650,501 tools. Updated 2026-10-13 23:36
"AWS Lambda" matching MCP tools:
- BATCH INSPECTION: run up to 32 AWS inspect probes in one call. ⚠️ **PREREQUISITE**: Same as awsinspect — deploy attempt required. Check convostatus for hasDeployAttempt=true before calling. Use this when you need to check more than ~3 resources. The backend fetches Oracle credentials ONCE per batch and fans out probes against a single AWS config — for a 12-resource health check this is ~5–8× faster and 12× fewer Oracle round-trips than calling awsinspect 12 times. BUDGETS: - Up to 32 sub-probes per call (subs array length). - 30s per-sub timeout; 60s total batch wall-clock. - Concurrency cap 8 — sub-probes run in parallel but never saturate AWS. - 512 KB response cap: subs past the cap keep their envelope (index/service/action/ok) but have result replaced with truncated=true. PARTIAL FAILURE IS EXPECTED. The response is an ordered results array; each entry has {index, service, action, ok, result, error}. Inspect each result — do NOT abort on the first error. A credential fetch failure leaves cred-less probes (list-actions, list-metrics) succeeding anyway. REQUIRES: session_id from convoopen response (format: sess_v2_...). Supported services: account, acm, alb, apigateway, apprunner, backup, bedrock, cloudfront, cloudwatchlogs, cognito, cost-explorer, dynamodb, ebs, ec2, ecs, eks, elasticache, kms, lambda, msk, opensearch, rds, route53, s3, sagemaker, secretsmanager, sqs, vpc, waf For a specific service's actions, use awsinspect (singular) with action="list-actions" — batch is not the place for discovery. Batch responses are always summarized (no detail/raw per-sub); use singular awsinspect when you need full metadata or raw API output for one resource. EXAMPLES: - awsinspect_batch(session_id=..., subs=[ {"service":"ec2","action":"describe-instances"}, {"service":"rds","action":"describe-db-instances"}, {"service":"vpc","action":"describe-vpcs"}, {"service":"s3","action":"list-buckets"}]) - awsinspect_batch(session_id=..., subs=[ {"service":"ec2","action":"get-metrics","filters":"{\"hours\":6}"}, {"service":"rds","action":"get-metrics","filters":"{\"hours\":6}"}])ConnectorNo auth
- AWS docs search. Each result's `context` is verbatim page text -- a real chunk of the actual page, not a short snippet -- and usually already contains the answer, so answer directly from it. Use `read_documentation` only when the chunks genuinely lack the needed detail. Pick ONE topic. Add a 2nd ONLY if query genuinely spans domains. Extra topics dilute ranking. - reference_documentation -- API/SDK/CLI specs, config params - current_awareness -- new/released/announced - troubleshooting -- errors, "how to fix" (NOT for conceptual/feature questions) - amplify_docs -- Amplify (+ language) - cdk_docs -- CDK concepts/guides - cdk_constructs -- CDK code samples, L3 - cloudformation -- CFN/SAM templates - strands_docs -- Strands Agents SDK (its Skills/agents concepts go here, NOT agent_skills) - agent_skills -- this tool's guided skills (load via `retrieve_skill`) - general (default) -- architecture, best practices, tutorials, feature behavior Results: rank_order (lower=better), url, title, context (verbatim page chunk -- answer directly from it).ConnectorNo auth
- BATCH INSPECTION: run up to 32 AWS inspect probes in one call. ⚠️ **PREREQUISITE**: Same as awsinspect — deploy attempt required. Check convostatus for hasDeployAttempt=true before calling. Use this when you need to check more than ~3 resources. The backend fetches Oracle credentials ONCE per batch and fans out probes against a single AWS config — for a 12-resource health check this is ~5–8× faster and 12× fewer Oracle round-trips than calling awsinspect 12 times. BUDGETS: - Up to 32 sub-probes per call (subs array length). - 30s per-sub timeout; 60s total batch wall-clock. - Concurrency cap 8 — sub-probes run in parallel but never saturate AWS. - 512 KB response cap: subs past the cap keep their envelope (index/service/action/ok) but have result replaced with truncated=true. PARTIAL FAILURE IS EXPECTED. The response is an ordered results array; each entry has {index, service, action, ok, result, error}. Inspect each result — do NOT abort on the first error. A credential fetch failure leaves cred-less probes (list-actions, list-metrics) succeeding anyway. REQUIRES: session_id from convoopen response (format: sess_v2_...). Supported services: account, acm, alb, apigateway, apprunner, backup, bedrock, cloudfront, cloudwatchlogs, cognito, cost-explorer, dynamodb, ebs, ec2, ecs, eks, elasticache, kms, lambda, msk, opensearch, rds, route53, s3, sagemaker, secretsmanager, sqs, vpc, waf For a specific service's actions, use awsinspect (singular) with action="list-actions" — batch is not the place for discovery. Batch responses are always summarized (no detail/raw per-sub); use singular awsinspect when you need full metadata or raw API output for one resource. EXAMPLES: - awsinspect_batch(session_id=..., subs=[ {"service":"ec2","action":"describe-instances"}, {"service":"rds","action":"describe-db-instances"}, {"service":"vpc","action":"describe-vpcs"}, {"service":"s3","action":"list-buckets"}]) - awsinspect_batch(session_id=..., subs=[ {"service":"ec2","action":"get-metrics","filters":"{\"hours\":6}"}, {"service":"rds","action":"get-metrics","filters":"{\"hours\":6}"}])ConnectorNo auth
- Start a cloud cost / FinOps scan of a linked account and return a job_id. Use this when the user wants to find idle, unused or underutilized cloud resources, review cloud spend, or estimate savings. The provider comes from the connection, and **AWS is the only provider supported today** (see `list_connections`). Other clouds will appear on this same tool as connections for them become linkable; nothing else about the call changes. READ-ONLY against your cloud: it reads resource metadata and monitoring metrics and reports; it never changes, stops or deletes anything. (It does create a scan job here and consume that account's scan quota, which is why this tool is not marked read-only.) On AWS it covers EC2 instances, EBS volumes and snapshots, RDS instances, Elastic IPs, NAT Gateways, load balancers, VPCs and VPC endpoints, site-to-site VPN and Transit Gateway attachments, Client VPN endpoints, Secrets Manager secrets, CloudFront distributions and WAF web ACLs. Resource kinds outside that list are not inspected, so a clean scan is not a claim that the whole bill is optimized. `connection_id` picks which linked AWS account to scan (see `list_connections`). Omit it to run against sample data — useful for showing the user what the output looks like before any account is linked. The scan runs asynchronously: poll `get_job(job_id)` roughly every 10 seconds until status is COMPLETED (typically 1-3 minutes), then call `list_cost_findings(job_id)`. Do NOT start another scan while one is running — each scan consumes the account's monthly quota. Pass `idempotency_key` (any unique string you choose) if you may retry on a network error: a retry with the same key returns the original job instead of starting a second scan.ConnectorNo auth
- Find which dimension values drove a cost change between two periods. This is a before/after analysis — compare is required (`{}` auto-derives the previous window, same as query). Prefer suggest_groupby / search / get_context first, then pass 2–4 columns (max 8). Do not invent columns. filterCel omitted or "" is unfiltered (not AWS-only). nestingEdges: a child's spend sits inside the parent — do not sum a contributor with its ancestors or descendants; independent contributors may be summed. Prefer omitting aggregationMethod (SUM). EXAMPLES: • "Why did last month's EC2 cost change?" → { datePreset: "LAST_MONTH", compare: {}, filterCel: "cos_service_name in [\"AmazonEC2\"]", columns: ["cos_region", "cos_usage_type"] } • "What drove the RDS jump in May?" → { from: "2026-05-01", to: "2026-05-31", compare: { from: "2026-04-01", to: "2026-04-30" }, filterCel: "cos_provider in [\"AWS\"] && cos_service_name in [\"AmazonRDS\"]", columns: ["cos_sub_account_id", { column: "cos_charge_description", contains: "IOPS" }] }ConnectorOAuth
- AWS resource availability per region. - Max 10 regions; multi-region needs `filters`; single-region supports `next_token`. - Status: isAvailableIn | isNotAvailableIn | isPlannedIn | Not Found. - Response key: products | service_apis | cfn_resources. Not for region counts/docs/vague queries -- use `search_documentation` / `list_regions`. Filter values must EXACTLY match AWS's catalog names; guessed, partial, or pluralized names are rejected ("values in filter parameter do not exist"). If unsure of the exact name, first call once for a single region with resource_type set and NO filters to list all valid names, then re-call filtering on the exact match.ConnectorNo auth
Matching MCP Servers
- AlicenseNot gradedqualityBmaintenanceAn MCP server that runs on AWS Lambda, enabling MCP clients like Claude Desktop to invoke tools such as weather forecasts via serverless infrastructure with OAuth authentication.MIT
- AlicenseNot gradedqualityDmaintenanceBridges MCP clients and AWS Lambda functions, enabling generative AI models to invoke Lambda functions as tools without code changes.Apache 2.0
Matching MCP Connectors
Ultra-fast, native AWS edge-cached infrastructure delivering high-quality synthetic logic reasoning datasets for multi-turn AI model training.
The AWS Knowledge MCP server is a fully managed remote Model Context Protocol server that provides real-time access to official AWS content in an LLM-compatible format. It offers structured access to AWS documentation, code samples, blog posts, What's New announcements, Well-Architected best practices, and regional availability information for AWS APIs and CloudFormation resources. Key capabilities include searching and reading documentation in markdown format, getting content recommendations, listing AWS regions, and checking regional availability for services and features.
- Scan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), private keys (RSA/EC/PGP), JWTs, database connection strings, Bearer tokens, and Basic auth headers. Returns a list of findings with type, severity, line number, and a redacted preview. Use before committing code, sharing logs, or sending text to an LLM. 100% regex-based, zero network calls.ConnectorNo auth
- Suggest the best dimensions to group costs by, based on an optional filterCel (CEL). Call this when the user asks "what should I look at?" or when you need columns for query or find_cost_change_factors. Prefer datePreset over from/to. Omit compare for current-window ranking. Pass compare (`{}` auto-derives, or `{ from, to }`) when the user asks what changed — then pass 2–4 of the returned column names (max 8; { column, contains } for token columns, dropping metrics) into find_cost_change_factors. Returns { column } or { column, contains } plus metrics; do not invent columns. filterCel omitted or "" is unfiltered (not AWS-only). filterCel supports == null for unlabelled dimension values (e.g. cos_environment == null). EXAMPLES: • "What should I split last month's EC2 cost by?" → { datePreset: "LAST_MONTH", filterCel: "cos_service_name in [\"AmazonEC2\"]" } • "Costs of EC2 spiked last month, what should I investigate?" → { datePreset: "LAST_MONTH", compare: {}, filterCel: "cos_service_name in [\"AmazonEC2\"]" }ConnectorOAuth
- Price a list of cloud components at real list prices. No account or signup. Use this when the user can name the pieces: "two m5.large servers, a Postgres database and a load balancer in Mumbai". If they cannot name the pieces, use `describe_workload` instead, which asks in units a person actually has. `items` is a list of `{"component": "<id>", "params": {...}}`. Get the ids and each component's parameters from `list_cost_building_blocks` and use them verbatim: a name you invent will be rejected, which is deliberate. `region` is an AWS region id such as `ap-south-1`. The reply is a RANGE, not a number: `monthly_total` has low, expected and high, because several inputs are genuinely uncertain and a single figure would hide that. `swing_factor` names the one input that most widens the range, which is the most useful sentence in the reply: it tells the user what to go and measure. `concentration` ranks the lines by share of the bill. `assumptions` lists every value that was defaulted rather than given, and `traps` lists costs this architecture usually incurs that the caller did not ask for, such as public IPv4 addresses or database storage billed apart from the database. `gaps` lists anything that could not be priced. It is never silently treated as zero. If a line is missing, the total is missing that line, and the gap says so. These are AWS on-demand list prices before any discount, credit or committed-use agreement, and they exclude tax. Treat the result as an upper bound on a real bill and never as a quote.ConnectorNo auth
- Fetch the step-by-step runbook for one specific waste pattern: symptoms, the detection queries to run, the fix, and the anti-pattern to avoid. Use this when the user asks how to detect, confirm, or fix one specific named waste pattern (zombie NAT gateway, snapshot sprawl, idle SageMaker endpoint, ...). It also serves questions about the user's own resources ("which of my X..."): the runbook's detection query is written to be run in the user's account, so the answer does not depend on access to that account. Args: name: Playbook slug as returned by ``list_playbooks`` (e.g. ``"aws-zombie-nat-gateway"``, ``"azure-orphan-disks"``, ``"cross-cloud-untagged-spend-drift"``). Returns ``{"name": ..., "title": ..., "content": "...", "lines": N}``. On miss, returns ``{"error": ..., "suggestions": [...]}`` with up to three string-distance matches so the caller can self-correct. A host with MCP Apps (SEP-1865) support may render this result via the linked ``ui://cloud-finops/playbook-viewer`` resource instead of showing the raw markdown.ConnectorNo auth
- Rank the startup credits, perks and deals one specific company can claim, from a catalog of 1,000+ programs (AWS Activate, Google for Startups, Microsoft for Startups, NVIDIA Inception, Anthropic, Stripe Atlas, Mercury, HubSpot and more). Use it when the user describes their own startup and asks what they can get or qualify for; use search_startup_perks to look up a provider or topic without a company profile, and get_startup_perk for one program's full terms. It checks each program's stated eligibility (stage, funding gate, raised-amount cap, company age, region) against the profile, ranks the categories the user needs first and takes each need in turn, and leaves out programs whose applications are paused or closed. Returns up to 25 programs, each with the value as the provider states it, whether the company qualifies and why, how to claim it, and links to the StartupPerks page, the provider's application and the provider's terms, plus a realistic claimable total (one program per provider, cloud counted once). Read-only; values are headline maximums, not guarantees.ConnectorNo auth
- Backtest a cost-alert condition BEFORE creating it: replays the `condition` against the last `lookbackDays` (default 45) of data and reports how many times it would have fired. Takes the same queries + condition + dedup as create_alert (no notification channel needed). The dedup window is per groupBy value; delivery stays one message listing newly eligible groups. Returns the evaluation window, `firingDays` (distinct days the condition held), `firingRows` (per-group fires), `notificationsCount` (days on which at least one newly eligible group would notify) and a sample of firing dates with per-group `state`. Use this to sanity-check a condition/threshold (and tune dedup) before calling create_alert. EXAMPLE: "Would 'alert if 7-day AWS spend tops $50k' have fired this month?" → { queries: [{ type: "cost", name: "a", metricId: "cost", currency: "USD", filterCel: "cos_provider in [\"AWS\"]" }], condition: "rollingSum(a, 7, DAY) > 50000", dedup: { kind: "CALENDAR", calendarUnit: "WEEK" }, lookbackDays: 30 }ConnectorOAuth
- Creates (or updates) a persistent per-org rule mapping a counterparty to an account, then BACK-APPLIES it to every pending review event from that counterparty — each is properly approved (journal lines written, audit entry, ledger sync queued), not bulk edited. After this, future events from the counterparty auto-classify and never reach review. This is how you act on get_pending_by_counterparty: "categorise all my AWS as infrastructure" becomes one call. This WRITES financial data — only call it with an account you are confident in. The counterparty is matched on a normalised key, so "AWS, Inc." and "AWS EMEA" resolve to the same rule. Idempotent: re-running updates the single rule and re-approves nothing already approved. actor_id is optional — it defaults to the organisation entity, and if provided must belong to this org. GUARDRAIL (OOB approval): if the rule would back-apply to an unusually large set (many events, a large aggregate, or a large rolling-hour total across recent applies), it returns status "approval_required" and writes ONLY an approval request — YOU CANNOT BOOK IT YOURSELF; confirm:true does not bypass it. Your human gets an email and approves on the dashboard, at which point the action books automatically — do NOT retry the call; verify later by re-reading the books (e.g. get_pending_by_counterparty). If the response says the request was denied recently, do not re-ask for 24h. Small approvals apply immediately (status "applied").ConnectorOAuth
- Make a feature's files the next version of the lambda, and delete the feature with its preview and its copy of the data - the lambda's own data is not touched. Its docs/ and tests/ become the version's documentation and tests, so bring them up to date in the feature first, and run its tests against the preview. Refused while the feature is not based on the newest version (update_feature says how to get it there), and while its code does not compile. deploy: true puts the new version online at once; otherwise deploy it when the user wants it live.ConnectorDestructiveNo auth
- Switch on a kind of data the lambda needs and does not have: 'database' (a SQLite database for its records - off until switched on, which makes it, empty), 'secrets' (off until switched on) or 'workspace' (on unless the owner switched it off). Do it when what you build needs it - records need the database, an API key for a service it calls needs secrets. Takes effect at once, without a deploy; switching the database on starts the lambda again on its next request, so its migrations run. There is no tool to switch one off: that deletes what it held, and is the owner's to do in the editor.ConnectorDestructiveNo auth
- Check the current health status for one or more vendors. Accepts registered vendor slugs (e.g., "github", "aws", "gcp", "gitlab") or raw Atlassian Statuspage base URLs. Registry entries are served by each vendor's native status API (Statuspage, Status.io, Slack, AWS Health, Google Cloud Service Health, Azure status, Firehydrant) and normalized to one shape. Returns per-vendor operational indicator (none = all clear, minor, major, critical, maintenance = scheduled window), degraded components, and active incidents. Use mode: "detailed" for component lists and maintenance windows, narrowed with component_filter and bounded by component_limit. Batch-friendly — pass a list to check your full stack in one call; a vendor that cannot be resolved or reached is reported in its own result row, so one bad entry never discards the rest. Every vendor with an active problem gets a pre-filled devops_suggest_action call in nextToolSuggestions.ConnectorNo auth
- [pqc_signature] 独立计算 ML-DSA 的 64 字节 mu 值(FIPS 204 Section 6.2)。 【用途】用于验证或调试 EXTERNAL_MU 模式的中间值,或与 AWS KMS EXTERNAL_MU 签名流程对接。 【计算公式】 - tr = SHAKE-256(raw_pk, 64) - M' = 0x00 || len(ctx) || ctx || message - mu = SHAKE-256(tr || M', 64) 【参数】 - public_key_spki_in_hex:公钥 hex(SPKI DER 或裸公钥均可),并校验 OID/长度与 algorithm 一致 - message_in_hex:原始消息 hex(最大 2048 字节,空字符串表示空消息) - context_in_hex:可选上下文 hex(最大 255 字节) - algorithm:ML-DSA-44 / ML-DSA-65(默认)/ ML-DSA-87 【输出】tr_in_hex、mu_in_hex、raw_pk_in_hex、algorithm、message_bytes。ConnectorNo auth
- Store (create or overwrite) the authenticated customer's AWS CloudWatch monitoring credentials. ADMIN only. accessKeyId, secretAccessKey, and region are required — use a permanent IAM user's access key and secret, not temporary STS credentials (those expire and are not supported). This tool never returns the stored value back — only a confirmation message.ConnectorAPI key
- Search Costory product docs (Mintlify) and knowledge base in parallel. Synthesize both: Mintlify is the product source of truth, the KB complements with org-specific or internal detail; if they conflict, trust Mintlify. Returns Mintlify matches (titles, snippets, and full docs URLs (`Url: https://docs.costory.io/...`)) and KB articles (title, summary, full markdown). Optional limit (1–10, default 5) applies to KB. For a full Mintlify page, use get_documentation_page. When citing a page in chat, use the full `Url:` value verbatim as the markdown href — do not convert to a relative app path. EXAMPLES: • "How do I create a budget alert?" → { query: "budget alert" } • "Why do costs differ from AWS Cost Explorer?" → { query: "AWS Cost Explorer discrepancy", limit: 3 }ConnectorOAuth
- List the cost-source providers (AWS, GCP, Anthropic, etc.) enabled for this account. Each row's cost_basis says where that provider's money figures come from: "invoiced" = amounts the provider actually charged; "estimated_from_provider_rates" = an estimate built from the provider's own published rates, because it exposes no historical billing API; "estimated_from_static_rates" = an estimate built from a list-rate card Plutus maintains, which will not reflect rates the customer negotiated. Qualify any total that includes an estimated source rather than reporting it as billed spend.ConnectorNo auth
- Attest the connected DropTrack MCP stage, base URL, non-secret database fingerprint, configured database-target match, Lambda identity, region, and authorization role. Call this before any write. Require databaseTargetMatchesExpected=true, compare stage, base URL, and fingerprint to the canonical environment table, then pass the exact stage and database fingerprint to guarded write tools. Never infer environment from company data alone.ConnectorOAuth