aws_list_profiles
List profiles configured in ~/.aws/config -- names, regions, and SSO metadata. Use before switching profiles or when an SSO error names one you haven't seen.
How to use it
aws_list_profiles is exposed by the Aws MCP MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the aws_list_profiles tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.
Install Aws MCP
npx -y @yawlabs/aws-mcp@latestOther tools in Aws MCP (24)
Call STS AssumeRole with your current identity and stash the temp creds as a new profile (mcp-<sessionName>) in ~/.aws/credentials. Use for cross-account access. The secret/session token stay on disk -- not returned to the model. Optional timeoutMs (default 120s) for slow SAML / credentialprocess co
Run any AWS API operation. service: 's3api', operation: 'list-buckets', optional params (PascalCase JSON), optional query (JMESPath). Returns parsed JSON.
Fetch an https://docs.aws.amazon.com/...html page and return it as markdown. Strips nav/cookie-banner/feedback chrome. Long pages paginate via startIndex + maxLength; the response carries hasMore and nextStartIndex. Usually fed a url from awsdocssearch.
Search live AWS documentation (the backend behind the docs.aws.amazon.com search box). Returns ranked {title, url, summary, excerpt}. Use to discover the right doc page for a service/API/concept the model may not know -- new services, recently changed APIs, exact parameter names.
Simulate IAM permissions for a principal: can principal X do actions Y on resources Z? Wraps iam simulate-principal-policy. Returns one entry per (action, resource) pair with decision (allowed / explicitDeny / implicitDeny), matchedStatementIds (which IAM statements decided), and missingContextValue
Block until the SSO subprocess finishes (you auth in your browser), returns the new identity.
Start aws sso login --no-browser --use-device-code, returns a verification URL + short code and a sessionId. (--use-device-code is omitted on AWS CLI older than 2.22.0, where the device grant is already the default.)
Fetch recent CloudWatch Logs events for a log group. Wraps aws logs tail --format json with since, filterPattern, and stream-name filters; returns events as a parsed array.
Query CloudWatch metrics via GetMetricData (the modern multi-metric / expression-capable API). Pass queries: [{id, namespace, metricName, dimensions?, statistic?, period?}] or expression-based queries; startTime/endTime accept ISO 8601 or relative shorthand ('15m', '1h', '1d'). Period auto-picks fro
Run the same AWS operation across N regions in parallel. Same shape as awscall but takes regions: string[]. Returns {region, ok, data?, error?}[] with okCount/errorCount. Partial failure is expected (services aren't everywhere, perms may be region-scoped).
Fetch one page of a paginated list/describe operation. Supports query too. Returns nextToken/hasMore; call again with the token to continue.
Check the cached SSO token and auto-start a refresh when < thresholdMinutes remain (default 10). One round-trip for "am I about to expire? if so, re-login."
Create an AWS resource via CCAPI. Async — returns top-level requestToken + operationStatus. Pass awaitCompletion: true to have the server poll to terminal state in one call.
Delete an AWS resource via CCAPI. Same async + awaitCompletion shape as create. Destructive — verify identifier first.
Dry-run a CCAPI update: fetches current state, simulates the JSON Patch in memory, returns {before, after, changes[]}. No mutation sent to AWS. Supports the add/remove/replace subset of RFC 6902; add auto-creates missing object parents to match CCAPI's actual update semantics (so patches like /Envir
Read an AWS resource via Cloud Control API by typeName + identifier (e.g. AWS::Lambda::Function + function name). Returns parsed Properties.
List resources of a type via CCAPI, paginated. Returns {identifier, properties} per entry plus a nextToken/hasMore.
Poll an async CCAPI request by requestToken. Returns the current state with operationStatus, identifier, errorCode, statusMessage flat-promoted (PENDING / INPROGRESS / SUCCESS / FAILED / CANCEL).
Update an AWS resource via CCAPI using RFC 6902 JSON Patch. Same async + awaitCompletion shape as create.
Run a short JS snippet that orchestrates the other tools and returns a combined result. Sandbox exposes aws.call, aws.paginate, aws.paginateAll, aws.resource.{get,list,create,update,delete,status}, aws.logsTail, aws.metricsQuery, aws.iamSimulate, aws.multiRegion, aws.assumeRole, aws.docs.{search,rea
Remove session profile/region overrides so env vars / defaults take over again. No args clears both.
Show the current session defaults and where each value came from (session/env/default).
Set the default profile and/or region for the rest of this MCP session. "Switch to prod," "use us-west-2."
Current identity (account, ARN) + SSO token expiry countdown. Call this first.