feat(servers): add AWS Security MCP Server

[crypto-br]

• Add GuardDuty findings integration
• Add Security Hub findings integration
• Add health check functionality
• Include comprehensive tests and documentation

Fixes

Summary

Changes

Please provide a summary of what's being changed

User experience

Please share what the user experience looks like before and after this change

Checklist

If your change doesn't seem to apply, please leave them unchecked.

• I have reviewed the contributing guidelines
• I have performed a self-review of this change
• Changes have been tested
• Changes are documented

Is this a breaking change? (Y/N)

RFC issue number:

Checklist:

• Migration process documented
• Implement warnings (if it can live side by side)

Acknowledgment

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.

[alexa-perlov]

Can you please take a look at the Well Architected Security MCP Server and see if it meets your use case? For example, it already has support for:

CheckSecurityServices: Monitor AWS security services operational status

Monitors operational status of GuardDuty, Security Hub, Inspector, and IAM Access Analyzer
Identifies service availability across regions for operational visibility
Provides operational recommendations for maintaining security service coverage

From a high level overview, looks like there is a lot of overlap. Please let me know what you think. Thanks!

[crypto-br]

@alexa-perlov ,

Thanks for the suggestion! I reviewed the Well-Architected Security MCP Server and while there is some overlap in service monitoring, the use cases are quite different:

• Well-Architected Server: Compliance assessment and overall security posture evaluation against the Well-Architected Framework
• AWS Security MCP Server: Direct access to operational security findings for threat analysis

They're complementary - the Well-Architected server answers 'how is my overall security posture' while mine answers 'what specific threats have been detected.' The Well-Architected server focuses on recommendations and compliance, while
mine provides direct access to GuardDuty findings with threat types, severity scores, and Security Hub findings with workflow status.

I believe both have unique value in the MCP ecosystem - one for strategic security assessment, the other for operational threat monitoring.

[github-actions]

This pull request is now marked as stale because it hasn't seen activity for a while. Add a comment or it will be closed soon. If you wish to exclude this issue from being marked as stale, add the "backlog" label.

[github-actions]

Closing this pull request as it hasn't seen activity for a while. Please add a comment @mentioning a maintainer to reopen. If you wish to exclude this issue from being marked as stale, add the "backlog" label.