Skip to content

Summary

AWS's managed MCP server: call any AWS API, run sandboxed Python against your account, and load AWS agent skills on demand — under IAM, CloudWatch and CloudTrail.

Features

  • Call any AWS API through a single tool, including uploads and long-running operations
  • Sandboxed Python execution against AWS services, with no local filesystem or shell access
  • On-demand agent skills replace static SOP documents
  • Documentation search and skill discovery work without AWS credentials
  • IAM-based guardrails with CloudWatch metrics and CloudTrail logging
  • One-command setup via `aws configure agent-toolkit` (AWS CLI 2.35.0+)
  • No additional charge — you pay only for the AWS resources agents use

Installation

Set up this MCP server in your favorite AI agent — copy a ready-made configuration below.

Any MCP-compatible agent

Most agents (Claude, Cursor, Windsurf, VS Code, and more) read a standard mcpServers configuration.

  1. Open your agent's MCP configuration file.
  2. Merge the snippet below into it.
  3. Restart the agent — the "AWS MCP Server" tools will be available.
{
  "mcpServers": {
    "aws-mcp-server": {
      "command": "uvx",
      "args": [
        "mcp-proxy-for-aws==1.6.3",
        "https://aws-mcp.us-east-1.api.aws/mcp",
        "--metadata",
        "AWS_REGION=us-west-2"
      ]
    }
  }
}

Description

The AWS MCP Server is Amazon's own managed endpoint for coding agents, generally available since 6 May 2026. It is the core component of the Agent Toolkit for AWS, and it is a different proposition from the open-source awslabs/mcp collection: rather than running a fleet of per-service servers locally, agents connect to a hosted endpoint that AWS operates.

The headline capability is breadth. A single tool calls any AWS API — including operations that need file uploads or long-running execution — so the server does not go stale as services ship new features. Alongside it, sandboxed script execution lets an agent run Python against your AWS account for genuine multi-step work (enumerate, filter, then act) without any access to your local filesystem or shell.

The third piece is agent skills, which AWS uses to replace the rigid SOP documents that agents were previously fed. Skills are discovered and loaded on demand, so guidance for CloudFormation troubleshooting or S3 lifecycle policies arrives only when the task calls for it. Usefully, documentation search and skill discovery need no AWS credentials at all — only the tools that actually touch your account do.

Governance is the reason to prefer it over a hand-rolled wrapper: every call runs under IAM-based guardrails, emits Amazon CloudWatch metrics and is recorded in AWS CloudTrail, so an agent's activity in your account is auditable by the same machinery as everything else.

Connection is via the mcp-proxy-for-aws stdio proxy (installed with uv) pointing at https://aws-mcp.us-east-1.api.aws/mcp. Claude Code and Codex have one-line plugin installs, and AWS CLI 2.35.0 or later ships an aws configure agent-toolkit wizard that detects installed agents, configures the connection and adds default skills in one command. Additional plugins cover agent-building on AgentCore, data analytics and DevSecOps.

The server itself is available at no additional charge — you pay only for the AWS resources your agents consume. Endpoints are currently in US East (N. Virginia) and Europe (Frankfurt).

Related MCP Servers

MCP: Vanta

by Vanta

New

Vanta's official remote MCP server — query controls, tests, vendors, vulnerabilities and policies across SOC 2 and ISO 27001, and remediate failing tests from your agent.

Browse all MCP servers →