

{
  "mcpServers": {
    "devops-code-auditor": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/ansarii/devops-code-auditor"
      ]
    }
  }
}

💻 Example Agent Usage

Once connected, your AI assistant can evaluate migration files and cloud manifests on demand:

User: "Check this PostgreSQL migration before I run it on production:
CREATE INDEX idx_orders_user_id ON orders (user_id);"

Claude (Tool Call):
audit_devops_code({
  "code": "CREATE INDEX idx_orders_user_id ON orders (user_id);",
  "file_type": "postgres"
})

Result:
{
  "status": "success",
  "total_findings": 1,
  "findings": [
    {
      "suite": "postgres-locks",
      "rule": "INDEX_NOT_CONCURRENT",
      "severity": "high",
      "file": "migration.sql",
      "line": 1,
      "message": "CREATE INDEX on \"orders\" without CONCURRENTLY blocks table writes during build.",
      "fix": "CREATE INDEX CONCURRENTLY idx_orders_user_id ON orders (user_id);"
    }
  ]
}

🔒 Security Guarantee: Zero Execution

This server executes 100% static analysis using AST pattern matching and regex verification. It never executes untrusted shell commands, arbitrary Python code, or database connections on your machine.

📜 License

MIT License — Copyright (c) 2026 Neon Innovation Lab. Maintained by Neon Innovation Lab.