Skip to main content
Glama

mcp-aws

A read-only AWS MCP server for stdio, designed to sit behind an MCP gateway.

The problem it solves

One tool per AWS API operation gives you hundreds of tools. Every tool schema is resent to the model on every turn, so a broad AWS server spends the context budget before the first question is asked.

mcp-aws registers five tools, permanently, over a catalog of read-only views declared in YAML. Coverage grows by adding YAML; the tool surface does not move. The catalog is discovered at runtime, so a model pays for the one view it needs instead of carrying the whole of AWS.

aws_list_accounts    which profiles (accounts) are configured and usable
aws_catalog          view ids + one-line summaries, filterable by service or search
aws_describe_view    one view's parameters and output shape, on demand
aws_query            run a view against a profile and region
aws_read_resource    ARN in, the matching detail view out

Typical flow: aws_catalog(service="eks")aws_describe_view("eks.nodegroups.list")aws_query(...).

Related MCP server: AWS Security MCP Server

Install and run

uv sync
uv run mcp-aws          # speaks MCP over stdio

Gateway / client config:

{
  "mcpServers": {
    "aws": {
      "command": "uv",
      "args": ["run", "--directory", "/path/to/mcp-aws", "mcp-aws"],
      "env": { "AWS_CONFIG_FILE": "/Users/you/.aws/config" }
    }
  }
}

Credentials

Each named profile in your AWS config is treated as an account. Nothing is assumed or assume-roled on your behalf. aws_list_accounts resolves every profile concurrently and reports per-profile status, so one expired SSO session degrades that row rather than the call:

{"profile": "prod", "account_id": "123456789012", "account_alias": "acme-prod",
 "default_region": "us-east-1", "status": "ok"}

Read-only by construction

Read-only is enforced at catalog load, not at call time:

  1. The operation name must match a read-only prefix (describe_, list_, get_, …).

  2. The operation must exist in the botocore service model, and every declared parameter must be a real member of its request shape.

  3. Read-shaped but sensitive operations (s3:get_object, secretsmanager:get_secret_value, ssm:get_parameter, kms:decrypt, log and item reads …) are denylisted outright.

A view that fails any of these aborts startup. The engine can only ever invoke an operation that survived, so there is no code path from a tool call to a mutating API.

Adding coverage

Add an entry to a file in src/mcp_aws/catalog/views/. No Python, no new tool, no change to the context cost:

- id: ec2.vpcs.list
  summary: VPCs with CIDR blocks and default flag
  client: ec2                 # boto3 client name
  operation: describe_vpcs    # snake_case, must be read-only and real
  paginate: true
  params:
    vpc_ids:
      type: "string[]"
      description: Specific VPC ids.
      maps_to: VpcIds         # request member, 'A.B' nesting, or 'Filters[vpc-id]'
  project: |                  # JMESPath, applied per page
    Vpcs[].{id: VpcId, cidr: CidrBlock, is_default: IsDefault}
  returns: One object per VPC.
  detail_of: ec2:vpc          # optional: makes this the target of aws_read_resource
  detail_param: vpc_ids

uv run pytest tests/test_catalog.py validates every view against the real AWS models.

Two constructs cover the awkward APIs:

  • expand — a declarative fan-out for services that split a list from its detail (eks:list_clusters + describe_cluster). inherit carries the parent's key into the child call, for describe_nodegroup and friends that need clusterName too. Bounded by max_items and a small thread pool.

  • Filters[$param] — a filter whose key is user data rather than part of the API contract, as the Resource Groups Tagging API needs. $self means this parameter's own value is the key; $other takes the key from a sibling parameter.

Point MCP_AWS_CATALOG_DIR at your own directory to add or override views without forking the package.

Results and pagination

Every response uses one envelope:

{"view": "ec2.instances.list", "profile": "prod", "region": "us-east-1",
 "count": 100, "truncated": true, "next_cursor": "eyJ0Ijo…", "items": [...]}

Results are capped by item count and serialized size. Truncation is lossless: each item records the page it came from, so a cut landing in the middle of an AWS page still produces a cursor that resumes at exactly the first dropped item.

Resources

Tools are the path a model uses; resources exist for humans and clients that browse or @-mention them.

URI

Contents

aws://catalog

Every view with its parameters

aws://accounts

Resolved profiles

aws://{profile}/{region}/{view_id}

A view result (default as region = the profile's own)

Configuration

Variable

Default

Purpose

MCP_AWS_TOOL_PREFIX

aws_

Namespace the tools behind a gateway

MCP_AWS_PROFILES

all

Comma-separated allowlist of visible profiles

MCP_AWS_CATALOG_DIR

Extra catalog directories (later wins)

MCP_AWS_MAX_ITEMS

100

Default item cap per response

MCP_AWS_MAX_CHARS

20000

Serialized size cap per response

MCP_AWS_CACHE_TTL

60

Result cache seconds; 0 disables

MCP_AWS_EXPAND_CONCURRENCY

8

Parallel detail calls during expand

MCP_AWS_LOG_LEVEL

INFO

Logging level (stderr only)

Coverage today

account (identity, regions, tagged-resource sweep), org (accounts, roots, OUs), ec2 (instances, security groups, VPCs, subnets, route tables, volumes, NAT gateways), elbv2 (load balancers, target groups, listeners, target health), autoscaling (groups), eks (clusters, node groups, add-ons, Fargate profiles).

Development

uv run pytest          # no network, no credentials; AWS is stubbed

Available Tools

5 tools
aws_catalogA
Read-only

List the read-only views this server offers, as view ids with one-line summaries. Start here to find out what can be asked about AWS.

Args: service: Restrict to one service prefix, e.g. 'ec2', 'eks', 'account'. query: Space-separated terms matched against id, summary and description.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryNo
serviceNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds the context that this is a discovery mechanism and that results are 'read-only views', which is consistent with annotations. It does not disclose additional behavioral traits like pagination, response size, or rate limits, but for a catalog tool the annotations carry most of the burden. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is remarkably concise: two sentences that deliver the purpose and entry-point advice, followed by a terse but informative args block. Every sentence earns its place, and the most critical information (what the tool does and where to start) is front-loaded. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity and the presence of an output schema (not shown but indicated), the description covers the core purpose and both parameters thoroughly. It does not mention output format, but the output schema likely handles that. The description is complete enough for an agent to call it correctly, though a note on return structure could push it to a 5.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description provides explicit, meaningful explanations for both parameters, including concrete examples for service ('ec2', 'eks', 'account') and the matching behavior for query. This goes well beyond the schema, which only lists types and defaults. With 0% schema coverage, the description fully compensates and adds significant value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action ('List') and resource ('read-only views'), and explains the output format (view ids with one-line summaries). It also positions itself as the entry point ('Start here'), which distinguishes it from sibling tools like aws_query or aws_read_resource that actually fetch data. This is a precise, non-tautological purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'Start here' provides clear contextual guidance on when to use this tool – as the first step for discovering available views. It also explains how to filter via service and query parameters. However, it does not explicitly name alternative tools or state when to avoid using it, though the sibling names suggest different roles. The guidance is adequate but not exhaustive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

aws_describe_viewA
Read-only

Show one view's parameters, output shape and the AWS call behind it.

Args: view_id: A view id from the catalog tool, e.g. 'ec2.instances.list'.

ParametersJSON Schema
NameRequiredDescriptionDefault
view_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark it read-only, open-world, and non-destructive, so the description doesn't need to restate safety. It adds useful behavioral context by explaining the tool reveals the 'AWS call behind it' and the view's 'output shape,' making clear this is a descriptive, non-executing operation. This goes beyond the schema and complements the annotations without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two lines: a front-loaded purpose sentence followed by a minimal parameter explanation. Every clause adds value—the purpose states exactly what is shown, and the args note supplies source and example. No filler, repetition, or unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter read-only introspection tool, the description is complete: it states what the tool shows, how to obtain a valid view_id, and that the call itself is only described. An output schema exists, so the return structure need not be spelled out. The combination of annotations, schema, and description covers everything an agent needs to select and invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description bears the full burden for explaining view_id. It does this well: 'A view id from the catalog tool' specifies provenance, and the example 'ec2.instances.list' gives concrete format and namespace conventions. For a single parameter, this is complete and actionable semantic guidance.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Show one view's parameters, output shape and the AWS call behind it.' This clearly identifies the tool as an introspection/metadata operation on a single view, distinguishing it from siblings like aws_read_resource and aws_query, which operate on actual resource data. The focus on view metadata rather than execution makes its purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear contextual guidance: the view_id comes from the catalog tool, with a concrete example ('ec2.instances.list'). This tells the agent where to obtain the required input and implies the tool is used after browsing the catalog. It does not explicitly enumerate when-not-to-use alternatives, but the context is strong enough to avoid confusing this with executing a view or reading a resource.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

aws_list_accountsA
Read-only

List the AWS accounts (named profiles) this server can read, with account id, alias, default region and whether the credentials currently work.

Args: refresh: Re-resolve identities instead of using the cached ones.

ParametersJSON Schema
NameRequiredDescriptionDefault
refreshNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false; the description adds useful behavioral context such as returning whether credentials currently work and the refresh mechanism that bypasses cached identities. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: the purpose appears in the first sentence, and the only parameter is explained in a single clear line. No filler or redundant restatement.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only list tool with an optional boolean parameter and an existing output schema, the description covers what is returned, the source of data (named profiles), and the effect of refresh. Nothing needed to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description fully compensates for the single parameter: 'refresh: Re-resolve identities instead of using the cached ones' adds real meaning beyond the bare boolean schema type.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb, 'List', paired with a distinct resource, 'AWS accounts (named profiles)', and enumerates the returned fields (account id, alias, default region, credential validity). This makes it clearly separable from the sibling catalog/view/read/query tools even without explicit sibling naming.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The context is clear: use this tool to enumerate the AWS accounts/profiles this server can read. It does not explicitly name alternatives or state when-not-to-use, so it misses the highest routing bar, but the usage context is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

aws_queryA
Read-only

Run a catalog view against one account and region.

Args: view_id: A view id from the catalog tool. profile: The AWS profile (account) to read, from the list-accounts tool. region: AWS region; defaults to the profile's configured region. params: View-specific parameters; see the describe-view tool. cursor: next_cursor from a previous truncated result. max_items: Cap on returned items for this call.

ParametersJSON Schema
NameRequiredDescriptionDefault
cursorNo
paramsNo
regionNo
profileYes
view_idYes
max_itemsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the description adds value beyond that by disclosing pagination behavior via next_cursor, the max_items cap, and the region defaulting behavior. It also clarifies the scope is one account and one region, which is useful operational context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one clear purpose sentence followed by a compact Args list. Every line serves a purpose, no filler is present, and the most important facts are front-loaded before the parameter details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with six parameters, an output schema, and read-only annotations, the description covers everything an agent needs: required argument provenance, defaults, pagination, and a pointer to describe-view for parameter details. The output schema exists, so lack of return-format documentation is not a gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does: every parameter receives at least a one-line explanation. Cursor, region defaults, params delegation to describe-view, and profile provenance all add meaning beyond the bare schema field names and types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Run a catalog view against one account and region.' It clearly distinguishes this tool from siblings by framing it as execution of a view, while referencing aws_catalog and aws_describe_view for inputs rather than confusing them with this tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context by pointing to where required inputs come from: view_id from the catalog tool, profile from list-accounts, and params from describe-view. It does not explicitly state when not to use this tool versus aws_read_resource, but the intended usage is strongly implied and cross-references help an agent route correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

aws_read_resourceA
Read-only

Describe a single AWS resource given its ARN, routing to the view that covers that resource type.

Args: arn: Full ARN, e.g. 'arn:aws:eks:us-east-1:123456789012:cluster/prod'. profile: Override the profile; by default it is matched from the ARN account.

ParametersJSON Schema
NameRequiredDescriptionDefault
arnYes
profileNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only and non-destructive behavior; the description adds meaningful context about internal routing to per-resource-type views and profile resolution based on the ARN account. However, it omits details about error handling or permissions, though these are less critical given the output schema and annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and efficiently structured: a purpose sentence followed by concise argument definitions. Every element earns its place, and the ARN example is immediately useful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter tool with read-only annotations and an output schema, the description covers the essentials: what it does, how to provide inputs, and expected routing behavior. It could mention siblings or failure modes, but it remains complete enough for straightforward invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description compensates well by defining the ARN format with an example and explaining the profile parameter as an override that defaults to the ARN's account. This adds actionable semantics beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Describe'), a clear resource scope (single AWS resource given an ARN), and distinguishes itself from siblings by mentioning routing to the resource-type-specific view. Including an example ARN further removes ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool should be used when you have a full ARN and want a resource description, but it never explicitly names alternative tools or exclusion conditions. It also does not clarify when to use aws_describe_view or aws_query instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 5 tool updatesv0.1.0
    • First observedaws_catalog
    • First observedaws_describe_view
    • First observedaws_list_accounts
    • First observedaws_query
    • First observedaws_read_resource

TDQS

A4.5/5.0

Scored across 5 tools

Disambiguation5/5

Each tool has a clearly distinct role: account discovery, view cataloging, view schema inspection, ARN-based resource lookup, and executing queries. There is no meaningful overlap between them.

Naming Consistency5/5

All tools share the aws_ prefix and follow a consistent verb-oriented pattern (list_accounts, catalog, describe_view, read_resource, query). The naming is uniform and predictable.

Tool Count5/5

Five tools is well-scoped for a read-only AWS exploration server. Each tool serves a distinct step in the workflow without redundancy or bloat.

Completeness5/5

The tool surface covers the full read-only workflow: discover accounts, browse available views, inspect view parameters, query data, and resolve individual resources by ARN. No obvious gaps exist for the stated purpose.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers