CloudSword
Cloud security assessment tool for Chinese cloud providers (Alibaba, Tencent, Huawei, Baidu, Qiniu). Enumerates cloud assets (storage buckets, compute instances, IAM users/roles, domains), tests access permissions, hardens bucket policies, and creates honey tokens for intrusion detection. Has a Metasploit-like CLI interface and MCP protocol support via SSE and STDIO modes.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Community/specialized tool. Apply standard security practices for category. Review documentation for specific security requirements.
⚡ Reliability
Best When
You need to assess security posture across Chinese cloud providers (Alibaba, Tencent, Huawei, Baidu, Qiniu) and are comfortable with a Chinese-language interface.
Avoid When
You work exclusively with Western cloud providers (AWS/Azure/GCP) or need English-language documentation and interface.
Use Cases
- • Cloud security posture assessment across Chinese cloud providers
- • Enumerating storage buckets, compute instances, and IAM entities
- • Testing object access permissions in cloud storage
- • Automated bucket security hardening (restricting to image-only uploads)
- • Deploying honey tokens for cloud intrusion detection
Not For
- • AWS, Azure, or GCP security testing
- • Non-security cloud management tasks
- • English-only environments (primary interface is Chinese)
Interface
Authentication
Requires cloud provider access key ID and secret via environment variables (CLOUD_SWORD_ACCESS_KEY_ID, CLOUD_SWORD_ACCESS_KEY_SECRET). Optional security token for temporary credentials. Credentials are not persisted by the tool.
Pricing
Apache 2.0 licensed. Written in Go. Requires valid credentials for target cloud accounts.
Agent Metadata
Known Gotchas
- ⚠ Interface and documentation are entirely in Chinese
- ⚠ Very early version (0.0.2) - API surface likely unstable
- ⚠ Module coverage varies significantly by cloud provider
- ⚠ Security tool that modifies cloud configurations - high risk if used incorrectly
- ⚠ Credentials passed via environment variables must be managed carefully
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for CloudSword.
Scores are editorial opinions as of 2026-03-06.