Skip to main content
Glama
Sign In
@yawlabs/aws-mcp

@yawlabs/aws-mcp

Official
by YawLabs
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

aws_sso_generate_profiles

Idempotent

Writes AWS config profiles for IAM Identity Center account and role assignments after SSO login, with selection and dry-run options to preview changes before updating the file.

Instructions

Write [profile ...] sections into the AWS config file for IAM Identity Center account/role assignments (after aws_login_start with ssoSession). Default: every assignment, capped at 200 (the rest are returned as dropped); or pass selection. Names default to '{accountName}-{roleName}', with the account ID inserted on a clash ('prod-111111111111-Admin'). Each section carries a managed-by: aws-mcp marker; a section without it is never modified -- a name clash with one is reported in skipped. region is written only when a profile is created. Use dryRun to preview. Selections are checked against the live assignments; IAM stays the authority.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "ssoSession": "<ssoSession>"
    },
    "name": "aws_sso_generate_profiles"
  }
}

Input Schema

NameRequiredDescriptionDefault
dryRunNoReport what would be written without touching the file.
regionNoDefault region written into each new profile. Default: the sso-session's sso_region.
selectionNoWhich account/role pairs to write. Default: every assignment (capped at 200; pass a selection beyond that).
ssoSessionYessso-session name logged in via aws_login_start.
nameTemplateNoProfile name template. Placeholders: {accountName} {accountId} {roleName} {ssoSession}. Default '{accountName}-{roleName}'.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv2.7.1

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: caps output at 200 with the remainder returned as `dropped`, protects unmarked sections via the `managed-by: aws-mcp` marker, reports clashes in `skipped`, writes `region` only on profile creation, and re-validates selections against live IAM assignments. These details clarify exactly what the write touches and what it refuses to touch, consistent with destructiveHint=false and idempotentHint=true.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the verb and target file, then layers constraints in descending importance; every clause carries information. Dense semicolon-and-parenthetical packing makes it slightly harder to scan than ideal.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description still explains the meaningful returned signals (`dropped`, `skipped`) and the side-effect scope of the write. An agent has enough to call it safely and interpret the result without further probing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents default-vs-selection behavior, the 200 cap, the nameTemplate placeholders, and the region default. The description largely restates these, adding only marginal extras (account ID inserted into the name on a clash, region written only for new profiles).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb and resource: 'Write [profile ...] sections into the AWS config file for IAM Identity Center account/role assignments.' It also states the prerequisite (aws_login_start with ssoSession), which anchors it against siblings like aws_list_profiles and aws_sso_list_assignments.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clear context for use: must follow aws_login_start with an ssoSession, defaults to all assignments, or pass `selection` when exceeding the 200 cap, and 'Use dryRun to preview' before writing. It stops short of naming alternative tools to use instead when the goal is merely to inspect assignments.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools