aws-sso-mcp
Integrates with AWS Organizations and IAM Identity Center to query and manage resources across multiple AWS accounts and orgs. It supports selecting accounts by org, name, ID, substring, or environment, applying config-defined IAM roles, fanning out AWS API calls in parallel, and returning merged, redacted results.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@aws-sso-mcpList all EC2 instance statuses across my organization."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
aws-sso-mcp
Got more than one AWS account or org? Sign in once, ask in plain English, and get one merged answer from all of them, using the IAM roles your rules choose, never the AI's.
aws-sso-mcp is an MCP (Model Context Protocol) server. It plugs
into a chat assistant such as GitHub Copilot Chat in VS Code or Claude Desktop, and lets that
assistant query and manage AWS through your AWS IAM Identity Center (SSO) login.
"List all stopped EC2 instances across every prod account in org1."
One sentence in. One combined answer out, from every matching account.
Contents
Related MCP server: Sandy
Is this for you?
If you work in more than one AWS account, yes. The more accounts and orgs you have, the more it saves you.
Several orgs. Keep every org in one config file. Switch between them in chat, or query several in a single request. Each org needs its own login, and you never mix them up by accident.
Dozens or hundreds of accounts. Find accounts by name, id or environment, then ask one question of all of them. No account-by-account console hopping, no profile juggling.
A different role per account. Prod gets
ReadOnlyAccess, sandboxes getPowerUserAccess. You write that once, and it is applied everywhere.Questions that cross accounts. "Where is this running?", "Which accounts have public buckets?", "What is stopped in prod?" Each is one sentence instead of an afternoon of clicking.
If you only ever use a single account, it still works, but a plain AWS CLI profile is simpler.
Why this exists
Companies often have tens or hundreds of AWS accounts, spread over several AWS Organizations. Answering "where is X running?" normally means logging in to each account in turn.
This server removes that grind:
Without it | With it |
Sign in to every account, one by one | Sign in once per organization |
Remember which IAM role to use in which account | Roles are chosen by rules you write in a config file |
Run the same CLI command N times | One request fans out to all N accounts in parallel |
Copy and merge the outputs yourself | One merged, sorted, redacted result |
What you can do with it
Query any AWS service. One generic tool (
aws_query) takes the sameserviceandoperationnames as the AWS CLI and boto3, for exampleec2andDescribeInstances. There are no per-service tools to wait for.Select accounts flexibly. Pick by org, exact name, id, name substring, or an environment (
prod,staging,dev) that you define. Exclusions are supported.Chain steps.
run_dagruns a small multi-step plan per account. For example, list the instances, then describe their volumes using the first step's output.Manage sessions. Log in, switch org, check token status, search the cached account directory.
Audit everything. Every call is appended to a local JSONL audit log.
How it works in 30 seconds
You --plain English--> Chat assistant (Copilot / Claude)
| MCP tool call over stdio
v
aws-sso-mcp
1. OIDC device login ------------> AWS IAM Identity Center
2. short-lived role credentials <-- AWS IAM Identity Center
3. the actual API call, per account, in parallel
|------------> AWS accounts (EC2, S3, IAM ...)
v
merged, redacted result --> Chat assistant --> answer to youThe full, step-by-step explanation (with code references) is in docs/how-it-works.md. The detailed connectivity diagrams are in docs/architecture.md.
Quick start
You need Python 3.12+ and uv.
1. Install
uv tool install aws-sso-mcp # or: pipx install aws-sso-mcp
aws-sso-mcp --version2. Create your config (references only, never secrets)
mkdir -p ~/.config/aws-sso-mcp
curl -fsSL https://raw.githubusercontent.com/arnabdas24/aws-sso-mcp/main/examples/config.example.toml \
-o ~/.config/aws-sso-mcp/config.tomlEdit it and set your start_url and region per org. The minimum is:
default_org = "org1"
[portals.org1]
start_url = "https://your-org1.awsapps.com/start"
region = "us-east-1" # where your Identity Center lives, NOT where you query
[portals.org1.environments.prod]
match = "endswith"
patterns = ["-prod"]
roles = ["ReadOnlyAccess"]On Windows, use %USERPROFILE%\.config\aws-sso-mcp\config.toml, or point AWS_SSO_MCP_CONFIG at any path.
3. Register it with your chat client (VS Code example, in your user mcp.json)
{
"servers": {
"aws-sso-mcp": { "type": "stdio", "command": "aws-sso-mcp" }
}
}Claude Desktop, Claude Code, Cursor, Windsurf and non-default config paths are all covered in docs/setup-guide.md.
4. Chat
In Agent mode, try:
Log in to org1.A browser opens once for approval.Find accounts with "prod" in the name.List stopped EC2 instances in us-east-1 across every prod account.
More ready-made phrasings, plus mistakes to avoid, are in docs/prompt-guide.md. To see the exact tool call behind each sentence, read docs/examples.md.
Safety model
Read this before pointing the server at real accounts.
Property | What it means |
IAM is the only gate | The server does not block writes locally. If your SSO role may delete something, a request can delete it. Use read-only roles in your config unless you truly need more. |
Role choice is deterministic | The AI model never picks a role. Rules in your TOML do (see roles.py). |
No surprise browser windows | Only the |
Blast-radius cap | A selection wider than |
Secrets are redacted | Tokens and keys are scrubbed from logs and tool output (redact.py). Credentials are never written to disk. |
Config cannot hold secrets | The loader rejects keys that look like secrets (config.py). |
Everything is audited | One line per call in |
AWS response data (tags, names, log lines) is untrusted text that reaches the model. This server bounds its size but cannot remove prompt-injection attempts. Details in docs/architecture.md.
Documentation map
Document | Read it if you want to... |
Understand, step by step and in plain language, what happens from your sentence to the answer | |
See connectivity diagrams, components, threads, storage and security layers | |
Understand each Python file step by step: who calls what, and how files link | |
Internals: authentication, token and credential caching, locks, threads, timeouts, known quirks | |
Learn what to say to your assistant, with copy-paste examples | |
Look up every tool, argument and response shape | |
Configure orgs, environments, roles and performance | |
Set up, test, extend and release the project | |
Understand why a design decision was made, and what it cost | |
Fix a specific error message | |
Contribute code: setup, quality gates, commit conventions | |
Report a vulnerability, or review the threat model | |
Install and wire up the server in various MCP clients |
Project layout
src/aws_sso_mcp/
├── server.py # MCP tools (thin entry points)
├── fanout.py # the shared multi-account pipeline
├── planner.py # which accounts? (selectors -> targets)
├── roles.py # which role? (deterministic rules)
├── state.py # per-process session state
├── config.py # TOML loading and validation
├── audit.py # append-only JSONL audit log
├── redact.py # secret scrubbing
├── hardening.py # output size caps + redaction in one pass
├── logging_setup.py # stderr + chat-UI logging
├── awscfg.py # cached boto3 client factory
├── errors.py # clean, user-facing exception types
├── sso/ # login (device_auth), credentials (broker), directory
├── cache/ # SQLite account/role cache
└── engine/ # catalog (one AWS call), dag (multi-step), executor (threads)Requirements and status
Python 3.12 or newer,
boto3, and themcpSDK (see pyproject.toml).Alpha (
0.1.x): interfaces may change.Transport is stdio. The server is started by your chat client, one process per session.
Security
Credentials are brokered, never stored on disk; see Safety model and the full threat model in SECURITY.md. Report vulnerabilities privately via GitHub Security Advisories, not public issues.
Releases are built by GitHub Actions with PyPI Trusted Publishing and carry a signed SLSA build-provenance attestation plus a CycloneDX SBOM:
gh attestation verify ./aws_sso_mcp-<version>-py3-none-any.whl --repo arnabdas24/aws-sso-mcpContributing
See CONTRIBUTING.md. Every change must pass ruff, mypy --strict, the test
suite with its global and per-module coverage floors, and vulture.
License
Available Tools
16 toolsaws_queryA
Run one AWS API call across every account a selector resolves to.
``service``/``operation``/``params`` follow the AWS CLI and botocore shape,
e.g. ``service="ec2"``, ``operation="DescribeInstances"``,
``params={"Filters": [{"Name": "instance-state-name", "Values": ["stopped"]}]}``.
Paginated operations are followed to completion automatically, so results
are complete rather than a silent first page. If a result is truncated,
raise ``max_items`` to collect more from each account.
``region`` is always required and never defaulted. Account selectors decide
which accounts are touched; with none given, every account in the active org
is targeted, subject to the configured blast-radius cap. The model never
picks which IAM role to assume - pass ``role=`` to override the
deterministic TOML/sole-grant resolution.
Any operation the assumed role may perform is dispatched - reads, writes,
deletes, secret reads, all of it - with AWS IAM as the sole authorization
boundary. Nothing is refused locally; if the role lacks permission, AWS
returns AccessDenied and that is what comes back.
| Name | Required | Description | Default |
|---|---|---|---|
| org | No | ||
| orgs | No | ||
| role | No | ||
| params | No | ||
| region | Yes | ||
| service | Yes | ||
| max_items | No | ||
| operation | Yes | ||
| account_id | No | ||
| account_ids | No | ||
| environment | No | ||
| account_name | No | ||
| max_accounts | No | ||
| account_names | No | ||
| name_contains | No | ||
| exclude_account_ids | No | ||
| exclude_account_names | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, this description carries the full burden and does it well: it discloses that reads, writes, deletes, and secret reads are all dispatched, that AWS IAM is the sole authorization boundary, that nothing is refused locally and AccessDenied is returned verbatim, that pagination is followed to completion, and that truncated results mean max_items should be raised. It also explains the blast-radius cap and the role-resolution rule, which are the non-obvious operational risks an agent must anticipate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is front-loaded with purpose and the highest-risk facts (blast radius, no local refusal) appear early, with code formatting keeping the parameter examples scannable. It is slightly long and the account-selector discussion is compressed into one dense sentence that could have been split by parameter family.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return shapes need not be described, and the mutation/authorization profile is thoroughly covered. The gap is the 17-parameter surface: with zero schema description coverage and no annotations, an agent still lacks the semantics of the many selector parameters needed to target accounts precisely rather than accidentally widening scope.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it only does so partially: it explains service, operation, params (with an example Filters shape), region, max_items, and role. The ten account-selector parameters (org/orgs, account_id/account_ids, account_name/account_names, environment, name_contains, and both exclude_* variants) are covered only collectively as "account selectors," with no indication of whether they combine, are mutually exclusive, or which to prefer for a given targeting need.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Run one AWS API call across every account a selector resolves to" gives a specific verb (run/dispatch), resource (AWS API call), and scope (fanned out over resolved accounts). The concrete service/operation/params examples make it unambiguous what kind of input is expected, and no sibling tool does anything comparable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states clear operating context: region is always required and never defaulted, omitting selectors targets every account in the active org subject to the blast-radius cap, and role= overrides the deterministic TOML/sole-grant resolution. It never names an alternative sibling to use for account discovery (search_accounts, list_roles, explain_role_selection), so there is no explicit routing guidance, but the when-to-use context is otherwise solid.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cache_statusA
Report cache freshness for one org, or every configured org.
| Name | Required | Description | Default |
|---|---|---|---|
| org | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, but 'Report' strongly implies a read-only, side-effect-free inspection, which is the main behavioral fact an agent needs. It does not say what 'freshness' is measured against (TTL, last sync timestamp), whether the call hits upstream services, or what cost/latency to expect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One front-loaded sentence with no filler, and the scope distinction is packed into the same clause. It is arguably too terse for the only documentation of the tool, but nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-required-parameter read tool with an output schema, this covers the essentials: what is reported and the two invocation modes. The remaining gap is the definition of 'freshness', which the output schema may itself disambiguate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must carry the meaning of the single `org` parameter. It does explain the key distinction — supply an org for one scope, omit it for all configured orgs — which the schema alone (nullable string, default null) does not convey. It adds no format examples or matching semantics for the org value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Report') and resource ('cache freshness') along with its scope ('one org, or every configured org'). An agent can distinguish it from siblings like refresh_accounts or org_status, though the description never explicitly names those alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the reader infers this is for checking data staleness before relying on cached results. There is no explicit when-to-use, when-not-to-use, or pointer to a sibling tool for refreshing versus inspecting.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
config_showA
Show the resolved, loaded configuration (it never contains secrets).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the behavioral burden. It usefully discloses that the configuration is 'resolved, loaded' and 'never contains secrets,' and 'Show' implies a read-only operation. However, it does not mention permissions, side effects, or other operational traits beyond the secret exclusion.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no unnecessary wording. Both the action and the key safety caveat are stated efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and parameterless, and an output schema exists to describe return values. The description covers the essential context—resolved/loaded configuration and absence of secrets—though it could explicitly contrast with config_validate for fuller completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there are no parameter semantics to explain. The baseline score of 4 applies because the description cannot add meaning beyond an empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Show') and resource ('resolved, loaded configuration'), making the tool's purpose clear. It does not explicitly distinguish itself from the sibling config_validate tool, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance on when to use this tool versus alternatives such as config_validate. The implied usage is to inspect the effective configuration, but no conditions, exclusions, or alternatives are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
config_validateA
Re-load and validate the config file, reporting errors without applying them.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description does real work by disclosing the key behavioral trait: errors are reported but not applied, so the operation is non-destructive. It leaves residual ambiguity about whether a valid re-load actually takes effect in the running process and what happens if the file is missing or unreadable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the action comes first and the non-applying guarantee follows immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-argument tool with an output schema, the description covers the action and its safety profile adequately. The remaining gap is the relationship to config_show and the prerequisite state of the config file.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4 and there is nothing further the description could add on parameter meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb pair (re-load and validate) and resource (the config file), which is far more than a restatement of the name. It distinguishes the action from the sibling config_show (display) by emphasizing validation, though it never names config_show directly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: an agent can infer this is for checking config correctness after edits, but the description never says when to pick this over config_show or what precondition (e.g. a config file on disk) must hold. No exclusions or alternatives are offered.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
current_orgA
Report the currently active org, if any.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. 'Report' implies a read-only operation and 'if any' usefully signals the result may be empty, but it says nothing about permissions or session prerequisites. The presence of an output schema covers the return shape.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence with the key qualifier ('currently active', 'if any') front-loaded. No wasted wording and nothing buried.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read with an output schema documenting the response, the description is nearly sufficient. The one remaining gap is how it relates to sibling org tools, which would help an agent route correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing parameter-level for the description to explain. Baseline is 4 for a parameterless tool, and nothing here misleads about inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource: 'Report the currently active org'. That clearly separates it from mutating siblings like use_org or login, though it does not explicitly name org_status or orgs_list as the alternatives an agent might confuse it with.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied — an agent can infer this is the way to check which org is currently active. There is no statement of when to prefer it over org_status, orgs_list, or use_org, and no note about switching orgs first.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
explain_role_selectionA
Dry-run deterministic role resolution for one account; makes no service call.
Shows exactly which role would be assumed and why - explicit override, TOML environment mapping, or sole granted role - without the model ever choosing a role itself.
| Name | Required | Description | Default |
|---|---|---|---|
| org | No | ||
| role | No | ||
| account_id | Yes | ||
| account_name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses that nothing is called remotely, that resolution is deterministic, and it enumerates the precedence chain (explicit override, TOML environment mapping, sole granted role). It does not state what happens when no role resolves or whether authentication is required, so it stops short of full coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two front-loaded sentences with no filler; the side-effect disclaimer leads and the resolution logic follows. The trailing clause 'without the model ever choosing a role itself' partially restates 'deterministic' and could be folded in, which keeps it just short of a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, and the description covers purpose, side effects, and resolution precedence for a moderately complex tool. The remaining gap is parameter-level meaning and the no-role-resolvable case, which matters for an explain tool whose whole value is the explanation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain all four parameters. It only loosely ties 'role' to the explicit-override mechanism and 'org' to the TOML environment mapping; account_id vs account_name (why both are required) and the nullability/defaults of org and role are left entirely unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource — dry-run deterministic role resolution for one account — and immediately separates itself from siblings by declaring it makes no service call and never lets the model pick a role. That distinguishes it from login, use_org, and list_roles without the agent needing to compare schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'dry-run' and 'makes no service call' framing implies this is the inspection step to run before an actual role assumption, but no sibling is named as the alternative and there is no explicit when-not guidance (e.g. 'use use_org to actually assume the role'). Usage is inferable rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_rolesC
List the IAM roles granted to you on one account, via that account's SSO portal.
| Name | Required | Description | Default |
|---|---|---|---|
| org | No | ||
| account_id | Yes | ||
| force_refresh | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full burden. It reveals that roles come from the account's SSO portal, implying an external/auth-dependent lookup, but says nothing about caching, whether stale results can be returned, what force_refresh does, or what failure looks like — gaps that matter given a sibling cache_status and a force_refresh parameter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler or repetition. It is efficient, though the brevity is partly the cause of the semantic gaps scored elsewhere rather than a model of completeness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output values need not be explained because an output schema exists, but for an auth-dependent, cacheable lookup with an undocumented org selector and a cache-control flag, the description is too thin. An agent could call it but cannot reason about auth prerequisites, caching effects, or how org selection interacts with account_id.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across three parameters. The description implies account_id ('on one account') but gives no meaning for 'org' (nullable, defaults to null) or 'force_refresh' (boolean, defaults false), leaving two of three parameters undocumented in both schema and description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb plus resource plus scope: 'List the IAM roles granted to you on one account, via that account's SSO portal.' An agent immediately knows this returns the caller's own role grants for a single account, which separates it from explain_role_selection or refresh_accounts. It stops short of explicitly contrasting with any sibling by name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use or when-not-to-use statement and no named alternative. The phrase 'granted to you' and 'SSO portal' hint at the precondition of being logged in, but an agent is left to infer when to call this versus explain_role_selection, refresh_accounts, or cache_status.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
loginA
Authenticate to an org via SSO device authorization (opens a browser for approval).
This is the only tool that will ever open a browser. Queries never start a sign-in on your behalf; they fail with a message telling you to call this first, so a browser window never appears unexpectedly mid-query.
| Name | Required | Description | Default |
|---|---|---|---|
| org | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden and does disclose the key non-obvious behavior: an interactive browser approval flow is launched and no other tool will ever do so. It omits whether the call blocks until approval, what happens on timeout/denial, and how long the resulting credentials persist, which are relevant for a stateful auth tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Short and front-loaded, with the mechanism and the browser side effect stated first. The second and third sentences restate the same point about browsers not appearing unexpectedly, which is mildly redundant but reinforces an important contract.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no prose, and the description covers the critical behaviors an agent needs before invoking an interactive auth flow. The only gap, the org parameter's semantics, is minor for a tool that is optional-parameter and single-purpose.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and the single 'org' parameter has no description or enum; the prose only says 'to an org' without stating the accepted format or what happens when it is omitted (the schema shows default null). The description adds some meaning by implying the target org scope, but leaves the parameter's optionality and format unspecified.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb (authenticate) and resource (an org) plus the exact mechanism (SSO device authorization with browser approval). No sibling tool performs authentication, and the phrase 'opens a browser for approval' makes the side effect unmistakable, so an agent can distinguish it immediately.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly states the trigger condition: queries fail with a message telling you to call this first, and this is the only tool that opens a browser. It does not address adjacent cases an agent might face, such as switching org afterwards (use_org) or checking existing credentials (token_status, org_status), but the core when-to-use guidance is explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
orgs_listA
List every org configured in the aws-sso-mcp TOML config.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden, but it does disclose the meaningful behavioral detail that results come from the local TOML config rather than a live AWS call. It does not state whether the tool fails when the config is missing, whether the active org is flagged, or whether any authentication is needed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that front-loads the verb and scope with no wasted wording. Nothing is padded or repeated from the name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read tool with an output schema already defining the return shape, the description supplies the one piece of context an agent needs: the data source. It could add a note about error behavior on a missing config file, but that is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate; the baseline of 4 applies. The description does correctly avoid implying any filtering or selection input.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource ('List every org') and names the exact source ('aws-sso-mcp TOML config'), so an agent knows precisely what is returned. It does not distinguish itself from related siblings such as current_org, use_org, or config_show, which is the only thing keeping it from a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use or when-not-to-use guidance. The listing verb implies a discovery step before use_org, but the description never says so and never mentions current_org or config_show as alternatives for related questions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
org_statusB
Report token validity and cache freshness for an org (defaults to the active org).
| Name | Required | Description | Default |
|---|---|---|---|
| org | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full behavioral burden. 'Report' implies a read-oriented status check, and the output schema likely covers return values, but the description does not clarify whether token validity is checked live or read from cache, whether any permissions are required, or whether the operation has side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler. The parenthetical default behavior is directly useful and does not distract from the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, has an output schema, and the description covers the basic report scope and default org behavior. However, it leaves gaps around sibling selection and org identifier semantics that an agent would need in order to invoke it confidently in context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage for the single optional org parameter. The description adds meaning by explaining that it defaults to the active org, but it does not specify the expected identifier format (name, ID, slug) or how a non-active org should be selected.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Report') and two concrete resources ('token validity and cache freshness') scoped to an org. It is clear what the tool does, but it does not explicitly distinguish itself from overlapping siblings such as token_status, cache_status, or current_org.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only usage context is that the org parameter defaults to the active org. There is no guidance on when to use this tool instead of token_status, cache_status, or current_org, nor any when-not conditions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
perf_statsA
Report cache hit/miss counts and executor sizing for the running server.
Answers "why was that fan-out slow?" without turning on debug logging. A high credential-broker miss rate points to short-lived sessions or role churn; a high role-cache miss rate suggests the directory TTL is too short.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations supplied, the description carries the full burden and does reasonably well: 'report' plus 'for the running server' establishes a read-only snapshot of server-internal counters with no arguments and no mutation implied. It also adds diagnostic context beyond the mechanics by explaining what a high credential-broker or role-cache miss rate indicates, though it does not state whether counters are cumulative since start or reset per call.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each doing distinct work: what is returned, what question it answers, and how to read the numbers. The purpose is front-loaded in the opening clause and there is no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read tool with an output schema, the description is nearly sufficient: it explains the data collected and how to interpret two key signals, so return values need not be documented. The remaining gap is routing, since the presence of the sibling cache_status means an agent still has to guess which of the two cache-related tools to call.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4 and there is nothing for the description to disambiguate. The description correctly implies a no-argument call scoped to the running server, matching the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence gives a specific verb plus resource: report cache hit/miss counts and executor sizing for the running server. It is clear what is measured, but it never distinguishes itself from the sibling tool cache_status, which an agent would plausibly confuse with this one.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is conveyed indirectly through a scenario ('why was that fan-out slow?') and an implicit alternative ('without turning on debug logging'), which gives an agent a real trigger to reach for this tool. However, there is no explicit statement of when NOT to use it, and the obvious sibling cache_status is never mentioned as an alternative or complement.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
refresh_accountsA
Force a refresh of the cached account directory for one org, or every configured org.
| Name | Required | Description | Default |
|---|---|---|---|
| org | No | ||
| all_orgs | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It does disclose that this mutates cached state ('force a refresh') rather than just reading, which is meaningful. But it omits cost/latency (this is likely a network refetch), what happens if both 'org' and 'all_orgs' are supplied, and behavior on partial failure across orgs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the resource and the two scoping modes come first. Nothing extraneous to trim.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and an output schema exists, so return values need not be explained. Still, for an unannotated, zero-description-coverage mutation tool, the description leaves the org/all_orgs interaction and the cost of a 'force' refresh unspecified — both of which affect whether an agent should call it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does map the two parameters to intent ('one org, or every configured org'), clarifying that 'org' scopes to a single directory and the alternative covers all configured orgs. However, it never says what 'org' identifies (name vs. id), what the default null means, or how the two flags interact.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource+scope: 'force a refresh of the cached account directory', with the two modes ('one org, or every configured org') made explicit. It is distinguishable from siblings like cache_status or search_accounts, though it never names them directly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the word 'force' and 'cached' suggest invoking it when the cache is stale, and cache_status is the obvious companion tool, but neither the trigger condition nor the alternative is stated. No when-not guidance, e.g. whether calling it repeatedly is wasteful.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_dagB
Run a small declarative multi-step query DAG against every resolved account.
Each entry in ``steps`` is
``{"id": ..., "service": ..., "operation": ..., "params": {...},
"extract": "...", "depends_on": [...]}``.
A later step's ``params`` may reference an earlier step's extracted output
anywhere a literal would go, via ``{"$ref": "<step_id>"}``. There is no
expression language and nothing is ever evaluated as code.
Every resolved account runs its own independent copy of the whole DAG, with
one credential mint per account rather than one per step. As with
``aws_query``, AWS IAM is the sole authorization boundary for every step,
and ``max_items`` raises the per-account pagination ceiling for every step.
| Name | Required | Description | Default |
|---|---|---|---|
| org | No | ||
| orgs | No | ||
| role | No | ||
| steps | Yes | ||
| region | Yes | ||
| max_items | No | ||
| account_id | No | ||
| account_ids | No | ||
| environment | No | ||
| account_name | No | ||
| max_accounts | No | ||
| account_names | No | ||
| name_contains | No | ||
| exclude_account_ids | No | ||
| exclude_account_names | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations supplied, the description carries the full burden and does well: it discloses that each resolved account runs an independent copy of the whole DAG, that credentials are minted once per account rather than per step, that IAM is the sole authorization boundary, that max_items raises the per-account pagination ceiling, and that nothing is ever evaluated as code. It omits failure semantics — what happens when one step or one account errors, and whether partial results are returned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the action, then the step shape, then the reference mechanism, then execution semantics. Every sentence carries information, including the security-relevant 'nothing is ever evaluated as code' clause. Slightly longer than needed only because the steps grammar is inline rather than deferred.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, and the execution model is well covered. But for a 15-parameter, unannotated, inherently multi-step tool, the missing pieces are significant: no error or partial-failure behavior, no guidance on the account-resolution parameters, and no indication of cost or rate limits when fanning out across many accounts.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 15 parameters, so the description must compensate. It documents the hardest parameter, steps, in full detail (id, service, operation, params, extract, depends_on, and $ref resolution) and explains max_items, but it is silent on the ten-plus account-selection parameters — org, orgs, role, account_id(s), account_name(s), name_contains, exclude_*, environment, max_accounts — leaving only the phrase 'resolved account' to imply how accounts are targeted.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: run a declarative multi-step query DAG across every resolved account, and the opening sentence makes the multi-step DAG nature explicit. The family resemblance to aws_query is signalled but the description never directly contrasts the two, so an agent must infer that this is the multi-step superset.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use guidance and no when-not-to-use. The only sibling reference to aws_query is about the IAM authorization boundary, not about choosing between a single query and a DAG, and nothing says whether this is appropriate for large fan-outs, whether it is expensive, or what to do if a step fails.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_accountsB
Search the cached account directory by exact name, substring, or account id.
The cache is refreshed automatically per org if it is missing or older than
the configured TTL. ``name_contains`` is a case-insensitive substring and
behaves identically to the ``name_contains`` selector on ``aws_query``, so
what you find here is exactly what a query will target.
| Name | Required | Description | Default |
|---|---|---|---|
| org | No | ||
| name | No | ||
| limit | No | ||
| all_orgs | No | ||
| account_id | No | ||
| name_contains | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does add real value by disclosing the cache TTL auto-refresh behavior per org. However, it omits whether the operation is read-only, how limit truncation behaves, and what happens when the cache is stale mid-search, leaving meaningful behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short paragraphs, front-loaded with the core action and matching modes, then the cache/consistency note. No filler, though the aws_query equivalence sentence is slightly verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values needn't be explained, and the cache behavior is covered. But for a 6-parameter tool with zero schema coverage, the missing limit/all_orgs semantics and lack of explicit read-only framing leave it only partially complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% across 6 parameters, so the description must compensate. It explains name_contains semantics (case-insensitive substring) and implies name/account_id/org usage, but says nothing about limit, all_orgs, or the org default, leaving half the parameters undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Search the cached account directory') and enumerates the three matching modes (exact name, substring, account id). It also distinguishes itself from aws_query by noting name_contains behaves identically, so an agent can tell what it targets, though it doesn't fully contrast the two tools' roles.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this is a discovery step whose results feed aws_query, which is useful implied guidance, but it never states explicitly when to use this versus aws_query or the sibling refresh_accounts/cache_status tools. Usage is inferable rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
token_statusB
Check cached SSO token validity WITHOUT ever opening a browser.
| Name | Required | Description | Default |
|---|---|---|---|
| org | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full burden. It does disclose a genuine behavioral trait — this never launches a browser, so it is a safe non-interactive probe — but it says nothing about whether an invalid token triggers a refresh, what permissions are needed, or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short, front-loaded sentence with no wasted words; the capitalized emphasis on the browser-free property aids scanning. Slightly clipped at the cost of missing detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained. However, with no annotations and an undocumented org parameter, the definition leaves key calling behavior (scope of the check, invalid-token outcome) unstated for a tool whose whole value is a quick validity verdict.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single 'org' parameter has 0% schema description coverage, so the description should explain its meaning and default behavior. It never mentions the parameter at all, leaving unclear whether omitting org checks the current org or all cached orgs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb+resource: 'Check cached SSO token validity'. The 'WITHOUT ever opening a browser' clause implicitly contrasts it with interactive login flows, but it never names a sibling such as login or cache_status to make the distinction explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: you check the token when you want to know if your cached session is still good, and the browser-free constraint hints that it is a non-interactive pre-flight check. There is no explicit when-to-use versus login/refresh_accounts, and no statement about what to do if the token is invalid.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
use_orgB
Set the active org for this session (one-off org= overrides still win).
| Name | Required | Description | Default |
|---|---|---|---|
| org | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the burden. It does disclose two important behaviors: the setting is session-scoped and explicit org= overrides take precedence. It omits what happens on an invalid org, whether it affects credentials/tokens, and whether the change is reversible.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no waste. The trailing parenthetical is terse to the point of being slightly cryptic, but it is not padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter session setter with an output schema, the core action is covered, and return values need not be explained. Missing pieces are the valid value source, session lifetime, persistence, and failure behavior, which matter for a stateful setter with no annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one required parameter, org, with 0% schema description coverage, so the description is the only source of meaning. It only implies the value can also be supplied one-off as org= and never states whether it is a name, ID, or alias, nor where to discover valid values (orgs_list).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb plus resource: 'Set the active org for this session.' This clearly separates it from read-only siblings like current_org and orgs_list. It does not name a sibling explicitly, but the action is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The parenthetical 'one-off org= overrides still win' tells the agent that a per-call override takes precedence, which is real routing guidance. However, it never says when to prefer this over login, current_org, or orgs_list, or whether the change persists beyond the session.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
16 tool updates
v0.1.0- First observed
aws_query - First observed
cache_status - First observed
config_show - First observed
config_validate - First observed
current_org - First observed
explain_role_selection - First observed
list_roles - First observed
login - First observed
org_status - First observed
orgs_list - First observed
perf_stats - First observed
refresh_accounts - First observed
run_dag - First observed
search_accounts - First observed
token_status - First observed
use_org
TDQS
Scored across 16 tools
Most tools have clearly distinct responsibilities, and aws_query versus run_dag is well separated by single-call versus dependent multi-step execution. The main ambiguity is among token_status, cache_status, and org_status, since org_status substantially combines the other two.
All names use readable snake_case, but their structure is inconsistent: list_roles and refresh_accounts are verb-first, while orgs_list, config_show, and config_validate are noun-first. Names such as current_org and perf_stats add further noun-phrase patterns, making the convention only moderately predictable.
Sixteen tools is slightly above the ideal range, and the separate status and diagnostic views add some weight. However, the server covers org and session management, account and role discovery, configuration, query execution, and performance diagnostics, so the count remains reasonable.
The primary workflow is covered end to end, from org selection and authentication through account discovery, deterministic role resolution, and arbitrary AWS operations, with run_dag supporting dependent calls. Minor administrative omissions such as explicit logout/session revocation and cache clearing remain, but they do not block normal discovery and querying.
Maintenance
Related MCP Connectors
Unified API to query AWS, GCP, Azure and generate Terraform/CLI execution kits for AI agents.
Call AI by role, not by model: tiered AI gateway over REST and MCP.
Run every client's AI from one console: workspaces, roles, MCP tools, approvals and spend.
AI routing, memory, guardrails, and governance. Routes across Claude, GPT, Gemini.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceConnects AI assistants to AWS infrastructure through AWS IAM Identity Center for secure, natural language management of cloud resources across multiple accounts. It enables users to execute AWS CLI commands, monitor resources, and run remote shell commands on EC2 instances via Systems Manager.600 npm15ISC
- AlicenseNot gradedqualityBmaintenanceProvides a sandboxed environment for AI coding agents to execute TypeScript AWS SDK queries securely, with cross-account aggregation and no host credential exposure.33 npm7Apache 2.0
- AlicenseNot gradedqualityDmaintenanceA minimal, security-focused MCP gateway for connecting ChatGPT to AWS account data through explicit, read-only tools.MIT
- AlicenseNot gradedqualityBmaintenanceEnables natural language queries across AWS multi-account security scan history, including infrastructure configurations, public exposures, and organizational relationships.MIT