AWS-Auth
⚡ AWS-Auth
빠르고 지능적인 AWS SSO 인증 및 Model Context Protocol (MCP) 서버
AWS SSO 로그인 피로를 없애세요. 보일러플레이트 구성 없이 지능형 역할 우선순위, 원자적 자격 증명 캐싱, 네이티브 AI 페어 프로그래밍 통합을 제공합니다.
빠른 시작 • 왜 aws-auth인가? • AI / MCP 통합 • 주요 기능 • 문서
┌───────────────────────┐ ┌────────────────────────┐ ┌───────────────────────┐
│ IAM Identity Center │ ────> │ aws-auth │ ────> │ ~/.aws/credentials │
│ (AWS SSO OIDC) │ │ (Smart Role Selector) │ │ (Strict 0600 POSIX) │
└───────────────────────┘ └───────────┬────────────┘ └───────────┬───────────┘
│ │
┌───────────▼────────────┐ ┌───────────▼───────────┐
│ MCP Server (stdio) │ │ Terraform / K8s / CLI │
│ (Claude / Cursor / AI) │ │ (Instant Compatibility)│
└────────────────────────┘ └───────────────────────┘💡 왜 대안 대신 aws-auth인가?
기능 |
| 공식 |
|
|
제로 구성 계정 검색 | ✅ 자동 | ❌ 수동 | ⚠️ 부분적 | ❌ 수동 |
Model Context Protocol (MCP) | ✅ 네이티브 내장 | ❌ 없음 | ❌ 없음 | ❌ 없음 |
1초 MRU / 고정 로그인 | ✅ 지능형 우선순위 | ❌ 없음 | ⚠️ 기록 프롬프트 | ❌ 없음 |
실시간 부분 문자열 및 별칭 필터 | ✅ 즉시 입력 | ❌ 없음 | ✅ 예 | ❌ 없음 |
직접 | ✅ 원자적 & | ❌ 토큰 캐시 전용 | ⚠️ 셸 래퍼 | ⚠️ 키체인 래퍼 |
레거시 및 GUI 도구 호환성 | ✅ 100% 즉시 사용 가능 | ⚠️ 많은 도구에서 실패 | ⚠️ 래퍼 필요 | ⚠️ 래퍼 필요 |
WSL2 -> Windows 브라우저 브리지 | ✅ 자동 | ❌ 실패 / 수동 복사 | ⚠️ 부분적 | ❌ 아니요 |
EC2 SSM 및 EKS 컨텍스트 전환 | ✅ 내장 | ❌ 별도 도구 | ❌ 별도 도구 | ❌ 아니요 |
👉 전체 기능 비교 가이드 보기.
Related MCP server: MCP SysOperator
✨ 주요 기능
⚡ 제로 보일러플레이트 검색:
~/.aws/config에 수백 줄을 유지할 필요가 없습니다. SSO 시작 URL을 한 번만 입력하면 모든 권한이 부여된 계정과 역할이 동적으로 로드됩니다.⭐ 지능형 역할 우선순위 지정 (MRU): 가장 최근에 사용한 역할(예:
QA Admin,Prod Admin)을 자동으로#1및#2에 고정합니다.Enter를 누르면 1초 이내에 로그인됩니다.🔍 대화형 부분 문자열 검색: 선택 프롬프트에 키워드(
prod,qa,admin,gpu,eks)를 입력하면 수십 개의 계정을 즉시 필터링할 수 있습니다.🤖 네이티브 Model Context Protocol (MCP) 서버: AWS 프로필 전환, 호출자 ID, EC2/EKS 탐색 기능을 LLM 페어 프로그래머(Claude Desktop, Cursor, Antigravity, Gemini)에 노출합니다.
🔒 엔터프라이즈급 보안: 엄격한 POSIX
0600파일 권한, 원자적 파일 교체(os.replace), 300초 만료 안전 여유 시간을 제공합니다.🌐 WSL2 원활한 브라우저 브리지: WSL2를 자동으로 감지하고 Windows 호스트 브라우저에서 인증 URL을 직접 엽니다.
☸️ DevOps 가속화: 즉각적인 EC2 SSM 셸 세션과 원클릭 Amazon EKS kubeconfig 컨텍스트 전환을 제공합니다.
📦 설치
옵션 1: 독립 실행형 바이너리 (권장)
최신 사전 컴파일된 바이너리를 GitHub Releases에서 다운로드하세요:
Windows (PowerShell 원라이너)
PowerShell에서 실행하여 바이너리를 자동으로 다운로드하고 PATH를 구성하세요:
irm https://raw.githubusercontent.com/N0mansky/aws-auth/main/install.ps1 | iex또는 PowerShell을 통한 수동 다운로드:
curl.exe -L https://github.com/N0mansky/aws-auth/releases/latest/download/aws-auth-windows-amd64.exe -o aws-auth.exeLinux (x86_64)
curl -L https://github.com/N0mansky/aws-auth/releases/latest/download/aws-auth-linux-amd64 -o aws-auth
chmod +x aws-auth && sudo mv aws-auth /usr/local/bin/macOS (Universal)
curl -L https://github.com/N0mansky/aws-auth/releases/latest/download/aws-auth-macos-universal -o aws-auth
chmod +x aws-auth && sudo mv aws-auth /usr/local/bin/옵션 2: pip로 설치
pip install git+https://github.com/N0mansky/aws-auth.git옵션 3: 소스에서 클론 및 설치
git clone https://github.com/N0mansky/aws-auth.git
cd aws-auth
./install.sh # Linux / macOS / WSL2
powershell .\install.ps1 # Windows (PowerShell)
.\install.bat # Windows (Command Prompt)🚀 빠른 시작
1. 대화형 로그인
aws-authAvailable account-role combinations (Showing 1-10 of 18):
+-----+------------------------------+-----------------+------------------------------+-------------+
| # | Account | Account ID | Role | Region |
+-----+------------------------------+-----------------+------------------------------+-------------+
| 1 | ⭐ Production-App (PROD) | (111222333444) | AdministratorAccess | us-east-1 |
| 2 | ⭐ Staging-Web (QA) | (555666777888) | AdministratorAccess | us-east-1 |
| 3 | Analytics-Data | (999888777666) | AdministratorAccess | us-east-1 |
...
Select number 1-10 (default: 1) (type keyword to filter): [ENTER]
✅ Profile 'production-app-admin' set as default in ~/.aws/credentials.2. 포털 및 사용자 정의 별칭 구성
aws-auth --configure~/.aws-auth/config.json에서 환경 레이블과 기본 계정을 사용자 정의하세요:
{
"sso_start_url": "https://my-company.awsapps.com/start",
"sso_region": "us-east-1",
"preferred_accounts": ["Staging-Web", "Production-App"],
"aliases": {
"555666777888": "QA",
"111222333444": "PROD"
}
}🤖 AI 에이전트 통합 (Model Context Protocol)
aws-auth는 stdio를 통해 고성능 MCP 서버로 실행됩니다.
Claude Desktop (claude_desktop_config.json) 또는 Cursor에 추가:
{
"mcpServers": {
"aws-auth": {
"command": "aws-auth",
"args": ["--mcp"]
}
}
}AI 어시스턴트가 aws-auth로 할 수 있는 작업:
활성 AWS 계정, 리전 및 IAM 역할 ARN을 확인합니다 (
aws_get_caller_identity).사람의 개입 없이 활성 AWS 프로필을 전환합니다 (
aws_switch_profile).실행 중인 EC2 인스턴스와 Amazon EKS 클러스터를 검사합니다 (
aws_list_ec2_instances,aws_list_eks_clusters).로컬 Kubernetes 컨텍스트를 업데이트합니다 (
aws_update_kubeconfig).
👉 전체 MCP 설정 및 도구 참조 가이드 보기.
🛠️ CLI 명령 참조
# Core Authentication
aws-auth # Interactive SSO login & smart role switch
aws-auth --configure # Interactive SSO portal setup
aws-auth --identity # Show current STS caller identity
aws-auth --refresh-cache # Force refresh remote account/role metadata
# Profile Management
aws-auth --list-profiles # List all stored AWS profiles
aws-auth --switch-profile # Switch active default profile
aws-auth --set-default NAME # Set specific profile as default
aws-auth --delete NAME # Delete profile credentials
# Resource Discovery & DevOps
aws-auth --list-ec2 # List EC2 instances and connect via SSM
aws-auth --list-eks # List EKS clusters and update kubeconfig
# Scripting & Headless Automation
aws-auth --list-profiles --json
aws-auth --identity --json
eval $(aws-auth --export-env prod-profile) # Export AWS keys to current shell
# AWS credential_process standard
aws-auth --credential-process my-profile📚 문서
🤝 기여
기여를 환영합니다! 개발 환경 설정 및 테스트 실행에 대한 자세한 내용은 CONTRIBUTING.md를 확인해 주세요.
📄 라이선스
이 프로젝트는 MIT 라이선스에 따라 라이선스가 부여됩니다.
Available Tools
8 toolsaws_ensure_credentialsB
Check if AWS credentials are valid, and automatically refresh using cached SSO refresh token if expired.
Args: profile_name: AWS profile name (defaults to 'default')
| Name | Required | Description | Default |
|---|---|---|---|
| profile_name | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It usefully discloses the auto-refresh side effect and dependence on a cached SSO refresh token, but omits failure behavior, required permissions, and what happens when no valid token exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core purpose is front-loaded in a single efficient sentence, and the Args block is short. The parameter note is thin but not padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values needn't be explained, and for a one-parameter tool the description is largely sufficient. Still, with no annotations, a credential-mutating refresh operation would benefit from stating side effects and failure conditions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage and one parameter, the description must compensate, and it does explain profile_name and its default. However, it introduces a discrepancy: the description says it defaults to 'default' while the schema declares default: null.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb+resource: it checks validity of AWS credentials and auto-refreshes via cached SSO token. This is clearly distinct in behavior from siblings like aws_get_caller_identity or aws_switch_profile, though it never names or contrasts them explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use guidance, no prerequisites, and no mention of the alternatives among the sibling tools (aws_switch_profile, aws_list_profiles, aws_get_session_env). The agent must infer that this is a pre-flight credential check.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aws_get_caller_identityA
Get current AWS caller identity (Account ID, IAM Role/User ARN, User ID) using STS.
Args: profile_name: Optional profile name to check. If omitted, checks the default profile.
| Name | Required | Description | Default |
|---|---|---|---|
| profile_name | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose the underlying mechanism (an STS call) and the shape of what comes back. It does not say what happens with no valid credentials/expired session, whether the call has side effects, or whether it requires network access — gaps that matter for a credential-adjacent tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short lines, front-loaded with the outcome (identity + returned fields) before the argument note. The 'Args:' block is slightly formulaic for a single optional parameter, but nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists and the single optional parameter is explained, so an agent has enough to invoke this correctly. Error/permission behavior is unaddressed, which is the only meaningful omission for a one-parameter read tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the only parameter is a bare nullable string, so the description does the work: it explains that profile_name selects which profile to check and that omission falls back to the default profile. It doesn't cover behavior for a nonexistent profile name, which is the remaining gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb ('Get'), a precise resource ('current AWS caller identity') and even enumerates the returned fields (Account ID, IAM Role/User ARN, User ID). It is unmistakably clear what the tool returns, but it never contrasts itself with siblings such as aws_ensure_credentials or aws_list_profiles, so it stops short of the top band.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states that profile_name is optional and that the default profile is used when omitted, which implies the basic usage pattern. However there is no explicit guidance on when to call this vs. aws_ensure_credentials or aws_switch_profile, and no prerequisites (e.g. credentials must already exist) are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aws_get_session_envA
Get raw AWS session environment variables (AccessKey, SecretKey, SessionToken, Region) for isolated subprocess execution.
Args: profile_name: AWS profile name (defaults to 'default')
| Name | Required | Description | Default |
|---|---|---|---|
| profile_name | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose that the values are 'raw' credentials intended for subprocess injection. It says nothing about whether credentials are temporary/STS-scoped, whether they are cached, how long they remain valid, or the security implications of handling the returned secrets — meaningful omissions for a credential-exposing tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One compact sentence front-loads the return contents, and the single parameter note is kept brief. The 'Args:' block is slightly ceremonial for one optional argument but not wasteful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value documentation is unnecessary, and with only one optional parameter the surface is small. The definition is nearly complete, with the only real gap being behavioral/security context around the credentials it exposes.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the schema only exposes a nullable 'Profile Name' with default null, so the description must compensate; it does explain the parameter is an AWS profile name and states the effective default ('default'), which the schema does not convey. Minor tension exists because the schema declares default null while the text says it defaults to 'default'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Get raw AWS session environment variables') and enumerates exactly what is returned (AccessKey, SecretKey, SessionToken, Region), which differentiates it from siblings like aws_get_caller_identity or aws_list_profiles. It does not, however, explicitly contrast itself with the closest sibling, aws_ensure_credentials, whose purpose could overlap.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'for isolated subprocess execution' implies the use case, so an agent can infer this tool is for obtaining env vars to hand to a child process rather than for making API calls directly. But no alternatives are named and no when-not-to-use condition is given, leaving the choice between this and aws_ensure_credentials to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aws_list_ec2_instancesB
List EC2 instances in a specific AWS region using the specified profile.
Args: region: AWS region (e.g. 'us-east-1', 'us-west-2') profile_name: AWS profile name to use (default: 'default')
| Name | Required | Description | Default |
|---|---|---|---|
| region | No | us-east-1 | |
| profile_name | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It implies a read-only listing but says nothing about pagination, whether instances across all states are returned, permission requirements, or error behavior for invalid credentials. For a zero-annotation tool this is a thin behavioral profile.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose is front-loaded in a single sentence, followed by a compact Args block that maps directly to the parameters. No filler text, though the Args/Sphinx style is slightly verbose for only two parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and with 2 optional parameters complexity is low. However, with no annotations and no mention of credential prerequisites or result scope (all instances vs. running only), the description is adequate but leaves meaningful gaps for an agent invoking it cold.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it does: it names both parameters, gives concrete region examples ('us-east-1', 'us-west-2'), and restates the profile default. It does not discuss region format validity beyond examples or profile resolution rules, but the added value over the bare schema is substantial.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List EC2 instances') plus the scoping dimensions (region, profile). The resource is distinct from all siblings (EKS clusters, profiles, caller identity), so an agent can route by resource without opening the schema. It stops short of explicitly naming an alternative tool, which keeps it at 4.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this versus the sibling listing tools, nor on prerequisites such as whether credentials for the named profile must already exist. The description only says a profile is 'used', leaving context entirely to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aws_list_eks_clustersB
List EKS clusters in a specific AWS region and optionally configure local ~/.kube/config.
Args: region: AWS region (e.g. 'us-east-1', 'us-west-2') profile_name: AWS profile name to use (default: 'default') update_kubeconfig: If True, automatically configures kubeconfig for found clusters
| Name | Required | Description | Default |
|---|---|---|---|
| region | No | us-east-1 | |
| profile_name | No | default | |
| update_kubeconfig | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It does disclose the key side effect that update_kubeconfig=True mutates the local ~/.kube/config, which is genuinely useful behavioral context. However, it says nothing about credential requirements, what happens when no clusters exist, or any side effects of the default path.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the purpose sentence and follows with a compact arg list. Slightly redundant for region/profile which repeat schema defaults, but overall efficient with no wasted prose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained. Given the tool's moderate complexity, the description is essentially complete for calling it: all three params are covered and the kubeconfig side effect is stated. Only minor gaps remain around credential/error behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it largely does: region gets concrete examples, profile_name states its default, and update_kubeconfig explains its behavioral effect. This adds real meaning beyond the bare schema types and defaults.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('List EKS clusters') plus a clear scope ('in a specific AWS region') and adds the secondary capability of writing kubeconfig. The purpose is unambiguous, though it never names or contrasts with its closest sibling (aws_update_kubeconfig), which also touches kubeconfig.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use or when-not-to-use guidance is given, and the alternatives are not mentioned. It's implied you call this to enumerate clusters, but the overlap with aws_update_kubeconfig (which also configures kubeconfig) is never resolved, leaving the agent to guess which tool to pick.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aws_list_profilesA
List all available local AWS profiles, current active default profile, and configured regions.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It discloses what is inspected (local profiles, active default, regions), and 'List' conveys a non-destructive read, but it says nothing about whether profile files are read from disk, whether credentials are resolved, or any auth/permission requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler. Every clause (profiles, active default, regions) conveys distinct information about the tool's scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description needn't document return values, and a zero-parameter read-only tool has little surface area to cover. It is complete enough to invoke correctly, though a brief note on prerequisites (e.g. AWS config files present) would close the remaining gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate beyond the schema. Baseline 4 applies; the description's enumeration of outputs adds light value but is not required at this parameter count.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (List) and resource (local AWS profiles), and goes further by naming the composite return content: active default profile and configured regions. It is distinguishable from write-oriented siblings like aws_switch_profile, though it never explicitly contrasts with them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The verb 'List' implies a read-only discovery use case, and the sibling set (aws_switch_profile, aws_ensure_credentials) makes the context inferable, but the description names no alternative or condition for choosing this tool. Usage is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aws_switch_profileB
Switch the default AWS credentials profile in ~/.aws/credentials to a specific profile name.
Args: profile_name: Name of the AWS profile to set as default (e.g. 'dev', 'prod', 'qa')
| Name | Required | Description | Default |
|---|---|---|---|
| profile_name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does disclose the concrete side effect — rewriting the default profile in ~/.aws/credentials — which is genuinely useful. However, it omits failure modes (behavior if the profile name doesn't exist), whether other profiles are preserved, and reversibility, leaving meaningful gaps for a persistent mutation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded single sentence stating the action and its target file, followed by a compact Args block. The Args header repeats the schema's parameter name, which is mild redundancy, but the examples justify the space.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the description covers the core effect and parameter meaning. For a persistent credential mutation with no annotations, the absence of error behavior and permission requirements leaves the definition only adequately complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it does: it explains that profile_name is the profile to set as default and supplies concrete examples ('dev', 'prod', 'qa'). It stops short of stating constraints such as case sensitivity or whether the profile must pre-exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb (switch) and resource (default AWS credentials profile), plus the concrete location of the effect (~/.aws/credentials). It is clearly distinguishable in kind from read-oriented siblings like aws_list_profiles, but it never names or contrasts with a sibling explicitly, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states what the tool does but gives no when-to-use guidance, no prerequisites (e.g. whether the profile must already exist), and no mention of alternatives such as aws_ensure_credentials or aws_get_session_env. The use case is only inferable from the verb itself.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aws_update_kubeconfigB
Configure local kubeconfig to connect to a specific EKS cluster.
Args: cluster_name: Name of the EKS cluster region: AWS region of the cluster profile_name: AWS profile name to authenticate with
| Name | Required | Description | Default |
|---|---|---|---|
| region | No | us-east-1 | |
| cluster_name | Yes | ||
| profile_name | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden and largely fails it. It never says that this writes/overwrites the local kubeconfig file, whether it replaces an existing context for the same cluster, whether it requires the AWS CLI or valid credentials, or what happens on failure. For a mutating configuration tool, that is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The main sentence is front-loaded and wastes nothing, and the Args list is compact. The parameter list restates information the schema container already shows, which is minor redundancy rather than bloat.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described. Still, for a tool that mutates local state with zero annotation coverage, the description omits the behavioral context (overwrite semantics, credential prerequisites) an agent would need to invoke it safely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the property titles ('Region', 'Cluster Name', 'Profile Name') are near-tautological, so the description's Args block does add real meaning (which AWS region, that the profile is used for authentication). However, it omits the schema defaults (us-east-1, 'default') and gives no format hints for cluster_name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Configure), resource (local kubeconfig), and target (a specific EKS cluster), which cleanly separates it from siblings like aws_list_eks_clusters or aws_get_caller_identity. It does not explicitly name any sibling as an alternative, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The scenario is implied by the purpose: use this when you need kubectl pointed at a given EKS cluster. There is no explicit when-to-use statement, no prerequisites (e.g. credentials must already exist), and no mention of related tools such as aws_list_eks_clusters for finding the cluster name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
8 tool updates
v1.1.0- First observed
aws_ensure_credentials - First observed
aws_get_caller_identity - First observed
aws_get_session_env - First observed
aws_list_ec2_instances - First observed
aws_list_eks_clusters - First observed
aws_list_profiles - First observed
aws_switch_profile - First observed
aws_update_kubeconfig
TDQS
Scored across 8 tools
Most tools are clearly distinct by resource and action (list_profiles, switch_profile, get_caller_identity, list_ec2_instances). Minor overlap exists between aws_ensure_credentials and aws_get_caller_identity/aws_get_session_env (all credential/session related), and aws_update_kubeconfig overlaps with aws_list_eks_clusters' update_kubeconfig flag.
Every tool follows a strict aws_verb_noun pattern (aws_list_profiles, aws_switch_profile, aws_get_caller_identity, aws_list_ec2_instances). Fully predictable and consistent conventions throughout.
Eight tools is well-scoped for an auth/session + light resource-discovery server. Each tool earns its place without redundancy or bloat.
Core auth lifecycle is covered: profile listing/switching, credential validation/refresh, session env, caller identity, plus EKS/EC2 discovery and kubeconfig setup. Minor gaps like assume-role or profile creation/cleanup are absent but agents can work around them via the existing profile tools.
Maintenance
Related MCP Connectors
MCP server connecting AI agents to 100+ apps (Gmail, Slack, Notion, GitHub) via one-click OAuth.
An MCP server that provides an API to LLMs to manage their JumpCloud resources.
Hosted Amazon Seller and Vendor MCP server for Claude, ChatGPT, Cursor, Codex, Gemini, Copilot.
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
Related MCP Servers
- FlicenseCqualityDmaintenanceA Model Context Protocol (MCP) server that enables AI assistants like Claude to interact with your AWS environment. This allows for natural language querying and management of your AWS resources during conversations. Think of better Amazon Q alternative.13296-
- AlicenseCqualityNot gradedmaintenanceAn MCP server for Infrastructure as Code that enables AI assistants to manage cloud resources through Ansible and Terraform operations. It supports executing playbooks, managing AWS services, and running Terraform commands with optional LocalStack integration.18-

@yawlabs/aws-mcpofficial
AlicenseAqualityAmaintenanceA small AWS MCP for AI assistants: one server, one config entry, SSO re-auth baked in, generic CRUD over hundreds of resource types, live docs lookup, server-side scripting for batched workflows.28697 npm5MIT- AlicenseNot gradedqualityDmaintenanceA Model Context Protocol (MCP) server that enables AI assistants to perform comprehensive AWS security analysis through natural language queries, bridging AI with AWS security services.2Apache 2.0