Loading ToolBench

Reading the current corpus…

iac-scanner MCP server · D · ToolBench

iac-scanner

Infrastructure-as-Code scanner exposed as MCP tools to Claude Desktop, Cursor, Continue.dev, and other MCP hosts. Scans Terraform and AWS CDK, performs security analysis with optional LLM augmentation, and provides rule-engine integration via Checkov and cdk-nag plugins.

2026-07-28+STDIO4 tools

59/100

Definition Quality69

Protocol Readiness42

Supportability54

Spec posture

Inferred effective spec 2026-07-28+·current baseline 2026-07-28

Static source inference · medium confidence

Current-spec patterns detected

Summary

The iac-scanner MCP server defines 4 tools with reasonable naming (action verbs: scan, run, list, iac_analysis) and clear parameter schemas. All tools have descriptions and input schemas with type definitions. However, descriptions lack depth for LLM optimization, parameter descriptions are minimal, output schemas are undocumented, and error handling guidance is absent. The server follows basic MCP structure but falls short of production-grade patterns around response shaping, pagination, and error recovery.

Tools (4)

iac_analysis_promptread onlysource verified62/100

Return ready-to-use analysis + fix prompt templates. Host LLMs can apply these prompts to content returned by scan_iac_path to produce findings without iac-scanner needing an API key.

list_iac_typesread onlysource verified68/100

List the IaC formats this server can scan.

run_rule_engineread onlysource verified74/100

Run the Checkov rule engine against a path (if installed). Returns deterministic, framework-mapped findings with CWE/CIS/NIST tags. Safe to combine with the host LLM's own analysis for hybrid coverage.

scan_iac_pathread onlysource verified71/100

Read Infrastructure-as-Code at the given path. Supports Terraform (directory with main.tf) and AWS CDK (directory with index.ts/js). Secrets are redacted and known secret files (tfstate, tfvars, .env) are skipped. Input is size-capped at 200KB by default. Returns the raw content plus metadata (iac_type, entry_path, file list).

Issues (7)

CRITICALtool ↗

Output schemas completely undocumented. No tool declares return type/structure. LLMs cannot plan downstream calls or extract data reliably.

scan_iac_pathrun_rule_enginelist_iac_typesiac_analysis_prompt

CRITICALrecovery-guide ↗

Error handling completely absent. No guidance on retryability, recovery steps, or user-fixable errors. A path-not-found or Checkov-missing error gives LLM nothing to act on.

scan_iac_pathrun_rule_engine

HIGHconstrained-input ↗

Insufficient parameter constraints and descriptions. 'path' parameter lacks guidance on format (absolute vs relative), required directory structure (must contain main.tf?), or validation rules. 'iac_type' parameter has enum but no description of what each type requires.

scan_iac_pathrun_rule_engine

HIGHtool-description ↗

list_iac_types description (13 chars) violates hard minimum. Fails 20-char threshold and provides no context on when/why to call.

Recommendations

Document output schemas for all 4 tools. Use the description to state: 'Returns { content: string, iac_type: string, entry_path: string, files: [string] }' and similar for each tool.
Expand parameter descriptions with format/constraint guidance. Example: 'path (absolute or relative path to directory containing main.tf for Terraform or index.ts/js for CDK; required)'.
Add error handling with recovery guidance to scan_iac_path and run_rule_engine. Example: 'If Checkov is not installed, the tool returns error code CHECK_NOT_INSTALLED with message: "Checkov is not available. Install with: pip install checkov[terraform]"'.
Rename iac_analysis_prompt to get_analysis_prompts and expand description to 100-150 chars explaining template types and use case.
Expand list_iac_types description to 50+ chars: 'Discover which IaC formats this server supports. Call this first to determine available scanning options.' Then state return format: 'Returns array of strings: ["terraform", "cdk"]'.
Document tool composition in each description. Example in scan_iac_path: 'Call this to read raw IaC content. Follow with run_rule_engine to add framework-mapped security findings, or use content with iac_analysis_prompt templates for LLM analysis.'
Add sensible defaults or bounds. For scan_iac_path, document the 200KB cap explicitly in the parameter description: 'path to scan (files exceeding 200KB total will be truncated or skipped)'.
Consider adding a result_limit parameter to run_rule_engine if Checkov can produce large finding lists (e.g. result_limit: 1-100, default 50).

Score history

Overall score trend

First recorded score · v2 rubric

59/100

Scored	Grade	Overall	Spec posture	Rubric
2026-09-23	D	59	2026-07-28+	v2