Skip to main content
Glama

⚡ AWS-Auth

Fast, Intelligent AWS SSO Authentication & Model Context Protocol (MCP) Server

CI Release License: MIT Python Version MCP Ready

Eliminate AWS SSO login fatigue. Zero configuration boilerplate, smart role prioritization, atomic credential caching, and native AI pair-programming integration.

Quick StartWhy aws-auth?AI / MCP IntegrationFeaturesDocumentation


  ┌───────────────────────┐       ┌────────────────────────┐       ┌───────────────────────┐
  │  IAM Identity Center  │ ────> │       aws-auth         │ ────> │  ~/.aws/credentials   │
  │     (AWS SSO OIDC)    │       │  (Smart Role Selector) │       │ (Strict 0600 POSIX)   │
  └───────────────────────┘       └───────────┬────────────┘       └───────────┬───────────┘
                                              │                                │
                                  ┌───────────▼────────────┐       ┌───────────▼───────────┐
                                  │   MCP Server (stdio)   │       │ Terraform / K8s / CLI │
                                  │ (Claude / Cursor / AI) │       │ (Instant Compatibility)│
                                  └────────────────────────┘       └───────────────────────┘

💡 Why aws-auth vs Alternatives?

Feature

aws-auth

Official aws sso login

granted / assume

aws-vault

Zero-Config Account Discovery

Automatic

❌ Requires manual ~/.aws/config

⚠️ Partial

❌ Manual

Model Context Protocol (MCP)

Native built-in

❌ None

❌ None

❌ None

1-Second MRU / Pinned Logins

Smart Prioritization

❌ None

⚠️ History prompt

❌ None

Real-time Substring & Alias Filter

Instant typing

❌ None

✅ Yes

❌ None

Direct ~/.aws/credentials Sync

Atomic & 0600

❌ Token cache only

⚠️ Shell wrapper

⚠️ Keychain wrapper

Legacy & GUI Tool Compatibility

100% Out of Box

⚠️ Many tools fail

⚠️ Requires wrapper

⚠️ Requires wrapper

WSL2 -> Windows Browser Bridge

Automatic

❌ Fails / manual copy

⚠️ Partial

❌ No

EC2 SSM & EKS Context Switching

Built-in

❌ Separate tools

❌ Separate tools

❌ No

👉 Read the full Feature Comparison Guide.


Related MCP server: MCP SysOperator

✨ Key Features

  • Zero-Boilerplate Discovery: No need to maintain hundreds of lines in ~/.aws/config. Enter your SSO Start URL once, and all authorized accounts and roles are loaded dynamically.

  • Smart Role Prioritization (MRU): Automatically pins your most recently used roles (e.g. QA Admin, Prod Admin) to #1 and #2. Pressing Enter logs you in within 1 second.

  • 🔍 Interactive Substring Search: Type any keyword (prod, qa, admin, gpu, eks) at the selection prompt to instantly filter dozens of accounts.

  • 🤖 Native Model Context Protocol (MCP) Server: Expose AWS profile switching, caller identity, and EC2/EKS exploration to LLM pair programmers (Claude Desktop, Cursor, Antigravity, Gemini).

  • 🔒 Enterprise-Grade Security: Strict POSIX 0600 file permissions, atomic file replacement (os.replace), and 300-second expiration safety margins.

  • 🌐 WSL2 Seamless Browser Bridge: Automatically detects WSL2 and opens authorization URLs directly in your Windows host browser.

  • ☸️ DevOps Acceleration: Instant EC2 SSM shell sessions and 1-click Amazon EKS kubeconfig context switching.


📦 Installation

Download the latest pre-compiled binary from GitHub Releases:

Windows (PowerShell 1-Liner)

Run in PowerShell to automatically download the binary and configure your PATH:

irm https://raw.githubusercontent.com/N0mansky/aws-auth/main/install.ps1 | iex

Or manual download via PowerShell:

curl.exe -L https://github.com/N0mansky/aws-auth/releases/latest/download/aws-auth-windows-amd64.exe -o aws-auth.exe

Linux (x86_64)

curl -L https://github.com/N0mansky/aws-auth/releases/latest/download/aws-auth-linux-amd64 -o aws-auth
chmod +x aws-auth && sudo mv aws-auth /usr/local/bin/

macOS (Universal)

curl -L https://github.com/N0mansky/aws-auth/releases/latest/download/aws-auth-macos-universal -o aws-auth
chmod +x aws-auth && sudo mv aws-auth /usr/local/bin/

Option 2: Install via pip

pip install git+https://github.com/N0mansky/aws-auth.git

Option 3: Clone & Install from Source

git clone https://github.com/N0mansky/aws-auth.git
cd aws-auth

./install.sh                      # Linux / macOS / WSL2
powershell .\install.ps1          # Windows (PowerShell)
.\install.bat                     # Windows (Command Prompt)

🚀 Quick Start

1. Interactive Login

aws-auth
Available account-role combinations (Showing 1-10 of 18):
+-----+------------------------------+-----------------+------------------------------+-------------+
| #   | Account                      | Account ID      | Role                         | Region      |
+-----+------------------------------+-----------------+------------------------------+-------------+
| 1   | ⭐ Production-App (PROD)        | (111222333444)  | AdministratorAccess     | us-east-1   |
| 2   | ⭐ Staging-Web (QA)          | (555666777888)  | AdministratorAccess     | us-east-1   |
| 3   | Analytics-Data                  | (999888777666)  | AdministratorAccess     | us-east-1   |
...
Select number 1-10 (default: 1) (type keyword to filter): [ENTER]

✅ Profile 'production-app-admin' set as default in ~/.aws/credentials.

2. Configure Portal & Custom Aliases

aws-auth --configure

Customize environment labels and preferred accounts in ~/.aws-auth/config.json:

{
  "sso_start_url": "https://my-company.awsapps.com/start",
  "sso_region": "us-east-1",
  "preferred_accounts": ["Staging-Web", "Production-App"],
  "aliases": {
    "555666777888": "QA",
    "111222333444": "PROD"
  }
}

🤖 AI Agent Integration (Model Context Protocol)

aws-auth runs as a high-performance MCP Server over stdio.

Add to Claude Desktop (claude_desktop_config.json) or Cursor:

{
  "mcpServers": {
    "aws-auth": {
      "command": "aws-auth",
      "args": ["--mcp"]
    }
  }
}

What AI Assistants Can Do with aws-auth:

  • Check active AWS Account, Region, and IAM Role ARN (aws_get_caller_identity).

  • Switch active AWS profile (aws_switch_profile) without human intervention.

  • Inspect running EC2 instances and Amazon EKS clusters (aws_list_ec2_instances, aws_list_eks_clusters).

  • Update local Kubernetes context (aws_update_kubeconfig).

👉 Read the full MCP Setup & Tool Reference Guide.


🛠️ CLI Command Reference

# Core Authentication
aws-auth                     # Interactive SSO login & smart role switch
aws-auth --configure         # Interactive SSO portal setup
aws-auth --identity          # Show current STS caller identity
aws-auth --refresh-cache     # Force refresh remote account/role metadata

# Profile Management
aws-auth --list-profiles     # List all stored AWS profiles
aws-auth --switch-profile    # Switch active default profile
aws-auth --set-default NAME  # Set specific profile as default
aws-auth --delete NAME       # Delete profile credentials

# Resource Discovery & DevOps
aws-auth --list-ec2          # List EC2 instances and connect via SSM
aws-auth --list-eks          # List EKS clusters and update kubeconfig

# Scripting & Headless Automation
aws-auth --list-profiles --json
aws-auth --identity --json
eval $(aws-auth --export-env prod-profile)  # Export AWS keys to current shell

# AWS credential_process standard
aws-auth --credential-process my-profile

📚 Documentation


🤝 Contributing

Contributions are welcome! Please check out CONTRIBUTING.md for details on setting up a development environment and running tests.


📄 License

This project is licensed under the MIT License.

Available Tools

8 tools
aws_ensure_credentialsB

Check if AWS credentials are valid, and automatically refresh using cached SSO refresh token if expired.

Args: profile_name: AWS profile name (defaults to 'default')

ParametersJSON Schema
NameRequiredDescriptionDefault
profile_nameNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It usefully discloses the auto-refresh side effect and dependence on a cached SSO refresh token, but omits failure behavior, required permissions, and what happens when no valid token exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core purpose is front-loaded in a single efficient sentence, and the Args block is short. The parameter note is thin but not padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values needn't be explained, and for a one-parameter tool the description is largely sufficient. Still, with no annotations, a credential-mutating refresh operation would benefit from stating side effects and failure conditions.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage and one parameter, the description must compensate, and it does explain profile_name and its default. However, it introduces a discrepancy: the description says it defaults to 'default' while the schema declares default: null.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb+resource: it checks validity of AWS credentials and auto-refreshes via cached SSO token. This is clearly distinct in behavior from siblings like aws_get_caller_identity or aws_switch_profile, though it never names or contrasts them explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use guidance, no prerequisites, and no mention of the alternatives among the sibling tools (aws_switch_profile, aws_list_profiles, aws_get_session_env). The agent must infer that this is a pre-flight credential check.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

aws_get_caller_identityA

Get current AWS caller identity (Account ID, IAM Role/User ARN, User ID) using STS.

Args: profile_name: Optional profile name to check. If omitted, checks the default profile.

ParametersJSON Schema
NameRequiredDescriptionDefault
profile_nameNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose the underlying mechanism (an STS call) and the shape of what comes back. It does not say what happens with no valid credentials/expired session, whether the call has side effects, or whether it requires network access — gaps that matter for a credential-adjacent tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short lines, front-loaded with the outcome (identity + returned fields) before the argument note. The 'Args:' block is slightly formulaic for a single optional parameter, but nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists and the single optional parameter is explained, so an agent has enough to invoke this correctly. Error/permission behavior is unaddressed, which is the only meaningful omission for a one-parameter read tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the only parameter is a bare nullable string, so the description does the work: it explains that profile_name selects which profile to check and that omission falls back to the default profile. It doesn't cover behavior for a nonexistent profile name, which is the remaining gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb ('Get'), a precise resource ('current AWS caller identity') and even enumerates the returned fields (Account ID, IAM Role/User ARN, User ID). It is unmistakably clear what the tool returns, but it never contrasts itself with siblings such as aws_ensure_credentials or aws_list_profiles, so it stops short of the top band.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states that profile_name is optional and that the default profile is used when omitted, which implies the basic usage pattern. However there is no explicit guidance on when to call this vs. aws_ensure_credentials or aws_switch_profile, and no prerequisites (e.g. credentials must already exist) are stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

aws_get_session_envA

Get raw AWS session environment variables (AccessKey, SecretKey, SessionToken, Region) for isolated subprocess execution.

Args: profile_name: AWS profile name (defaults to 'default')

ParametersJSON Schema
NameRequiredDescriptionDefault
profile_nameNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose that the values are 'raw' credentials intended for subprocess injection. It says nothing about whether credentials are temporary/STS-scoped, whether they are cached, how long they remain valid, or the security implications of handling the returned secrets — meaningful omissions for a credential-exposing tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One compact sentence front-loads the return contents, and the single parameter note is kept brief. The 'Args:' block is slightly ceremonial for one optional argument but not wasteful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value documentation is unnecessary, and with only one optional parameter the surface is small. The definition is nearly complete, with the only real gap being behavioral/security context around the credentials it exposes.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the schema only exposes a nullable 'Profile Name' with default null, so the description must compensate; it does explain the parameter is an AWS profile name and states the effective default ('default'), which the schema does not convey. Minor tension exists because the schema declares default null while the text says it defaults to 'default'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Get raw AWS session environment variables') and enumerates exactly what is returned (AccessKey, SecretKey, SessionToken, Region), which differentiates it from siblings like aws_get_caller_identity or aws_list_profiles. It does not, however, explicitly contrast itself with the closest sibling, aws_ensure_credentials, whose purpose could overlap.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'for isolated subprocess execution' implies the use case, so an agent can infer this tool is for obtaining env vars to hand to a child process rather than for making API calls directly. But no alternatives are named and no when-not-to-use condition is given, leaving the choice between this and aws_ensure_credentials to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

aws_list_ec2_instancesB

List EC2 instances in a specific AWS region using the specified profile.

Args: region: AWS region (e.g. 'us-east-1', 'us-west-2') profile_name: AWS profile name to use (default: 'default')

ParametersJSON Schema
NameRequiredDescriptionDefault
regionNous-east-1
profile_nameNodefault

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It implies a read-only listing but says nothing about pagination, whether instances across all states are returned, permission requirements, or error behavior for invalid credentials. For a zero-annotation tool this is a thin behavioral profile.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded in a single sentence, followed by a compact Args block that maps directly to the parameters. No filler text, though the Args/Sphinx style is slightly verbose for only two parameters.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and with 2 optional parameters complexity is low. However, with no annotations and no mention of credential prerequisites or result scope (all instances vs. running only), the description is adequate but leaves meaningful gaps for an agent invoking it cold.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does: it names both parameters, gives concrete region examples ('us-east-1', 'us-west-2'), and restates the profile default. It does not discuss region format validity beyond examples or profile resolution rules, but the added value over the bare schema is substantial.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List EC2 instances') plus the scoping dimensions (region, profile). The resource is distinct from all siblings (EKS clusters, profiles, caller identity), so an agent can route by resource without opening the schema. It stops short of explicitly naming an alternative tool, which keeps it at 4.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this versus the sibling listing tools, nor on prerequisites such as whether credentials for the named profile must already exist. The description only says a profile is 'used', leaving context entirely to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

aws_list_eks_clustersB

List EKS clusters in a specific AWS region and optionally configure local ~/.kube/config.

Args: region: AWS region (e.g. 'us-east-1', 'us-west-2') profile_name: AWS profile name to use (default: 'default') update_kubeconfig: If True, automatically configures kubeconfig for found clusters

ParametersJSON Schema
NameRequiredDescriptionDefault
regionNous-east-1
profile_nameNodefault
update_kubeconfigNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does disclose the key side effect that update_kubeconfig=True mutates the local ~/.kube/config, which is genuinely useful behavioral context. However, it says nothing about credential requirements, what happens when no clusters exist, or any side effects of the default path.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the purpose sentence and follows with a compact arg list. Slightly redundant for region/profile which repeat schema defaults, but overall efficient with no wasted prose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained. Given the tool's moderate complexity, the description is essentially complete for calling it: all three params are covered and the kubeconfig side effect is stated. Only minor gaps remain around credential/error behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it largely does: region gets concrete examples, profile_name states its default, and update_kubeconfig explains its behavioral effect. This adds real meaning beyond the bare schema types and defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('List EKS clusters') plus a clear scope ('in a specific AWS region') and adds the secondary capability of writing kubeconfig. The purpose is unambiguous, though it never names or contrasts with its closest sibling (aws_update_kubeconfig), which also touches kubeconfig.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use or when-not-to-use guidance is given, and the alternatives are not mentioned. It's implied you call this to enumerate clusters, but the overlap with aws_update_kubeconfig (which also configures kubeconfig) is never resolved, leaving the agent to guess which tool to pick.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

aws_list_profilesA

List all available local AWS profiles, current active default profile, and configured regions.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It discloses what is inspected (local profiles, active default, regions), and 'List' conveys a non-destructive read, but it says nothing about whether profile files are read from disk, whether credentials are resolved, or any auth/permission requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with zero filler. Every clause (profiles, active default, regions) conveys distinct information about the tool's scope.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description needn't document return values, and a zero-parameter read-only tool has little surface area to cover. It is complete enough to invoke correctly, though a brief note on prerequisites (e.g. AWS config files present) would close the remaining gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to disambiguate beyond the schema. Baseline 4 applies; the description's enumeration of outputs adds light value but is not required at this parameter count.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (List) and resource (local AWS profiles), and goes further by naming the composite return content: active default profile and configured regions. It is distinguishable from write-oriented siblings like aws_switch_profile, though it never explicitly contrasts with them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The verb 'List' implies a read-only discovery use case, and the sibling set (aws_switch_profile, aws_ensure_credentials) makes the context inferable, but the description names no alternative or condition for choosing this tool. Usage is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

aws_switch_profileB

Switch the default AWS credentials profile in ~/.aws/credentials to a specific profile name.

Args: profile_name: Name of the AWS profile to set as default (e.g. 'dev', 'prod', 'qa')

ParametersJSON Schema
NameRequiredDescriptionDefault
profile_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It does disclose the concrete side effect — rewriting the default profile in ~/.aws/credentials — which is genuinely useful. However, it omits failure modes (behavior if the profile name doesn't exist), whether other profiles are preserved, and reversibility, leaving meaningful gaps for a persistent mutation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded single sentence stating the action and its target file, followed by a compact Args block. The Args header repeats the schema's parameter name, which is mild redundancy, but the examples justify the space.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the description covers the core effect and parameter meaning. For a persistent credential mutation with no annotations, the absence of error behavior and permission requirements leaves the definition only adequately complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does: it explains that profile_name is the profile to set as default and supplies concrete examples ('dev', 'prod', 'qa'). It stops short of stating constraints such as case sensitivity or whether the profile must pre-exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb (switch) and resource (default AWS credentials profile), plus the concrete location of the effect (~/.aws/credentials). It is clearly distinguishable in kind from read-oriented siblings like aws_list_profiles, but it never names or contrasts with a sibling explicitly, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states what the tool does but gives no when-to-use guidance, no prerequisites (e.g. whether the profile must already exist), and no mention of alternatives such as aws_ensure_credentials or aws_get_session_env. The use case is only inferable from the verb itself.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

aws_update_kubeconfigB

Configure local kubeconfig to connect to a specific EKS cluster.

Args: cluster_name: Name of the EKS cluster region: AWS region of the cluster profile_name: AWS profile name to authenticate with

ParametersJSON Schema
NameRequiredDescriptionDefault
regionNous-east-1
cluster_nameYes
profile_nameNodefault

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden and largely fails it. It never says that this writes/overwrites the local kubeconfig file, whether it replaces an existing context for the same cluster, whether it requires the AWS CLI or valid credentials, or what happens on failure. For a mutating configuration tool, that is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The main sentence is front-loaded and wastes nothing, and the Args list is compact. The parameter list restates information the schema container already shows, which is minor redundancy rather than bloat.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described. Still, for a tool that mutates local state with zero annotation coverage, the description omits the behavioral context (overwrite semantics, credential prerequisites) an agent would need to invoke it safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the property titles ('Region', 'Cluster Name', 'Profile Name') are near-tautological, so the description's Args block does add real meaning (which AWS region, that the profile is used for authentication). However, it omits the schema defaults (us-east-1, 'default') and gives no format hints for cluster_name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Configure), resource (local kubeconfig), and target (a specific EKS cluster), which cleanly separates it from siblings like aws_list_eks_clusters or aws_get_caller_identity. It does not explicitly name any sibling as an alternative, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The scenario is implied by the purpose: use this when you need kubectl pointed at a given EKS cluster. There is no explicit when-to-use statement, no prerequisites (e.g. credentials must already exist), and no mention of related tools such as aws_list_eks_clusters for finding the cluster name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 8 tool updatesv1.1.0
    • First observedaws_ensure_credentials
    • First observedaws_get_caller_identity
    • First observedaws_get_session_env
    • First observedaws_list_ec2_instances
    • First observedaws_list_eks_clusters
    • First observedaws_list_profiles
    • First observedaws_switch_profile
    • First observedaws_update_kubeconfig

TDQS

A3.7/5.0

Scored across 8 tools

Disambiguation4/5

Most tools are clearly distinct by resource and action (list_profiles, switch_profile, get_caller_identity, list_ec2_instances). Minor overlap exists between aws_ensure_credentials and aws_get_caller_identity/aws_get_session_env (all credential/session related), and aws_update_kubeconfig overlaps with aws_list_eks_clusters' update_kubeconfig flag.

Naming Consistency5/5

Every tool follows a strict aws_verb_noun pattern (aws_list_profiles, aws_switch_profile, aws_get_caller_identity, aws_list_ec2_instances). Fully predictable and consistent conventions throughout.

Tool Count5/5

Eight tools is well-scoped for an auth/session + light resource-discovery server. Each tool earns its place without redundancy or bloat.

Completeness4/5

Core auth lifecycle is covered: profile listing/switching, credential validation/refresh, session env, caller identity, plus EKS/EC2 discovery and kubeconfig setup. Minor gaps like assume-role or profile creation/cleanup are absent but agents can work around them via the existing profile tools.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    C
    quality
    D
    maintenance
    A Model Context Protocol (MCP) server that enables AI assistants like Claude to interact with your AWS environment. This allows for natural language querying and management of your AWS resources during conversations. Think of better Amazon Q alternative.
    3
    295
    -
  • A
    license
    C
    quality
    Not graded
    maintenance
    An MCP server for Infrastructure as Code that enables AI assistants to manage cloud resources through Ansible and Terraform operations. It supports executing playbooks, managing AWS services, and running Terraform commands with optional LocalStack integration.
    18
    -
  • A
    license
    A
    quality
    A
    maintenance
    A small AWS MCP for AI assistants: one server, one config entry, SSO re-auth baked in, generic CRUD over hundreds of resource types, live docs lookup, server-side scripting for batched workflows.
    28
    745 npm
    5
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    A Model Context Protocol (MCP) server that enables AI assistants to perform comprehensive AWS security analysis through natural language queries, bridging AI with AWS security services.
    2
    Apache 2.0