cloudarmor-mcp

MCP server for Google Cloud Armor WAF log patrol — deny summaries per rule, home-region false-positive checks, and preview (dry-run) rule review, straight from Cloud Logging.

Built for a daily "is the WAF healthy?" patrol: one daily_brief call answers what did we block, did we block anyone we shouldn't have, and are the preview rules ready to promote.

Tools

Tool Purpose
daily_brief One-call morning summary: enforced DENYs by rule priority, home-region false-positive lens, preview DENYs
enforce_denies Enforced DENY counts per rule priority
home_region_denies Enforced DENYs whose source IP geolocates to your home region — anything not marked known-normal is a false-positive candidate
preview_denies Preview (dry-run) DENY counts — a quiet preview rule is a promotion candidate
health_check Version, config presence, and a minimal Cloud Logging probe

All tools are read-only. Counts are hard-capped (default 2000 entries per query) and a capped result is reported as >= N (capped), never as an exact total.

Setup

1. Least-privilege service account

Create a service account with roles/logging.viewer only and download a key. Unlike human accounts, service accounts are not subject to organization re-authentication policies, so an unattended patrol never silently expires.

gcloud iam service-accounts create waf-log-viewer --project=YOUR_PROJECT
gcloud projects add-iam-policy-binding YOUR_PROJECT \
  --member=serviceAccount:waf-log-viewer@YOUR_PROJECT.iam.gserviceaccount.com \
  --role=roles/logging.viewer
gcloud iam service-accounts keys create key.json \
  --iam-account=waf-log-viewer@YOUR_PROJECT.iam.gserviceaccount.com

2. Install

pip install cloudarmor-mcp
# or
uv tool install cloudarmor-mcp

3. Environment variables

Variable Required Meaning
CLOUDARMOR_PROJECT yes GCP project ID that receives the load-balancer logs
GOOGLE_APPLICATION_CREDENTIALS yes Path to the service-account key file
CLOUDARMOR_BACKEND_SERVICES no Comma-separated backend service names to filter (default: all)
CLOUDARMOR_HOME_REGION no ISO region code treated as home traffic, e.g. JP. Enables the false-positive lens
CLOUDARMOR_RULES_INI no Path to a rules INI (labels + known-normal priorities, see below)

4. Optional rules INI

Keep your rule numbering out of prompts and give the reports human-readable labels:

[rules]
101 = block non-home deep-path crawlers
500 = AutoDiscover probe block
1002 = OWASP LFI protection

[home]
; home-region DENYs on these priorities are expected, not false positives
known_normal_priorities = 500, 600

5. Claude Code

claude mcp add cloudarmor -- cloudarmor-mcp

with the environment variables above in the server's env.

CLI

cloudarmor-mcp --version   # print version
cloudarmor-mcp --check     # config + API probe (exit 0 when healthy)
cloudarmor-mcp --brief     # print daily_brief to stdout (cron / smoke tests)

Reading the report

  • Enforced DENY by rule — your normal blocking volume. Sudden shifts in the mix are worth a look.
  • Home-region DENY — requests from your own country/region that were blocked. Legitimate users and legitimate crawlers being denied show up here; scanner traffic that happens to originate locally will too, so the known_normal_priorities list keeps expected rules (e.g. an AutoDiscover block) out of the suspicious list.
  • Preview DENY — rules in dry-run. A preview rule that stays free of home-region hits over time is a candidate for promotion to enforce.

License

MIT

Project links

Data verified by PyPI on
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.2.0)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for sigetika from gravatar.com sigetika

Credits

Author: AIKAWA Shigechika

GitHub Statistics

Data verified by PyPI on 
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

MIT
View SPDX License List

Requires

Python >=3.10

Tags

cloud-armor waf gcp mcp model-context-protocol security monitoring

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

cloudarmor_mcp-0.1.0.tar.gz (13.9 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

cloudarmor_mcp-0.1.0-py3-none-any.whl (12.3 kB view details)

Uploaded Python 3

File details

Details for the file cloudarmor_mcp-0.1.0.tar.gz.

File metadata

  • Download URL: cloudarmor_mcp-0.1.0.tar.gz
  • Upload date:
  • Size: 13.9 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for cloudarmor_mcp-0.1.0.tar.gz
Algorithm Hash digest
SHA256 449f89e6ea8a1839224c9a020c0c2d02ae15caadf8c1708e40dc93e5c295d849
MD5 00cf7ae47f544f61547dd07bc6670ce1
BLAKE2b-256 8b57e882945725d2ecb0c550419d3e87269ce33985b34b4844e89c23b03ec91e

See more details on using hashes here.

Provenance

The following attestation bundles were made for cloudarmor_mcp-0.1.0.tar.gz:

Publisher: release.yml on shigechika/cloudarmor-mcp

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file cloudarmor_mcp-0.1.0-py3-none-any.whl.

File metadata

  • Download URL: cloudarmor_mcp-0.1.0-py3-none-any.whl
  • Upload date:
  • Size: 12.3 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for cloudarmor_mcp-0.1.0-py3-none-any.whl
Algorithm Hash digest
SHA256 9ee3d3643a0069b12512274f10be6e746dccadf3771e1e0f452b2a9d7d71fa6f
MD5 6183e9d42c35d20274b1f4b06f6a31a0
BLAKE2b-256 42cbe6d93945ecb656946571fa8f9f1a68b8930f9c5c8f5f0226eb1a589ee114

See more details on using hashes here.

Provenance

The following attestation bundles were made for cloudarmor_mcp-0.1.0-py3-none-any.whl:

Publisher: release.yml on shigechika/cloudarmor-mcp

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page