mcp/cloudtrail-mcp-server pulls statistics

AWS CloudTrail MCP Server

AWS CloudTrail audit logging and monitoring.

What is an MCP Server?

MCP Info

Attribute|Details| |-|-| Docker Image|mcp/cloudtrail-mcp-server Author|awslabs Repository|https://github.com/awslabs/mcp

Image Building Info

Attribute|Details| |-|-| Dockerfile|https://github.com/awslabs/mcp/blob/636aca8e109b5559006044f035bb89c16e9e5410/src/cloudtrail-mcp-server/Dockerfile Commit|636aca8e109b5559006044f035bb89c16e9e5410 Docker Image built by|Docker Inc. Docker Scout Health Score| Verify Signature|COSIGN_REPOSITORY=mcp/signatures cosign verify mcp/cloudtrail-mcp-server --key https://raw.githubusercontent.com/docker/keyring/refs/heads/main/public/mcp/latest.pub Licence|Apache License 2.0

Available Tools (5)

Tools provided by this Server|Short Description -|- get_query_results|Get the results of a completed CloudTrail Lake query with pagination support.| get_query_status|Get the status of a CloudTrail Lake query.| lake_query|Execute a SQL query against CloudTrail Lake for complex analytics and filtering.| list_event_data_stores|List available CloudTrail Lake Event Data Stores with their capabilities and event selectors.| lookup_events|Look up CloudTrail events based on various criteria.|

Tools Details

Tool: get_query_results

Get the results of a completed CloudTrail Lake query with pagination support.

This tool retrieves the results of a previously executed CloudTrail Lake query. It supports pagination for large result sets, allowing you to fetch results in chunks.

Usage: Use this tool to get the results of a query that has completed (status = 'FINISHED'). For large result sets, use the next_token to fetch subsequent pages of results.

Pagination workflow: 1. Call get_query_results with just the query_id to get the first page 2. If next_token is returned, call again with the same query_id and the next_token 3. Repeat until next_token is null/empty

Returns:

QueryResult containing: • query_id: The query identifier • query_status: Current status of the query • query_result_rows: Results for this page • next_token: Token for next page (null if no more pages) • query_statistics: Performance statistics for the query Parameters|Type|Description -|-|- query_id|string|The ID of the query to get results for max_results|string optional|Maximum number of results to return per page (1-50, default: 50) next_token|string optional|Token for pagination to fetch the next page of results. Use the next_token returned from a previous call to get successive pages. region|string optional|AWS region to query. Defaults to us-east-1.

Tool: get_query_status

Get the status of a CloudTrail Lake query.

This tool checks the status of a previously started CloudTrail Lake query. Use this when you need to check if a long-running query has completed or if you want to get details about query execution.

Usage: Use this tool to monitor the progress of CloudTrail Lake queries, especially long-running ones that may take time to complete.

Returns:

QueryStatus containing: • query_id: The query identifier • query_status: Current status (QUEUED, RUNNING, FINISHED, FAILED, CANCELLED, TIMED_OUT) • query_statistics: Performance and execution statistics • error_message: Error details if the query failed Parameters|Type|Description -|-|- query_id|string|The ID of the query to check status for region|string optional|AWS region to query. Defaults to us-east-1.

Tool: lake_query

Execute a SQL query against CloudTrail Lake for complex analytics and filtering.

CloudTrail Lake allows you to run SQL queries against your CloudTrail events for advanced analysis. This is more powerful than the basic lookup functions and allows for complex filtering, aggregation, and analysis.

PAGINATION WORKFLOW: For large result sets, you have two options: 1. Use wait_for_completion=False to get the query_id immediately, then use get_query_results with pagination 2. Use wait_for_completion=True (default) to get first page of results, then use get_query_results with next_token for additional pages

IMPORTANT LIMITATIONS: • CloudTrail Lake only supports SELECT statements using Trino-compatible SQL syntax • INSERT, UPDATE, DELETE, CREATE, DROP, and other DDL/DML operations are not supported • Do not use Common Table Expression (CTE) • Your SQL query MUST include a valid Event Data Store (EDS) ID in the FROM clause • Use the list_event_data_stores tool first to get available EDS IDs, then reference the EDS ID directly in your FROM clause • Always use a start and end time using eventtime or have a limit on total output by default

CLOUDTRAIL EVENT SCHEMA: All CloudTrail events contain these key fields that you can query:

Core Fields (Always Present): • eventTime: UTC timestamp when request completed • eventVersion: Log format version (current: 1.11) • eventSource: AWS service name (e.g., "s3.amazonaws.com") • eventName: API action name • awsRegion: AWS region where request was made • sourceIPAddress: IP address of requester • eventID: Unique GUID for this event • eventType: AwsApiCall, AwsServiceEvent, AwsConsoleAction, AwsConsoleSignIn, AwsVpceEvent • eventCategory: Management, Data, NetworkActivity, Insight…