AWS-Auth
⚡ AWS-Auth
快速、智能的 AWS SSO 认证与模型上下文协议(MCP)服务器
告别 AWS SSO 登录疲劳。 零配置样板、智能角色优先级排序、原子化凭据缓存,以及原生 AI 结对编程集成。
快速开始 • 为什么选择 aws-auth? • AI / MCP 集成 • 功能特性 • 文档
┌───────────────────────┐ ┌────────────────────────┐ ┌───────────────────────┐
│ IAM Identity Center │ ────> │ aws-auth │ ────> │ ~/.aws/credentials │
│ (AWS SSO OIDC) │ │ (Smart Role Selector) │ │ (Strict 0600 POSIX) │
└───────────────────────┘ └───────────┬────────────┘ └───────────┬───────────┘
│ │
┌───────────▼────────────┐ ┌───────────▼───────────┐
│ MCP Server (stdio) │ │ Terraform / K8s / CLI │
│ (Claude / Cursor / AI) │ │ (Instant Compatibility)│
└────────────────────────┘ └───────────────────────┘💡 为什么选择 aws-auth 而非其他替代方案?
功能 |
| 官方 |
|
|
零配置账户发现 | ✅ 自动 | ❌ 需要手动配置 | ⚠️ 部分 | ❌ 手动 |
模型上下文协议(MCP) | ✅ 原生内置 | ❌ 无 | ❌ 无 | ❌ 无 |
1 秒 MRU / 固定登录 | ✅ 智能优先级 | ❌ 无 | ⚠️ 历史提示 | ❌ 无 |
实时子串与别名过滤 | ✅ 即时输入 | ❌ 无 | ✅ 是 | ❌ 无 |
直接同步 | ✅ 原子化且 | ❌ 仅令牌缓存 | ⚠️ Shell 包装器 | ⚠️ 钥匙串包装器 |
旧版与 GUI 工具兼容性 | ✅ 100% 开箱即用 | ⚠️ 许多工具会失败 | ⚠️ 需要包装器 | ⚠️ 需要包装器 |
WSL2 -> Windows 浏览器桥接 | ✅ 自动 | ❌ 失败 / 手动复制 | ⚠️ 部分 | ❌ 否 |
EC2 SSM 与 EKS 上下文切换 | ✅ 内置 | ❌ 独立工具 | ❌ 独立工具 | ❌ 否 |
👉 阅读完整的功能对比指南。
Related MCP server: MCP SysOperator
✨ 核心功能
⚡ 零样板发现:无需在
~/.aws/config中维护数百行配置。只需输入一次 SSO Start URL,所有已授权的账户和角色即可动态加载。⭐ 智能角色优先级排序(MRU):自动将最近使用的角色(例如
QA Admin、Prod Admin)固定到#1和#2。按下Enter即可在 1 秒 内完成登录。🔍 交互式子串搜索:在选择提示符下输入任意关键字(
prod、qa、admin、gpu、eks),即可即时筛选数十个账户。🤖 原生模型上下文协议(MCP)服务器:向 LLM 结对编程工具(Claude Desktop、Cursor、Antigravity、Gemini)开放 AWS 配置文件切换、调用者身份以及 EC2/EKS 探索功能。
🔒 企业级安全:严格的 POSIX
0600文件权限、原子化文件替换(os.replace)以及 300 秒过期安全余量。🌐 WSL2 无缝浏览器桥接:自动检测 WSL2 并直接在 Windows 主机浏览器中打开授权 URL。
☸️ DevOps 加速:即时 EC2 SSM Shell 会话和一键式 Amazon EKS kubeconfig 上下文切换。
📦 安装
选项 1:独立二进制文件(推荐)
从 GitHub Releases 下载最新的预编译二进制文件:
Windows(PowerShell 单行命令)
在 PowerShell 中运行以自动下载二进制文件并配置 PATH:
irm https://raw.githubusercontent.com/N0mansky/aws-auth/main/install.ps1 | iex或通过 PowerShell 手动下载:
curl.exe -L https://github.com/N0mansky/aws-auth/releases/latest/download/aws-auth-windows-amd64.exe -o aws-auth.exeLinux (x86_64)
curl -L https://github.com/N0mansky/aws-auth/releases/latest/download/aws-auth-linux-amd64 -o aws-auth
chmod +x aws-auth && sudo mv aws-auth /usr/local/bin/macOS(通用)
curl -L https://github.com/N0mansky/aws-auth/releases/latest/download/aws-auth-macos-universal -o aws-auth
chmod +x aws-auth && sudo mv aws-auth /usr/local/bin/选项 2:通过 pip 安装
pip install git+https://github.com/N0mansky/aws-auth.git选项 3:从源码克隆并安装
git clone https://github.com/N0mansky/aws-auth.git
cd aws-auth
./install.sh # Linux / macOS / WSL2
powershell .\install.ps1 # Windows (PowerShell)
.\install.bat # Windows (Command Prompt)🚀 快速开始
1. 交互式登录
aws-authAvailable account-role combinations (Showing 1-10 of 18):
+-----+------------------------------+-----------------+------------------------------+-------------+
| # | Account | Account ID | Role | Region |
+-----+------------------------------+-----------------+------------------------------+-------------+
| 1 | ⭐ Production-App (PROD) | (111222333444) | AdministratorAccess | us-east-1 |
| 2 | ⭐ Staging-Web (QA) | (555666777888) | AdministratorAccess | us-east-1 |
| 3 | Analytics-Data | (999888777666) | AdministratorAccess | us-east-1 |
...
Select number 1-10 (default: 1) (type keyword to filter): [ENTER]
✅ Profile 'production-app-admin' set as default in ~/.aws/credentials.2. 配置门户与自定义别名
aws-auth --configure在 ~/.aws-auth/config.json 中自定义环境标签和首选账户:
{
"sso_start_url": "https://my-company.awsapps.com/start",
"sso_region": "us-east-1",
"preferred_accounts": ["Staging-Web", "Production-App"],
"aliases": {
"555666777888": "QA",
"111222333444": "PROD"
}
}🤖 AI 代理集成(模型上下文协议)
aws-auth 作为基于 stdio 的高性能 MCP 服务器 运行。
添加到 Claude Desktop(claude_desktop_config.json)或 Cursor:
{
"mcpServers": {
"aws-auth": {
"command": "aws-auth",
"args": ["--mcp"]
}
}
}AI 助手使用 aws-auth 可以做什么:
检查当前 AWS 账户、区域和 IAM 角色 ARN(
aws_get_caller_identity)。无需人工干预即可切换当前 AWS 配置文件(
aws_switch_profile)。检查正在运行的 EC2 实例和 Amazon EKS 集群(
aws_list_ec2_instances、aws_list_eks_clusters)。更新本地 Kubernetes 上下文(
aws_update_kubeconfig)。
👉 阅读完整的 MCP 设置与工具参考指南。
🛠️ CLI 命令参考
# Core Authentication
aws-auth # Interactive SSO login & smart role switch
aws-auth --configure # Interactive SSO portal setup
aws-auth --identity # Show current STS caller identity
aws-auth --refresh-cache # Force refresh remote account/role metadata
# Profile Management
aws-auth --list-profiles # List all stored AWS profiles
aws-auth --switch-profile # Switch active default profile
aws-auth --set-default NAME # Set specific profile as default
aws-auth --delete NAME # Delete profile credentials
# Resource Discovery & DevOps
aws-auth --list-ec2 # List EC2 instances and connect via SSM
aws-auth --list-eks # List EKS clusters and update kubeconfig
# Scripting & Headless Automation
aws-auth --list-profiles --json
aws-auth --identity --json
eval $(aws-auth --export-env prod-profile) # Export AWS keys to current shell
# AWS credential_process standard
aws-auth --credential-process my-profile📚 文档
🤝 贡献
欢迎贡献!请查看 CONTRIBUTING.md 了解如何设置开发环境和运行测试的详细信息。
📄 许可证
本项目采用 MIT 许可证 许可。
Available Tools
8 toolsaws_ensure_credentialsB
Check if AWS credentials are valid, and automatically refresh using cached SSO refresh token if expired.
Args: profile_name: AWS profile name (defaults to 'default')
| Name | Required | Description | Default |
|---|---|---|---|
| profile_name | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It usefully discloses the auto-refresh side effect and dependence on a cached SSO refresh token, but omits failure behavior, required permissions, and what happens when no valid token exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core purpose is front-loaded in a single efficient sentence, and the Args block is short. The parameter note is thin but not padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values needn't be explained, and for a one-parameter tool the description is largely sufficient. Still, with no annotations, a credential-mutating refresh operation would benefit from stating side effects and failure conditions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage and one parameter, the description must compensate, and it does explain profile_name and its default. However, it introduces a discrepancy: the description says it defaults to 'default' while the schema declares default: null.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb+resource: it checks validity of AWS credentials and auto-refreshes via cached SSO token. This is clearly distinct in behavior from siblings like aws_get_caller_identity or aws_switch_profile, though it never names or contrasts them explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use guidance, no prerequisites, and no mention of the alternatives among the sibling tools (aws_switch_profile, aws_list_profiles, aws_get_session_env). The agent must infer that this is a pre-flight credential check.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aws_get_caller_identityA
Get current AWS caller identity (Account ID, IAM Role/User ARN, User ID) using STS.
Args: profile_name: Optional profile name to check. If omitted, checks the default profile.
| Name | Required | Description | Default |
|---|---|---|---|
| profile_name | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose the underlying mechanism (an STS call) and the shape of what comes back. It does not say what happens with no valid credentials/expired session, whether the call has side effects, or whether it requires network access — gaps that matter for a credential-adjacent tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short lines, front-loaded with the outcome (identity + returned fields) before the argument note. The 'Args:' block is slightly formulaic for a single optional parameter, but nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists and the single optional parameter is explained, so an agent has enough to invoke this correctly. Error/permission behavior is unaddressed, which is the only meaningful omission for a one-parameter read tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the only parameter is a bare nullable string, so the description does the work: it explains that profile_name selects which profile to check and that omission falls back to the default profile. It doesn't cover behavior for a nonexistent profile name, which is the remaining gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb ('Get'), a precise resource ('current AWS caller identity') and even enumerates the returned fields (Account ID, IAM Role/User ARN, User ID). It is unmistakably clear what the tool returns, but it never contrasts itself with siblings such as aws_ensure_credentials or aws_list_profiles, so it stops short of the top band.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states that profile_name is optional and that the default profile is used when omitted, which implies the basic usage pattern. However there is no explicit guidance on when to call this vs. aws_ensure_credentials or aws_switch_profile, and no prerequisites (e.g. credentials must already exist) are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aws_get_session_envA
Get raw AWS session environment variables (AccessKey, SecretKey, SessionToken, Region) for isolated subprocess execution.
Args: profile_name: AWS profile name (defaults to 'default')
| Name | Required | Description | Default |
|---|---|---|---|
| profile_name | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose that the values are 'raw' credentials intended for subprocess injection. It says nothing about whether credentials are temporary/STS-scoped, whether they are cached, how long they remain valid, or the security implications of handling the returned secrets — meaningful omissions for a credential-exposing tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One compact sentence front-loads the return contents, and the single parameter note is kept brief. The 'Args:' block is slightly ceremonial for one optional argument but not wasteful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value documentation is unnecessary, and with only one optional parameter the surface is small. The definition is nearly complete, with the only real gap being behavioral/security context around the credentials it exposes.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the schema only exposes a nullable 'Profile Name' with default null, so the description must compensate; it does explain the parameter is an AWS profile name and states the effective default ('default'), which the schema does not convey. Minor tension exists because the schema declares default null while the text says it defaults to 'default'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Get raw AWS session environment variables') and enumerates exactly what is returned (AccessKey, SecretKey, SessionToken, Region), which differentiates it from siblings like aws_get_caller_identity or aws_list_profiles. It does not, however, explicitly contrast itself with the closest sibling, aws_ensure_credentials, whose purpose could overlap.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'for isolated subprocess execution' implies the use case, so an agent can infer this tool is for obtaining env vars to hand to a child process rather than for making API calls directly. But no alternatives are named and no when-not-to-use condition is given, leaving the choice between this and aws_ensure_credentials to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aws_list_ec2_instancesB
List EC2 instances in a specific AWS region using the specified profile.
Args: region: AWS region (e.g. 'us-east-1', 'us-west-2') profile_name: AWS profile name to use (default: 'default')
| Name | Required | Description | Default |
|---|---|---|---|
| region | No | us-east-1 | |
| profile_name | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It implies a read-only listing but says nothing about pagination, whether instances across all states are returned, permission requirements, or error behavior for invalid credentials. For a zero-annotation tool this is a thin behavioral profile.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose is front-loaded in a single sentence, followed by a compact Args block that maps directly to the parameters. No filler text, though the Args/Sphinx style is slightly verbose for only two parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and with 2 optional parameters complexity is low. However, with no annotations and no mention of credential prerequisites or result scope (all instances vs. running only), the description is adequate but leaves meaningful gaps for an agent invoking it cold.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it does: it names both parameters, gives concrete region examples ('us-east-1', 'us-west-2'), and restates the profile default. It does not discuss region format validity beyond examples or profile resolution rules, but the added value over the bare schema is substantial.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List EC2 instances') plus the scoping dimensions (region, profile). The resource is distinct from all siblings (EKS clusters, profiles, caller identity), so an agent can route by resource without opening the schema. It stops short of explicitly naming an alternative tool, which keeps it at 4.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this versus the sibling listing tools, nor on prerequisites such as whether credentials for the named profile must already exist. The description only says a profile is 'used', leaving context entirely to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aws_list_eks_clustersB
List EKS clusters in a specific AWS region and optionally configure local ~/.kube/config.
Args: region: AWS region (e.g. 'us-east-1', 'us-west-2') profile_name: AWS profile name to use (default: 'default') update_kubeconfig: If True, automatically configures kubeconfig for found clusters
| Name | Required | Description | Default |
|---|---|---|---|
| region | No | us-east-1 | |
| profile_name | No | default | |
| update_kubeconfig | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It does disclose the key side effect that update_kubeconfig=True mutates the local ~/.kube/config, which is genuinely useful behavioral context. However, it says nothing about credential requirements, what happens when no clusters exist, or any side effects of the default path.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the purpose sentence and follows with a compact arg list. Slightly redundant for region/profile which repeat schema defaults, but overall efficient with no wasted prose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained. Given the tool's moderate complexity, the description is essentially complete for calling it: all three params are covered and the kubeconfig side effect is stated. Only minor gaps remain around credential/error behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it largely does: region gets concrete examples, profile_name states its default, and update_kubeconfig explains its behavioral effect. This adds real meaning beyond the bare schema types and defaults.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('List EKS clusters') plus a clear scope ('in a specific AWS region') and adds the secondary capability of writing kubeconfig. The purpose is unambiguous, though it never names or contrasts with its closest sibling (aws_update_kubeconfig), which also touches kubeconfig.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use or when-not-to-use guidance is given, and the alternatives are not mentioned. It's implied you call this to enumerate clusters, but the overlap with aws_update_kubeconfig (which also configures kubeconfig) is never resolved, leaving the agent to guess which tool to pick.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aws_list_profilesA
List all available local AWS profiles, current active default profile, and configured regions.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It discloses what is inspected (local profiles, active default, regions), and 'List' conveys a non-destructive read, but it says nothing about whether profile files are read from disk, whether credentials are resolved, or any auth/permission requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler. Every clause (profiles, active default, regions) conveys distinct information about the tool's scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description needn't document return values, and a zero-parameter read-only tool has little surface area to cover. It is complete enough to invoke correctly, though a brief note on prerequisites (e.g. AWS config files present) would close the remaining gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate beyond the schema. Baseline 4 applies; the description's enumeration of outputs adds light value but is not required at this parameter count.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (List) and resource (local AWS profiles), and goes further by naming the composite return content: active default profile and configured regions. It is distinguishable from write-oriented siblings like aws_switch_profile, though it never explicitly contrasts with them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The verb 'List' implies a read-only discovery use case, and the sibling set (aws_switch_profile, aws_ensure_credentials) makes the context inferable, but the description names no alternative or condition for choosing this tool. Usage is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aws_switch_profileB
Switch the default AWS credentials profile in ~/.aws/credentials to a specific profile name.
Args: profile_name: Name of the AWS profile to set as default (e.g. 'dev', 'prod', 'qa')
| Name | Required | Description | Default |
|---|---|---|---|
| profile_name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does disclose the concrete side effect — rewriting the default profile in ~/.aws/credentials — which is genuinely useful. However, it omits failure modes (behavior if the profile name doesn't exist), whether other profiles are preserved, and reversibility, leaving meaningful gaps for a persistent mutation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded single sentence stating the action and its target file, followed by a compact Args block. The Args header repeats the schema's parameter name, which is mild redundancy, but the examples justify the space.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the description covers the core effect and parameter meaning. For a persistent credential mutation with no annotations, the absence of error behavior and permission requirements leaves the definition only adequately complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it does: it explains that profile_name is the profile to set as default and supplies concrete examples ('dev', 'prod', 'qa'). It stops short of stating constraints such as case sensitivity or whether the profile must pre-exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb (switch) and resource (default AWS credentials profile), plus the concrete location of the effect (~/.aws/credentials). It is clearly distinguishable in kind from read-oriented siblings like aws_list_profiles, but it never names or contrasts with a sibling explicitly, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states what the tool does but gives no when-to-use guidance, no prerequisites (e.g. whether the profile must already exist), and no mention of alternatives such as aws_ensure_credentials or aws_get_session_env. The use case is only inferable from the verb itself.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aws_update_kubeconfigB
Configure local kubeconfig to connect to a specific EKS cluster.
Args: cluster_name: Name of the EKS cluster region: AWS region of the cluster profile_name: AWS profile name to authenticate with
| Name | Required | Description | Default |
|---|---|---|---|
| region | No | us-east-1 | |
| cluster_name | Yes | ||
| profile_name | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden and largely fails it. It never says that this writes/overwrites the local kubeconfig file, whether it replaces an existing context for the same cluster, whether it requires the AWS CLI or valid credentials, or what happens on failure. For a mutating configuration tool, that is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The main sentence is front-loaded and wastes nothing, and the Args list is compact. The parameter list restates information the schema container already shows, which is minor redundancy rather than bloat.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described. Still, for a tool that mutates local state with zero annotation coverage, the description omits the behavioral context (overwrite semantics, credential prerequisites) an agent would need to invoke it safely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the property titles ('Region', 'Cluster Name', 'Profile Name') are near-tautological, so the description's Args block does add real meaning (which AWS region, that the profile is used for authentication). However, it omits the schema defaults (us-east-1, 'default') and gives no format hints for cluster_name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Configure), resource (local kubeconfig), and target (a specific EKS cluster), which cleanly separates it from siblings like aws_list_eks_clusters or aws_get_caller_identity. It does not explicitly name any sibling as an alternative, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The scenario is implied by the purpose: use this when you need kubectl pointed at a given EKS cluster. There is no explicit when-to-use statement, no prerequisites (e.g. credentials must already exist), and no mention of related tools such as aws_list_eks_clusters for finding the cluster name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
8 tool updates
v1.1.0- First observed
aws_ensure_credentials - First observed
aws_get_caller_identity - First observed
aws_get_session_env - First observed
aws_list_ec2_instances - First observed
aws_list_eks_clusters - First observed
aws_list_profiles - First observed
aws_switch_profile - First observed
aws_update_kubeconfig
TDQS
Scored across 8 tools
Most tools are clearly distinct by resource and action (list_profiles, switch_profile, get_caller_identity, list_ec2_instances). Minor overlap exists between aws_ensure_credentials and aws_get_caller_identity/aws_get_session_env (all credential/session related), and aws_update_kubeconfig overlaps with aws_list_eks_clusters' update_kubeconfig flag.
Every tool follows a strict aws_verb_noun pattern (aws_list_profiles, aws_switch_profile, aws_get_caller_identity, aws_list_ec2_instances). Fully predictable and consistent conventions throughout.
Eight tools is well-scoped for an auth/session + light resource-discovery server. Each tool earns its place without redundancy or bloat.
Core auth lifecycle is covered: profile listing/switching, credential validation/refresh, session env, caller identity, plus EKS/EC2 discovery and kubeconfig setup. Minor gaps like assume-role or profile creation/cleanup are absent but agents can work around them via the existing profile tools.
Maintenance
Related MCP Connectors
MCP server connecting AI agents to 100+ apps (Gmail, Slack, Notion, GitHub) via one-click OAuth.
An MCP server that provides an API to LLMs to manage their JumpCloud resources.
Hosted Amazon Seller and Vendor MCP server for Claude, ChatGPT, Cursor, Codex, Gemini, Copilot.
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
Related MCP Servers
- FlicenseCqualityDmaintenanceA Model Context Protocol (MCP) server that enables AI assistants like Claude to interact with your AWS environment. This allows for natural language querying and management of your AWS resources during conversations. Think of better Amazon Q alternative.13296-
- AlicenseCqualityNot gradedmaintenanceAn MCP server for Infrastructure as Code that enables AI assistants to manage cloud resources through Ansible and Terraform operations. It supports executing playbooks, managing AWS services, and running Terraform commands with optional LocalStack integration.18-

@yawlabs/aws-mcpofficial
AlicenseAqualityAmaintenanceA small AWS MCP for AI assistants: one server, one config entry, SSO re-auth baked in, generic CRUD over hundreds of resource types, live docs lookup, server-side scripting for batched workflows.28697 npm5MIT- AlicenseNot gradedqualityDmaintenanceA Model Context Protocol (MCP) server that enables AI assistants to perform comprehensive AWS security analysis through natural language queries, bridging AI with AWS security services.2Apache 2.0