Kloudle Logo
Agent Tools

Cloud Security Scanners
Built for AI Agents

Static binaries that AI agents can discover, download, and run autonomously. No SDKs, no dependencies, no containers — just curl, verify, execute.

How It Works

🔍

1. Discover

Agent calls search("s3 encryption") via MCP to find the right scanner.

📦

2. Get

Agent calls get("kloudle-aws-s3") and receives a ready-to-run command with SHA256 verification.

🛡️

3. Run

Agent downloads the ~2MB static binary, verifies the checksum, and executes the security scan.

7 AWS Security Scanners

Each scanner is a self-contained static binary (~2MB). No runtime dependencies, no containers, no SDK installation. Works on any Linux x86_64 host.

🪣

S3

kloudle-aws-s3

Bucket encryption, public access blocks, versioning, logging, lifecycle policies

5 checks
🔑

IAM

kloudle-aws-iam

Root account MFA, stale access keys, password policy compliance

3 checks
🖥️

EC2

kloudle-aws-ec2

Public SSH access, security group rules, EBS encryption, IMDSv2 enforcement

4 checks
☸️

EKS

kloudle-aws-eks

Public endpoint access, control plane logging, secrets encryption

3 checks
🗄️

RDS

kloudle-aws-rds

Public accessibility, storage encryption, automated backup retention

3 checks
📋

CloudTrail

kloudle-aws-cloudtrail

Multi-region trails, log file validation, KMS encryption

3 checks
📊

CloudWatch Logs

kloudle-aws-cloudwatch-logs

Log group retention, encryption at rest, metric filter coverage

3 checks

Connect via MCP

Add the Kloudle MCP server to any MCP-compatible AI agent or IDE.

{
  "mcpServers": {
    "kloudle": {
      "url": "https://mcp.kloudle.dev/mcp"
    }
  }
}
Streamable HTTP transport
50 free scans/day
No API key required
Also available on Smithery and MCP Registry.

Built for Agents, Not Humans

Static Binaries

Compiled with Rust + musl for zero external dependencies. No glibc, no shared libraries, no Docker required.

SHA256 Verified

Every binary ships with a checksum. The MCP server returns a command that downloads, verifies, and runs in a single pipeline.

Structured Exit Codes

0 = all clear, 1 = misconfigurations found, 2 = auth failure, 3 = network error. Agents can branch logic without parsing output.

JSON Output

Machine-readable results with severity levels, resource identifiers, and remediation hints that agents can act on directly.

Minimal IAM Permissions

Each scanner declares exactly which read-only IAM permissions it needs. No admin access, no write permissions.

CDN-Delivered

Binaries served from Cloudflare R2 with immutable caching. Fast downloads worldwide, versioned paths for reproducibility.

Let Your AI Agent
Secure Your Cloud

Point any MCP-compatible agent at mcp.kloudle.dev and start scanning. 50 free scans per day, no signup required.

View MCP Server Find on Smithery