Bug: 'str' object has no attribute 'get' in CheckSecurityServices and GetSecurityFindings

[iguinea]

Description

When using the well-architected-security-mcp-server, certain tool calls fail with the error:

Error: 'str' object has no attribute 'get'

This error occurs when parsing AWS API responses, suggesting the code expects a dictionary but receives a string.

Affected Tools

Tool	Parameters	Result
CheckSecurityServices	region=eu-west-1, services=[guardduty, securityhub, inspector, accessanalyzer, trustedadvisor, macie]	❌ Error
CheckSecurityServices	region=eu-west-1 (defaults)	❌ Error
GetSecurityFindings	service=inspector, region=eu-west-1	❌ Error
GetSecurityFindings	service=accessanalyzer, region=eu-west-1	❌ Error

Environment

• AWS Region: eu-west-1
• AWS Account: XXXXXXXXXXXX
• MCP Server: well-architected-security-mcp-server
• Date: 2026-01-23

Steps to Reproduce

1. Configure the well-architected-security-mcp-server with valid AWS credentials
2. Call CheckSecurityServices with region eu-west-1
3. Call GetSecurityFindings for inspector or accessanalyzer services

Expected Behavior

The tools should return security service status and findings without errors.

Actual Behavior

Tools return error: 'str' object has no attribute 'get'

Root Cause Hypothesis

The error 'str' object has no attribute 'get' typically occurs when:

1. An AWS API response returns an unexpected format (string instead of dict)
2. JSON parsing issues where a value is already a string
3. Code attempts .get() on a value that is a string rather than a dictionary

Additional Context

Despite these errors, the job completed successfully because the agent retried with different approaches and was able to generate the security audit report. However, these silent failures reduce the quality of the security assessment.

---

Reported via automated analysis of job execution logs