Integrates with Codecov to track code coverage metrics during CI/CD runs with target coverage thresholds and PR status checks
Provides containerized deployment option with multi-architecture support for AMD64/x86_64 and ARM64, with security isolation and consistent environment configuration
Distributes the containerized application through GitHub Packages with versioned releases and development builds tagged with Git commit SHA
Utilizes Mermaid diagrams to visualize architecture and workflows in documentation
Incorporates Pytest for unit testing and integration testing of AWS resource interactions
Supports local installation and execution using Python 3.13+ as an alternative to the Docker deployment method
Uses Ruff for code linting and formatting as part of the development workflow
AWS MCP Server
Give Claude access to all 200+ AWS services through the AWS CLI.
Demo
Related MCP server: MCP2Lambda
What It Does
This MCP server lets Claude run AWS CLI commands on your behalf. Instead of wrapping each AWS API individually, it wraps the CLI itself—giving Claude complete AWS access through just two tools:
Tool | Purpose |
| Get documentation for any AWS command |
| Execute AWS CLI commands with optional pipes (
,
, etc.) |
Claude learns commands on-demand using --help, then executes them. Your IAM policy controls what it can actually do.
Quick Start
Prerequisites
AWS CLI installed
AWS credentials configured (see AWS Credentials)
uv installed (for
uvx)
Claude Code
Add to your MCP settings (Cmd+Shift+P → "Claude: Open MCP Config"):
Claude Desktop
Add to your Claude Desktop config file:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
Docker (More Secure)
Docker provides stronger isolation by running commands in a container:
Note: Replace
~/.awswith the full path on Windows (e.g.,C:\Users\YOU\.aws).
AWS Credentials
The server uses the standard AWS credential chain. Your credentials are discovered automatically from:
Environment variables:
AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEYCredentials file:
~/.aws/credentialsConfig file:
~/.aws/config(for profiles and region)IAM role: When running on EC2, ECS, or Lambda
To use a specific profile:
Configuration
AWS Settings
Environment Variable | Description | Default |
| AWS profile to use |
|
| AWS region (also accepts
) |
|
| Custom path to AWS config file |
|
| Custom path to credentials file |
|
Server Settings
Environment Variable | Description | Default |
| Command execution timeout in seconds |
|
| Maximum output size in characters |
|
| Transport protocol (
or
) |
|
| Sandbox mode (
,
,
) |
|
| Credential passing (
,
,
) |
|
Security
Your IAM policy is your security boundary. This server executes whatever AWS commands Claude requests—IAM controls what actually succeeds.
Best practices:
Use a least-privilege IAM role (only permissions Claude needs)
Never use root credentials
Consider Docker for additional host isolation
For detailed security architecture, see Security Documentation.
Documentation
Usage Guide — Tools, resources, and prompt templates
Security Architecture — IAM + Sandbox + Docker model
Development Guide — Contributing and testing
License
MIT License — see LICENSE for details.