AWS API MCP Server
The official AWS Labs catch-all server. Bridges any AWS CLI command to MCP, giving agents universal access to the AWS API surface. Helps the agent select the right CLI command for a task; respects the local AWS credential chain.
“The AWS API MCP server is the broadest of the AWS Labs servers and the one most teams will reach for first. It exposes the AWS CLI itself as the agent's interface: any command the local CLI can run, the agent can call. This makes it the universal AWS surface area. The trade-off is that the surface area is gigantic and the safety boundary lives in IAM; tool whitelisting effectively sits at the credential layer. With admin-level credentials, this server lets the agent do anything those credentials permit. The fix is the same as for any cloud-shell-with-an-AI: scope the IAM role narrowly, set AWS_API_MCP_PROFILE_NAME to a profile that uses that role, and route destructive operations through a separate confirmation flow. With that discipline in place, this is the server that pays for itself in week one.”
INSTALL THIS SERVER
{
"mcpServers": {
"awslabs.aws-api-mcp-server": {
"command": "uvx",
"args": [
"awslabs.aws-api-mcp-server@latest"
],
"env": {
"AWS_PROFILE": "your-aws-profile",
"AWS_REGION": "us-east-1",
"FASTMCP_LOG_LEVEL": "ERROR"
}
}
}
}
{
"mcpServers": {
"awslabs.aws-api-mcp-server": {
"command": "uvx",
"args": [
"awslabs.aws-api-mcp-server@latest"
],
"env": {
"AWS_PROFILE": "your-aws-profile",
"AWS_REGION": "us-east-1",
"FASTMCP_LOG_LEVEL": "ERROR"
}
}
}
}
{
"mcpServers": {
"awslabs.aws-api-mcp-server": {
"command": "uvx",
"args": [
"awslabs.aws-api-mcp-server@latest"
],
"env": {
"AWS_PROFILE": "your-aws-profile",
"AWS_REGION": "us-east-1",
"FASTMCP_LOG_LEVEL": "ERROR"
}
}
}
}
{
"mcpServers": {
"awslabs.aws-api-mcp-server": {
"command": "uvx",
"args": [
"awslabs.aws-api-mcp-server@latest"
],
"env": {
"AWS_PROFILE": "your-aws-profile",
"AWS_REGION": "us-east-1",
"FASTMCP_LOG_LEVEL": "ERROR"
}
}
}
}
{
"mcpServers": {
"awslabs.aws-api-mcp-server": {
"command": "uvx",
"args": [
"awslabs.aws-api-mcp-server@latest"
],
"env": {
"AWS_PROFILE": "your-aws-profile",
"AWS_REGION": "us-east-1",
"FASTMCP_LOG_LEVEL": "ERROR"
}
}
}
}
2 TOOLS AVAILABLE
OUR ASSESSMENT
- Exposes the entire AWS CLI surface; coverage tracks whatever AWS supports, including services released after the LLM's training cutoff.
- Helps the agent choose the right CLI command for the task; reduces hallucinated commands compared to giving an agent raw aws shell access.
- Profile-based credential management via AWS_API_MCP_PROFILE_NAME keeps secrets out of the MCP config and respects the local credential chain.
- Active maintenance from the same team that ships the rest of the awslabs/mcp monorepo.
- The breadth is also the risk: with admin credentials, the agent can do anything those credentials permit. Scoped IAM is mandatory.
- AWS CLI version drift between the MCP server's bundled CLI and the locally installed CLI can cause command behaviour mismatches; the README recommends a virtual environment.
- Less guided than a service-specific server like the ECS or EKS MCP; the agent has more freedom and more places to go wrong.
Credentials are sourced via boto3's standard credential chain, controlled by AWS_API_MCP_PROFILE_NAME (recommended) or AWS_PROFILE. The server inherits whatever permissions the configured IAM principal holds, so the boundary lives in IAM; the MCP layer hands credentials through to AWS directly. AWS recommends a dedicated IAM role with least-privilege policies; pair with CloudTrail to audit what the agent runs.
Teams who want a single AWS server covering every service from one install. Pair with tightly scoped IAM roles.
TECHNICAL DETAILS
ADOPTION METRICS
// Reading thisShares the awslabs/mcp 8.9k star base. The AWS API server is the universal-surface flagship and drives a meaningful share of monorepo install traffic.
// Reading thisTop-tier vendor cloud MCP for breadth. The catch-all design makes it the default starting point for AWS-on-MCP work, which earns it a top-10 ranking.
SOURCES & VERIFICATION
We don't take any single directory's word for it. Before scoring, we cross-reference 5 public MCP sources, install the server ourselves against the clients we cover, and record when we last re-verified.
The same server, 5 different lenses. We reconcile these signals into our editorial score, which is why our number sometimes diverges from a directory-aggregate star count.
| Source | Their rating | Their star count | Their downloads | Last synced |
|---|---|---|---|---|
| AutomationSwitch This page | 4.5editorial | 8,894 | — | APR 28, 2026 |
| PulseMCP | — unrated | unavailable | unavailable | APR 28, 2026 |
| Official MCP Registry | — unrated | unavailable | unavailable | APR 28, 2026 |
| Awesome MCP Servers | — unrated | unavailable | unavailable | APR 28, 2026 |
| Smithery | — unrated | unavailable | unavailable | APR 28, 2026 |
| Glama | — unrated | unavailable | unavailable | APR 28, 2026 |
// Counts are directory-reported; we don't adjust them. Discrepancies usually come from different snapshot times or star-caching.
OTHER CLOUD MCP SERVERS
Cloudflare MCP
Cloudflare's MCP offering: 14 hosted remote MCP servers segmented by product surface (Workers Bindings, Observability, Radar, Browser Rendering, Logpush, AI Gateway, Audit Logs, DNS Analytics, DEX, CASB, GraphQL, Docs, Container, Builds) plus a Code Mode server for broader API access. All authenticate via OAuth.
Amazon ECS MCP Server
Vendor-built ECS MCP server covering the full container deployment lifecycle: containerize, push to ECR, deploy via ECS Express Mode with ALB, troubleshoot. Notable for ALLOW_WRITE and ALLOW_SENSITIVE_DATA environment flags that make read-only mode a configuration default.
Amazon EKS MCP Server
AWS Labs server for Amazon EKS covering cluster creation via CloudFormation, full Kubernetes resource lifecycle, log retrieval, event fetching, and troubleshooting. Read-only and write IAM policies documented separately for scoped credential setup.
Vercel
Deployment layer for managing Vercel projects, deployments, environment variables, and domains. Deploy, promote, rollback, and inspect from your agent context.
DISCUSS YOUR
MCP REQUIREMENTS.
Evaluating a server, scoping an internal deployment, or working out whether MCP is the right fit at all. Start the conversation and we will point you at the right piece of the ecosystem.