mcp-aws
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcp-awswhat EC2 instances are running in prod?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
mcp-aws
A read-only AWS MCP server for stdio, designed to sit behind an MCP gateway.
The problem it solves
One tool per AWS API operation gives you hundreds of tools. Every tool schema is resent to the model on every turn, so a broad AWS server spends the context budget before the first question is asked.
mcp-aws registers five tools, permanently, over a catalog of read-only views
declared in YAML. Coverage grows by adding YAML; the tool surface does not move. The
catalog is discovered at runtime, so a model pays for the one view it needs instead of
carrying the whole of AWS.
aws_list_accounts which profiles (accounts) are configured and usable
aws_catalog view ids + one-line summaries, filterable by service or search
aws_describe_view one view's parameters and output shape, on demand
aws_query run a view against a profile and region
aws_read_resource ARN in, the matching detail view outTypical flow: aws_catalog(service="eks") → aws_describe_view("eks.nodegroups.list")
→ aws_query(...).
Related MCP server: AWS Security MCP Server
Install and run
uv sync
uv run mcp-aws # speaks MCP over stdioGateway / client config:
{
"mcpServers": {
"aws": {
"command": "uv",
"args": ["run", "--directory", "/path/to/mcp-aws", "mcp-aws"],
"env": { "AWS_CONFIG_FILE": "/Users/you/.aws/config" }
}
}
}Credentials
Each named profile in your AWS config is treated as an account. Nothing is assumed
or assume-roled on your behalf. aws_list_accounts resolves every profile concurrently
and reports per-profile status, so one expired SSO session degrades that row rather than
the call:
{"profile": "prod", "account_id": "123456789012", "account_alias": "acme-prod",
"default_region": "us-east-1", "status": "ok"}Read-only by construction
Read-only is enforced at catalog load, not at call time:
The operation name must match a read-only prefix (
describe_,list_,get_, …).The operation must exist in the botocore service model, and every declared parameter must be a real member of its request shape.
Read-shaped but sensitive operations (
s3:get_object,secretsmanager:get_secret_value,ssm:get_parameter,kms:decrypt, log and item reads …) are denylisted outright.
A view that fails any of these aborts startup. The engine can only ever invoke an operation that survived, so there is no code path from a tool call to a mutating API.
Adding coverage
Add an entry to a file in src/mcp_aws/catalog/views/. No Python, no new tool, no
change to the context cost:
- id: ec2.vpcs.list
summary: VPCs with CIDR blocks and default flag
client: ec2 # boto3 client name
operation: describe_vpcs # snake_case, must be read-only and real
paginate: true
params:
vpc_ids:
type: "string[]"
description: Specific VPC ids.
maps_to: VpcIds # request member, 'A.B' nesting, or 'Filters[vpc-id]'
project: | # JMESPath, applied per page
Vpcs[].{id: VpcId, cidr: CidrBlock, is_default: IsDefault}
returns: One object per VPC.
detail_of: ec2:vpc # optional: makes this the target of aws_read_resource
detail_param: vpc_idsuv run pytest tests/test_catalog.py validates every view against the real AWS models.
Two constructs cover the awkward APIs:
expand— a declarative fan-out for services that split a list from its detail (eks:list_clusters+describe_cluster).inheritcarries the parent's key into the child call, fordescribe_nodegroupand friends that needclusterNametoo. Bounded bymax_itemsand a small thread pool.Filters[$param]— a filter whose key is user data rather than part of the API contract, as the Resource Groups Tagging API needs.$selfmeans this parameter's own value is the key;$othertakes the key from a sibling parameter.
Point MCP_AWS_CATALOG_DIR at your own directory to add or override views without
forking the package.
Results and pagination
Every response uses one envelope:
{"view": "ec2.instances.list", "profile": "prod", "region": "us-east-1",
"count": 100, "truncated": true, "next_cursor": "eyJ0Ijo…", "items": [...]}Results are capped by item count and serialized size. Truncation is lossless: each item records the page it came from, so a cut landing in the middle of an AWS page still produces a cursor that resumes at exactly the first dropped item.
Resources
Tools are the path a model uses; resources exist for humans and clients that browse or
@-mention them.
URI | Contents |
| Every view with its parameters |
| Resolved profiles |
| A view result ( |
Configuration
Variable | Default | Purpose |
|
| Namespace the tools behind a gateway |
| all | Comma-separated allowlist of visible profiles |
| – | Extra catalog directories (later wins) |
|
| Default item cap per response |
|
| Serialized size cap per response |
|
| Result cache seconds; |
|
| Parallel detail calls during |
|
| Logging level (stderr only) |
Coverage today
account (identity, regions, tagged-resource sweep), org (accounts, roots, OUs),
ec2 (instances, security groups, VPCs, subnets, route tables, volumes, NAT gateways),
elbv2 (load balancers, target groups, listeners, target health), autoscaling
(groups), eks (clusters, node groups, add-ons, Fargate profiles).
Development
uv run pytest # no network, no credentials; AWS is stubbedAvailable Tools
5 toolsaws_catalogARead-only
List the read-only views this server offers, as view ids with one-line summaries. Start here to find out what can be asked about AWS.
Args: service: Restrict to one service prefix, e.g. 'ec2', 'eks', 'account'. query: Space-separated terms matched against id, summary and description.
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | ||
| service | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds the context that this is a discovery mechanism and that results are 'read-only views', which is consistent with annotations. It does not disclose additional behavioral traits like pagination, response size, or rate limits, but for a catalog tool the annotations carry most of the burden. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is remarkably concise: two sentences that deliver the purpose and entry-point advice, followed by a terse but informative args block. Every sentence earns its place, and the most critical information (what the tool does and where to start) is front-loaded. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity and the presence of an output schema (not shown but indicated), the description covers the core purpose and both parameters thoroughly. It does not mention output format, but the output schema likely handles that. The description is complete enough for an agent to call it correctly, though a note on return structure could push it to a 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description provides explicit, meaningful explanations for both parameters, including concrete examples for service ('ec2', 'eks', 'account') and the matching behavior for query. This goes well beyond the schema, which only lists types and defaults. With 0% schema coverage, the description fully compensates and adds significant value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action ('List') and resource ('read-only views'), and explains the output format (view ids with one-line summaries). It also positions itself as the entry point ('Start here'), which distinguishes it from sibling tools like aws_query or aws_read_resource that actually fetch data. This is a precise, non-tautological purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Start here' provides clear contextual guidance on when to use this tool – as the first step for discovering available views. It also explains how to filter via service and query parameters. However, it does not explicitly name alternative tools or state when to avoid using it, though the sibling names suggest different roles. The guidance is adequate but not exhaustive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aws_describe_viewARead-only
Show one view's parameters, output shape and the AWS call behind it.
Args: view_id: A view id from the catalog tool, e.g. 'ec2.instances.list'.
| Name | Required | Description | Default |
|---|---|---|---|
| view_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark it read-only, open-world, and non-destructive, so the description doesn't need to restate safety. It adds useful behavioral context by explaining the tool reveals the 'AWS call behind it' and the view's 'output shape,' making clear this is a descriptive, non-executing operation. This goes beyond the schema and complements the annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two lines: a front-loaded purpose sentence followed by a minimal parameter explanation. Every clause adds value—the purpose states exactly what is shown, and the args note supplies source and example. No filler, repetition, or unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter read-only introspection tool, the description is complete: it states what the tool shows, how to obtain a valid view_id, and that the call itself is only described. An output schema exists, so the return structure need not be spelled out. The combination of annotations, schema, and description covers everything an agent needs to select and invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description bears the full burden for explaining view_id. It does this well: 'A view id from the catalog tool' specifies provenance, and the example 'ec2.instances.list' gives concrete format and namespace conventions. For a single parameter, this is complete and actionable semantic guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Show one view's parameters, output shape and the AWS call behind it.' This clearly identifies the tool as an introspection/metadata operation on a single view, distinguishing it from siblings like aws_read_resource and aws_query, which operate on actual resource data. The focus on view metadata rather than execution makes its purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear contextual guidance: the view_id comes from the catalog tool, with a concrete example ('ec2.instances.list'). This tells the agent where to obtain the required input and implies the tool is used after browsing the catalog. It does not explicitly enumerate when-not-to-use alternatives, but the context is strong enough to avoid confusing this with executing a view or reading a resource.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aws_list_accountsARead-only
List the AWS accounts (named profiles) this server can read, with account id, alias, default region and whether the credentials currently work.
Args: refresh: Re-resolve identities instead of using the cached ones.
| Name | Required | Description | Default |
|---|---|---|---|
| refresh | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false; the description adds useful behavioral context such as returning whether credentials currently work and the refresh mechanism that bypasses cached identities. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: the purpose appears in the first sentence, and the only parameter is explained in a single clear line. No filler or redundant restatement.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with an optional boolean parameter and an existing output schema, the description covers what is returned, the source of data (named profiles), and the effect of refresh. Nothing needed to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description fully compensates for the single parameter: 'refresh: Re-resolve identities instead of using the cached ones' adds real meaning beyond the bare boolean schema type.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb, 'List', paired with a distinct resource, 'AWS accounts (named profiles)', and enumerates the returned fields (account id, alias, default region, credential validity). This makes it clearly separable from the sibling catalog/view/read/query tools even without explicit sibling naming.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The context is clear: use this tool to enumerate the AWS accounts/profiles this server can read. It does not explicitly name alternatives or state when-not-to-use, so it misses the highest routing bar, but the usage context is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aws_queryARead-only
Run a catalog view against one account and region.
Args:
view_id: A view id from the catalog tool.
profile: The AWS profile (account) to read, from the list-accounts tool.
region: AWS region; defaults to the profile's configured region.
params: View-specific parameters; see the describe-view tool.
cursor: next_cursor from a previous truncated result.
max_items: Cap on returned items for this call.
| Name | Required | Description | Default |
|---|---|---|---|
| cursor | No | ||
| params | No | ||
| region | No | ||
| profile | Yes | ||
| view_id | Yes | ||
| max_items | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the description adds value beyond that by disclosing pagination behavior via next_cursor, the max_items cap, and the region defaulting behavior. It also clarifies the scope is one account and one region, which is useful operational context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one clear purpose sentence followed by a compact Args list. Every line serves a purpose, no filler is present, and the most important facts are front-loaded before the parameter details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with six parameters, an output schema, and read-only annotations, the description covers everything an agent needs: required argument provenance, defaults, pagination, and a pointer to describe-view for parameter details. The output schema exists, so lack of return-format documentation is not a gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it does: every parameter receives at least a one-line explanation. Cursor, region defaults, params delegation to describe-view, and profile provenance all add meaning beyond the bare schema field names and types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Run a catalog view against one account and region.' It clearly distinguishes this tool from siblings by framing it as execution of a view, while referencing aws_catalog and aws_describe_view for inputs rather than confusing them with this tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context by pointing to where required inputs come from: view_id from the catalog tool, profile from list-accounts, and params from describe-view. It does not explicitly state when not to use this tool versus aws_read_resource, but the intended usage is strongly implied and cross-references help an agent route correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aws_read_resourceARead-only
Describe a single AWS resource given its ARN, routing to the view that covers that resource type.
Args: arn: Full ARN, e.g. 'arn:aws:eks:us-east-1:123456789012:cluster/prod'. profile: Override the profile; by default it is matched from the ARN account.
| Name | Required | Description | Default |
|---|---|---|---|
| arn | Yes | ||
| profile | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only and non-destructive behavior; the description adds meaningful context about internal routing to per-resource-type views and profile resolution based on the ARN account. However, it omits details about error handling or permissions, though these are less critical given the output schema and annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short and efficiently structured: a purpose sentence followed by concise argument definitions. Every element earns its place, and the ARN example is immediately useful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter tool with read-only annotations and an output schema, the description covers the essentials: what it does, how to provide inputs, and expected routing behavior. It could mention siblings or failure modes, but it remains complete enough for straightforward invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description compensates well by defining the ARN format with an example and explaining the profile parameter as an override that defaults to the ARN's account. This adds actionable semantics beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Describe'), a clear resource scope (single AWS resource given an ARN), and distinguishes itself from siblings by mentioning routing to the resource-type-specific view. Including an example ARN further removes ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool should be used when you have a full ARN and want a resource description, but it never explicitly names alternative tools or exclusion conditions. It also does not clarify when to use aws_describe_view or aws_query instead.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.1.0- First observed
aws_catalog - First observed
aws_describe_view - First observed
aws_list_accounts - First observed
aws_query - First observed
aws_read_resource
TDQS
Scored across 5 tools
Each tool has a clearly distinct role: account discovery, view cataloging, view schema inspection, ARN-based resource lookup, and executing queries. There is no meaningful overlap between them.
All tools share the aws_ prefix and follow a consistent verb-oriented pattern (list_accounts, catalog, describe_view, read_resource, query). The naming is uniform and predictable.
Five tools is well-scoped for a read-only AWS exploration server. Each tool serves a distinct step in the workflow without redundancy or bloat.
The tool surface covers the full read-only workflow: discover accounts, browse available views, inspect view parameters, query data, and resolve individual resources by ARN. No obvious gaps exist for the stated purpose.
Maintenance
Related MCP Connectors
Read-only MCP access to a documented IT fleet: state, changes, posture. 15 tools.
- ZopDev MCPOAuthdev.zop
Cloud cost, inventory and governance on AWS/Azure/GCP. Read-only by default, optional scoped writes
Governed MCP gateway: one endpoint for your tools, with credential custody and audit log.
Governed data discovery, exact queries, decisions, simulations, and runtime utilities over MCP.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceA read-only MCP server for safe, structured investigation of AWS serverless resources, providing curated tools for tracing dependencies, permissions, and failures without exposing raw SDK access.MIT
- AlicenseNot gradedqualityDmaintenanceEnables management and analysis of AWS security groups, S3 buckets, and VPC connections via MCP.7MIT
- AlicenseNot gradedqualityDmaintenanceA minimal, security-focused MCP gateway for connecting ChatGPT to AWS account data through explicit, read-only tools.MIT
- FlicenseNot gradedqualityDmaintenanceEnables read-only SQL querying and schema inspection across MSSQL, PostgreSQL, and MySQL databases via MCP tools.-