Provides comprehensive tools for AWS Financial Operations (FinOps), enabling cost analysis, resource cleanup, capacity right-sizing, and security auditing across dozens of AWS services like EC2, S3, RDS, and Lambda.
Enables auditing of Amazon EKS clusters to identify outdated Kubernetes versions for maintenance and governance.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@AWS FinOps MCP Serverfind unused resources and identify cost saving opportunities in us-east-1"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
AWS FinOps MCP Server
Production-Ready Deployment: This MCP server is optimized for deployment on Amazon Bedrock AgentCore Runtime
Model Context Protocol (MCP) server for AWS Financial Operations (FinOps) - providing comprehensive tools for cloud resource optimization, cost management, and performance monitoring.
π Quick Start - Deploy to AWS
Deploy to Amazon Bedrock AgentCore (Recommended)
Deploy your MCP server to production in minutes:
π Complete Deployment Guides:
AGENTCORE_DEPLOYMENT_FINAL.md - Complete deployment guide with troubleshooting
AGENTCORE_QUICKSTART.md - Quick 5-minute deployment
AGENTCORE_RUNTIME_REVIEW.md - Status review and next steps
QUICK_FIX_DEPLOYMENT.md - Quick fixes for common issues
MANUAL_AGENTCORE_DEPLOY.md - Manual Docker deployment
Local Development
π― Quick Overview
76 Tools across 14 categories for comprehensive AWS optimization
Category Filtering - Load only the tools you need (NEW!)
Dual Modes - stdio for direct integration, HTTP for remote access
Cost Savings - Identify unused resources and optimization opportunities
Security & Compliance - Find unencrypted resources and security issues
Performance Analysis - Analyze and optimize application performance
Ready-to-Use IAM Policies - Get started in minutes
π View Architecture Diagrams - Visual system architecture and data flows
π What's New
Category-Based Tool Filtering
Problem: Loading all 76 tools can be slow and overwhelming for MCP clients.
Solution: Use MCP_TOOL_CATEGORIES to enable only the categories you need!
Benefits:
β‘ 67-89% faster loading for focused use cases
π― Better organization - see only relevant tools
π§ Flexible - change categories without code changes
β Backward compatible - defaults to all tools
π See TOOL_CATEGORIES.md for complete guide
New Tools Added
Network: NAT Gateways, VPC Endpoints, Internet Gateways, CloudFront, Route53
Storage: S3 buckets, storage class recommendations
Containers: ECS clusters/services, ECR images, launch templates
Messaging: SQS queues, SNS topics, EventBridge rules
Database: DynamoDB tables and utilization
Monitoring: CloudWatch alarms and dashboards
Performance: Lambda cold starts, API Gateway, DynamoDB throttling, RDS insights, CloudFront cache
Security: Unencrypted resources, public S3 buckets, permissive security groups
Governance: Untagged resources, tag compliance, cost allocation
Capacity: ElastiCache, ECS services, Lambda utilization
Upgrade: Lambda runtimes, EC2 generations, EBS types, RDS/ElastiCache engines, EKS versions
Cost: Savings Plans, Reserved Instances, EBS optimization, snapshots, data transfer, NAT Gateway
π Tool Categories
Category | Tools | Description |
π§Ή Cleanup | 9 | Find unused resources to delete |
π° Cost | 16 | Cost optimization and analysis |
π Capacity | 9 | Resource utilization and right-sizing |
π Security | 5 | Security compliance checks |
β‘ Performance | 5 | Performance analysis and tuning |
π Upgrade | 8 | Outdated resource detection |
π Network | 5 | Network resource optimization |
πΎ Storage | 2 | Storage optimization |
π¦ Containers | 4 | Container resource management |
π¬ Messaging | 3 | Messaging service cleanup |
ποΈ Database | 2 | Database optimization |
π Monitoring | 3 | Monitoring resource cleanup |
π Application | 2 | Application health monitoring |
ποΈ Governance | 3 | Tagging and compliance |
Total: 76 tools - Use category filtering to load only what you need!
π See TOOL_CATEGORIES.md for complete documentation
Features
76 Tools Across 14 Categories - Use category filtering to load only what you need!
π§Ή Cleanup Tools (9 tools)
Find unused AWS resources to reduce costs:
find_unused_lambda_functions- Lambda functions with no invocationsfind_unused_elastic_ips- Unattached Elastic IPs ($3.60/month each)find_unused_amis- AMIs not used by instances or ASGsfind_unused_load_balancers- Load balancers with no traffic ($22-32/month)find_unused_target_groups- Target groups with no targets or trafficfind_unused_log_groups- CloudWatch Log Groups with no recent eventsfind_unused_snapshots- EBS snapshots not associated with AMIs ($0.05/GB/month)find_unused_security_groups- Security groups not attached to resourcesfind_unused_volumes- Unattached EBS volumes
π° Cost Tools (16 tools)
Cost optimization, analysis, and savings recommendations:
Cost Optimization Hub:
get_all_cost_optimization_recommendations- All 19 resource typesget_cost_optimization_ec2- EC2 instance recommendationsget_cost_optimization_lambda- Lambda function recommendationsget_cost_optimization_rds- RDS instance recommendationsget_cost_optimization_ebs- EBS volume recommendations
Cost Explorer:
get_cost_by_region- Cost breakdown by AWS regionget_cost_by_service- Cost breakdown by AWS serviceget_cost_by_region_and_service- Combined region and service breakdownget_daily_cost_trend- Daily cost trends with statistics
Savings & Optimization:
get_savings_plans_recommendations- Savings Plans recommendationsget_reserved_instance_recommendations- RI purchase recommendationsanalyze_reserved_instance_utilization- RI utilization and coverageget_ebs_volume_type_recommendations- EBS volume type optimizationget_snapshot_lifecycle_recommendations- Snapshot lifecycle managementanalyze_data_transfer_costs- Data transfer cost analysisget_nat_gateway_optimization_recommendations- NAT Gateway optimization
π Capacity Tools (9 tools)
Resource utilization analysis for right-sizing:
Compute:
find_underutilized_ec2_instances- EC2 with low CPU/memory (β€20%)find_overutilized_ec2_instances- EC2 with high CPU/memory (β₯80%)find_underutilized_lambda_functions- Lambda with low invocations
Database:
find_underutilized_rds_instances- RDS with low CPU (β€20%)find_overutilized_rds_instances- RDS with high CPU (β₯80%)find_underutilized_dynamodb_tables- DynamoDB with low capacityfind_overutilized_dynamodb_tables- DynamoDB with high capacity (>80%)find_underutilized_elasticache_clusters- ElastiCache with low CPU (<20%)find_overutilized_elasticache_clusters- ElastiCache with high CPU/memory (>80%)
Containers:
find_underutilized_ecs_services- ECS services with low CPU/memory (<20%)
π Security Tools (5 tools)
Security compliance and best practices:
find_unencrypted_ebs_volumes- EBS volumes without encryptionfind_unencrypted_s3_buckets- S3 buckets without default encryptionfind_unencrypted_rds_instances- RDS instances without encryptionfind_public_s3_buckets- S3 buckets with public access enabledfind_overly_permissive_security_groups- Security groups with 0.0.0.0/0 rules
β‘ Performance Tools (5 tools)
Performance analysis and optimization:
analyze_lambda_cold_starts- Lambda cold start analysisanalyze_api_gateway_performance- API Gateway performance metricsanalyze_dynamodb_throttling- DynamoDB throttling issuesanalyze_rds_performance_insights- RDS Performance Insights dataanalyze_cloudfront_cache_hit_ratio- CloudFront cache performance
π Upgrade Tools (8 tools)
Identify outdated resources needing upgrades:
Compute:
find_asgs_with_old_amis- Auto Scaling Groups using old AMIsfind_outdated_lambda_runtimes- Lambda with deprecated runtimesfind_ec2_instances_with_old_generations- EC2 using previous generation typesfind_ebs_volumes_with_old_types- EBS using previous generation typesfind_outdated_ecs_platform_versions- ECS not on latest platform version
Database:
find_outdated_rds_engine_versions- RDS not on latest engine versionfind_outdated_elasticache_engine_versions- ElastiCache not on latest version
Containers:
find_outdated_eks_cluster_versions- EKS not on latest Kubernetes version
π Network Tools (5 tools)
Network resource optimization:
find_unused_nat_gateways- NAT Gateways with no traffic ($32.40/month)find_unused_vpc_endpoints- VPC Endpoints with no connections ($7.20/month per AZ)find_unused_internet_gateways- Unattached Internet Gatewaysfind_unused_cloudfront_distributions- CloudFront with no requestsfind_unused_route53_hosted_zones- Route53 zones with no queries
πΎ Storage Tools (2 tools)
Storage optimization:
find_unused_s3_buckets- S3 buckets with no activityget_s3_storage_class_recommendations- S3 storage class optimization (30-95% savings)
π¦ Container Tools (4 tools)
Container and orchestration resource management:
find_old_ecs_task_definitions- Old ECS task definitions not in usefind_unused_ecr_images- Unused ECR images ($0.10/GB/month)find_unused_launch_templates- EC2 launch templates not in usefind_unused_ecs_clusters_and_services- ECS clusters/services with no activity
π¬ Messaging Tools (3 tools)
Messaging service optimization:
find_unused_sqs_queues- SQS queues with no messagesfind_unused_sns_topics- SNS topics with no subscriptions/messagesfind_unused_eventbridge_rules- EventBridge rules with no invocations
ποΈ Database Tools (2 tools)
Database resource analysis:
find_unused_dynamodb_tables- DynamoDB tables with no read/write activityfind_underutilized_dynamodb_tables- DynamoDB with low capacity utilization
π Monitoring Tools (3 tools)
Monitoring resource cleanup:
find_unused_cloudwatch_alarms- CloudWatch alarms in INSUFFICIENT_DATA statefind_orphaned_cloudwatch_dashboards- Dashboards referencing deleted resourcesfind_orphaned_cloudwatch_alarms- Alarms not associated with active resources
π Application Tools (2 tools)
Application health monitoring:
find_target_groups_with_high_error_rate- Target groups with 5XX errors (>5%)find_target_groups_with_high_response_time- Target groups with slow response times (>1s)
ποΈ Governance Tools (3 tools)
Resource governance and compliance:
find_untagged_resources- Resources missing required tagsanalyze_tag_compliance- Tag compliance analysis across resourcesgenerate_cost_allocation_report- Cost allocation by tags
β¨ Tool Features
All tools include:
β Comprehensive Details - Full ARNs, configurations, and metadata
β Cost Estimates - Monthly cost savings potential
β Complete Tags - Cost allocation and ownership tracking
β Age Calculations - Prioritize cleanup efforts
β Security Details - Encryption, KMS keys, ownership
β Total Savings - Aggregate cost savings per tool
π Deployment Modes
Standard Mode (stdio): Direct integration with MCP clients
HTTP Server Mode: Remote access via REST API for distributed deployments
Run on EC2 and connect from anywhere
SSH tunnel for secure development
HTTPS with Nginx for production
AWS Systems Manager for no-SSH access
API endpoints:
/health,/tools,/mcp
Installation
π NEW: Deploy to Amazon Bedrock AgentCore
Deploy this MCP server to AWS Bedrock AgentCore for production-ready, scalable agent integration:
Quick Links:
β‘ Quick Fix Deployment - Deploy in 5 commands
π Manual Deployment Guide - Step-by-step manual process
π Complete Documentation - Full deployment guide
βοΈ Deployment Comparison - Choose the right method
Two Deployment Methods:
Gateway (Lambda) - Quick setup, serverless, cost-effective
Runtime (Container) - Production-ready, unlimited execution time (use
agentcore launch)
Quick Start (Virtual Environment)
Manual Installation
Docker Installation
Option 1: Standard Mode (stdio)
Option 2: HTTP Server Mode (Remote Access)
See DEPLOYMENT.md for detailed deployment options including EC2, ECS, Lambda, and Kubernetes.
See REMOTE_ACCESS_GUIDE.md for remote access setup and configuration.
Usage
π― Tool Category Filtering (NEW!)
Problem: Loading all 76 tools can be slow and overwhelming for clients.
Solution: Use MCP_TOOL_CATEGORIES to enable only the tools you need!
Available Categories (14 total):
cleanup(9 tools) - Find unused resourcescost(16 tools) - Cost optimization and analysiscapacity(9 tools) - Resource utilization analysissecurity(5 tools) - Security compliance checksperformance(5 tools) - Performance analysisupgrade(8 tools) - Outdated resource detectionnetwork(5 tools) - Network resource optimizationstorage(2 tools) - Storage optimizationcontainers(4 tools) - Container resource managementdatabase(2 tools) - Database optimizationmessaging(3 tools) - Messaging service cleanupmonitoring(3 tools) - Monitoring resource cleanupapplication(2 tools) - Application health monitoringgovernance(3 tools) - Tagging and compliance
π See
Mode 1: Standard MCP Server (stdio)
Add to your MCP client configuration (e.g., Kiro's mcp.json):
Or using uvx:
Mode 2: HTTP Server (Remote Access)
Run the server in HTTP mode for remote access:
HTTP API Endpoints
Health Check:
List Tools:
Execute Tool:
Remote Access Options
SSH Tunnel (Recommended for Development):
HTTPS with Nginx (Recommended for Production):
See REMOTE_ACCESS_GUIDE.md for complete remote access setup instructions.
Tool Parameters
All tools accept the following parameters:
AWS Credentials (one of):
profile_name: AWS profile namerole_arn: IAM role ARN to assumeaccess_key+secret_access_key: Direct credentialsaccess_key+secret_access_key+session_token: Temporary credentials
Common Parameters:
region_name: AWS region (default: "us-east-1")period: Lookback period in days (default: 90)max_results: Maximum results to return (default: 100)
Example Tool Calls
stdio Mode (MCP Client)
HTTP Mode (REST API)
AWS Permissions Required
Quick Setup
We provide ready-to-use IAM policies for different use cases:
Available Policies
Policy | Use Case | Tools Enabled |
Full Policy | Production (recommended) | All 76 tools |
Minimal Policy | Testing/Development | All 76 tools (basic) |
Read-Only Policy | Maximum security | All 76 tools |
Cost-Only Policy | Cost analysis only | 16 cost tools |
Policy Files
iam-policies/finops-full-policy.json- Complete permissions (recommended)iam-policies/finops-minimal-policy.json- Basic permissionsiam-policies/finops-readonly-policy.json- Read-only accessiam-policies/finops-cost-only-policy.json- Cost analysis only
Setup Methods
AWS Console: Copy policy JSON β Create Policy β Attach to Role/User
AWS CLI:
Terraform: See iam-policies/examples/terraform-example.tf
CloudFormation: See iam-policies/examples/cloudformation-example.yaml
π Complete Guide: See IAM_SETUP_GUIDE.md for detailed instructions
Architecture
Deployment Modes
stdio Mode (Default):
HTTP Mode (Remote Access):
Category Filtering (NEW!)
Development
Environment Variables
Server Configuration
Example Configurations
stdio Mode with Category Filtering (Recommended):
stdio Mode (All Tools):
HTTP Mode with Category Filtering:
Docker HTTP Mode with Filtering:
License
MIT License
Quick Reference
Run Modes
Mode | Command | Use Case |
stdio |
| Direct MCP client integration |
HTTP |
| Remote access, distributed deployments |
Docker Commands
Remote Access
Documentation
Document | Description |
π Deploy to Amazon Bedrock AgentCore in 5 minutes | |
π Complete AgentCore deployment guide | |
π Compare Gateway vs Runtime deployment | |
Complete setup guide with MCP configuration | |
Category filtering guide | |
Quick reference for categories | |
All 76 tools documentation | |
Deployment options (EC2, ECS, Lambda, K8s) | |
HTTP mode and remote access setup | |
IAM permissions and policies | |
System architecture and design | |
Migration guide for category filtering | |
IAM policy templates |
This server cannot be installed