What it is
The AWS MCP Server is a managed remote server, part of the Agent Toolkit for AWS, which went generally available in May 2026. It exposes eight tools: five read-only knowledge tools for documentation search, curated AWS skills and regional availability, and three API tools, chief among them aws___run_script, which runs Python with AWS API access in a sandbox. Every authenticated call is authorised by your existing IAM policies and logged in CloudTrail.
It now runs in eight regions (N. Virginia, Oregon, Frankfurt, Ireland, London, Singapore, Sydney and Tokyo), up from the two named at launch. You can connect directly over OAuth 2.1 through AWS Sign-in, or run the local MCP Proxy for AWS (uvx mcp-proxy-for-aws-cli@latest) to sign requests with SigV4, which is required for read-only mode and multi-account profiles.
The older awslabs/mcp repository of single-service stdio servers still exists and takes contributions, but AWS calls the Agent Toolkit its successor and asks users to remove the AWS API and AWS Knowledge servers to avoid tool conflicts.
Install
https://aws-mcp.us-east-1.api.aws/mcpOur review
This is now the server to start with on AWS, and the case rests on IAM rather than tool count. The server defines no IAM actions of its own. It authenticates the request, stamps it with the condition keys aws:ViaAWSMCPService and aws:CalledViaAWSMCP, and lets the downstream service authorise it against your existing policies. A security team can therefore write an SCP that denies writes made through MCP while leaving the same engineer’s console access alone, something no third-party AWS server can offer.
The design choice that matters most is aws___run_script. Instead of hundreds of per-service tools, the agent writes Python that calls AWS APIs and the server runs it in a sandbox. That keeps the list to eight tools and suits multi-step jobs, but a person approving a tool call is now reading code rather than a named action such as "delete bucket". Read-only mode, which hides the write-capable tools, works only through the SigV4 proxy, not over OAuth.
Quotas are generous for one developer and tight for a fleet. Authenticated traffic is capped at 10 requests per second per account per region, a limit AWS will not raise, with 100 concurrent connections per account. Files the server handles sit on ephemeral storage for up to 8 hours under AWS-managed keys only, and FIPS endpoints are not supported, which rules it out for some regulated workloads.
The surrounding estate is the weak point. The awslabs/mcp repository has published 13 security advisories, including a critical read-only bypass in its Postgres server in September 2026, and a medium-severity S3 bucket-ownership flaw (CVE-2026-87912) hit a DevSecOps plugin in the toolkit itself. The managed server has no published advisory, but a team that mixes it with older Labs servers inherits their record as well.
Where it earns its place
A platform engineer at a 30-person SaaS company on AWS
Find out why a Lambda function started failing after last night’s deploy
The agent calls the serverless capability’s diagnose, get_recent_changes and search_logs helpers, which compare metrics against a 7-day baseline and list who changed what from CloudTrail and CloudFormation. It is read-only and free beyond normal CloudWatch and X-Ray charges, and saves stitching logs, traces and change history together by hand.
A cloud security lead at a regulated fintech
Let developers use coding agents in shared accounts without giving the agents write access
An SCP denies mutating actions when aws:ViaAWSMCPService is true, so an engineer keeps console write access while their agent stays read-only, and CloudTrail records every MCP-originated call for audit. The gap is FIPS, which the server does not support.
A startup CTO with one developer and AWS Activate credits
Stand up a first serverless API without learning CloudFormation first
Attach the AWSMCPSignInOAuthAccessPolicy managed policy, connect Claude Code over OAuth and let the agent follow the aws-core skills for CDK and serverless. The server costs nothing; the risk is the bill, because an agent on an admin role can start anything, so scope the role before the first prompt.
Before you commit
- Setup
- Over OAuth, add https://aws-mcp.us-east-1.api.aws/mcp in Claude Code, Kiro CLI or Devin (Cursor, VS Code, Codex and Claude Desktop append ?oauth=initialize) after attaching the AWSMCPSignInOAuthAccessPolicy policy. SigV4 needs AWS CLI 2.32.0 or later plus uv, and AWS warns the first connection can take a few minutes.
- Integrations
- Eight tools: five read-only knowledge tools (search_documentation, read_documentation, retrieve_skill, list_regions, get_regional_availability) and three API tools (run_script, get_presigned_url, get_tasks) that can read or write across 300+ services, plus a read-only serverless troubleshooting capability for Lambda.
- Data and privacy
- A stateless proxy acting with your credentials; files live on encrypted ephemeral storage for at most 8 hours and are not used by any persistent store. run_script can read anything your role can, including logs and S3 objects that may carry injected instructions, so the IAM role is the real boundary.
- Cost at scale
- No fee for the server or toolkit; you pay standard prices for what the agent creates or reads. Throughput binds first: 10 authenticated requests per second per account per region, 180 concurrent sessions per account and 90 per IAM principal, with only the session quotas adjustable.
- Limits
- Unauthenticated callers get the docs tools only, at 5 requests per second per IP. OAuth tokens last 1 hour and refresh for up to 12, and OAuth cannot switch profiles across accounts. The May 2026 launch post lists two regions; the setup guide’s list of eight is current.
What's good
- IAM condition keys let policies target agent calls only
- CloudTrail logs every request; CloudWatch usage metrics
- OAuth in eight regions, so no local proxy is required
- No charge beyond the AWS resources used
What's not
- Read-only mode and multi-account need the SigV4 proxy
- 10 requests/second per account cap is not adjustable
- No FIPS endpoints or customer-managed KMS keys
- Older Labs servers overlap and carry their own advisories
Best for
Teams on AWS who want agents to explore, build and operate resources under the IAM policies and audit trail they already have.
Alternatives
AWS MCP Server: common questions
- Is AWS MCP Server worth it?
- IAM condition keys that tell agent calls from human ones make this the AWS server to standardise on; the older Labs servers around it are the risk. We rate it 4.4 out of 5.
- How much does AWS MCP Server cost?
- No charge for the server or toolkit; you pay standard prices for the AWS resources your agents create or use.
- What are the downsides of AWS MCP Server?
- Read-only mode and multi-account need the SigV4 proxy; 10 requests/second per account cap is not adjustable; no FIPS endpoints or customer-managed KMS keys; older Labs servers overlap and carry their own advisories.
- Who is AWS MCP Server best for?
- Teams on AWS who want agents to explore, build and operate resources under the IAM policies and audit trail they already have.
- How much does AWS MCP Server cost for a team or in production?
- No fee for the server or toolkit; you pay standard prices for what the agent creates or reads. Throughput binds first: 10 authenticated requests per second per account per region, 180 concurrent sessions per account and 90 per IAM principal, with only the session quotas adjustable.
- Is AWS MCP Server safe for company data?
- A stateless proxy acting with your credentials; files live on encrypted ephemeral storage for at most 8 hours and are not used by any persistent store. run_script can read anything your role can, including logs and S3 objects that may carry injected instructions, so the IAM role is the real boundary.
- What are the best AWS MCP Server alternatives?
- The closest alternatives we have reviewed are Azure MCP Server, Cloudflare MCP Server and Terraform MCP Server.
Answers checked Oct 22, 2026.
Make AWS MCP Server? Show this rating on your site
