Shieldly AWS Security MCP Server ★ New (July 12)¶

AI-Powered Security Analysis for AWS - the official MCP server from shieldly.io. Analyze IAM policies and CloudFormation templates from any MCP client. Catch over-privileged roles, policy violations, and infrastructure misconfigurations before they reach production.

Source: mcp.so (submitted July 12, 2026) · GitHub: shieldly-io (exact repo TBD)

What It Is¶

An official MCP server from Shieldly that brings AWS security analysis into AI agent workflows. Operators can ask agents to review IAM policies for least-privilege violations, scan CloudFormation templates for security gaps, or audit existing infrastructure - all from within their MCP client.

Business Relevance¶

DevOps/SRE teams can shift-left security analysis into development workflows
Compliance operators can audit IAM policies against SOC 2 / ISO 27001 requirements
Cloud architects can validate CloudFormation templates before deployment
CorpusIQ complement for businesses managing AWS infrastructure alongside business data

Tools Available¶

Tool	Description
`analyze_iam_policy`	Review IAM policy for over-privilege, wildcards, risky actions
`analyze_cloudformation`	Scan CF template for security misconfigurations
`audit_role`	Full role analysis - attached policies, trust relationships, last used
`suggest_fixes`	Generate least-privilege policy recommendations

Quick Start¶

# Install via npx
npx @shieldly-io/mcp-server

# Or add to MCP client config
{
  "mcpServers": {
    "shieldly": {
      "command": "npx",
      "args": ["@shieldly-io/mcp-server"],
      "env": {
        "SHIELDLY_API_KEY": "your-api-key",
        "AWS_REGION": "us-east-1"
      }
    }
  }
}

Business Use Cases¶

Pre-deployment security review: "Scan this CloudFormation template for security issues before we deploy"
IAM audit: "Check all IAM roles in this account for over-privileged policies"
Compliance evidence: "Generate a report showing all IAM roles comply with least-privilege principle"
Incident response: "Analyze this IAM policy that was modified - what new risks does it introduce?"

Integration with CorpusIQ¶

CorpusIQ is the connector layer that lets AI assistants read the systems a business already runs on - accounting, payments, CRM, email, files and analytics - and answer with the source named. It is read-only by design: it retrieves data and never writes to, or acts in, a connected system, which is what makes it safe to point at live accounts.

This page is part of the CorpusIQ directory, the reference we maintain for the MCP server and agent-skill ecosystem. Run alongside CorpusIQ, a third-party server like this one can be combined with a company's own business data in a single answer.

See what CorpusIQ connects

Limitations¶

Requires Shieldly API key and AWS credentials with read access
Analysis scope limited to IAM and CloudFormation (not full AWS security suite)
Community-reported; verify analysis accuracy against AWS IAM Access Analyzer
Requires outbound internet access from agent host