Aws MCP
未认领AWS MCP server, streamlines AWS SSO login from inside AI assistants
01 / 选择客户端
03 / 添加配置
claude mcp add --transport stdio 'yawlabs-aws-mcp' -- 'npx' '-y' '@yawlabs/aws-mcp@latest'04 / 在客户端中确认
打开客户端的 MCP 设置，确认服务器已连接并列出工具。复制配置不代表连接成功。
更多AI & ML服务器
浏览完整目录安全概况
已认领和已认证的服务器每周接受一次静态扫描，显示代码能触及的范围（外部服务、环境变量、shell 命令、代理配置目录）以及带有已知公告的依赖。认领此列表即可获得。 安全概况的工作原理
25 个工具中显示 25 个
文档中列出的工具 (25)
内容来自项目文档。服务器握手不会验证每个工具的说明或行为。
aws_assume_role
Call STS AssumeRole with your current identity and stash the temp creds as a new profile (mcp-<sessionName>) in ~/.aws/credentials. Use for cross-account access. The secret/session token stay on disk -- not returned to the model. Optional timeoutMs (default 120s) for slow SAML / credentialprocess co
aws_call
Run any AWS API operation. service: 's3api', operation: 'list-buckets', optional params (PascalCase JSON), optional query (JMESPath). Returns parsed JSON.
aws_docs_read
Fetch an https://docs.aws.amazon.com/...html page and return it as markdown. Strips nav/cookie-banner/feedback chrome. Long pages paginate via startIndex + maxLength; the response carries hasMore and nextStartIndex. Usually fed a url from awsdocssearch.
aws_docs_search
Search live AWS documentation (the backend behind the docs.aws.amazon.com search box). Returns ranked {title, url, summary, excerpt}. Use to discover the right doc page for a service/API/concept the model may not know -- new services, recently changed APIs, exact parameter names.
aws_iam_simulate
Simulate IAM permissions for a principal: can principal X do actions Y on resources Z? Wraps iam simulate-principal-policy. Returns one entry per (action, resource) pair with decision (allowed / explicitDeny / implicitDeny), matchedStatementIds (which IAM statements decided), and missingContextValue
aws_list_profiles
List profiles configured in ~/.aws/config -- names, regions, and SSO metadata. Use before switching profiles or when an SSO error names one you haven't seen.
aws_login_complete
Block until the SSO subprocess finishes (you auth in your browser), returns the new identity.
aws_login_start
Start aws sso login --no-browser --use-device-code, returns a verification URL + short code and a sessionId. (--use-device-code is omitted on AWS CLI older than 2.22.0, where the device grant is already the default.)
aws_logs_tail
Fetch recent CloudWatch Logs events for a log group. Wraps aws logs tail --format json with since, filterPattern, and stream-name filters; returns events as a parsed array.
aws_metrics_query
Query CloudWatch metrics via GetMetricData (the modern multi-metric / expression-capable API). Pass queries: [{id, namespace, metricName, dimensions?, statistic?, period?}] or expression-based queries; startTime/endTime accept ISO 8601 or relative shorthand ('15m', '1h', '1d'). Period auto-picks fro
aws_multi_region
Run the same AWS operation across N regions in parallel. Same shape as awscall but takes regions: string[]. Returns {region, ok, data?, error?}[] with okCount/errorCount. Partial failure is expected (services aren't everywhere, perms may be region-scoped).
aws_paginate
Fetch one page of a paginated list/describe operation. Supports query too. Returns nextToken/hasMore; call again with the token to continue.
aws_refresh_if_expiring_soon
Check the cached SSO token and auto-start a refresh when < thresholdMinutes remain (default 10). One round-trip for "am I about to expire? if so, re-login."
aws_resource_create
Create an AWS resource via CCAPI. Async — returns top-level requestToken + operationStatus. Pass awaitCompletion: true to have the server poll to terminal state in one call.
aws_resource_delete
Delete an AWS resource via CCAPI. Same async + awaitCompletion shape as create. Destructive — verify identifier first.
aws_resource_diff
Dry-run a CCAPI update: fetches current state, simulates the JSON Patch in memory, returns {before, after, changes[]}. No mutation sent to AWS. Supports the add/remove/replace subset of RFC 6902; add auto-creates missing object parents to match CCAPI's actual update semantics (so patches like /Envir
aws_resource_get
Read an AWS resource via Cloud Control API by typeName + identifier (e.g. AWS::Lambda::Function + function name). Returns parsed Properties.
aws_resource_list
List resources of a type via CCAPI, paginated. Returns {identifier, properties} per entry plus a nextToken/hasMore.
aws_resource_status
Poll an async CCAPI request by requestToken. Returns the current state with operationStatus, identifier, errorCode, statusMessage flat-promoted (PENDING / INPROGRESS / SUCCESS / FAILED / CANCEL).
aws_resource_update
Update an AWS resource via CCAPI using RFC 6902 JSON Patch. Same async + awaitCompletion shape as create.
aws_script
Run a short JS snippet that orchestrates the other tools and returns a combined result. Sandbox exposes aws.call, aws.paginate, aws.paginateAll, aws.resource.{get,list,create,update,delete,status}, aws.logsTail, aws.metricsQuery, aws.iamSimulate, aws.multiRegion, aws.assumeRole, aws.docs.{search,rea
aws_session_clear
Remove session profile/region overrides so env vars / defaults take over again. No args clears both.
aws_session_get
Show the current session defaults and where each value came from (session/env/default).
aws_session_set
Set the default profile and/or region for the rest of this MCP session. "Switch to prod," "use us-west-2."
aws_whoami
Current identity (account, ARN) + SSO token expiry countdown. Call this first.