AWS MCP Server MCP server

Endpoint: https://aws-mcp.us-east-1.api.aws/mcp · Authentication: Sign in with OAuth

Searches AWS documentation and runs AWS API calls and sandboxed scripts under the caller's IAM permissions. Uses OAuth through AWS Sign-in, or SigV4 through the AWS-published proxy.

How do I authenticate?

Add the endpoint in your client, start Connect or Sign in, approve the requested scopes, and return to the client. OAuth discovery finds the authorization server; client registration requirements vary by provider. Follow the provider guidance and client setup below.

Authentication and connection guide

Connection specification

Remote endpoint
https://aws-mcp.us-east-1.api.aws/mcp
Browser access
Not yet measured
Declared MCP transport
Streamable HTTP
Live-validated MCP transport
Streamable HTTP — Observed by the latest catalog validation
Declared authentication
OAuth 2.1
Detected authentication
OAuth 2.1 detected or retained from publisher evidence
Alternative endpoint
https://aws-mcp.us-west-2.api.aws/mcp — Use for the US West (Oregon) Region (OAuth 2.1)
Alternative endpoint
https://aws-mcp.eu-central-1.api.aws/mcp — Use for the Europe (Frankfurt) Region (OAuth 2.1)
Protocol lifecycle
Stateful MCP · 2025-06-18
Authorization server
https://us-east-1.oauth.signin.aws/
Category
Cloud

Product documentation · Source repository · Official listing documentation

Provider guidance

  • Initialization and documentation tools work without credentials in the 2026-10-20 audit; AWS API tools require AWS Sign-in OAuth (the IAM principal needs the AWSMCPSignInOAuthAccessPolicy policy) or SigV4. AWS documents eight Regional endpoints of the form https://aws-mcp.<region>.api.aws/mcp.

More Cloud MCP servers · Browse all MCP servers · Test this endpoint in the MCP Playground

Authorization setup

Registration requirements not verified

The OAuth authorization and app-registration requirements for this exact endpoint have not been verified. A compatible client will request authorization, but follow the publisher documentation and do not guess client credentials or callbacks.

Publisher evidence reviewed .

Publisher documentation

Connect it

Live-validated endpoint: https://aws-mcp.us-east-1.api.aws/mcp · Streamable HTTP. Registration requirements not verified: The OAuth authorization and app-registration requirements for this exact endpoint have not been verified. A compatible client will request authorization, but follow the publisher documentation and do not guess client credentials or callbacks.

Agent prompt for Claude Code or Codex
Add the AWS MCP Server MCP server to my MCP client configuration and verify that it works.

What it is: Searches AWS documentation and runs AWS API calls and sandboxed scripts under the caller's IAM permissions. Uses OAuth through AWS Sign-in, or SigV4 through the AWS-published proxy.
Server URL: https://aws-mcp.us-east-1.api.aws/mcp
Transport: Streamable HTTP (remote MCP server, no local install).
Authentication: OAuth 2.1. Registration requirements not verified: The OAuth authorization and app-registration requirements for this exact endpoint have not been verified. A compatible client will request authorization, but follow the publisher documentation and do not guess client credentials or callbacks.
Tools (8, as last observed by mcptest): aws___get_presigned_url, aws___get_regional_availability, aws___get_tasks, aws___list_regions, aws___read_documentation, aws___retrieve_skill, aws___run_script, aws___search_documentation.
Reference: https://mcptest.io/servers/aws/

Steps:
1. Work out which MCP client I use (Claude Code, Codex, Cursor, VS Code or another) and add the server under the name "aws" in that client's MCP configuration, user scope unless I ask otherwise.
   Claude Code: claude mcp add --transport http --scope user 'aws' 'https://aws-mcp.us-east-1.api.aws/mcp'
   Other clients: use the setup for that client on the reference page.
2. Never write a credential value into a file that could be committed; reference an environment variable or the client's secret store, and ask me for any value you need.
3. Verify: connect to the server and call tools/list. Confirm the tools above are listed, and report any sign-in step I still have to complete.
MCP client

Claude Code setup

Run in a terminal. This user-scoped entry is available across projects.

claude mcp add --transport http --scope user 'aws' 'https://aws-mcp.us-east-1.api.aws/mcp'
  • After adding the server, open Claude Code, run /mcp, select the server, and follow the browser flow to authenticate.

Codex CLI setup

Run in a terminal; Codex stores the entry in ~/.codex/config.toml.

codex mcp add 'aws' --url 'https://aws-mcp.us-east-1.api.aws/mcp'
codex mcp login 'aws'

Cursor setup

Add to .cursor/mcp.json for this project, or ~/.cursor/mcp.json for all projects.

{
  "mcpServers": {
    "aws": {
      "url": "https://aws-mcp.us-east-1.api.aws/mcp"
    }
  }
}

VS Code setup

Add to .vscode/mcp.json, or run “MCP: Open User Configuration” for a private user-level entry.

{
  "servers": {
    "aws": {
      "type": "http",
      "url": "https://aws-mcp.us-east-1.api.aws/mcp"
    }
  }
}

Claude setup

Add the endpoint above in Claude:

  • Customize > Connectors > Add custom connector
  • Team/Enterprise: Organization settings > Connectors > Add > Custom > Web

Claude Desktop setup

Add the endpoint above in Claude Desktop:

  • Remote: Customize > Connectors (same as claude.ai)
  • Local: Settings > Developer > Edit Config, or Settings > Extensions for .mcpb files
  • ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), local servers only

ChatGPT setup

Add the endpoint above in ChatGPT:

  • ChatGPT web: Plugins > Add custom MCP server, then configure authentication and accept the risk warning

Windsurf setup

Add the endpoint above in Windsurf:

  • ~/.config/devin/mcp_config.json (%APPDATA%\devin\mcp_config.json on Windows), serverUrl or url
  • Cascade panel > ... > MCPs > Open MCP config file

Gemini CLI setup

Add the endpoint above in Gemini CLI:

  • gemini mcp add --transport http <name> <url>
  • ~/.gemini/settings.json (user) or .gemini/settings.json (project), mcpServers

MCP SDK setup

Add the endpoint above in MCP SDK:

  • Programmatic: new Client(...).connect(new StreamableHTTPClientTransport(url))

Notes for every client

  • Publisher evidence (reviewed 2026-10-20): https://docs.aws.amazon.com/agent-toolkit/latest/userguide/getting-started-aws-mcp-server.html
  • Alternative endpoint: https://aws-mcp.us-west-2.api.aws/mcp — Use for the US West (Oregon) Region.
  • Alternative endpoint: https://aws-mcp.eu-central-1.api.aws/mcp — Use for the Europe (Frankfurt) Region.
  • Provider guidance: Initialization and documentation tools work without credentials in the 2026-10-20 audit; AWS API tools require AWS Sign-in OAuth (the IAM principal needs the AWSMCPSignInOAuthAccessPolicy policy) or SigV4. AWS documents eight Regional endpoints of the form https://aws-mcp.<region>.api.aws/mcp.

Client compatibility

ClientStatusWhy
Claude CodeSupportedClaude Code supports Streamable HTTP servers and OAuth sign-in.
CodexSupportedCodex supports Streamable HTTP servers and OAuth sign-in.
CursorSupportedCursor supports Streamable HTTP servers and OAuth sign-in.
VS CodeSupportedVS Code supports Streamable HTTP servers and OAuth sign-in.
ClaudeSupportedClaude supports Streamable HTTP servers and OAuth sign-in.
Claude DesktopSupportedClaude Desktop supports Streamable HTTP servers and OAuth sign-in.
ChatGPTPartialStateful routing needs operational care: ChatGPT can preserve MCP sessions, but the deployment must route a session consistently and retain its state.
WindsurfPartialWindsurf's documentation does not state support for OAuth sign-in.
Gemini CLISupportedGemini CLI supports Streamable HTTP servers and OAuth sign-in.
MCP SDKSupportedMCP SDK supports Streamable HTTP servers and OAuth sign-in.

Computed from this server's validated transport, protocol and authentication against documented client support. Checks the catalog has not observed are not counted.

Similar servers

  • Cloudflare — Remote MCP server for Cloudflare Workers, D1, R2, DNS, and account APIs. OAuth 2.1
  • Vercel — Vercel's remote MCP server for inspecting and managing projects, deployments, logs, and platform resources. OAuth 2.1
  • Cloudflare Workers Bindings — Manages the storage, AI, and compute primitives that Workers bind to, such as KV, R2, and D1, in a Cloudflare account. Requires Cloudflare OAuth. OAuth 2.1
  • Cloudflare Workers Builds — Lists Workers Builds and reads their status and logs for Workers connected to Git. Requires Cloudflare OAuth. OAuth 2.1
  • Cloudflare Browser Run — Fetches web pages through Cloudflare Browser Rendering and returns HTML, Markdown, or screenshots. Requires Cloudflare OAuth. OAuth 2.1
  • Cloudflare Containers — Spins up a sandboxed container development environment for running code. Requires Cloudflare OAuth. OAuth 2.1

Guides for this server

Watch this server for breaking changes

Share and embed

Maintain AWS MCP Server? Embed this badge in your README. It follows the latest catalog validation result and links to this server profile.

mcptest.io: ready

Latest validation evidence

Validation status
Online when last tested
Validation checked at
Oct 26, 2026 at 11:06 AM
Validation detail
Negotiated stateful MCP 2025-06-18 at https://aws-mcp.us-east-1.api.aws/mcp; detected transport streamable-http; authentication oauth

Tool inventory

What the catalog validator observed on at https://aws-mcp.us-east-1.api.aws/mcp without credentials. The live server may have changed since; connect in the Playground for the current list.

Tools provided by AWS MCP Server 8

Some details were sanitized for public display.

  • aws___get_presigned_urloutputSchema declared

    Generate pre-signed S3 URLs for uploading or downloading files. Use BEFORE run_script when an operation requires a local file. Use for direct S3 uploads/downloads. Max upload 5 GB; larger files use multipart. For uploads: generates PUT URL. For downloads: generates GET URL. No special headers needed unless s3_params provided—then corresponding HTTP headers MUST be included or request fails with SignatureDoesNotMatch.

    Input requests: array
    • requests: arrayrequired

      Array of 1-25 presigned URL requests.

  • aws___get_regional_availabilityNo outputSchema

    AWS resource availability per region. - Max 10 regions; multi-region needs `filters`; single-region supports `next_token`. - Status: isAvailableIn | isNotAvailableIn | isPlannedIn | Not Found. - Response key: products | service_apis | cfn_resources. Not for region counts/docs/vague queries -- use `search_documentation` / `list_regions`. Filter values must EXACTLY match AWS's catalog names; guessed, partial, or pluralized names are rejected ("values in filter parameter do not exist"). If unsure of the exact name, first call once for a single region with resource_type set and NO filters to list

    Input filters?: array, next_token?: string, region?: string, regions?: array, resource_type: string
    • filters?: arrayoptional

      Use exact AWS product or sub-feature name. - product: 'Amazon Bedrock' (service), or sub-features like 'Comprehend Auto Scaling', 'Latency-Based Routing', 'PrivateLink Support'. When the user names a specific sub-feature, filter on the sub-feature -- do NOT generalize to the parent service ('Amazon Comprehend'); that returns availability for the wrong scope. - api: 'SdkServiceId+Operation' (e.g. 'CloudFormation+CreateStack', 'IAM+GetSSHPublicKey') or 'SdkServiceId' (e.g. 'EC2'). Use a literal '+' between service and operation -- not space, colon, or hyphen. - cfn: 'AWS::EC2::Instance', 'AWS::L

    • next_token?: stringoptional

      Pagination token. Single-region, no filters only.

    • region?: stringoptional

      Unused; use `regions`.

    • regions?: arrayoptional

      AWS region codes (max 10). Multi-region requires `filters`; single-region supports `next_token`.

    • resource_type: stringrequired

      Required: 'product' | 'api' | 'cfn'.

  • aws___get_tasksoutputSchema declared

    Poll status of long-running tasks. Use after a tool call returns task_id with status "working". Up to 3 IDs per call. Tasks expire after 5 min. Pass poll_iteration (start at 1, increment each call) and follow the recommended_wait_seconds in the response before polling again.

    Input poll_iteration?: any, task_ids: array
    • poll_iteration?: anyoptional
    • task_ids: arrayrequired

      One or more task IDs (up to 3) from previous tool invocations.

  • aws___list_regionsNo outputSchema

    Retrieve a list of all AWS regions.

    Input No parameters

  • aws___read_documentationNo outputSchema

    Fetch full AWS doc pages as markdown. `search_documentation` already returns verbatim page chunks, so don't re-read a URL whose chunk you already have to "confirm" or "round out" an answer -- the chunk is the real page text; treat it as authoritative. Reading the full page is justified ONLY when the chunks genuinely lack the content: - an enumeration or aggregation ("list all X", "how many X") needs the complete set and the chunks show only part of it; - no search result is on-topic after refining the query, and a known doc URL would have the answer. Otherwise, answer from the chunks. Use exac

    Input requests?: array
    • requests?: arrayoptional

      List of `{url, max_length?, start_index?}`. Batch 2-5.

  • aws___retrieve_skillNo outputSchema

    Retrieve an AWS skill (workflows, references). Returns SKILL.md, or `file` if given. Call `search_documentation` FIRST and copy `skill_name` verbatim -- it is an opaque registry ID. Never guess or fabricate `skill_name` or `file`.

    Input file?: string, skill_name: string
    • file?: stringoptional

      Optional file path within the skill, copied as cited (e.g. `references/architecture.md`). Don't add or strip a `references/` prefix. Omit for SKILL.md.

    • skill_name: stringrequired

      Required. Exact `skill_name` from a search_documentation result, copied verbatim. Do not invent or modify.

  • aws___run_scriptNo outputSchema

    Execute Python code in sandboxed environment with AWS API access via `call_boto3`. No network except `call_boto3`. ```python async def call_boto3( *, service_name: str, operation_name: str, region_name: str | None = None, params: dict | None = None, ) -> dict: ... ``` ``operation_name`` MUST be the PascalCase AWS API operation name (e.g. ``ListBuckets``, ``GetTable``, ``StartQueryExecution``). Do not use the snake_case boto3 method name (``list_buckets``, ``get_table``); exact matches are corrected only as a runtime fallback. Response includes `api_calls` list—verify APIs ran before trusting `

    Input code: string
    • code: stringrequired

      Python code to execute

  • aws___search_documentationNo outputSchema

    AWS docs search. Each result's `context` is verbatim page text -- a real chunk of the actual page, not a short snippet -- and usually already contains the answer, so answer directly from it. Use `read_documentation` only when the chunks genuinely lack the needed detail. Pick ONE topic. Add a 2nd ONLY if query genuinely spans domains. Extra topics dilute ranking. - reference_documentation -- API/SDK/CLI specs, config params - current_awareness -- new/released/announced - troubleshooting -- errors, "how to fix" (NOT for conceptual/feature questions) - amplify_docs -- Amplify (+ language) - cdk_d

    Input limit?: integer, search_phrase: string, topics?: array
    • limit?: integeroptional

      Maximum number of results to return (default 4).

    • search_phrase: stringrequired

      Keywords; preserve exact error strings and all task terms verbatim.

    • topics?: arrayoptional

      Up to 3 from: reference_documentation, current_awareness, troubleshooting, amplify_docs, cdk_docs, cdk_constructs, cloudformation, agent_skills, strands_docs, general. Default ["general"].