MCP server · Infrastructure

OfficialSource Validated (historical)Read-writeProprietaryUpdated September 2026

AWS MCP Server

Search AWS knowledge and run IAM-authorized AWS API workflows through AWS's managed MCP server.

InstallOfficial documentation

Review overdue. This profile was due for re-review on 2026-09-15. Its facts were true at the last review; treat the install details as historical until it is re-checked.

Quick verdict

A major, well-documented managed-cloud connector whose value is proportional to its risk; ship only with IAM scope, remote Python execution, destructive-action and billing warnings all visible together.

  • MaintainerAmazon Web Services (AWS) (official)
  • Security scopeRead-write
  • Transportsstreamable-http
  • Install channelremote · https://aws-mcp.us-east-1.api.aws/mcp
  • EvidenceSource Validated (historical)
  • LicenseProprietary · Proprietary managed service

AWS MCP Server combines documentation and regional-availability lookup with authenticated AWS operations, curated skills and sandboxed Python workflows. It uses the caller's existing IAM authority, adds MCP-specific global condition context keys, and records downstream API calls in CloudTrail. Direct OAuth is the proposed connection path; an optional local proxy (mcp-proxy-for-aws) supports SigV4 signing, multi-profile switching and read-only tool filtering for clients that cannot sign MCP HTTP requests directly — it is a separate client-side bridge, not the managed server implementation. AWS announced general availability on 2026-05-06.

MCP security best practices

Install AWS MCP Server

http https://aws-mcp.us-east-1.api.aws/mcp

Config entry (mcpServers)
{
  "mcpServers": {
    "aws-mcp": {
      "url": "https://aws-mcp.us-east-1.api.aws/mcp"
    }
  }
}

AWS-managed US East (N. Virginia) regional endpoint; AWS also documents a Europe (Frankfurt) endpoint at https://aws-mcp.eu-central-1.api.aws/mcp. Knowledge-search tools work unauthenticated; authenticated API tools, the sandboxed Python tool and presigned-URL tools require OAuth sign-in with an IAM principal holding the AWSMCPSignInOAuthAccessPolicy managed policy, and downstream permissions still come from that principal’s own IAM policies. Some MCP clients require appending ?oauth=initialize to this URL to trigger the flow.

Credentials

No static secret goes in this config, but this server still requires account authorization. Connecting it starts an interactive sign-in and consent flow against the account it reaches, and whatever that account is allowed to do becomes what the agent can do through this server. Authorize it from an account scoped to the work at hand, and keep your client’s approval prompts on.

Verified configurations

Not run by us yet. This profile is Source Validated (historical): the install channel, config entry, credentials and license were checked against the source and upstream metadata, but no configuration has been installed, discovered and executed in a recorded environment. When one is, it appears here with the eight scope dimensions below.

Best for

AWS teams that want first-party account operations in an assistant and can provide a dedicated least-privilege IAM principal, SCP or permission-boundary guardrails, CloudTrail review and disposable test resources.

Why use it

It unifies current AWS knowledge, curated skills and broad API execution behind one vendor-managed endpoint while preserving normal IAM authorization and audit controls.

Tradeoffs

The service has one of the broadest possible cloud authority surfaces: authenticated tools can reach more than 15,000 AWS APIs under whatever the connected IAM principal permits, including destructive and billable actions. The run-script tool executes model-authored Python remotely with AWS API access. The older call-aws tool was deprecated 2026-07-15, with removal announced for 2026-08-31. As of 2026-09-01, the unauthenticated managed endpoint still advertised call-aws in its tool inventory, and AWS's documentation still listed it as deprecated rather than removed; authenticated invocability was not tested. Treat its remaining lifetime as unknown; run-script is the documented replacement and must be the profile's test path. The SigV4 local proxy's read-only mode is safer for discovery but is not this proposed zero-install path.

Upstream state

in the official MCP Registry (active). Lifecycle is derived from a committed upstream snapshot at build time, never authored by hand.

Official MCP Registry name: io.github.aws/aws-mcp

Editorial review

Reviewed byCJ ZwartLast updatedSeptember 2026SourcesAWS MCP Server overview; Setting up AWS MCP Server; Understanding AWS MCP Server tools; AWS MCP Server IAM authorization; Agent Toolkit for AWS and pricing; MCP Proxy for AWS (separate client-side SigV4 bridge, Apache-2.0); Official MCP Registry — AWS MCP; AWS MCP Server general availability announcement; AWS News Blog: AWS MCP Server is now generally available

Grade B — Source Validated (historical). Re-review is due by 2026-09-15. Config entries, credential names and package status can change upstream; verify against the official documentation before granting an agent access.

Sources

  • Basic Memory MCPGive agents durable local memory in plain Markdown, with search, graph traversal and explicit note creation, editing and deletion.
  • Cloudflare API MCPSearch and operate the Cloudflare API through a compact Code Mode MCP server with OAuth-scoped account access.
  • Netlify MCPBuild, deploy and manage Netlify sites and account resources through Netlify's official hosted MCP server.

Related guides

All MCP servers →