AWS MCP Servers: Which to Use and How to Connect

AWS has more than one MCP offering, and they overlap. The one AWS tells you to start with is the AWS MCP Server (in preview): a remote, managed server at an aws-mcp.<region>.api.aws/mcp endpoint that combines AWS API access with current documentation, using IAM permissions and CloudTrail logging. The older open source suite lives in awslabs/mcp. We checked AWS's docs and repos on 31 October 2026.

Quick facts

The map: four things called "AWS MCP"

People mix these up, so here is the lay of the land from AWS's own docs.

AWS's own docs add one more nudge. If you already use the AWS API MCP Server or the Knowledge server, they recommend switching to the AWS MCP Server and removing the older entries from your config first, because duplicate tools can confuse the agent and reduce performance.

What the AWS MCP Server does

From the awslabs README and the AWS user guide:

• Access to AWS services for managing infrastructure, exploring resources and running operations.
• Current AWS documentation, API references, What's New posts and Getting Started content.
• Pre-built Agent SOPs, standard operating procedures that follow AWS best practices so agents complete multi-step tasks more reliably.
• Syntactically validated API calls.
• IAM-based permissions with no credential exposure to the agent.
• CloudTrail logging of what the agent did.

The pitch is control and traceability: the agent acts through your IAM role, and every call can be audited.

Connect it

AWS gives two authentication options and a decision guide.

AWS describes OAuth as the simple option for people new to AWS with one account, or using web clients, and SigV4 as the advanced option for terminal and IDE-based coding agents such as Claude Code, Kiro and Codex.

OAuth route

Add the regional URL as a remote MCP server in a client that supports OAuth. For Claude Code that is the HTTP form:

claude mcp add --transport http aws https://aws-mcp.us-east-1.api.aws/mcp

Then sign in through /mcp. AWS's setup guide lists Claude Code CLI among the clients that fully support OAuth with the default endpoint, and says access tokens last 1 hour and refresh for up to 12 hours.

SigV4 route with the MCP Proxy for AWS

Authenticate with the AWS CLI first, then use the proxy, which signs requests with your credentials. The proxy's README gives this command and a config example:

uvx mcp-proxy-for-aws-cli@latest https://aws-mcp.us-east-1.api.aws/mcp

{
  "mcpServers": {
    "aws": {
      "command": "uvx",
      "args": ["mcp-proxy-for-aws-cli@latest", "https://aws-mcp.us-east-1.api.aws/mcp"],
      "env": {
        "AWS_MCP_PROXY_PROFILES": "prod-readonly dev staging"
      }
    }
  }
}

The AWS_MCP_PROXY_PROFILES variable lets one proxy route calls through several AWS CLI profiles. The proxy adds an aws_profile parameter to tools that need auth, uses the first profile as default, and rejects an unknown profile with an error that lists the allowed ones.

The same config in each agent:

The first run can take tens of seconds while uvx downloads and caches dependencies. The proxy README notes that the CLI package, mcp-proxy-for-aws-cli, pins its whole dependency tree to tested versions, while mcp-proxy-for-aws is for library use.

The awslabs open source servers

The awslabs/mcp repo is a suite of focused servers. It is Apache-2.0, and at the time we checked it had about 9,800 stars and was updated on 30 October 2026.

Its README groups servers by what you are building. Examples of the categories it lists: real-time access to AWS documentation; infrastructure and deployment (containers, serverless, migration, support); AI and machine learning; data and analytics (SQL and NoSQL databases, search, caching, open data); developer tools; integration and messaging; cost and operations; and healthcare and life sciences. It also groups them by how you work: development, conversational assistants and autonomous background agents.

Facts that matter before you run any of them:

• Stdio only. The README says these servers are designed to support stdio only.
• No SSE. SSE support was removed from the latest major versions of all of them on 26 May 2025. If you need SSE, use the previous major version of that server.
• Install buttons. The README has one-click installs for Cursor, VS Code and Kiro. Most servers start with uvx awslabs.<name>@latest.
• Local vs remote. The README's own advice: local for development, offline work and keeping credentials on your machine; remote for teams, heavy tasks, IAM-based controls and audit logging.

Agent Toolkit for AWS

At the top of the README, AWS says the Agent Toolkit for AWS is live and is the successor to the MCP servers, plugins and skills on AWS Labs. It recommends the toolkit if you are building production software with coding agents or building agents for your own customers, and lists IAM condition keys that tell agent actions from human ones, CloudWatch and CloudTrail visibility, and skills evaluated for accuracy and effectiveness. The Labs repo "continues to work and accept contributions", and AWS says the most useful projects will move into the toolkit over time. Treat the Labs suite as maintained but transitional.

Real tasks with copy-ready prompts

Ask before you act

Using the AWS Knowledge server, explain the difference between an
ALB and an NLB for a gRPC service, and cite the AWS docs you used.
Do not call any account APIs.

Read-only inventory

List the EC2 instances and RDS databases in us-east-1 for this
profile. Show name, type and state in a table. Make no changes.

Explain a bill

Which three services cost the most last month in this account? Show
the numbers and one suggestion for each. Read-only.

Debug a failing deploy

Our CloudFormation stack "api-prod" is in ROLLBACK_COMPLETE. Read the
stack events, find the first failed resource and explain why.

Plan, then stop

Draft the CDK changes to add a dead-letter queue to the "orders"
SQS queue. Print the diff. Do not deploy.

Security: the bit that matters most on AWS

AWS gives an agent real power, so give it little.

1. Use a dedicated IAM role. Give it read-only permissions to start. IAM is the real control; a tool list is not.
2. Use a named profile (prod-readonly, dev) rather than your admin one. With the proxy you can list several and let the agent choose, so make sure the default is the safe one.
3. Keep production out of the first session. Test in a sandbox account.
4. Turn on CloudTrail and read what the agent actually called. AWS's managed server logs to CloudTrail; use it.
5. Use IAM condition keys where the Agent Toolkit or managed server supports them, to tell agent actions from human ones.
6. Hide write tools with the read-only mode that the SigV4 route offers.
7. Approve each write. Do not run an agent that can change infrastructure in an auto-approve mode.
8. Mind prompt injection. Tag values, log lines and resource descriptions are text that anyone with write access can set, and the agent reads them.
9. Check the AWS terms. The README reminds you that you are responsible for how you use these servers under the terms that govern them.

A narrow IAM policy to start from

The security list says IAM is the real control, so it helps to see one. This policy is an example for a role that an agent assumes. It allows a small set of read-only calls and denies anything that changes cost or access. It is our sketch, not AWS's recommendation, so adapt the actions to the services you want the agent to inspect.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadSomeServices",
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*",
        "s3:ListAllMyBuckets",
        "s3:GetBucketLocation",
        "cloudwatch:GetMetricData",
        "cloudwatch:ListMetrics",
        "logs:DescribeLogGroups",
        "logs:FilterLogEvents"
      ],
      "Resource": "*"
    },
    {
      "Sid": "NeverChangeAccess",
      "Effect": "Deny",
      "Action": ["iam:*", "organizations:*", "kms:Decrypt"],
      "Resource": "*"
    }
  ]
}

Three points follow from it. Read access still exposes data: logs:FilterLogEvents can return log lines with personal data or secrets, so scope the resource to named log groups before you use it for real. A deny statement beats any allow, which is why the second block is a useful backstop if someone attaches a broader policy later. And start from this and add, instead of starting from a managed read-only policy and removing, because the managed ones cover many services you did not mean to share. Test the role by asking the agent to do something the policy forbids, and confirm it fails with an access error.

Which account for which job

The pattern is that the agent proposes and a pipeline applies. An agent with write access to production in an interactive session is one mistyped approval away from an outage, and the approval prompt is the only brake. Use a short-lived role for incident work and let it expire, so access does not linger after the incident.

Checking what the agent did

AWS says the managed server logs to CloudTrail, so use it as the record. After a session, look at what the role called. If the role uses a recognizable session name, you can search by it with the CLI:

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=agent-readonly-session \
  --max-results 50

The session name above is a placeholder for whatever name your role session uses. Read the event names for anything unexpected, such as a write or an access denial. Denials are useful signals: a model that keeps trying a forbidden action is telling you its prompt or its plan is wrong. Keep a short note of each review with the date, and turn the notes into a checklist if the same surprise happens twice. CloudTrail records are also what you hand to a security team when they ask what the agent was allowed to do.

What it costs

We could not read a pricing statement for the AWS MCP Server, so check AWS's pricing and documentation pages for any charge of its own. The work the agent triggers is billed as normal AWS usage. The practical risk is cost by accident: an agent asked to "clean up" can create resources as easily as it lists them. A read-only role removes that risk, and a budget alarm on the account catches the rest. Set a monthly budget with an alert at a low percentage, because an agent can act faster than a person notices. Model usage in your client is a separate bill.

Limits and known issues

• Preview status. The flagship server is labelled "in preview". Features and regions can change.
• Overlap. Four offerings, partly overlapping. AWS tells you to remove older servers to avoid tool conflicts.
• Stdio-only Labs servers do not fit clients that only speak remote HTTP.
• Proxy start-up time. The first uvx run is slow.
• Region choice. The endpoint is regional; pick one close to your work and set a default Region if you use SigV4.
• Transitional repo. Expect projects to move from awslabs/mcp into the Agent Toolkit.
• Not every AWS feature is wrapped. Check the tool list before assuming a service is covered.

Alternatives

See the MCP servers hub for more.

Which agents it works best with

AWS's own guidance puts terminal and IDE coding agents, naming Claude Code, Kiro and Codex, on the SigV4 route, and web clients such as Claude.ai and ChatGPT.com on OAuth. The Labs servers have one-click installs for Cursor, VS Code and Kiro. For Gemini CLI and Codex, use the command form.

Our take

We read AWS's documentation and READMEs; we did not connect an account.

If you are on AWS and want an agent to help, start with the Knowledge server because it touches nothing. Then move to the managed AWS MCP Server with a read-only IAM role and the SigV4 route, since that is what AWS points coding agents to and it gives you read-only mode and multi-profile control.

The messy part is the naming. Four offerings, one successor announced, a Labs repo that still works. We would not build a team standard on the Labs suite without checking whether the server you want has moved into the Agent Toolkit. Check the README banner and the toolkit announcement first.

The simple rule for any cloud MCP server: the role decides what can go wrong, not the server. Spend your time on the IAM policy.

Frequently asked questions

Which AWS MCP server should I start with? The AWS MCP Server (in preview), per AWS.

How does it authenticate? OAuth, or SigV4 through the MCP Proxy for AWS.

What happened to the awslabs servers? They still work; AWS names the Agent Toolkit for AWS as the successor.

Do the awslabs servers support HTTP? No, stdio only.

Can I make the agent read-only? Use the SigV4 route's read-only mode and a read-only IAM role.

*Product names are used descriptively. We are not affiliated with Amazon Web Services.*