Cloud Flow Monitor MCP

MCP server for intelligent cloud application flow monitoring and analysis. Traces requests across AWS services (API Gateway → Lambda → ECS → DynamoDB), analyzes logs, detects bottlenecks, evaluates capacity, and generates detailed reports.

100% read-only — does not create, modify, or delete any cloud resources.

Quick Start

1. Configure in Kiro

Create .kiro/settings/mcp.json:

{
  "mcpServers": {
    "cloud-flow-monitor": {
      "command": "npx",
      "args": ["cloud-flow-monitor-mcp"],
      "env": {
        "AWS_SSO_START_URL": "https://your-company.awsapps.com/start",
        "AWS_SSO_REGION": "us-east-1",
        "AWS_SSO_ACCOUNT_ID": "123456789012",
        "AWS_SSO_ROLE_NAME": "YourSSORole",
        "AWS_REGION": "us-east-1"
      },
      "disabled": false,
      "autoApprove": ["list_providers", "health_check"]
    }
  }
}

2. Use with Kiro

"Configure AWS with SSO"
"Analyze the flow of trace 1-abc123 in AWS"
"Analyze the capacity of my services auth-lambda and user-service in the last hour"
"Analyze deployment deploy-v2.3.1, pre window 1pm-2pm, post window 2pm-3pm"

Features

| Tool | Description | | --- | --- | | configure_provider | Connect a cloud provider (AWS, Azure, Digital Ocean) | | list_providers | List configured providers | | health_check | Verify connectivity with all providers | | analyze_flow | Trace and analyze a request flow across services | | analyze_capacity | Analyze resource consumption and scaling needs | | analyze_deployment | Detect performance regressions after deployments |

AWS SSO Support

Native SSO authentication — no AWS CLI required. The MCP handles the full OIDC device authorization flow:

1. You say "Configure AWS with SSO"
2. Kiro shows you a URL and verification code
3. You open the URL in your browser and authenticate
4. The MCP obtains temporary credentials automatically

Security

This MCP only performs read operations:

• sts:GetCallerIdentity — Validate credentials
• xray:BatchGetTraces / xray:GetTraceSummaries — Read distributed traces
• logs:FilterLogEvents — Read CloudWatch logs
• cloudwatch:GetMetricData — Read metrics

No write, modify, or delete operations exist in the codebase.

Minimum IAM Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sts:GetCallerIdentity",
        "xray:BatchGetTraces",
        "xray:GetTraceSummaries",
        "logs:FilterLogEvents",
        "cloudwatch:GetMetricData"
      ],
      "Resource": "*"
    }
  ]
}

Multi-Cloud Support

• AWS — X-Ray traces, CloudWatch Logs, CloudWatch Metrics (fully integrated)
• Azure — Application Insights, Azure Monitor (adapter ready, SDK integration pending)
• Digital Ocean — DO Monitoring (adapter ready, SDK integration pending)

License

MIT