Lists AWS IoT things in the configured region, newest page first, with optional filters by thing type or by a single attribute name/value pair. Use this to discover thing names before inspecting a shadow. Returns names and types only — call describe_thing for detail.

Returns the registry record of one thing: ARN, thing type, version, billing group, its thing groups, and its attributes. Attributes are returned inside an untrusted-data fence because any principal with UpdateThing can write them.

Runs a fleet-indexing query (AWS_Things index) and returns matching things with their connectivity state when connectivity indexing is enabled. This is the only way to answer "which devices are offline right now". Query syntax examples: connectivity.connected:false — thingName:gw-* — attributes.site:santiago — shadow.reported.firmware:1.2.3. Requires fleet indexing to be enabled on the account.

Reports whether fleet indexing is enabled and which modes are active (registry, shadow, connectivity, named shadows). Call this first when search_fleet_index returns nothing or reports unknown connectivity — it distinguishes "no matches" from "not indexed".

Reads the classic or a named device shadow and returns three things: how stale each reported field is, which desired fields the device has not converged on, and the raw document inside an untrusted-data fence. Prefer this over reading the raw shadow yourself — the staleness and drift analysis is where the operational answer usually is.

Lists the named shadows that exist for one thing. The classic (unnamed) shadow is never listed here by AWS — read it with get_device_shadow and no shadow_name.

Structural diff of the reported state of two things (or of two named shadows of the same thing). This is the fastest way to answer "what is different about the one that misbehaves?" — it lists only the fields that differ, so a fleet-wide config drift shows up immediately.

Lists the topic rules of the account with their topic filter and whether they are disabled. Use it to answer "where does telemetry from this topic go?" before opening a single rule.

Returns one topic rule in full: its SQL, its SQL version, every action with the target it writes to, and its error action. A rule without an error action loses messages silently when its action fails, which this tool calls out explicitly.

Returns the account-specific IoT endpoint addresses. iot:Data-ATS is the MQTT/HTTPS data endpoint devices connect to; the others serve jobs and the credential provider. Endpoints are per account and per region, which is the usual cause of "the device connects but nothing arrives".

Lists the X.509 certificates attached to a thing with their status and expiry date, and flags the ones that are inactive, revoked, already expired or expiring soon. Certificate expiry is the classic silent fleet outage: everything works until the day it does not.

Diagnostic sweep over a sample of things. For each one it checks shadow freshness, desired-vs-reported convergence, certificate status and expiry, and connectivity when the fleet index provides it, then returns findings ranked worst-first with a per-code summary. Read-only and non-prescriptive: it reports what is wrong and never changes anything. Give it either an explicit list of thing names or a fleet-index query.