samvas-codes/dawshund_mcp

This package wraps the dAWShund project in two different servers
so you can enumerate AWS IAM data, evaluate effective permissions and
obtain a high‑level summary without having to remember a handful of
separate scripts. The upstream project describes itself as a way to
“put a leash on naughty permissions” and provides three main
components:
* **sAWSage** – enumerates IAM principals and resource policies and
consolidates them into a single JSON document. Supported resources
include IAM groups, roles and users and a subset of resource based
policies such as AWS Backup, EFS, KMS, Lambda, S3, SNS and SQS. The
consolidated file (sawsage.json) is produced under policies/
after running the scrip.
* **Gerakina** – feeds the consolidated policies into AWS’s
simulate-principal-policy API and produces a new JSON file,
effective_permissions.json, listing which actions are allowed,
explicitly denied or implicitly denied for each principal. This
step may take some time because it calls the AWS API for every
unique combination of principal, action and resource.
* **dAWShund** – imports the effective permissions into a Neo4j
database and builds a graph of principals and resources. It
generates permissions4j.json and dawshund.json suitable for
browsing in Neo4j and BloodHound respectively. Using the Neo4j
functionality is optional; the HTTP server included here provides a
lightweight summary instead.
Requirements
dAWShund depends on Python, the AWS CLI and a handful of Python
packages. If you wish to use the Neo4j visualisation then a
running Neo4j instance is also required. At a minimum you need:
* Python 3.x
* An AWS account with permissions to call IAM APIs (for enumeration)
and the simulate-principal-policy API (for evaluation). You
should configure your AWS credentials using aws configure --profile
.
* The AWS CLI installed and available on your path.
* **Optional:** a Neo4j server if you plan to use the dawshund.py
script directly (the HTTP server summarises results without Neo4j).
The setup.sh script in this directory will install Python
dependencies (using pip) and clone the upstream dAWShund repository.
If you prefer to manage dependencies manually you can see
setup.sh for the exact commands.
Installation
1. Install the AWS CLI and configure a named profile for the account
you wish to assess. For example:
2. Clone this repository (or copy the mcp_dawshund_server folder)
and run the setup script:
The script installs Python dependencies (boto3, neo4j, flask,
flask_cors) and clones the dAWShund code into a local
subdirectory. If you wish to use a Python virtual environment you
can create and activate one before running setup.sh.
3. Start the server:
By default the HTTP service listens on port 8000 on all interfaces.
You can change the port by setting the PORT environment variable
before starting the server, for example:
If you intend to use the MCP implementation instead of the HTTP API,
you can run it with:
The MCP server does not bind to a TCP port; it communicates via
standard input/output and is typically launched by a client such as
Claude for Desktop. See Using the MCP server
below for details.
Using the HTTP server
The Flask-based server (server.py) exposes three endpoints over HTTP.
All requests and responses use JSON. The examples below use curl
but any HTTP client will work.
1 – Enumerate IAM policies (/collect)
Trigger enumeration of IAM principals and resource policies via
sAWSage. Provide your AWS CLI profile name and optionally an array of
regions. If no regions are supplied, sAWSage enumerates all known
regions for supported services.
The response is a large JSON document keyed by AWS ARN. Each entry
includes metadata (friendly name, attached policies) and the raw