AWS MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| AWS_REGION | No | The AWS region to use (e.g., us-east-1) | us-east-1 |
| AWS_ACCESS_KEY_ID | Yes | Your AWS Access Key ID with read-only permissions | |
| AWS_SECRET_ACCESS_KEY | Yes | Your AWS Secret Access Key with read-only permissions |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| get_aws_caller_identityB | Returns the AWS IAM caller identity (user/role) to verify credentials. |
| list_s3_bucketsB | Lists all S3 buckets in the AWS account. |
| list_ec2_instancesB | Lists EC2 instances in the current region, showing ID, type, state, and public IP. |
| list_iam_usersB | Lists IAM users in the AWS account. |
| list_recent_cloudtrail_eventsB | Lists recent CloudTrail events to track console access and changes. |
| list_cloudwatch_alarmsC | Lists CloudWatch alarms, optionally filtering by state. |
| get_recent_costC | Retrieves daily AWS costs for the specified date range (default: last 7 days). |
| get_cost_by_serviceB | Retrieves AWS costs broken down by service for the specified date range. |
| get_cost_breakdownB | Detailed cost analysis. If service_name is provided, breaks down that service by Usage Type. Otherwise, breaks down by Service. |
| get_cost_forecastC | Predicts future costs for a specified time range. |
| get_budget_detailsB | Lists all AWS Budgets along with their status, limits, and current spend. |
| get_cost_anomaliesC | Retrieves cost anomalies detected by AWS Cost Anomaly Detection. |
| get_savings_plans_utilizationC | Retrieves Savings Plans utilization percentages. |
| get_reservation_utilizationC | Retrieves Reserved Instance (RI) utilization percentages. |
| get_instance_detailsC | Retrieves detailed information about a specific EC2 instance. |
| list_vpcsB | Lists all VPCs in the current region. |
| list_subnetsB | Lists subnets with availability zones and available IP counts. |
| list_route_tablesB | Lists route tables with their routes and associations. |
| list_internet_gatewaysB | Lists Internet Gateways and their attachments. |
| list_nat_gatewaysC | Lists NAT Gateways with their state and public IP. |
| list_security_groupsC | Lists all security groups. |
| list_users_without_mfaA | Lists IAM users who do not have MFA enabled. |
| list_old_access_keysC | Lists access keys older than 90 days (or specified days). |
| list_expiring_certificatesB | Lists ACM certificates expiring within the specified days. |
| list_rds_instancesB | Lists RDS instances with engine versions and status. |
| list_lambda_functionsB | Lists Lambda functions with runtimes and last modified dates. |
| list_backup_jobsB | Lists recent backup jobs, optionally filtering by state (default: FAILED). |
| list_open_security_groupsA | Lists security groups that allow ingress from 0.0.0.0/0 on specified ports (default: 22, 3389). |
| list_unused_ebs_volumesB | Lists EBS volumes that are available (not attached to any instance). |
| list_unassociated_eipsB | Lists Elastic IPs that are not associated with any instance. |
| list_guardduty_findingsC | Lists recent high-severity GuardDuty findings. |
| get_recent_logsC | Retrieves recent log events from a CloudWatch Log Group. |
| search_cloudwatch_logsC | Search CloudWatch logs using a filter pattern (e.g., 'ERROR', 'Exception'). |
| list_cloudtrail_changesC | Lists write/mutation events (Create, Update, Delete) for a specific resource or service. |
| list_access_denied_eventsC | Lists recent Access Denied or Unauthorized events from CloudTrail. |
| get_service_healthB | Lists recent open events from AWS Health Dashboard. |
| list_load_balancersB | Lists all Application and Network Load Balancers. |
| list_target_groupsC | Lists all Target Groups. |
| list_listener_rulesB | Lists listeners and routing rules (host, path) for a specified Load Balancer. |
| get_target_healthB | Retrieves the health of targets in a specified Target Group. |
| list_web_aclsC | Lists Web ACLs (Global/CloudFront or Regional). |
| get_waf_sampled_requestsC | Retrieves sampled requests from a Web ACL. |
| check_ip_in_wafC | Checks if an IP address exists in any WAF IP Set (Blocklists/Allowlists). |
| get_metric_statisticsB | Retrieves statistics for a specific CloudWatch metric. |
| list_sns_topicsB | Lists all SNS topics. |
| list_record_setsC | Lists DNS records for a given hosted zone. |
| list_hosted_zonesB | Lists all Route53 Hosted Zones. |
| list_ecs_clustersB | Lists ECS clusters with their status and running task counts. |
| list_ecs_servicesC | Lists services in a specific ECS cluster. |
| list_eks_clustersB | Lists EKS clusters in the current region. |
| list_auto_scaling_groupsB | Lists Auto Scaling Groups with their capacity settings. |
| list_scaling_activitiesC | Describes recent scaling activities for an Auto Scaling Group. |
| list_cloudfront_distributionsB | Lists CloudFront distributions with their domain names and status. |
| list_secretsB | Lists Secrets Manager secrets (names only). |
| list_ssm_parametersB | Lists SSM Parameters (names only). |
| list_cloudformation_stacksB | Lists CloudFormation stacks and their status. |
| list_dynamodb_tablesB | Lists DynamoDB tables. |
| list_trusted_advisor_checksC | Lists Trusted Advisor checks available. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 58 tools
Most tools are clearly distinct, targeting specific AWS services and operations (e.g., list_ec2_instances vs. get_instance_details). However, some overlap exists, such as list_recent_cloudtrail_events and list_cloudtrail_changes, which could cause confusion without careful reading of descriptions. Overall, the domain coverage is broad but well-organized.
Tool names follow a highly consistent verb_noun pattern throughout, using snake_case uniformly. All tools start with verbs like 'get', 'list', 'check', or 'search', followed by specific nouns, making them predictable and easy to parse. No deviations or mixed conventions are present.
With 58 tools, the count is excessive for a single server, making it overwhelming and likely to cause agent confusion. While AWS is a broad domain, this many tools suggests poor scoping; it would be more coherent if split into focused sub-servers (e.g., cost management, security, compute).
The tool set provides extensive coverage across AWS services, including monitoring, security, cost, and infrastructure, with many CRUD-like operations (e.g., list and get tools). Minor gaps exist, such as limited mutation tools (e.g., no create or delete operations), but agents can still perform comprehensive read-only analysis and diagnostics.