Which integrations are available for this server?

Enables interaction with Amazon OpenSearch Service, providing capabilities to list and describe OpenSearch clusters as part of the AWS environment. Provides tools to interact with Amazon ElastiCache for Redis, enabling users to describe cache clusters, replication groups, and serverless cache instances.

How do I use AWS MCP Server?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@AWS MCP Server list my running EC2 instances and their status" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

AWS MCP Server

by marcelobrake

Overview Schema Source Related Servers Discussions Admin

Python

Local

AWS MCP Server

A Model Context Protocol (MCP) server that provides Claude Desktop with tools to interact with AWS services using your machine's configured AWS profiles.

Features

208 AWS tools across 57 services: EC2, S3, IAM, Lambda, CloudWatch, ECS, RDS, DynamoDB, SQS, SNS, SES, ECR, ElastiCache, API Gateway, CloudFront, Route53, Cost Explorer, Cognito, MemoryDB, DocumentDB, OpenSearch, EKS, Athena, Glue, MWAA, Firehose, Secrets Manager, SSM, Lake Formation, CloudTrail, CloudFormation, KMS, ACM, Kinesis, EMR, SageMaker, VPC, Organizations, Resource Groups, EventBridge, ELB v2, Auto Scaling, Step Functions, WAF v2, GuardDuty, Security Hub, CodePipeline, CodeBuild, CodeDeploy, Redshift, EFS, AWS Backup, and more
Multi-profile support — use any AWS profile from ~/.aws/config
Readonly by default — starts in safe mode; use --write to allow mutating operations
Sensitive data gate — Secrets Manager and decrypted SSM reads require extra authentication even in write-enabled mode
Structured JSONL logging — every operation is logged to logs/aws_mcp.jsonl
OpenTelemetry tracing (opt-in) — distributed traces are exported only when OTEL_EXPORTER_OTLP_ENDPOINT is set
Pre-push security scans — semgrep, gitleaks, trivy, bandit, and pip-audit can block unsafe pushes
Cross-platform — works on Ubuntu/Linux, macOS, and Windows

Related MCP server: claude-aws-mcp

Requirements

Python 3.12+
AWS CLI configured with profiles (~/.aws/config and ~/.aws/credentials)

Quick Start

1. Setup

cd aws-mcp
chmod +x setup.sh
./setup.sh

Or manually:

python3 -m venv .venv
source .venv/bin/activate        # Linux/macOS
# .venv\Scripts\activate         # Windows
pip install -e ".[dev]"

2. Test the server

# Verify it starts (will wait for MCP input on stdin, Ctrl+C to stop)
.venv/bin/python main.py

3. Configure Claude Desktop

Edit your Claude Desktop configuration file:

OS	Config file path
Linux	`~/.config/Claude/claude_desktop_config.json`
macOS	`~/Library/Application Support/Claude/claude_desktop_config.json`
Windows	`%APPDATA%\Claude\claude_desktop_config.json`

Add the server to the mcpServers section:

{
  "mcpServers": {
    "aws-mcp": {
      "command": "/absolute/path/to/aws-mcp/.venv/bin/python",
      "args": [
        "/absolute/path/to/aws-mcp/main.py"
      ]
    }
  }
}

See claude_desktop_config.example.json for a full example with multiple configurations.

Windows configuration

{
  "mcpServers": {
    "aws-mcp": {
      "command": "C:\\path\\to\\aws-mcp\\.venv\\Scripts\\python.exe",
      "args": [
        "C:\\path\\to\\aws-mcp\\main.py"
      ]
    }
  }
}

4. Restart Claude Desktop

After saving the configuration, restart Claude Desktop. The AWS tools will appear in the tools menu.

CLI Options

Flag	Description	Default
`--readonly`	Force readonly mode explicitly	On
`--write`	Allow mutating operations	Off
`--log-dir`	Directory for JSONL log files	`logs`
`--log-level`	Log verbosity: DEBUG, INFO, WARNING, ERROR	`INFO`

Sensitive Data Access

Some operations can return secret or decrypted data directly to the MCP client. These operations now require an extra approval token even when the server is running with --write.

Protected flows:

aws_secretsmanager_get_secret_value
aws_ssm_get_parameter with with_decryption=true
aws_ssm_get_parameters_by_path with with_decryption=true
Equivalent sensitive calls made through aws_execute

Set an out-of-band token in the server environment:

export AWS_MCP_SENSITIVE_ACCESS_TOKEN="replace-with-a-long-random-token"

For protected operations, pass all three fields below:

{
  "sensitive_access_token": "replace-with-a-long-random-token",
  "sensitive_access_reason": "incident response for production database access",
  "sensitive_access_acknowledged": true
}

Notes:

SSM decryption now defaults to false.
KMS metadata tools remain read-only. If a future KMS tool can return plaintext, it must use the same gate.

Available Tools (208 total)

Profile Management

Tool	Description	Readonly
`aws_list_profiles`	List all configured AWS profiles and their regions	Allowed
`aws_get_caller_identity`	Get STS caller identity for a profile	Allowed

EC2

Tool	Description	Readonly
`aws_ec2_describe_instances`	List/describe EC2 instances	Allowed
`aws_ec2_describe_security_groups`	Describe security groups	Allowed
`aws_ec2_manage_instances`	Start/stop/reboot instances	DryRun=True

S3

Tool	Description	Readonly
`aws_s3_list_buckets`	List S3 buckets	Allowed
`aws_s3_list_objects`	List objects in a bucket	Allowed
`aws_s3_get_object`	Download and read an object	Allowed
`aws_s3_put_object`	Upload an object	Blocked
`aws_s3_delete_objects`	Delete objects	Blocked

IAM

Tool	Description	Readonly
`aws_iam_list_users`	List IAM users	Allowed
`aws_iam_list_roles`	List IAM roles	Allowed
`aws_iam_list_policies`	List IAM policies	Allowed

Lambda

Tool	Description	Readonly
`aws_lambda_list_functions`	List Lambda functions	Allowed
`aws_lambda_get_function`	Get function config and metadata	Allowed
`aws_lambda_invoke`	Invoke a function	InvocationType=DryRun

CloudWatch Logs

Tool	Description	Readonly
`aws_logs_describe_log_groups`	List log groups	Allowed
`aws_logs_get_log_events`	Get events from a log stream	Allowed
`aws_logs_filter_log_events`	Search logs with a filter pattern	Allowed

CloudWatch Metrics & Alarms

Tool	Description	Readonly
`aws_cloudwatch_describe_alarms`	List alarms with state and threshold config	Allowed
`aws_cloudwatch_list_metrics`	List available metrics by namespace	Allowed
`aws_cloudwatch_get_metric_data`	Retrieve time-series data for multiple metrics	Allowed
`aws_cloudwatch_get_metric_statistics`	Get statistics for a single metric	Allowed

ECS

Tool	Description	Readonly
`aws_ecs_list_clusters`	List ECS clusters	Allowed
`aws_ecs_describe_clusters`	Describe cluster details	Allowed
`aws_ecs_list_services`	List services in a cluster	Allowed
`aws_ecs_describe_services`	Describe service details	Allowed
`aws_ecs_list_tasks`	List tasks in a cluster	Allowed
`aws_ecs_describe_tasks`	Describe task details	Allowed

RDS

Tool	Description	Readonly
`aws_rds_describe_db_instances`	Describe RDS instances	Allowed
`aws_rds_describe_db_clusters`	Describe Aurora clusters	Allowed

DynamoDB

Tool	Description	Readonly
`aws_dynamodb_list_tables`	List DynamoDB tables	Allowed
`aws_dynamodb_describe_table`	Describe table schema and settings	Allowed
`aws_dynamodb_query`	Query a table by key condition	Allowed
`aws_dynamodb_scan`	Scan a table (use sparingly)	Allowed

SQS

Tool	Description	Readonly
`aws_sqs_list_queues`	List SQS queues	Allowed
`aws_sqs_get_queue_attributes`	Get queue attributes (message count, DLQ, etc.)	Allowed
`aws_sqs_receive_message`	Peek messages without deleting	Allowed
`aws_sqs_send_message`	Send a message to a queue	Blocked
`aws_sqs_purge_queue`	Purge all messages from a queue	Blocked

SNS

Tool	Description	Readonly
`aws_sns_list_topics`	List SNS topics	Allowed
`aws_sns_get_topic_attributes`	Get topic attributes	Allowed
`aws_sns_list_subscriptions`	List subscriptions	Allowed
`aws_sns_publish`	Publish a message to a topic	Blocked

SES

Tool	Description	Readonly
`aws_ses_list_identities`	List verified email addresses and domains	Allowed
`aws_ses_get_send_statistics`	Get sending stats (deliveries, bounces, etc.)	Allowed
`aws_ses_get_send_quota`	Get sending quota and current usage	Allowed
`aws_ses_get_identity_verification_attributes`	Get verification status	Allowed
`aws_ses_send_email`	Send an email	Blocked

ECR

Tool	Description	Readonly
`aws_ecr_describe_repositories`	List and describe ECR repositories	Allowed
`aws_ecr_list_images`	List images in a repository	Allowed
`aws_ecr_describe_images`	Get image metadata (size, scan status, vulns)	Allowed
`aws_ecr_get_lifecycle_policy`	Get repository lifecycle policy	Allowed

ElastiCache (Redis / Memcached)

Tool	Description	Readonly
`aws_elasticache_describe_cache_clusters`	Describe clusters (engine, node type, endpoints)	Allowed
`aws_elasticache_describe_replication_groups`	Describe Redis replication groups	Allowed
`aws_elasticache_describe_serverless_caches`	Describe serverless caches	Allowed
`aws_elasticache_describe_events`	Get recent events (maintenance, failover, etc.)	Allowed

ELB v2 (ALB / NLB)

Tool	Description	Readonly
`aws_elbv2_describe_load_balancers`	List ALBs, NLBs, and Gateway LBs	Allowed
`aws_elbv2_describe_target_groups`	List target groups	Allowed
`aws_elbv2_describe_target_health`	Get health of targets in a target group	Allowed
`aws_elbv2_describe_listeners`	List listeners for a load balancer	Allowed

Auto Scaling

Tool	Description	Readonly
`aws_autoscaling_describe_auto_scaling_groups`	List ASGs with capacity and instance details	Allowed
`aws_autoscaling_describe_scaling_policies`	List scaling policies	Allowed
`aws_autoscaling_describe_scaling_activities`	Get recent scale-out/in events	Allowed
`aws_autoscaling_describe_launch_configurations`	List launch configurations	Allowed

API Gateway

Tool	Description	Readonly
`aws_apigateway_get_rest_apis`	List REST APIs (v1)	Allowed
`aws_apigateway_get_resources`	List resources/paths for a REST API	Allowed
`aws_apigateway_get_stages`	List stages for a REST API	Allowed
`aws_apigatewayv2_get_apis`	List HTTP/WebSocket APIs (v2)	Allowed
`aws_apigatewayv2_get_routes`	List routes for an HTTP/WS API	Allowed
`aws_apigatewayv2_get_stages`	List stages for an HTTP/WS API	Allowed

CloudFront

Tool	Description	Readonly
`aws_cloudfront_list_distributions`	List distributions with domains/origins	Allowed
`aws_cloudfront_get_distribution`	Get full distribution configuration	Allowed
`aws_cloudfront_list_invalidations`	List cache invalidation requests	Allowed
`aws_cloudfront_create_invalidation`	Create a cache invalidation	Blocked

Route53

Tool	Description	Readonly
`aws_route53_list_hosted_zones`	List hosted zones (DNS domains)	Allowed
`aws_route53_get_hosted_zone`	Get zone details and NS records	Allowed
`aws_route53_list_resource_record_sets`	List DNS records in a zone	Allowed
`aws_route53_change_resource_record_sets`	Create/update/delete DNS records	Blocked

VPC

Tool	Description	Readonly
`aws_vpc_describe_vpcs`	Describe VPCs	Allowed
`aws_vpc_describe_subnets`	Describe subnets	Allowed
`aws_vpc_describe_nat_gateways`	Describe NAT gateways	Allowed
`aws_vpc_describe_internet_gateways`	Describe internet gateways	Allowed
`aws_vpc_describe_route_tables`	Describe route tables	Allowed
`aws_vpc_describe_vpc_peering_connections`	Describe VPC peering connections	Allowed

Cost Explorer

Tool	Description	Readonly
`aws_ce_get_cost_and_usage`	Get cost and usage data for a date range	Allowed
`aws_ce_get_cost_forecast`	Forecast future AWS costs	Allowed

KMS

Tool	Description	Readonly
`aws_kms_list_keys`	List KMS keys	Allowed
`aws_kms_describe_key`	Describe a KMS key	Allowed
`aws_kms_list_aliases`	List KMS key aliases	Allowed

ACM (Certificate Manager)

Tool	Description	Readonly
`aws_acm_list_certificates`	List ACM certificates	Allowed
`aws_acm_describe_certificate`	Get full certificate details	Allowed

Secrets Manager

Tool	Description	Readonly
`aws_secretsmanager_list_secrets`	List secrets (names/metadata, not values)	Allowed
`aws_secretsmanager_describe_secret`	Get secret metadata and rotation info	Allowed
`aws_secretsmanager_get_secret_value`	Retrieve actual secret value	Blocked

SSM (Systems Manager)

Tool	Description	Readonly
`aws_ssm_describe_parameters`	List Parameter Store parameters	Allowed
`aws_ssm_get_parameter`	Get a parameter value (decrypts SecureString)	Allowed
`aws_ssm_get_parameters_by_path`	Get parameters under a path hierarchy	Allowed
`aws_ssm_describe_instance_information`	List SSM-managed instances	Allowed
`aws_ssm_put_parameter`	Create/update a parameter	Blocked

Cognito

Tool	Description	Readonly
`aws_cognito_list_user_pools`	List Cognito user pools	Allowed
`aws_cognito_describe_user_pool`	Get user pool configuration details	Allowed
`aws_cognito_list_users`	List users in a user pool	Allowed
`aws_cognito_list_groups`	List groups in a user pool	Allowed

EKS

Tool	Description	Readonly
`aws_eks_list_clusters`	List EKS clusters	Allowed
`aws_eks_describe_cluster`	Describe cluster details	Allowed
`aws_eks_list_nodegroups`	List node groups in a cluster	Allowed
`aws_eks_describe_nodegroup`	Describe node group details	Allowed
`aws_eks_list_fargate_profiles`	List Fargate profiles	Allowed

Kinesis

Tool	Description	Readonly
`aws_kinesis_list_streams`	List Kinesis data streams	Allowed
`aws_kinesis_describe_stream`	Describe a stream	Allowed
`aws_kinesis_list_shards`	List shards in a stream	Allowed

Firehose

Tool	Description	Readonly
`aws_firehose_list_delivery_streams`	List delivery streams	Allowed
`aws_firehose_describe_delivery_stream`	Describe stream configuration	Allowed

Step Functions

Tool	Description	Readonly
`aws_sfn_list_state_machines`	List state machines	Allowed
`aws_sfn_describe_state_machine`	Get state machine definition	Allowed
`aws_sfn_list_executions`	List executions for a state machine	Allowed
`aws_sfn_describe_execution`	Get execution status and output	Allowed
`aws_sfn_get_execution_history`	Get execution event history	Allowed

EventBridge

Tool	Description	Readonly
`aws_events_list_event_buses`	List event buses	Allowed
`aws_events_list_rules`	List rules on an event bus	Allowed
`aws_events_describe_rule`	Get full rule configuration	Allowed
`aws_events_list_targets_by_rule`	List targets attached to a rule	Allowed

WAF v2

Tool	Description	Readonly
`aws_wafv2_list_web_acls`	List Web ACLs (REGIONAL or CLOUDFRONT)	Allowed
`aws_wafv2_get_web_acl`	Get full Web ACL configuration	Allowed
`aws_wafv2_get_web_acl_for_resource`	Get Web ACL associated with a resource	Allowed
`aws_wafv2_list_ip_sets`	List IP sets (allow/block lists)	Allowed
`aws_wafv2_list_rule_groups`	List rule groups	Allowed

GuardDuty

Tool	Description	Readonly
`aws_guardduty_list_detectors`	List detector IDs	Allowed
`aws_guardduty_get_detector`	Get detector configuration	Allowed
`aws_guardduty_list_findings`	List finding IDs (filter by severity/type)	Allowed
`aws_guardduty_get_findings`	Get full finding details	Allowed
`aws_guardduty_get_findings_statistics`	Get findings count by severity	Allowed

Security Hub

Tool	Description	Readonly
`aws_securityhub_describe_hub`	Get Security Hub configuration	Allowed
`aws_securityhub_get_findings`	Get findings from all integrated services	Allowed
`aws_securityhub_get_findings_summary`	Get findings count by severity	Allowed
`aws_securityhub_list_standards_subscriptions`	List enabled security standards	Allowed
`aws_securityhub_list_enabled_products_for_import`	List active integrations	Allowed

CodePipeline

Tool	Description	Readonly
`aws_codepipeline_list_pipelines`	List pipelines	Allowed
`aws_codepipeline_get_pipeline`	Get pipeline structure	Allowed
`aws_codepipeline_get_pipeline_state`	Get current stage execution state	Allowed
`aws_codepipeline_list_pipeline_executions`	List recent executions	Allowed

CodeBuild

Tool	Description	Readonly
`aws_codebuild_list_projects`	List build project names	Allowed
`aws_codebuild_batch_get_projects`	Get project configuration details	Allowed
`aws_codebuild_list_builds_for_project`	List recent build IDs for a project	Allowed
`aws_codebuild_batch_get_builds`	Get build details (status, phases, logs)	Allowed

CodeDeploy

Tool	Description	Readonly
`aws_codedeploy_list_applications`	List application names	Allowed
`aws_codedeploy_list_deployment_groups`	List deployment groups	Allowed
`aws_codedeploy_list_deployments`	List deployments with status filter	Allowed
`aws_codedeploy_get_deployment`	Get full deployment details	Allowed

Athena

Tool	Description	Readonly
`aws_athena_list_work_groups`	List Athena workgroups	Allowed
`aws_athena_list_databases`	List databases in a catalog	Allowed
`aws_athena_list_table_metadata`	List tables in a database	Allowed
`aws_athena_start_query_execution`	Start a SQL query	Blocked
`aws_athena_get_query_execution`	Get query status	Allowed
`aws_athena_get_query_results`	Get query results	Allowed

Glue

Tool	Description	Readonly
`aws_glue_get_databases`	List Glue Data Catalog databases	Allowed
`aws_glue_get_tables`	List tables in a database	Allowed
`aws_glue_get_jobs`	List Glue ETL jobs	Allowed
`aws_glue_get_job_runs`	Get runs for a specific job	Allowed
`aws_glue_get_crawlers`	List Glue crawlers	Allowed
`aws_glue_start_job_run`	Start a Glue ETL job	Blocked

MWAA (Managed Airflow)

Tool	Description	Readonly
`aws_mwaa_list_environments`	List MWAA environments	Allowed
`aws_mwaa_get_environment`	Get environment details	Allowed

Lake Formation

Tool	Description	Readonly
`aws_lakeformation_get_data_lake_settings`	Get data lake settings	Allowed
`aws_lakeformation_list_permissions`	List permissions on resources	Allowed
`aws_lakeformation_list_resources`	List registered resources	Allowed

CloudTrail

Tool	Description	Readonly
`aws_cloudtrail_describe_trails`	Describe trails in the account	Allowed
`aws_cloudtrail_get_trail_status`	Get trail logging status	Allowed
`aws_cloudtrail_lookup_events`	Look up recent management events	Allowed

CloudFormation

Tool	Description	Readonly
`aws_cfn_list_stacks`	List stacks with status filter	Allowed
`aws_cfn_describe_stacks`	Get detailed stack info	Allowed
`aws_cfn_list_stack_resources`	List resources in a stack	Allowed
`aws_cfn_get_template`	Get stack template body	Allowed
`aws_cfn_describe_stack_events`	Get stack events (for debugging)	Allowed

Redshift

Tool	Description	Readonly
`aws_redshift_describe_clusters`	List clusters with status and endpoint	Allowed
`aws_redshift_describe_cluster_snapshots`	List manual and automated snapshots	Allowed
`aws_redshift_describe_cluster_parameters`	List parameter group settings	Allowed

EFS (Elastic File System)

Tool	Description	Readonly
`aws_efs_describe_file_systems`	List EFS file systems	Allowed
`aws_efs_describe_mount_targets`	List mount targets	Allowed
`aws_efs_describe_access_points`	List access points	Allowed

AWS Backup

Tool	Description	Readonly
`aws_backup_list_backup_plans`	List backup plans	Allowed
`aws_backup_list_backup_vaults`	List backup vaults	Allowed
`aws_backup_list_backup_jobs`	List backup jobs with status	Allowed
`aws_backup_list_recovery_points_by_backup_vault`	List recovery points in a vault	Allowed

EMR

Tool	Description	Readonly
`aws_emr_list_clusters`	List EMR clusters	Allowed
`aws_emr_describe_cluster`	Describe cluster details	Allowed
`aws_emr_list_steps`	List steps in a cluster	Allowed

SageMaker

Tool	Description	Readonly
`aws_sagemaker_list_endpoints`	List inference endpoints	Allowed
`aws_sagemaker_describe_endpoint`	Get endpoint configuration	Allowed
`aws_sagemaker_list_notebook_instances`	List notebook instances	Allowed
`aws_sagemaker_list_training_jobs`	List training jobs	Allowed

OpenSearch

Tool	Description	Readonly
`aws_opensearch_list_domain_names`	List OpenSearch domain names	Allowed
`aws_opensearch_describe_domain`	Describe domain configuration	Allowed
`aws_opensearch_describe_domain_health`	Get domain cluster health	Allowed

DocumentDB

Tool	Description	Readonly
`aws_docdb_describe_db_clusters`	Describe DocumentDB clusters	Allowed
`aws_docdb_describe_db_instances`	Describe DocumentDB instances	Allowed

MemoryDB

Tool	Description	Readonly
`aws_memorydb_describe_clusters`	Describe MemoryDB clusters	Allowed
`aws_memorydb_describe_snapshots`	Describe MemoryDB snapshots	Allowed

Organizations

Tool	Description	Readonly
`aws_organizations_describe_organization`	Describe the AWS Organization	Allowed
`aws_organizations_list_accounts`	List all accounts in the organization	Allowed
`aws_organizations_list_organizational_units`	List OUs for a parent	Allowed
`aws_organizations_list_roots`	List organization roots	Allowed

Resource Groups & Tag Manager

Tool	Description	Readonly
`aws_tagging_get_resources`	Find resources by tag across all services	Allowed
`aws_tagging_get_tag_keys`	List all tag keys in the account/region	Allowed
`aws_tagging_get_tag_values`	List all values for a tag key	Allowed
`aws_resourcegroups_list_groups`	List Resource Groups	Allowed

General

Tool	Description	Readonly
`aws_execute`	Execute any AWS API call	Depends on operation

Readonly Mode

The server starts in readonly mode by default. When readonly mode is active, it enforces these rules:

Read-only operations (list*, describe*, get*, etc.) — always allowed
Mutating operations with DryRun support (e.g., EC2 start/stop, Lambda invoke) — executed with DryRun=True to validate permissions without making changes
Mutating operations without DryRun (e.g., S3 put/delete, SSM put, SQS send) — blocked with a clear error message

This makes it safe to give Claude access to production AWS accounts for observation and troubleshooting.

Logging

All operations are logged in JSONL format to logs/aws_mcp.jsonl. Each line is a JSON object with fields:

{
  "timestamp": "2025-03-25T12:00:00.000000+00:00",
  "level": "INFO",
  "logger": "aws_mcp",
  "message": "Tool 'aws_ec2_describe_instances' completed successfully",
  "tool_name": "aws_ec2_describe_instances",
  "duration_ms": 342.15,
  "aws_profile": "production",
  "aws_region": "sa-east-1"
}

Telemetry (OpenTelemetry)

Every tool invocation creates an OpenTelemetry span with attributes like tool.name, aws.profile, aws.region, and duration_ms.

To export traces to an observability backend (Jaeger, Grafana Tempo, etc.):

OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317 .venv/bin/python main.py

Without the environment variable, tracing stays disabled.

Security Hooks

The repository ships with a versioned pre-push hook in .githooks/pre-push. Running ./setup.sh configures core.hooksPath automatically.

The hook runs scripts/security_scan.sh, which executes:

semgrep --config auto
gitleaks detect
trivy fs
bandit -r aws_mcp main.py
pip-audit

Required external binaries:

gitleaks
trivy

Python-based scanners are installed by default with pip install -e ".[dev]" during ./setup.sh. If you only want runtime dependencies, run INSTALL_DEV_TOOLS=0 ./setup.sh.

Project Structure

aws-mcp/
├── main.py                     # Entry point
├── aws_mcp/
│   ├── __init__.py             # App initialization
│   ├── server.py               # MCP server and tool dispatch
│   ├── config.py               # CLI argument parsing
│   ├── aws_client.py           # boto3 session management
│   ├── readonly_guard.py       # Readonly mode enforcement
│   ├── logging_config.py       # JSONL logging setup
│   ├── telemetry.py            # OpenTelemetry setup
│   └── tools/
│       ├── __init__.py         # Tool registry and loader
│       ├── profiles.py         # AWS profile / STS tools
│       ├── ec2.py              # EC2 tools
│       ├── s3.py               # S3 tools
│       ├── iam.py              # IAM tools
│       ├── lambda_tool.py      # Lambda tools
│       ├── cloudwatch.py       # CloudWatch Logs, Metrics & Alarms
│       ├── ecs.py              # ECS tools
│       ├── rds.py              # RDS tools
│       ├── dynamodb.py         # DynamoDB tools
│       ├── sqs.py              # SQS tools
│       ├── sns.py              # SNS tools
│       ├── ses.py              # SES tools
│       ├── ecr.py              # ECR tools
│       ├── elasticache.py      # ElastiCache (Redis/Memcached)
│       ├── elbv2.py            # ALB / NLB / Gateway LB
│       ├── autoscaling.py      # Auto Scaling Groups
│       ├── apigateway.py       # API Gateway v1 + v2
│       ├── cloudfront.py       # CloudFront
│       ├── route53.py          # Route53
│       ├── vpc.py              # VPC, subnets, gateways
│       ├── kms.py              # KMS keys and aliases
│       ├── acm.py              # ACM certificates
│       ├── cost_explorer.py    # Cost Explorer
│       ├── secretsmanager.py   # Secrets Manager
│       ├── ssm.py              # SSM Parameter Store
│       ├── cognito.py          # Cognito user pools
│       ├── eks.py              # EKS clusters and node groups
│       ├── kinesis.py          # Kinesis Data Streams
│       ├── firehose.py         # Kinesis Firehose
│       ├── stepfunctions.py    # Step Functions
│       ├── eventbridge.py      # EventBridge
│       ├── wafv2.py            # WAF v2
│       ├── guardduty.py        # GuardDuty
│       ├── securityhub.py      # Security Hub
│       ├── codepipeline.py     # CodePipeline
│       ├── codebuild.py        # CodeBuild
│       ├── codedeploy.py       # CodeDeploy
│       ├── athena.py           # Athena
│       ├── glue.py             # Glue
│       ├── mwaa.py             # MWAA (Managed Airflow)
│       ├── lakeformation.py    # Lake Formation
│       ├── cloudtrail.py       # CloudTrail
│       ├── cloudformation.py   # CloudFormation
│       ├── redshift.py         # Redshift
│       ├── efs.py              # EFS
│       ├── backup.py           # AWS Backup
│       ├── emr.py              # EMR
│       ├── sagemaker.py        # SageMaker
│       ├── opensearch.py       # OpenSearch
│       ├── documentdb.py       # DocumentDB
│       ├── memorydb.py         # MemoryDB
│       ├── organizations.py    # Organizations
│       ├── resourcegroups.py   # Resource Groups & Tag Manager
│       └── general.py          # General-purpose AWS executor
├── logs/                       # JSONL log output
├── pyproject.toml              # Package metadata and dependencies
├── setup.sh                    # Setup script
├── claude_desktop_config.example.json
├── LICENSE
└── README.md

License

BSD 3-Clause — see LICENSE for details.

Available Tools

208 tools

aws_acm_describe_certificateC

Describe an ACM certificate in detail.

Inputs: certificate_arn (required), profile, region.

aws_acm_list_certificatesC

List ACM certificates in the account/region, optionally filtered by status.

Inputs: profile, region, certificate_statuses.

aws_apigateway_get_resourcesB

List resources (paths) for a REST API, including configured methods.

Inputs: rest_api_id (required), profile, region, limit.

aws_apigateway_get_rest_apisC

List API Gateway REST APIs (v1).

Inputs: profile, region, limit.

aws_apigateway_get_stagesC

List deployment stages for a REST API.

Inputs: rest_api_id (required), profile, region.

aws_apigatewayv2_get_apisC

List API Gateway v2 APIs (HTTP and WebSocket).

Inputs: profile, region, max_results.

aws_apigatewayv2_get_routesB

List routes for an HTTP/WebSocket API (v2).

Inputs: api_id (required), profile, region.

aws_apigatewayv2_get_stagesC

List stages for an HTTP/WebSocket API (v2).

Inputs: api_id (required), profile, region.

aws_athena_get_query_executionB

Get status and details of an Athena query execution.

Inputs: query_execution_id (required), profile, region.

aws_athena_get_query_resultsB

Get results of a completed Athena query execution.

Inputs: query_execution_id (required), profile, region, max_results.

aws_athena_list_databasesC

List databases in an Athena data catalog.

Inputs: profile, region, catalog_name, max_results.

aws_athena_list_table_metadataC

List tables in an Athena database.

Inputs: database_name (required), profile, region, catalog_name, +1 more.

aws_athena_list_work_groupsC

List Athena workgroups.

Inputs: profile, region, max_results.

aws_athena_start_query_executionA

Start an Athena SQL query execution. Blocked in --readonly mode. Returns a query execution ID to check results with get_query_results.

Inputs: query_string (required), profile, region, database, +2 more.

aws_autoscaling_describe_auto_scaling_groupsA

List Auto Scaling Groups with their current capacity, health, and instance details.

Inputs: profile, region, auto_scaling_group_names, max_records.

aws_autoscaling_describe_launch_configurationsC

List launch configurations used by Auto Scaling Groups.

Inputs: profile, region, launch_configuration_names, max_records.

aws_autoscaling_describe_scaling_activitiesA

Get recent scaling activities for an Auto Scaling Group (scale-out/in events, failures).

Inputs: auto_scaling_group_name (required), profile, region, max_records.

aws_autoscaling_describe_scaling_policiesC

List scaling policies for Auto Scaling Groups.

Inputs: profile, region, auto_scaling_group_name, policy_names, +1 more.

aws_backup_list_backup_jobsB

List AWS Backup jobs with their status and resource details.

Inputs: profile, region, by_state, by_resource_type, +2 more.

aws_backup_list_backup_plansC

List AWS Backup plans.

Inputs: profile, region, include_deleted, max_results.

aws_backup_list_backup_vaultsC

List AWS Backup vaults.

Inputs: profile, region, max_results.

aws_backup_list_recovery_points_by_backup_vaultC

List recovery points (backups) stored in a backup vault.

Inputs: backup_vault_name (required), profile, region, by_resource_type, +1 more.

aws_ce_get_cost_and_usageB

Get cost and usage data for a time period. Group by service, account, region, tag, etc. TimePeriod format: {'Start': 'YYYY-MM-DD', 'End': 'YYYY-MM-DD'}.

Inputs: time_period (required), profile, region, granularity, +3 more.

aws_ce_get_cost_forecastC

Get a cost forecast for a future time period.

Inputs: time_period (required), profile, region, metric, +1 more.

aws_cfn_describe_stack_eventsA

Get recent events for a CloudFormation stack (useful for debugging deployments).

Inputs: stack_name (required), profile, region.

aws_cfn_describe_stacksB

Get detailed info for one or all CloudFormation stacks (parameters, outputs, tags).

Inputs: profile, region, stack_name.

aws_cfn_get_templateC

Get the CloudFormation template body for a stack.

Inputs: stack_name (required), profile, region, template_stage.

aws_cfn_list_stack_resourcesC

List all resources in a CloudFormation stack.

Inputs: stack_name (required), profile, region.

aws_cfn_list_stacksC

List CloudFormation stacks with optional status filter.

Inputs: profile, region, stack_status_filter.

aws_cloudfront_create_invalidationB

Create a cache invalidation for a CloudFront distribution. Blocked in --readonly mode.

Inputs: distribution_id (required), paths (required), profile, region.

aws_cloudfront_get_distributionC

Get full configuration details for a CloudFront distribution.

Inputs: distribution_id (required), profile, region.

aws_cloudfront_list_distributionsB

List CloudFront distributions with domain names, origins, and status.

Inputs: profile, region, max_items.

aws_cloudfront_list_invalidationsB

List recent cache invalidation requests for a CloudFront distribution.

Inputs: distribution_id (required), profile, region, max_items.

aws_cloudtrail_describe_trailsC

Describe CloudTrail trails in the account.

Inputs: profile, region, trail_name_list, include_shadow_trails.

aws_cloudtrail_get_trail_statusC

Get logging status for a CloudTrail trail.

Inputs: name (required), profile, region.

aws_cloudtrail_lookup_eventsA

Look up recent CloudTrail management events. Filter by event name, resource type, user name, etc. Returns the last 90 days by default.

Inputs: profile, region, lookup_attributes, start_time, +2 more.

aws_cloudwatch_describe_alarmsB

List CloudWatch alarms with their state and threshold configuration.

Inputs: profile, region, alarm_names, state_value, +2 more.

aws_cloudwatch_get_metric_dataA

Retrieve time-series metric data for one or more CloudWatch metrics. Supports multiple metrics and math expressions in a single call.

Inputs: metric_data_queries (required), start_time (required), end_time (required), profile, +2 more.

aws_cloudwatch_get_metric_statisticsB

Get statistics (Average, Sum, Min, Max) for a single CloudWatch metric over a time period.

Inputs: namespace (required), metric_name (required), start_time (required), end_time (required), +5 more.

aws_cloudwatch_list_metricsB

List available CloudWatch metrics for a namespace or resource.

Inputs: profile, region, namespace, metric_name, +1 more.

aws_codebuild_batch_get_buildsB

Get full details (status, logs, duration, phases) for CodeBuild builds.

Inputs: ids (required), profile, region.

aws_codebuild_batch_get_projectsB

Get full configuration details for one or more CodeBuild projects.

Inputs: names (required), profile, region.

aws_codebuild_list_builds_for_projectC

List recent build IDs for a CodeBuild project.

Inputs: project_name (required), profile, region, sort_order.

aws_codebuild_list_projectsB

List CodeBuild project names.

Inputs: profile, region, sort_by, sort_order.

aws_codedeploy_get_deploymentB

Get full details of a CodeDeploy deployment (status, duration, error info).

Inputs: deployment_id (required), profile, region.

aws_codedeploy_list_applicationsC

List CodeDeploy application names.

Inputs: profile, region.

aws_codedeploy_list_deployment_groupsC

List deployment groups for a CodeDeploy application.

Inputs: application_name (required), profile, region.

aws_codedeploy_list_deploymentsC

List CodeDeploy deployments, optionally filtered by application and status.

Inputs: profile, region, application_name, deployment_group_name, +1 more.

aws_codepipeline_get_pipelineA

Get the full structure and stage configuration of a CodePipeline.

Inputs: name (required), profile, region.

aws_codepipeline_get_pipeline_stateB

Get the current execution state of each stage in a CodePipeline.

Inputs: name (required), profile, region.

aws_codepipeline_list_pipeline_executionsB

List recent executions of a CodePipeline with their status.

Inputs: pipeline_name (required), profile, region, max_results.

aws_codepipeline_list_pipelinesD

List CodePipeline pipelines.

Inputs: profile, region, max_results.

aws_cognito_describe_user_poolC

Get detailed configuration for a Cognito user pool.

Inputs: user_pool_id (required), profile, region.

aws_cognito_list_groupsC

List groups in a Cognito user pool.

Inputs: user_pool_id (required), profile, region, limit.

aws_cognito_list_user_poolsC

List Cognito user pools in the account/region.

Inputs: profile, region, max_results.

aws_cognito_list_usersC

List users in a Cognito user pool with optional filter.

Inputs: user_pool_id (required), profile, region, filter, +1 more.

aws_docdb_describe_db_clustersC

Describe DocumentDB clusters.

Inputs: profile, region, db_cluster_identifier, filters.

aws_docdb_describe_db_instancesC

Describe DocumentDB instances.

Inputs: profile, region, db_instance_identifier, filters.

aws_dynamodb_describe_tableB

Get schema, throughput, indexes, and status for a DynamoDB table.

Inputs: table_name (required), profile, region.

aws_dynamodb_list_tablesC

List DynamoDB tables in the account/region.

Inputs: profile, region, limit.

aws_dynamodb_queryA

Query a DynamoDB table using a key condition expression. Items are returned deserialized as plain JSON objects.

Inputs: table_name (required), key_condition_expression (required), expression_attribute_values (required), profile, +6 more.

aws_dynamodb_scanA

Scan a DynamoDB table (reads every item). Use sparingly on large tables. Prefer query when you know the partition key.

Inputs: table_name (required), profile, region, filter_expression, +3 more.

aws_ec2_describe_instancesA

Describe EC2 instances. Filter by instance IDs, state, tags, or custom filters. Returns instance details including ID, type, state, IPs, and tags.

Inputs: profile, region, instance_ids, filters, +1 more.

aws_ec2_describe_security_groupsB

Describe EC2 security groups. Filter by group IDs, names, or VPC.

Inputs: profile, region, group_ids, filters.

aws_ec2_manage_instancesA

Start, stop, or reboot EC2 instances. In --readonly mode, this executes with DryRun=True to validate permissions without making changes.

Inputs: instance_ids (required), action (required), profile, region.

aws_ecr_describe_imagesA

Get detailed metadata for ECR images: size, push date, scan status, and vulnerability counts.

Inputs: repository_name (required), profile, region, image_ids, +1 more.

aws_ecr_describe_repositoriesC

List and describe ECR repositories.

Inputs: profile, region, repository_names, max_results.

aws_ecr_get_lifecycle_policyC

Get the lifecycle policy for an ECR repository.

Inputs: repository_name (required), profile, region.

aws_ecr_list_imagesB

List images in an ECR repository with tag status and digest.

Inputs: repository_name (required), profile, region, tag_status, +1 more.

aws_ecs_describe_clustersC

Get detailed information about one or more ECS clusters.

Inputs: clusters (required), profile, region.

aws_ecs_describe_servicesB

Get detailed information about ECS services including deployments and events.

Inputs: cluster (required), services (required), profile, region.

aws_ecs_describe_tasksC

Get detailed information about ECS tasks.

Inputs: cluster (required), tasks (required), profile, region.

aws_ecs_list_clustersC

List ECS clusters in the account/region.

Inputs: profile, region.

aws_ecs_list_servicesC

List ECS services in a cluster.

Inputs: cluster (required), profile, region, max_results.

aws_ecs_list_tasksC

List ECS tasks in a cluster with optional service or status filter.

Inputs: cluster (required), profile, region, service_name, +1 more.

aws_efs_describe_access_pointsA

List EFS access points (application-specific entry points with path and permissions).

Inputs: profile, region, file_system_id, max_results.

aws_efs_describe_file_systemsA

List EFS file systems with their size, throughput mode, and lifecycle state.

Inputs: profile, region, file_system_id, max_items.

aws_efs_describe_mount_targetsA

List EFS mount targets for a file system or VPC subnet.

Inputs: profile, region, file_system_id, mount_target_id, +1 more.

aws_eks_describe_clusterB

Get detailed EKS cluster info: version, endpoint, VPC config, logging, status, and platform version.

Inputs: name (required), profile, region.

aws_eks_describe_nodegroupC

Get details for an EKS managed node group.

Inputs: cluster_name (required), nodegroup_name (required), profile, region.

aws_eks_list_clustersC

List EKS clusters in the account/region.

Inputs: profile, region, max_results.

aws_eks_list_fargate_profilesC

List Fargate profiles for an EKS cluster.

Inputs: cluster_name (required), profile, region.

aws_eks_list_nodegroupsC

List managed node groups for an EKS cluster.

Inputs: cluster_name (required), profile, region, max_results.

aws_elasticache_describe_cache_clustersA

Describe ElastiCache clusters (Redis/Memcached). Returns engine, node type, status, endpoint, and configuration.

Inputs: profile, region, cache_cluster_id, show_cache_node_info, +1 more.

aws_elasticache_describe_eventsA

Get recent ElastiCache events (maintenance, failover, scaling, etc.).

Inputs: profile, region, source_identifier, source_type, +2 more.

aws_elasticache_describe_replication_groupsA

Describe ElastiCache Redis replication groups (clusters with replicas). Returns primary/replica endpoints, node groups, and failover settings.

Inputs: profile, region, replication_group_id, max_records.

aws_elasticache_describe_serverless_cachesC

Describe ElastiCache Serverless caches (Redis/Memcached serverless).

Inputs: profile, region, serverless_cache_name, max_results.

aws_elbv2_describe_listenersB

List listeners for a load balancer (ports, protocols, rules).

Inputs: load_balancer_arn (required), profile, region.

aws_elbv2_describe_load_balancersA

List ALB, NLB, and Gateway Load Balancers with their DNS names and state.

Inputs: profile, region, load_balancer_arns, names.

aws_elbv2_describe_target_groupsC

List target groups, optionally filtered by load balancer.

Inputs: profile, region, load_balancer_arn, target_group_arns, +1 more.

aws_elbv2_describe_target_healthA

Get health status of all targets registered in a target group.

Inputs: target_group_arn (required), profile, region.

aws_emr_describe_clusterC

Get detailed information about an EMR cluster.

Inputs: cluster_id (required), profile, region.

aws_emr_list_clustersC

List EMR clusters in the account/region.

Inputs: profile, region, cluster_states.

aws_emr_list_stepsC

List steps in an EMR cluster.

Inputs: cluster_id (required), profile, region, step_states.

aws_events_describe_ruleB

Get full configuration for an EventBridge rule.

Inputs: name (required), profile, region, event_bus_name.

aws_events_list_event_busesB

List EventBridge event buses (default, custom, and partner).

Inputs: profile, region, name_prefix, limit.

aws_events_list_rulesB

List EventBridge rules, optionally on a specific event bus.

Inputs: profile, region, event_bus_name, name_prefix, +1 more.

aws_events_list_targets_by_ruleA

List targets (Lambda, SQS, etc.) attached to an EventBridge rule.

Inputs: rule (required), profile, region, event_bus_name.

aws_executeA

Execute any AWS API call by specifying service, method, and parameters. Use this for AWS operations not covered by other tools. In --readonly mode: read-only operations pass through, mutating operations with DryRun support run as dry-run, and all other mutations are blocked.

Inputs: service (required), method (required), profile, region, +4 more.

aws_firehose_describe_delivery_streamA

Get detailed config for a Firehose delivery stream: source, destination, buffering, compression, and status.

Inputs: delivery_stream_name (required), profile, region.

aws_firehose_list_delivery_streamsC

List Kinesis Data Firehose delivery streams.

Inputs: profile, region, delivery_stream_type, limit.

aws_get_caller_identityA

Get the IAM identity of the current caller (STS GetCallerIdentity). Useful for verifying which AWS account and role are active for a profile.

Inputs: profile, region.

aws_glue_get_crawlersC

List Glue crawlers.

Inputs: profile, region, max_results.

aws_glue_get_databasesC

List Glue Data Catalog databases.

Inputs: profile, region, catalog_id, max_results.

aws_glue_get_job_runsC

Get execution history for a Glue job.

Inputs: job_name (required), profile, region, max_results.

aws_glue_get_jobsC

List Glue ETL jobs.

Inputs: profile, region, max_results.

aws_glue_get_tablesB

List tables in a Glue Data Catalog database.

Inputs: database_name (required), profile, region, expression, +1 more.

aws_glue_start_job_runC

Start a Glue job run. Blocked in --readonly mode.

Inputs: job_name (required), profile, region, arguments.

aws_guardduty_get_detectorC

Get GuardDuty detector configuration and status.

Inputs: detector_id (required), profile, region.

aws_guardduty_get_findingsB

Get full details for GuardDuty findings (severity, type, resource, action).

Inputs: detector_id (required), finding_ids (required), profile, region.

aws_guardduty_get_findings_statisticsB

Get a count of GuardDuty findings grouped by severity or finding type.

Inputs: detector_id (required), profile, region, finding_statistic_types.

aws_guardduty_list_detectorsB

List GuardDuty detector IDs in the account (one per region).

Inputs: profile, region.

aws_guardduty_list_findingsA

List GuardDuty finding IDs, optionally filtered by severity or type. Use aws_guardduty_get_findings to retrieve full details.

Inputs: detector_id (required), profile, region, finding_criteria, +1 more.

aws_iam_list_policiesA

List IAM policies. By default lists only customer-managed policies. Set scope to 'AWS' for AWS-managed or 'All' for both.

Inputs: profile, region, scope, max_items.

aws_iam_list_rolesB

List IAM roles in the AWS account with optional path prefix filter.

Inputs: profile, region, path_prefix, max_items.

aws_iam_list_usersB

List IAM users in the AWS account with optional path prefix filter.

Inputs: profile, region, path_prefix, max_items.

aws_kinesis_describe_streamC

Describe a Kinesis stream.

Inputs: stream_name (required), profile, region.

aws_kinesis_list_shardsC

List shards in a Kinesis stream.

Inputs: stream_name (required), profile, region.

aws_kinesis_list_streamsC

List Kinesis data streams.

Inputs: profile, region.

aws_kms_describe_keyC

Describe a KMS key.

Inputs: key_id (required), profile, region.

aws_kms_list_aliasesC

List KMS key aliases.

Inputs: profile, region, key_id.

aws_kms_list_keysC

List KMS keys in the account.

Inputs: profile, region.

aws_lakeformation_get_data_lake_settingsB

Get Lake Formation data lake settings (admins, create defaults, etc.).

Inputs: profile, region, catalog_id.

aws_lakeformation_list_permissionsC

List Lake Formation permissions for a principal or resource.

Inputs: profile, region, catalog_id, principal, +2 more.

aws_lakeformation_list_resourcesC

List resources registered with Lake Formation.

Inputs: profile, region, max_results.

aws_lambda_get_functionC

Get detailed configuration and metadata for a Lambda function.

Inputs: function_name (required), profile, region.

aws_lambda_invokeA

Invoke a Lambda function. In --readonly mode, uses InvocationType='DryRun' to validate permissions without executing the function.

Inputs: function_name (required), profile, region, payload, +1 more.

aws_lambda_list_functionsC

List Lambda functions in the account/region.

Inputs: profile, region, max_items.

aws_list_profilesA

List all AWS profiles configured on this machine (from ~/.aws/config and ~/.aws/credentials). Returns profile names and their default regions.

Inputs: no named parameters.

aws_logs_describe_log_groupsB

List CloudWatch Log groups with optional prefix filter.

Inputs: profile, region, log_group_prefix, limit.

aws_logs_filter_log_eventsB

Search CloudWatch log events using a filter pattern across one or more log streams. Useful for searching logs by keyword or pattern.

Inputs: log_group_name (required), profile, region, filter_pattern, +4 more.

aws_logs_get_log_eventsC

Retrieve log events from a specific CloudWatch log stream. Provide both log_group_name and log_stream_name.

Inputs: log_group_name (required), log_stream_name (required), profile, region, +3 more.

aws_memorydb_describe_clustersC

Describe MemoryDB for Redis clusters.

Inputs: profile, region, cluster_name, max_results.

aws_memorydb_describe_snapshotsC

Describe MemoryDB snapshots.

Inputs: profile, region, cluster_name, snapshot_name, +1 more.

aws_mwaa_get_environmentA

Get detailed MWAA environment info: Airflow version, DAG S3 path, execution role, network config, logging, status, and web server URL.

Inputs: name (required), profile, region.

aws_mwaa_list_environmentsC

List MWAA (Apache Airflow) environments.

Inputs: profile, region, max_results.

aws_opensearch_describe_domainA

Get detailed configuration for an OpenSearch domain: cluster config, EBS, VPC, endpoints, engine version, and status.

Inputs: domain_name (required), profile, region.

aws_opensearch_describe_domain_healthB

Get health status of an OpenSearch domain (cluster health, node count, shards).

Inputs: domain_name (required), profile, region.

aws_opensearch_list_domain_namesC

List all OpenSearch domain names in the account/region.

Inputs: profile, region, engine_type.

aws_organizations_describe_organizationB

Describe the AWS Organization (master account, feature set, ARN).

Inputs: profile, region.

aws_organizations_list_accountsB

List all AWS accounts in the organization.

Inputs: profile, region.

aws_organizations_list_organizational_unitsB

List organizational units (OUs) for a parent (root or OU).

Inputs: parent_id (required), profile, region.

aws_organizations_list_rootsA

List the root(s) of the AWS Organization (needed to navigate the OU tree).

Inputs: profile, region.

aws_rds_describe_db_clustersC

Describe RDS Aurora database clusters.

Inputs: profile, region, db_cluster_identifier.

aws_rds_describe_db_instancesB

Describe RDS database instances. Returns engine, status, endpoint, size, and storage details for each instance.

Inputs: profile, region, db_instance_identifier, filters.

aws_redshift_describe_cluster_parametersB

List parameters for a Redshift parameter group.

Inputs: parameter_group_name (required), profile, region, source.

aws_redshift_describe_clustersB

List Redshift clusters with their configuration, status, and endpoint.

Inputs: profile, region, cluster_identifier, max_records.

aws_redshift_describe_cluster_snapshotsC

List Redshift cluster snapshots (manual and automated).

Inputs: profile, region, cluster_identifier, snapshot_type, +1 more.

aws_resourcegroups_list_groupsC

List Resource Groups in the account.

Inputs: profile, region, max_results.

aws_route53_change_resource_record_setsB

Create, update, or delete DNS records in a Route53 hosted zone. Blocked in --readonly mode.

Inputs: hosted_zone_id (required), changes (required), profile, region, +1 more.

aws_route53_get_hosted_zoneB

Get detailed information about a Route53 hosted zone including NS records and VPCs.

Inputs: hosted_zone_id (required), profile, region.

aws_route53_list_hosted_zonesB

List Route53 hosted zones (DNS domains managed by this account).

Inputs: profile, region, max_items.

aws_route53_list_resource_record_setsB

List DNS records in a Route53 hosted zone. Returns record name, type, TTL, and values.

Inputs: hosted_zone_id (required), profile, region, start_record_name, +2 more.

aws_s3_delete_objectsA

Delete one or more objects from an S3 bucket. Blocked in --readonly mode.

Inputs: bucket (required), keys (required), profile, region.

aws_s3_get_objectA

Download and return the content of an S3 object. Text files are returned as strings; binary files as base64. Use 'range' for partial downloads of large files.

Inputs: bucket (required), key (required), profile, region, +1 more.

aws_s3_list_bucketsB

List all S3 buckets in the account.

Inputs: profile, region.

aws_s3_list_objectsA

List objects in an S3 bucket with optional prefix filter. Returns up to 1000 objects per call; use continuation_token for pagination.

Inputs: bucket (required), profile, region, prefix, +2 more.

aws_s3_put_objectB

Upload content to an S3 object. Blocked in --readonly mode.

Inputs: bucket (required), key (required), content (required), profile, +2 more.

aws_sagemaker_describe_endpointC

Describe a SageMaker endpoint.

Inputs: endpoint_name (required), profile, region.

aws_sagemaker_list_endpointsC

List SageMaker inference endpoints.

Inputs: profile, region, status_equals, max_results.

aws_sagemaker_list_notebook_instancesC

List SageMaker notebook instances.

Inputs: profile, region, status_equals, max_results.

aws_sagemaker_list_training_jobsC

List SageMaker training jobs.

Inputs: profile, region, status_equals, max_results.

aws_secretsmanager_describe_secretA

Get metadata about a secret (rotation, replication, tags) without retrieving the value.

Inputs: secret_id (required), profile, region, sensitive_access_token, +2 more.

aws_secretsmanager_get_secret_valueA

Retrieve the actual secret value. Use with caution — the value will appear in the conversation. Blocked in --readonly mode.

Inputs: secret_id (required), profile, region, version_id, +1 more.

aws_secretsmanager_list_secretsA

List secrets in AWS Secrets Manager (names and metadata, not values).

Inputs: profile, region, max_results, filters.

aws_securityhub_describe_hubB

Get Security Hub configuration and subscription status for the account.

Inputs: profile, region.

aws_securityhub_get_findingsA

Retrieve Security Hub findings with optional filters. Aggregates findings from GuardDuty, Inspector, Macie, IAM Access Analyzer, and more.

Inputs: profile, region, filters, sort_criteria, +1 more.

aws_securityhub_get_findings_summaryA

Get a count summary of Security Hub findings by severity (CRITICAL, HIGH, MEDIUM, LOW).

Inputs: profile, region, record_state.

aws_securityhub_list_enabled_products_for_importB

List Security Hub integrations (products) that are sending findings.

Inputs: profile, region, max_results.

aws_securityhub_list_standards_subscriptionsB

List security standards enabled in Security Hub (CIS, AWS Foundational, PCI DSS, etc.).

Inputs: profile, region, max_results.

aws_ses_get_identity_verification_attributesC

Get verification status for SES identities (email addresses and domains).

Inputs: identities (required), profile, region.

aws_ses_get_send_quotaA

Get SES sending quota: max send rate, max 24h send, and sent in last 24h.

Inputs: profile, region.

aws_ses_get_send_statisticsB

Get SES sending statistics: delivery attempts, bounces, complaints, and rejects.

Inputs: profile, region.

aws_ses_list_identitiesB

List SES verified identities (email addresses and domains).

Inputs: profile, region, identity_type, max_items.

aws_ses_send_emailA

Send an email via SES. Blocked in --readonly mode.

Inputs: source (required), to_addresses (required), subject (required), body_text (required), +4 more.

aws_sfn_describe_executionA

Get the status, input, and output of a specific Step Functions execution.

Inputs: execution_arn (required), profile, region.

aws_sfn_describe_state_machineB

Get the full definition and configuration of a Step Functions state machine.

Inputs: state_machine_arn (required), profile, region.

aws_sfn_get_execution_historyA

Get the event history of a Step Functions execution (steps, errors, inputs/outputs).

Inputs: execution_arn (required), profile, region, max_results, +1 more.

aws_sfn_list_executionsC

List executions for a Step Functions state machine.

Inputs: state_machine_arn (required), profile, region, status_filter, +1 more.

aws_sfn_list_state_machinesC

List Step Functions state machines.

Inputs: profile, region, max_results.

aws_sns_get_topic_attributesA

Get attributes of an SNS topic: ARN, display name, subscription count, policy, etc.

Inputs: topic_arn (required), profile, region.

aws_sns_list_subscriptionsB

List SNS subscriptions, optionally filtered by topic ARN.

Inputs: profile, region, topic_arn.

aws_sns_list_topicsC

List all SNS topics in the account/region.

Inputs: profile, region.

aws_sns_publishA

Publish a message to an SNS topic or target ARN. Blocked in --readonly mode.

Inputs: topic_arn (required), message (required), profile, region, +1 more.

aws_sqs_get_queue_attributesA

Get attributes of an SQS queue: message count, delay, visibility timeout, dead-letter config, ARN, and more.

Inputs: queue_url (required), profile, region, attribute_names.

aws_sqs_list_queuesC

List SQS queues with optional name prefix filter.

Inputs: profile, region, queue_name_prefix.

aws_sqs_purge_queueA

Purge all messages from an SQS queue. Blocked in --readonly mode.

Inputs: queue_url (required), profile, region.

aws_sqs_receive_messageA

Receive (peek) messages from an SQS queue without deleting them. Uses a short visibility timeout so messages return to the queue quickly.

Inputs: queue_url (required), profile, region, max_number_of_messages, +1 more.

aws_sqs_send_messageA

Send a message to an SQS queue. Blocked in --readonly mode.

Inputs: queue_url (required), message_body (required), profile, region, +2 more.

aws_ssm_describe_instance_informationA

List EC2 instances managed by SSM with agent status and platform info.

Inputs: profile, region, filters, max_results.

aws_ssm_describe_parametersB

List SSM Parameter Store parameters with optional filters.

Inputs: profile, region, filters, max_results.

aws_ssm_get_parameterC

Get the value of an SSM parameter. SecureString values are decrypted.

Inputs: name (required), profile, region, sensitive_access_token, +3 more.

aws_ssm_get_parameters_by_pathC

Get all SSM parameters under a path hierarchy.

Inputs: path (required), profile, region, sensitive_access_token, +5 more.

aws_ssm_put_parameterA

Create or update an SSM parameter. Blocked in --readonly mode.

Inputs: name (required), value (required), profile, region, +3 more.

aws_tagging_get_resourcesC

Find resources by tag across all supported AWS services. Uses the Resource Groups Tagging API.

Inputs: profile, region, tag_filters, resource_type_filters, +1 more.

aws_tagging_get_tag_keysB

List all tag keys used across AWS resources in the account/region.

Inputs: profile, region.

aws_tagging_get_tag_valuesA

List all values used for a specific tag key across resources.

Inputs: key (required), profile, region.

aws_vpc_describe_internet_gatewaysA

Describe internet gateways, optionally filtered by attached VPC.

Inputs: profile, region, vpc_id.

aws_vpc_describe_nat_gatewaysC

Describe NAT gateways, optionally filtered by VPC.

Inputs: profile, region, vpc_id.

aws_vpc_describe_route_tablesB

Describe route tables, optionally filtered by VPC.

Inputs: profile, region, vpc_id.

aws_vpc_describe_subnetsC

Describe subnets, optionally filtered by VPC.

Inputs: profile, region, vpc_id, subnet_ids.

aws_vpc_describe_vpc_peering_connectionsC

Describe VPC peering connections in the account.

Inputs: profile, region.

aws_vpc_describe_vpcsC

Describe VPCs in the account.

Inputs: profile, region, vpc_ids.

aws_wafv2_get_web_aclB

Get the full configuration of a WAF v2 Web ACL including all rules.

Inputs: name (required), scope (required), id (required), profile, +1 more.

aws_wafv2_get_web_acl_for_resourceA

Get the Web ACL associated with an AWS resource (ALB, API GW, AppSync).

Inputs: resource_arn (required), profile, region.

aws_wafv2_list_ip_setsB

List WAF v2 IP sets (allow/block lists).

Inputs: scope (required), profile, region, limit.

aws_wafv2_list_rule_groupsB

List WAF v2 managed and custom rule groups.

Inputs: scope (required), profile, region, limit.

aws_wafv2_list_web_aclsA

List WAF v2 Web ACLs. Scope must be 'REGIONAL' (ALB, API GW, AppSync) or 'CLOUDFRONT' (must use us-east-1 region).

Inputs: scope (required), profile, region, limit.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

B3.2/5.0

Scored 2026-04-13 01:20 across 208 tools

Disambiguation5/5

Each tool is clearly distinguished by its AWS service and operation, with no overlap in purpose. The naming convention includes service and operation details, making it easy for an agent to select the correct tool for a specific AWS resource or action without confusion.

Naming Consistency5/5

All tools follow a consistent snake_case pattern with the structure 'aws_<service>_<operation>'. This predictable naming scheme enhances readability and allows agents to easily infer the tool's function and associated AWS service.

Tool Count2/5

With 208 tools, the count is excessive and overwhelming for an agent to navigate effectively. While AWS is a broad domain, this many tools likely includes redundant or overly granular operations that could be consolidated, making the toolset feel heavy and difficult to manage.

Completeness5/5

The toolset provides comprehensive coverage across numerous AWS services, including CRUD operations, monitoring, and management tasks. The inclusion of a generic 'aws_execute' tool ensures that any gaps in specific operations can be addressed, making the surface effectively complete for AWS interactions.

Maintenance

ActivityInactive

ResponsivenessNo recent community issues

Resources

Related MCP Connectors

constants
io.github.constants-ai
One workspace of tools for Claude and ChatGPT: connect 600+ apps, generate media, build tools.
App Automation Developer Tools Multimedia Processing
1
https://www.constants.io/api/mcp
StudioMeyer Crew
io.studiomeyer
Agent personas for Claude. 16 tools, 13 personas, 3 workflows. Zero extra API cost. Free.
Autonomous Agents Agent Orchestration
2
https://crew.studiomeyer.io/mcp
Eyevinn Open Source Cloud
io.osaas.mcp
Your AI Agent's Infrastructure Layer. Connect Claude, Copilot, Codex, or ChatGPT to 200+ managed open source services. Start databases, pipelines, and applications through natural language.
Cloud Platforms Agent Orchestration Developer Tools
2
https://mcp.osaas.io/mcp
FreeRDC
io.github.danielarif26
Safe folder access for ChatGPT and Claude: read, write and search files, risky tools opt-in.
File Systems
11
https://freerdc.sjaman.deno.net/mcp

Related MCP Servers

AWS MCP Server
Cloud Platforms Vector Databases Monitoring
Havoc24k
A
license
B
quality
D
maintenance
Enables Claude to interact with core AWS services like S3, EC2, RDS, and CloudWatch, along with a generic SDK wrapper for any AWS operation. It also supports cost monitoring and optional vector store capabilities for document ingestion and search.
Updated a year ago (2025-11-25 15:26 UTC)
10
3
-
claude-aws-mcp
Cloud Platforms Cloud Storage AI & Machine Learning
chyang222
A
license
Not graded
quality
D
maintenance
Enables natural language control of AWS resources (EC2, Security Groups, S3, Bedrock, etc.) directly from Claude Desktop or Claude Code.
Updated 6 months ago (2026-05-22 13:33 UTC)
84 PyPI
MIT
AWS API MCP Server
Cloud Platforms Developer Tools
3feet-lim
A
license
Not graded
quality
D
maintenance
Enables AI assistants to interact with AWS services and resources through AWS CLI commands, allowing management of AWS infrastructure with security controls.
Updated 9 months ago (2026-02-10 01:48 UTC)
Apache 2.0
AWS Infrastructure MCP Server
Cloud Platforms Security
figfhgfgg
F
license
Not graded
quality
D
maintenance
Enables Claude AI to automatically audit AWS cloud resource configurations, diagnose security vulnerabilities, and generate high-availability optimization reports.
Updated 4 months ago (2026-07-05 21:45 UTC)
-