cloudarmor-mcp

MCP server for Google Cloud Armor WAF log patrol — deny summaries per rule, home-region false-positive checks, and preview (dry-run) rule review, straight from Cloud Logging.

Built for a daily "is the WAF healthy?" patrol: one daily_brief call answers what did we block, did we block anyone we shouldn't have, and are the preview rules ready to promote.

Tools

Tool Purpose
daily_brief One-call morning summary: enforced DENYs by rule priority, home-region false-positive lens, preview DENYs
enforce_denies Enforced DENY counts per rule priority
home_region_denies Enforced DENYs whose source IP geolocates to your home region — anything not marked known-normal is a false-positive candidate
preview_denies Preview (dry-run) DENY counts — a quiet preview rule is a promotion candidate
health_check Version, config presence, and a minimal Cloud Logging probe

All tools are read-only. Counts are hard-capped (default 2000 entries per query) and a capped result is reported as >= N (capped), never as an exact total.

Setup

1. Least-privilege service account

Create a service account with roles/logging.viewer only and download a key. Unlike human accounts, service accounts are not subject to organization re-authentication policies, so an unattended patrol never silently expires.

gcloud iam service-accounts create waf-log-viewer --project=YOUR_PROJECT
gcloud projects add-iam-policy-binding YOUR_PROJECT \
  --member=serviceAccount:waf-log-viewer@YOUR_PROJECT.iam.gserviceaccount.com \
  --role=roles/logging.viewer
gcloud iam service-accounts keys create key.json \
  --iam-account=waf-log-viewer@YOUR_PROJECT.iam.gserviceaccount.com

2. Install

pip install cloudarmor-mcp
# or
uv tool install cloudarmor-mcp

3. Environment variables

Variable Required Meaning
CLOUDARMOR_PROJECT yes GCP project ID that receives the load-balancer logs
GOOGLE_APPLICATION_CREDENTIALS yes Path to the service-account key file
CLOUDARMOR_BACKEND_SERVICES no Comma-separated backend service names to filter (default: all)
CLOUDARMOR_HOME_REGION no ISO region code treated as home traffic, e.g. JP. Enables the false-positive lens
CLOUDARMOR_RULES_INI no Path to a rules INI (labels + known-normal priorities, see below)

4. Optional rules INI

Keep your rule numbering out of prompts and give the reports human-readable labels:

[rules]
101 = block non-home deep-path crawlers
500 = AutoDiscover probe block
1002 = OWASP LFI protection

[home]
; home-region DENYs on these priorities are expected, not false positives
known_normal_priorities = 500, 600

5. Claude Code

claude mcp add cloudarmor -- cloudarmor-mcp

with the environment variables above in the server's env.

CLI

cloudarmor-mcp --version   # print version
cloudarmor-mcp --check     # config + API probe (exit 0 when healthy)
cloudarmor-mcp --brief     # print daily_brief to stdout (cron / smoke tests)

Reading the report

  • Enforced DENY by rule — your normal blocking volume. Sudden shifts in the mix are worth a look.
  • Home-region DENY — requests from your own country/region that were blocked. Legitimate users and legitimate crawlers being denied show up here; scanner traffic that happens to originate locally will too, so the known_normal_priorities list keeps expected rules (e.g. an AutoDiscover block) out of the suspicious list.
  • Preview DENY — rules in dry-run. A preview rule that stays free of home-region hits over time is a candidate for promotion to enforce.

License

MIT

Project links

Data verified by PyPI on
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.2.0)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for sigetika from gravatar.com sigetika

Credits

Author: AIKAWA Shigechika

GitHub Statistics

Data verified by PyPI on 
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

MIT
View SPDX License List

Requires

Python >=3.10

Tags

cloud-armor waf gcp mcp model-context-protocol security monitoring

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

cloudarmor_mcp-0.1.2.tar.gz (14.0 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

cloudarmor_mcp-0.1.2-py3-none-any.whl (12.3 kB view details)

Uploaded Python 3

File details

Details for the file cloudarmor_mcp-0.1.2.tar.gz.

File metadata

  • Download URL: cloudarmor_mcp-0.1.2.tar.gz
  • Upload date:
  • Size: 14.0 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for cloudarmor_mcp-0.1.2.tar.gz
Algorithm Hash digest
SHA256 8eb719fa15a920f7b9c99d3914f78ecd51d8507a5d8c6aa54803bb35f31c0c32
MD5 0e9e2f59845c884fea26f76370f7d6ad
BLAKE2b-256 c4458be59122451e2643b8c80cddeca4a43d5a970192806fff546bf084468991

See more details on using hashes here.

Provenance

The following attestation bundles were made for cloudarmor_mcp-0.1.2.tar.gz:

Publisher: release.yml on shigechika/cloudarmor-mcp

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file cloudarmor_mcp-0.1.2-py3-none-any.whl.

File metadata

  • Download URL: cloudarmor_mcp-0.1.2-py3-none-any.whl
  • Upload date:
  • Size: 12.3 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for cloudarmor_mcp-0.1.2-py3-none-any.whl
Algorithm Hash digest
SHA256 7d7a74f98fc653382e187d7e3dfe1c1206df2da3beaf51705a20af6a9e044620
MD5 85e30232157400441c014a148539d5e6
BLAKE2b-256 dae6658ece9878a59b783ca89d052182deee6a09a0bcdf4722ec70dc21c3c537

See more details on using hashes here.

Provenance

The following attestation bundles were made for cloudarmor_mcp-0.1.2-py3-none-any.whl:

Publisher: release.yml on shigechika/cloudarmor-mcp

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page