{
  "markdown": "<!-- mcp-name: io.github.shigechika/cloudarmor-mcp -->\n\n# cloudarmor-mcp\n\nEnglish | [日本語](README.ja.md)\n\nMCP server for [Google Cloud Armor](https://cloud.google.com/armor) WAF log patrol — deny summaries per rule, home-region false-positive checks, and preview (dry-run) rule review, straight from Cloud Logging.\n\nBuilt for a daily \"is the WAF healthy?\" patrol: one `daily_brief` call answers *what did we block, did we block anyone we shouldn't have, and are the preview rules ready to promote*.\n\nDocumentation: <https://shigechika.github.io/cloudarmor-mcp/>\n\n## Tools\n\n| Tool | Purpose |\n|---|---|\n| `daily_brief` | One-call morning summary: enforced DENYs by rule priority, home-region false-positive lens, preview DENYs |\n| `enforce_denies` | Enforced DENY counts per rule priority |\n| `home_region_denies` | Enforced DENYs whose source IP geolocates to your home region — anything not marked known-normal is a false-positive candidate |\n| `preview_denies` | Preview (dry-run) DENY counts — a quiet preview rule is a promotion candidate |\n| `health_check` | Version, config presence, and a minimal Cloud Logging probe |\n\nAll tools are read-only. Counts are hard-capped (default 2000 entries per query) and a capped result is reported as `>= N (capped)`, never as an exact total.\n\n## Setup\n\n### 1. Least-privilege service account\n\nCreate a service account with **`roles/logging.viewer` only** and download a key. Unlike human accounts, service accounts are not subject to organization re-authentication policies, so an unattended patrol never silently expires.\n\n```bash\ngcloud iam service-accounts create waf-log-viewer --project=YOUR_PROJECT\ngcloud projects add-iam-policy-binding YOUR_PROJECT \\\n  --member=serviceAccount:waf-log-viewer@YOUR_PROJECT.iam.gserviceaccount.com \\\n  --role=roles/logging.viewer\ngcloud iam service-accounts keys create key.json \\\n  --iam-account=waf-log-viewer@YOUR_PROJECT.iam.gserviceaccount.com\n```\n\n### 2. Install\n\n```bash\npip install cloudarmor-mcp\n# or\nuv tool install cloudarmor-mcp\n```\n\n### 3. Environment variables\n\n| Variable | Required | Meaning |\n|---|---|---|\n| `CLOUDARMOR_PROJECT` | yes | GCP project ID that receives the load-balancer logs |\n| `GOOGLE_APPLICATION_CREDENTIALS` | yes | Path to the service-account key file |\n| `CLOUDARMOR_BACKEND_SERVICES` | no | Comma-separated backend service names to filter (default: all) |\n| `CLOUDARMOR_HOME_REGION` | no | ISO region code treated as home traffic, e.g. `JP`. Enables the false-positive lens |\n| `CLOUDARMOR_RULES_INI` | no | Path to a rules INI (labels + known-normal priorities, see below) |\n| `CLOUDARMOR_MAX_ENTRIES` | no | Max entries fetched per query (default 2000) |\n\n### 4. Optional rules INI\n\nKeep your rule numbering out of prompts and give the reports human-readable labels:\n\n```ini\n[rules]\n101 = block non-home deep-path crawlers\n500 = AutoDiscover probe block\n1002 = OWASP LFI protection\n\n[home]\n; home-region DENYs on these priorities are expected, not false positives\nknown_normal_priorities = 500, 600\n```\n\n### 5. Claude Code (plugin)\n\nThis repository doubles as a single-plugin marketplace, so Claude Code can install\nthe server for you:\n\n```\n/plugin marketplace add shigechika/cloudarmor-mcp\n/plugin install cloudarmor-mcp@cloudarmor-mcp\n```\n\nThe plugin launches `uvx cloudarmor-mcp` and reads the same environment variables\ndescribed in [Environment variables](#3-environment-variables) above; export them\nbefore starting Claude Code. `GOOGLE_APPLICATION_CREDENTIALS` still has to point at\na service-account key file that exists on your own machine — the plugin can't ship\nor fetch that file for you, so this server can't be fully configured through the\nplugin's own settings alone.\n\n`uvx` must be on the `PATH` of the process that runs Claude Code — a login\nshell usually has it, but a GUI-launched app may not; install\n[uv](https://docs.astral.sh/uv/) system-wide if the plugin fails to start.\n\n### 6. Claude Code (manual)\n\n```bash\nclaude mcp add cloudarmor -- cloudarmor-mcp\n```\n\nwith the environment variables above in the server's env.\n\n## CLI\n\n```bash\ncloudarmor-mcp --version   # print version\ncloudarmor-mcp --check     # config + API probe (exit 0 when healthy)\ncloudarmor-mcp --brief     # print daily_brief to stdout (cron / smoke tests)\n```\n\n## Reading the report\n\n- **Enforced DENY by rule** — your normal blocking volume. Sudden shifts in the mix are worth a look.\n- **Home-region DENY** — requests from your own country/region that were blocked. Legitimate users and legitimate crawlers being denied show up here; scanner traffic that happens to originate locally will too, so the `known_normal_priorities` list keeps expected rules (e.g. an AutoDiscover block) out of the suspicious list.\n- **Preview DENY** — rules in dry-run. A preview rule that stays free of home-region hits over time is a candidate for promotion to enforce.\n\n## License\n\nMIT\n",
  "bytes": 4885,
  "sha": "4bc15b2a934a6a24957f29a3ff15afadf98e0b07e3427f639a9a3649eb2c9ad0",
  "repo_slug": "shigechika/cloudarmor-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_shigechika_cloudarmor_mcp_9ca82afa/readme"
}