DevOps & Cloud Code Auditor

DevOps & Cloud Code Auditor (MCP Server)

A production-ready Model Context Protocol (MCP) Server providing AI coding assistants (Claude Desktop, Cursor, Windsurf, Cline) with automated static analysis tools to prevent production outages, cloud cost leaks, and security vulnerabilities.

---

🌟 Capabilities & Audited Rule Sets

This server inspects codebases across three mission-critical engineering vectors:

1. Cloud Cost Leaks (Terraform / HCL / AWS):

• `EBS_GP2`: Identifies legacy gp2 EBS volumes (gp3 provides equal durability with ~20% baseline cost reduction and higher baseline IOPS).
• `PUBLIC_IP`: Flags unneeded associate_public_ip_address = true incurring hourly AWS IPv4 charges ($0.005/hr/IP).
• `CW_NO_RETENTION`: Catches aws_cloudwatch_log_group missing retention policies (preventing infinite unbudgeted log ingestion costs).
• `S3_NO_LIFECYCLE`: Detects S3 buckets lacking Glacier lifecycle transitions.
• `RDS_MULTIAZ_NONPROD` & `RDS_PROVISIONED_IOPS_NONPROD`: Flags doubled database infrastructure costs on development and staging environments.

1. PostgreSQL Migration Table Lock Hazards:

• `INDEX_NOT_CONCURRENT`: Detects CREATE INDEX missing CONCURRENTLY (which acquires an EXCLUSIVE lock and halts table writes in production).
• `NOT_NULL_VOLATILE_DEFAULT`: Catches ADD COLUMN ... NOT NULL DEFAULT rewriting every table row under an ACCESS EXCLUSIVE lock.
• `FK_NO_INDEX`: Flags unindexed foreign key constraints causing cascading table-level sequential lock scans on parent updates/deletes.
• `FOR_UPDATE_UNBOUNDED`: Catches SELECT ... FOR UPDATE missing LIMIT or SKIP LOCKED, preventing deadlocks.

1. OWASP & Full-Stack Next.js API Security:

• `NEXT_PUBLIC_SECRET_LEAK`: Flags sensitive tokens and private API keys prefixed with NEXT_PUBLIC_ that leak into public client browser bundles.
• `NEXTJS_SERVER_ACTION_NO_AUTH`: Flags Next.js 14/15 Server Actions exporting mutations without explicit session auth verification.
• `SQLI_RAW_INTERPOLATION`: Identifies raw SQL query templates using string interpolation instead of parameterized inputs.
• `SSRF_UNVALIDATED_FETCH`: Catches external fetch calls consuming user inputs without protocol/hostname validation.

---

🛠️ MCP Tools Exposed

This server implements the official Model Context Protocol specification (tools/list and tools/call):

1. audit_devops_repository

Clones a public Git repository shallowly without executing hooks, performs AST and regex static syntax audits, and returns structured findings and a formatted Markdown report.

• Parameters:
• repository_url (string, required): Public Git URL of the repository to audit (e.g. https://github.com/example/cloud-infra).
• sub_directory (string, optional): Specific subdirectory within the repository to inspect (e.g. terraform/ or prisma/migrations/).
• Returns:
• status: "success" | "error"
• total_findings: Number of detected issues
• findings: Array of detailed vulnerability records (file, line number, rule ID, severity, message, fix code)
• markdown_report: Human-readable summary table

2. audit_devops_code

Directly audits a raw code snippet of Terraform (HCL), PostgreSQL migration (SQL), or Next.js API/Server Action code.

• Parameters:
• code (string, required): The source code string to audit.
• file_type (string, optional, default: "auto"): One of "terraform", "postgres", "nextjs", or "auto".
• Returns: Structured JSON findings with exact drop-in code fixes.

3. audit_local_devops_directory

Audits a local filesystem directory on the host machine before submitting a Pull Request or deploying to staging.

• Parameters:
• directory_path (string, required): Absolute filesystem path to the target folder.
• Returns: Structured JSON findings and severity breakdown.

---

🚀 Client Configuration & Quickstart

1. Claude Desktop Setup

Add the server to your claude_desktop_config.json:

{

"mcpServers": { "devops-code-auditor": { "command": "python3", "args": ["/path/to/devops-code-auditor/server.py"] } } }

2. Cursor IDE / Windsurf Setup

In Cursor, navigate to Settings → Features → MCP → Add New MCP Server:

• Name: devops-code-auditor
• Type: command
• Command: python3 /absolute/path/to/devops-code-auditor/server.py

3. Docker Execution

Run the isolated container via Docker:

{

"mcpServers": { "devops-code-auditor": { "command": "docker", "args": [ "run", "-i", "--rm", "ghcr.io/ansarii/devops-code-auditor" ] } } }

---

💻 Example Agent Usage

Once connected, your AI assistant can evaluate migration files and cloud manifests on demand:

User: "Check this PostgreSQL migration before I run it on production:

CREATE INDEX idx_orders_user_id ON orders (user_id);"

Claude (Tool Call): audit_devops_code({ "code": "CREATE INDEX idx_orders_user_id ON orders (user_id);", "file_type": "postgres" })

Result: { "status": "success", "total_findings": 1, "findings": [ { "suite": "postgres-locks", "rule": "INDEX_NOT_CONCURRENT", "severity": "high", "file": "migration.sql", "line": 1, "message": "CREATE INDEX on \"orders\" without CONCURRENTLY blocks table writes during build.", "fix": "CREATE INDEX CONCURRENTLY idx_orders_user_id ON orders (user_id);" } ] }

---

🔒 Security Guarantee: Zero Execution

This server executes 100% static analysis using AST pattern matching and regex verification. It never executes untrusted shell commands, arbitrary Python code, or database connections on your machine.

---

📜 License

MIT License — Copyright (c) 2026 Neon Innovation Lab. Maintained by Neon Innovation Lab.