AWS MCP Server: Tools, Setup and Security

The AWS MCP Server lets an AI agent search AWS documentation, check Region availability and run AWS API calls in your account under your own IAM credentials. Amazon Web Services publishes and hosts it as part of the Agent Toolkit for AWS.

Checked against: Agent Toolkit for AWS User Guide on 28 October 2026. eSEOspace did not install or test this server.

At a glance

One caution on status. The awslabs/mcp README still labels the AWS MCP Server "in preview," while the user guide's history records general availability. Check the user guide before you rely on either label.

What it can do

AWS's tools reference lists two groups of tools.

AWS Knowledge Tools (no credentials needed for documentation search):

• aws___retrieve_skill: returns a full AWS skill, meaning a step-by-step procedure with reference material.
• aws___search_documentation: searches AWS docs, API references, best practices and skills.
• aws___read_documentation: converts an AWS docs page to markdown.
• aws___list_regions: lists all AWS Regions.
• aws___get_regional_availability: checks whether a service, feature, SDK API or CloudFormation resource is available in a Region.

AWS API Tools (use your IAM credentials):

• aws___run_script: runs Python with AWS API access in a sandboxed environment.
• aws___get_presigned_url: creates pre-signed Amazon S3 upload or download links.
• aws___get_tasks: checks on long-running tasks started by aws___run_script.

The guide also describes "capabilities," which are task-specific toolsets. The first is a serverless capability that inspects a Lambda function read-only, with helper functions such as diagnose and search_logs.

AWS also maintains many older single-purpose servers in awslabs/mcp. That README now calls the Agent Toolkit for AWS "the successor" to those servers. The setup guide recommends removing the older aws-api-mcp-server and aws-knowledge-mcp-server entries to avoid tool conflicts.

How to connect it

The setup guide lists eight Regional endpoints, including US East (N. Virginia), US West (Oregon), Europe (Ireland) and Asia Pacific (Tokyo).

Option A: OAuth. First attach the managed policy that allows OAuth sign-in to your IAM role:

aws iam attach-role-policy \
 --role-name MyRole \
 --policy-arn arn:aws:iam::aws:policy/AWSMCPSignInOAuthAccessPolicy

Then add the server. For Claude Code, AWS documents:

claude mcp add aws-mcp https://aws-mcp.us-east-1.api.aws/mcp --transport http

AWS says Claude Desktop, Cursor, Kiro IDE and VS Code need ?oauth=initialize appended to the endpoint URL.

Option B: SigV4. Install AWS CLI 2.32.0 or later, run aws login, install uv, then run the MCP Proxy for AWS locally. AWS recommends this route for terminal coding agents and for switching between accounts. AWS also offers plugins that bundle the server for Claude Code, Codex and Devin.

Security notes

• IAM is the ceiling. AWS says the toolkit "does not add permissions." An agent can do only what the IAM identity behind your credentials allows. AWS recommends scoping roles to the minimum the agent needs.
• Agent-only policies. Every request carries the aws:ViaAWSMCPService and aws:CalledViaAWSMCP condition keys. You can allow or deny actions only when an agent makes them.
• Read-only mode needs SigV4. The setup guide's decision table says to choose SigV4 if you want to hide write-capable tools from the agent entirely.
• Audit trail. CloudTrail records the API calls the server makes, and CloudWatch publishes tool-invocation metrics.
• Data. AWS says the server does not use persistent storage for customer content.

A broad admin role turns any prompt injection into a real incident. Read excessive permissions in MCP servers and the MCP security hub before you connect a production account.

Alternatives

• Microsoft Azure MCP Server for Azure subscriptions.
• Google Cloud MCP servers for Google Cloud projects.
• Terraform MCP Server if you manage AWS through Terraform rather than direct API calls.

Next step

Before you give an agent access to a cloud account, decide which roles, accounts and Regions it may touch. Our MCP readiness audit maps that out with you, and the server directory profiles more options.

Frequently asked questions