AWS MCP Server MCP server
Endpoint: https://aws-mcp.us-east-1.api.aws/mcp · Authentication: Sign in with OAuth
Searches AWS documentation and runs AWS API calls and sandboxed scripts under the caller's IAM permissions. Uses OAuth through AWS Sign-in, or SigV4 through the AWS-published proxy.
How do I authenticate?
Add the endpoint in your client, start Connect or Sign in, approve the requested scopes, and return to the client. OAuth discovery finds the authorization server; client registration requirements vary by provider. Follow the provider guidance and client setup below.
Authentication and connection guideConnection specification
- Remote endpoint
https://aws-mcp.us-east-1.api.aws/mcp- Browser access
- Not yet measured
- Declared MCP transport
- Streamable HTTP
- Live-validated MCP transport
- Streamable HTTP — Observed by the latest catalog validation
- Declared authentication
- OAuth 2.1
- Detected authentication
- OAuth 2.1 detected or retained from publisher evidence
- Alternative endpoint
https://aws-mcp.us-west-2.api.aws/mcp— Use for the US West (Oregon) Region (OAuth 2.1)- Alternative endpoint
https://aws-mcp.eu-central-1.api.aws/mcp— Use for the Europe (Frankfurt) Region (OAuth 2.1)- Protocol lifecycle
- Stateful MCP · 2025-06-18
- Authorization server
https://us-east-1.oauth.signin.aws/- Category
- Cloud
Product documentation · Source repository · Official listing documentation
Provider guidance
- Initialization and documentation tools work without credentials in the 2026-10-20 audit; AWS API tools require AWS Sign-in OAuth (the IAM principal needs the AWSMCPSignInOAuthAccessPolicy policy) or SigV4. AWS documents eight Regional endpoints of the form https://aws-mcp.<region>.api.aws/mcp.
More Cloud MCP servers · Browse all MCP servers · Test this endpoint in the MCP Playground
Connect it
Live-validated endpoint: https://aws-mcp.us-east-1.api.aws/mcp · Streamable HTTP. Registration requirements not verified: The OAuth authorization and app-registration requirements for this exact endpoint have not been verified. A compatible client will request authorization, but follow the publisher documentation and do not guess client credentials or callbacks.
Agent prompt for Claude Code or Codex
Add the AWS MCP Server MCP server to my MCP client configuration and verify that it works. What it is: Searches AWS documentation and runs AWS API calls and sandboxed scripts under the caller's IAM permissions. Uses OAuth through AWS Sign-in, or SigV4 through the AWS-published proxy. Server URL: https://aws-mcp.us-east-1.api.aws/mcp Transport: Streamable HTTP (remote MCP server, no local install). Authentication: OAuth 2.1. Registration requirements not verified: The OAuth authorization and app-registration requirements for this exact endpoint have not been verified. A compatible client will request authorization, but follow the publisher documentation and do not guess client credentials or callbacks. Tools (8, as last observed by mcptest): aws___get_presigned_url, aws___get_regional_availability, aws___get_tasks, aws___list_regions, aws___read_documentation, aws___retrieve_skill, aws___run_script, aws___search_documentation. Reference: https://mcptest.io/servers/aws/ Steps: 1. Work out which MCP client I use (Claude Code, Codex, Cursor, VS Code or another) and add the server under the name "aws" in that client's MCP configuration, user scope unless I ask otherwise. Claude Code: claude mcp add --transport http --scope user 'aws' 'https://aws-mcp.us-east-1.api.aws/mcp' Other clients: use the setup for that client on the reference page. 2. Never write a credential value into a file that could be committed; reference an environment variable or the client's secret store, and ask me for any value you need. 3. Verify: connect to the server and call tools/list. Confirm the tools above are listed, and report any sign-in step I still have to complete.
Claude Code setup
Run in a terminal. This user-scoped entry is available across projects.
claude mcp add --transport http --scope user 'aws' 'https://aws-mcp.us-east-1.api.aws/mcp'- After adding the server, open Claude Code, run /mcp, select the server, and follow the browser flow to authenticate.
Codex CLI setup
Run in a terminal; Codex stores the entry in ~/.codex/config.toml.
codex mcp add 'aws' --url 'https://aws-mcp.us-east-1.api.aws/mcp'
codex mcp login 'aws'Cursor setup
Add to .cursor/mcp.json for this project, or ~/.cursor/mcp.json for all projects.
{
"mcpServers": {
"aws": {
"url": "https://aws-mcp.us-east-1.api.aws/mcp"
}
}
}VS Code setup
Add to .vscode/mcp.json, or run “MCP: Open User Configuration” for a private user-level entry.
{
"servers": {
"aws": {
"type": "http",
"url": "https://aws-mcp.us-east-1.api.aws/mcp"
}
}
}Claude setup
Add the endpoint above in Claude:
- Customize > Connectors > Add custom connector
- Team/Enterprise: Organization settings > Connectors > Add > Custom > Web
Claude Desktop setup
Add the endpoint above in Claude Desktop:
- Remote: Customize > Connectors (same as claude.ai)
- Local: Settings > Developer > Edit Config, or Settings > Extensions for .mcpb files
~/Library/Application Support/Claude/claude_desktop_config.json(macOS) or%APPDATA%\Claude\claude_desktop_config.json(Windows), local servers only
ChatGPT setup
Add the endpoint above in ChatGPT:
- ChatGPT web: Plugins > Add custom MCP server, then configure authentication and accept the risk warning
Windsurf setup
Add the endpoint above in Windsurf:
~/.config/devin/mcp_config.json(%APPDATA%\devin\mcp_config.jsonon Windows),serverUrlorurl- Cascade panel > ... > MCPs > Open MCP config file
Gemini CLI setup
Add the endpoint above in Gemini CLI:
gemini mcp add --transport http <name> <url>~/.gemini/settings.json(user) or.gemini/settings.json(project),mcpServers
MCP SDK setup
Add the endpoint above in MCP SDK:
- Programmatic:
new Client(...).connect(new StreamableHTTPClientTransport(url))
Notes for every client
- Publisher evidence (reviewed 2026-10-20): https://docs.aws.amazon.com/agent-toolkit/latest/userguide/getting-started-aws-mcp-server.html
- Alternative endpoint: https://aws-mcp.us-west-2.api.aws/mcp — Use for the US West (Oregon) Region.
- Alternative endpoint: https://aws-mcp.eu-central-1.api.aws/mcp — Use for the Europe (Frankfurt) Region.
- Provider guidance: Initialization and documentation tools work without credentials in the 2026-10-20 audit; AWS API tools require AWS Sign-in OAuth (the IAM principal needs the AWSMCPSignInOAuthAccessPolicy policy) or SigV4. AWS documents eight Regional endpoints of the form https://aws-mcp.<region>.api.aws/mcp.
Client compatibility
| Client | Status | Why |
|---|---|---|
| Claude Code | Supported | Claude Code supports Streamable HTTP servers and OAuth sign-in. |
| Codex | Supported | Codex supports Streamable HTTP servers and OAuth sign-in. |
| Cursor | Supported | Cursor supports Streamable HTTP servers and OAuth sign-in. |
| VS Code | Supported | VS Code supports Streamable HTTP servers and OAuth sign-in. |
| Claude | Supported | Claude supports Streamable HTTP servers and OAuth sign-in. |
| Claude Desktop | Supported | Claude Desktop supports Streamable HTTP servers and OAuth sign-in. |
| ChatGPT | Partial | Stateful routing needs operational care: ChatGPT can preserve MCP sessions, but the deployment must route a session consistently and retain its state. |
| Windsurf | Partial | Windsurf's documentation does not state support for OAuth sign-in. |
| Gemini CLI | Supported | Gemini CLI supports Streamable HTTP servers and OAuth sign-in. |
| MCP SDK | Supported | MCP SDK supports Streamable HTTP servers and OAuth sign-in. |
Computed from this server's validated transport, protocol and authentication against documented client support. Checks the catalog has not observed are not counted.
Latest validation evidence
- Validation status
- Online when last tested
- Validation checked at
- Oct 26, 2026 at 11:06 AM
- Validation detail
- Negotiated stateful MCP 2025-06-18 at https://aws-mcp.us-east-1.api.aws/mcp; detected transport streamable-http; authentication oauth
Tool inventory
What the catalog validator observed on at https://aws-mcp.us-east-1.api.aws/mcp without credentials. The live server may have changed since; connect in the Playground for the current list.
Tools provided by AWS MCP Server 8
Some details were sanitized for public display.
aws___get_presigned_urloutputSchema declaredGenerate pre-signed S3 URLs for uploading or downloading files. Use BEFORE run_script when an operation requires a local file. Use for direct S3 uploads/downloads. Max upload 5 GB; larger files use multipart. For uploads: generates PUT URL. For downloads: generates GET URL. No special headers needed unless s3_params provided—then corresponding HTTP headers MUST be included or request fails with SignatureDoesNotMatch.
Input
requests: arrayrequests: arrayrequiredArray of 1-25 presigned URL requests.
aws___get_regional_availabilityNo outputSchemaAWS resource availability per region. - Max 10 regions; multi-region needs `filters`; single-region supports `next_token`. - Status: isAvailableIn | isNotAvailableIn | isPlannedIn | Not Found. - Response key: products | service_apis | cfn_resources. Not for region counts/docs/vague queries -- use `search_documentation` / `list_regions`. Filter values must EXACTLY match AWS's catalog names; guessed, partial, or pluralized names are rejected ("values in filter parameter do not exist"). If unsure of the exact name, first call once for a single region with resource_type set and NO filters to list
Input
filters?: array, next_token?: string, region?: string, regions?: array, resource_type: stringfilters?: arrayoptionalUse exact AWS product or sub-feature name. - product: 'Amazon Bedrock' (service), or sub-features like 'Comprehend Auto Scaling', 'Latency-Based Routing', 'PrivateLink Support'. When the user names a specific sub-feature, filter on the sub-feature -- do NOT generalize to the parent service ('Amazon Comprehend'); that returns availability for the wrong scope. - api: 'SdkServiceId+Operation' (e.g. 'CloudFormation+CreateStack', 'IAM+GetSSHPublicKey') or 'SdkServiceId' (e.g. 'EC2'). Use a literal '+' between service and operation -- not space, colon, or hyphen. - cfn: 'AWS::EC2::Instance', 'AWS::L
next_token?: stringoptionalPagination token. Single-region, no filters only.
region?: stringoptionalUnused; use `regions`.
regions?: arrayoptionalAWS region codes (max 10). Multi-region requires `filters`; single-region supports `next_token`.
resource_type: stringrequiredRequired: 'product' | 'api' | 'cfn'.
aws___get_tasksoutputSchema declaredPoll status of long-running tasks. Use after a tool call returns task_id with status "working". Up to 3 IDs per call. Tasks expire after 5 min. Pass poll_iteration (start at 1, increment each call) and follow the recommended_wait_seconds in the response before polling again.
Input
poll_iteration?: any, task_ids: arraypoll_iteration?: anyoptionaltask_ids: arrayrequiredOne or more task IDs (up to 3) from previous tool invocations.
aws___list_regionsNo outputSchemaRetrieve a list of all AWS regions.
Input No parameters
aws___read_documentationNo outputSchemaFetch full AWS doc pages as markdown. `search_documentation` already returns verbatim page chunks, so don't re-read a URL whose chunk you already have to "confirm" or "round out" an answer -- the chunk is the real page text; treat it as authoritative. Reading the full page is justified ONLY when the chunks genuinely lack the content: - an enumeration or aggregation ("list all X", "how many X") needs the complete set and the chunks show only part of it; - no search result is on-topic after refining the query, and a known doc URL would have the answer. Otherwise, answer from the chunks. Use exac
Input
requests?: arrayrequests?: arrayoptionalList of `{url, max_length?, start_index?}`. Batch 2-5.
aws___retrieve_skillNo outputSchemaRetrieve an AWS skill (workflows, references). Returns SKILL.md, or `file` if given. Call `search_documentation` FIRST and copy `skill_name` verbatim -- it is an opaque registry ID. Never guess or fabricate `skill_name` or `file`.
Input
file?: string, skill_name: stringfile?: stringoptionalOptional file path within the skill, copied as cited (e.g. `references/architecture.md`). Don't add or strip a `references/` prefix. Omit for SKILL.md.
skill_name: stringrequiredRequired. Exact `skill_name` from a search_documentation result, copied verbatim. Do not invent or modify.
aws___run_scriptNo outputSchemaExecute Python code in sandboxed environment with AWS API access via `call_boto3`. No network except `call_boto3`. ```python async def call_boto3( *, service_name: str, operation_name: str, region_name: str | None = None, params: dict | None = None, ) -> dict: ... ``` ``operation_name`` MUST be the PascalCase AWS API operation name (e.g. ``ListBuckets``, ``GetTable``, ``StartQueryExecution``). Do not use the snake_case boto3 method name (``list_buckets``, ``get_table``); exact matches are corrected only as a runtime fallback. Response includes `api_calls` list—verify APIs ran before trusting `
Input
code: stringcode: stringrequiredPython code to execute
aws___search_documentationNo outputSchemaAWS docs search. Each result's `context` is verbatim page text -- a real chunk of the actual page, not a short snippet -- and usually already contains the answer, so answer directly from it. Use `read_documentation` only when the chunks genuinely lack the needed detail. Pick ONE topic. Add a 2nd ONLY if query genuinely spans domains. Extra topics dilute ranking. - reference_documentation -- API/SDK/CLI specs, config params - current_awareness -- new/released/announced - troubleshooting -- errors, "how to fix" (NOT for conceptual/feature questions) - amplify_docs -- Amplify (+ language) - cdk_d
Input
limit?: integer, search_phrase: string, topics?: arraylimit?: integeroptionalMaximum number of results to return (default 4).
search_phrase: stringrequiredKeywords; preserve exact error strings and all task terms verbatim.
topics?: arrayoptionalUp to 3 from: reference_documentation, current_awareness, troubleshooting, amplify_docs, cdk_docs, cdk_constructs, cloudformation, agent_skills, strands_docs, general. Default ["general"].