mcp/cloudtrail-mcp-server pulls statistics

AWS CloudTrail MCP Server

AWS CloudTrail audit logging and monitoring.

What is an MCP Server?

MCP Info

Attribute	Details
Docker Image	mcp/cloudtrail-mcp-server
Author	awslabs
Repository	https://github.com/awslabs/mcp

Image Building Info

Attribute	Details
Dockerfile	https://github.com/awslabs/mcp/blob/636aca8e109b5559006044f035bb89c16e9e5410/src/cloudtrail-mcp-server/Dockerfile
Commit	636aca8e109b5559006044f035bb89c16e9e5410
Docker Image built by	Docker Inc.
Docker Scout Health Score
Verify Signature	COSIGN_REPOSITORY=mcp/signatures cosign verify mcp/cloudtrail-mcp-server --key https://raw.githubusercontent.com/docker/keyring/refs/heads/main/public/mcp/latest.pub
Licence	Apache License 2.0

Available Tools (5)

Tools provided by this Server	Short Description
get_query_results	Get the results of a completed CloudTrail Lake query with pagination support.
get_query_status	Get the status of a CloudTrail Lake query.
lake_query	Execute a SQL query against CloudTrail Lake for complex analytics and filtering.
list_event_data_stores	List available CloudTrail Lake Event Data Stores with their capabilities and event selectors.
lookup_events	Look up CloudTrail events based on various criteria.

---

Tools Details

Tool: get_query_results

Get the results of a completed CloudTrail Lake query with pagination support.

This tool retrieves the results of a previously executed CloudTrail Lake query. It supports pagination for large result sets, allowing you to fetch results in chunks.

Usage: Use this tool to get the results of a query that has completed (status = 'FINISHED'). For large result sets, use the next_token to fetch subsequent pages of results.

Pagination workflow:

1. Call get_query_results with just the query_id to get the first page
2. If next_token is returned, call again with the same query_id and the next_token
3. Repeat until next_token is null/empty

Returns:

QueryResult containing: - query_id: The query identifier - query_status: Current status of the query - query_result_rows: Results for this page - next_token: Token for next page (null if no more pages) - query_statistics: Performance statistics for the query

Parameters	Type	Description
query_id	string	The ID of the query to get results for
max_results	string optional	Maximum number of results to return per page (1-50, default: 50)
next_token	string optional	Token for pagination to fetch the next page of results. Use the next_token returned from a previous call to get successive pages.
region	string optional	AWS region to query. Defaults to us-east-1.

---

Tool: get_query_status

Get the status of a CloudTrail Lake query.

This tool checks the status of a previously started CloudTrail Lake query. Use this when you need to check if a long-running query has completed or if you want to get details about query execution.

Usage: Use this tool to monitor the progress of CloudTrail Lake queries, especially long-running ones that may take time to complete.

Returns:

QueryStatus containing: - query_id: The query identifier - query_status: Current status (QUEUED, RUNNING, FINISHED, FAILED, CANCELLED, TIMED_OUT) - query_statistics: Performance and execution statistics - error_message: Error details if the query failed

Parameters	Type	Description
query_id	string	The ID of the query to check status for
region	string optional	AWS region to query. Defaults to us-east-1.

---

Tool: lake_query

Execute a SQL query against CloudTrail Lake for complex analytics and filtering.

CloudTrail Lake allows you to run SQL queries against your CloudTrail events for advanced analysis. This is more powerful than the basic lookup functions and allows for complex filtering, aggregation, and analysis.

PAGINATION WORKFLOW: For large result sets, you have two options:

1. Use wait_for_completion=False to get the query_id immediately, then use get_query_results with pagination
2. Use wait_for_completion=True (default) to get first page of results, then use get_query_results with next_token for additional pages

IMPORTANT LIMITATIONS:

• CloudTrail Lake only supports SELECT statements using Trino-compatible SQL syntax
• INSERT, UPDATE, DELETE, CREATE, DROP, and other DDL/DML operations are not supported
• Do not use Common Table Expression (CTE)
• Your SQL query MUST include a valid Event Data Store (EDS) ID in the FROM clause
• Use the list_event_data_stores tool first to get available EDS IDs, then reference the EDS ID directly in your FROM clause
• Always use a start and end time using eventtime or have a limit on total output by default

CLOUDTRAIL EVENT SCHEMA: All CloudTrail events contain these key fields that you can query:

Core Fields (Always Present):

• eventTime: UTC timestamp when request completed
• eventVersion: Log format version (current: 1.11)
• eventSource: AWS service name (e.g., "s3.amazonaws.com")
• eventName: API action name
• awsRegion: AWS region where request was made
• sourceIPAddress: IP address of requester
• eventID: Unique GUID for this event
• eventType: AwsApiCall, AwsServiceEvent, AwsConsoleAction, AwsConsoleSignIn, AwsVpceEvent
• eventCategory: Management, Data, NetworkActivity, Insight…