cloudarmor-mcp

MCP server for Google Cloud Armor WAF log patrol — deny summaries per rule, home-region false-positive checks, and preview (dry-run) rule review, straight from Cloud Logging.

Built for a daily "is the WAF healthy?" patrol: one daily_brief call answers what did we block, did we block anyone we shouldn't have, and are the preview rules ready to promote.

Tools

Tool Purpose
daily_brief One-call morning summary: enforced DENYs by rule priority, home-region false-positive lens, preview DENYs
enforce_denies Enforced DENY counts per rule priority
home_region_denies Enforced DENYs whose source IP geolocates to your home region — anything not marked known-normal is a false-positive candidate
preview_denies Preview (dry-run) DENY counts — a quiet preview rule is a promotion candidate
health_check Version, config presence, and a minimal Cloud Logging probe

All tools are read-only. Counts are hard-capped (default 2000 entries per query) and a capped result is reported as >= N (capped), never as an exact total.

Setup

1. Least-privilege service account

Create a service account with roles/logging.viewer only and download a key. Unlike human accounts, service accounts are not subject to organization re-authentication policies, so an unattended patrol never silently expires.

gcloud iam service-accounts create waf-log-viewer --project=YOUR_PROJECT
gcloud projects add-iam-policy-binding YOUR_PROJECT \
  --member=serviceAccount:waf-log-viewer@YOUR_PROJECT.iam.gserviceaccount.com \
  --role=roles/logging.viewer
gcloud iam service-accounts keys create key.json \
  --iam-account=waf-log-viewer@YOUR_PROJECT.iam.gserviceaccount.com

2. Install

pip install cloudarmor-mcp
# or
uv tool install cloudarmor-mcp

3. Environment variables

Variable Required Meaning
CLOUDARMOR_PROJECT yes GCP project ID that receives the load-balancer logs
GOOGLE_APPLICATION_CREDENTIALS yes Path to the service-account key file
CLOUDARMOR_BACKEND_SERVICES no Comma-separated backend service names to filter (default: all)
CLOUDARMOR_HOME_REGION no ISO region code treated as home traffic, e.g. JP. Enables the false-positive lens
CLOUDARMOR_RULES_INI no Path to a rules INI (labels + known-normal priorities, see below)

4. Optional rules INI

Keep your rule numbering out of prompts and give the reports human-readable labels:

[rules]
101 = block non-home deep-path crawlers
500 = AutoDiscover probe block
1002 = OWASP LFI protection

[home]
; home-region DENYs on these priorities are expected, not false positives
known_normal_priorities = 500, 600

5. Claude Code

claude mcp add cloudarmor -- cloudarmor-mcp

with the environment variables above in the server's env.

CLI

cloudarmor-mcp --version   # print version
cloudarmor-mcp --check     # config + API probe (exit 0 when healthy)
cloudarmor-mcp --brief     # print daily_brief to stdout (cron / smoke tests)

Reading the report

  • Enforced DENY by rule — your normal blocking volume. Sudden shifts in the mix are worth a look.
  • Home-region DENY — requests from your own country/region that were blocked. Legitimate users and legitimate crawlers being denied show up here; scanner traffic that happens to originate locally will too, so the known_normal_priorities list keeps expected rules (e.g. an AutoDiscover block) out of the suspicious list.
  • Preview DENY — rules in dry-run. A preview rule that stays free of home-region hits over time is a candidate for promotion to enforce.

License

MIT

Project links

Data verified by PyPI on
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for sigetika from gravatar.com sigetika

Credits

Author: AIKAWA Shigechika

GitHub Statistics

Data verified by PyPI on 
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

MIT
View SPDX License List

Requires

Python >=3.10

Tags

cloud-armor waf gcp mcp model-context-protocol security monitoring

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

cloudarmor_mcp-0.2.0.tar.gz (14.2 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

cloudarmor_mcp-0.2.0-py3-none-any.whl (12.3 kB view details)

Uploaded Python 3

File details

Details for the file cloudarmor_mcp-0.2.0.tar.gz.

File metadata

  • Download URL: cloudarmor_mcp-0.2.0.tar.gz
  • Upload date:
  • Size: 14.2 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for cloudarmor_mcp-0.2.0.tar.gz
Algorithm Hash digest
SHA256 6026eb849320e9463f1e8ba5b90815e2a868d0c78784585ff36929709d0c2623
MD5 816429257fa2c6acc9efba85f6942290
BLAKE2b-256 f630a550ec6678035595bc4a48b6a8ae74080dcabccba18ac79a59be40226ff3

See more details on using hashes here.

Provenance

The following attestation bundles were made for cloudarmor_mcp-0.2.0.tar.gz:

Publisher: release.yml on shigechika/cloudarmor-mcp

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file cloudarmor_mcp-0.2.0-py3-none-any.whl.

File metadata

  • Download URL: cloudarmor_mcp-0.2.0-py3-none-any.whl
  • Upload date:
  • Size: 12.3 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for cloudarmor_mcp-0.2.0-py3-none-any.whl
Algorithm Hash digest
SHA256 733ed07abd9fb1443880982c0059d7cf7fc49b205c8fb73ff19ad34d86a0bd64
MD5 404fe16a90c68a58ec09f880ec27cf1d
BLAKE2b-256 a28b96c33298491c702b9b07d5e81ec9439230b177cfb5cf24ad9b2277c2fedb

See more details on using hashes here.

Provenance

The following attestation bundles were made for cloudarmor_mcp-0.2.0-py3-none-any.whl:

Publisher: release.yml on shigechika/cloudarmor-mcp

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page