AWS Infrastructure as Code MCP Server
AWS Labs server for Infrastructure as Code lifecycle. Validates CloudFormation templates with cfn-lint, checks compliance via cfn-guard against AWS Guard Rules and Control Tower controls, troubleshoots failed deployments with pattern-matched analysis, searches CloudFormation and CDK documentation.
“This server is the safety net for agent-generated infrastructure code. It runs cfn-lint against CloudFormation templates, cfn-guard against AWS Guard Rules and Control Tower proactive controls, and pattern matches deployment failures against 30+ known cases with CloudTrail deep links for the postmortem. The CDK side searches AWS-approved code samples and the official CDK best practices; this is the difference between an agent that drafts CDK that compiles and one that drafts CDK that compiles and is also correct. The honest weakness is that pure validation pairs with the deployment, with runtime verification staying mandatory: cfn-lint catches schema errors, cfn-guard catches policy violations, and a logic error in a custom resource still surfaces at deploy time. Use this server before deployment, then use CloudFormation deploy events and CloudTrail to verify the actual outcome.”
INSTALL THIS SERVER
{
"mcpServers": {
"awslabs.aws-iac-mcp-server": {
"command": "uvx",
"args": [
"awslabs.aws-iac-mcp-server@latest"
],
"env": {
"AWS_PROFILE": "your-aws-profile",
"AWS_REGION": "us-east-1",
"FASTMCP_LOG_LEVEL": "ERROR"
}
}
}
}
{
"mcpServers": {
"awslabs.aws-iac-mcp-server": {
"command": "uvx",
"args": [
"awslabs.aws-iac-mcp-server@latest"
],
"env": {
"AWS_PROFILE": "your-aws-profile",
"AWS_REGION": "us-east-1",
"FASTMCP_LOG_LEVEL": "ERROR"
}
}
}
}
{
"mcpServers": {
"awslabs.aws-iac-mcp-server": {
"command": "uvx",
"args": [
"awslabs.aws-iac-mcp-server@latest"
],
"env": {
"AWS_PROFILE": "your-aws-profile",
"AWS_REGION": "us-east-1",
"FASTMCP_LOG_LEVEL": "ERROR"
}
}
}
}
{
"mcpServers": {
"awslabs.aws-iac-mcp-server": {
"command": "uvx",
"args": [
"awslabs.aws-iac-mcp-server@latest"
],
"env": {
"AWS_PROFILE": "your-aws-profile",
"AWS_REGION": "us-east-1",
"FASTMCP_LOG_LEVEL": "ERROR"
}
}
}
}
{
"mcpServers": {
"awslabs.aws-iac-mcp-server": {
"command": "uvx",
"args": [
"awslabs.aws-iac-mcp-server@latest"
],
"env": {
"AWS_PROFILE": "your-aws-profile",
"AWS_REGION": "us-east-1",
"FASTMCP_LOG_LEVEL": "ERROR"
}
}
}
}
7 TOOLS AVAILABLE
OUR ASSESSMENT
- cfn-lint integration provides syntax and schema validation with line-numbered fix suggestions.
- cfn-guard checks against AWS Guard Rules Registry and Control Tower proactive controls, catching security posture issues before deployment.
- Failure analysis pattern-matches against 30+ known CloudFormation deployment failures with CloudTrail deep links.
- CDK documentation search returns AWS-approved code samples; reduces hallucination risk versus asking the LLM directly.
- Validation is structural and policy-based; logic errors in custom resources still require runtime verification.
- Coverage is CDK and CloudFormation; Terraform users need a separate tool.
- The CDK best-practices search is bounded to AWS-approved patterns; community patterns and emerging idioms appear later than they do in the broader CDK ecosystem.
The server reads templates and queries documentation; deployment of resources stays out of scope. This makes its security model simpler than the deploying servers in awslabs/mcp. Credentials follow the standard boto3 chain when calling AWS APIs for documentation lookups. Templates submitted for validation stay on the local server.
Teams using CDK or CloudFormation who want pre-deployment validation and post-failure analysis baked into their agent workflow.
TECHNICAL DETAILS
ADOPTION METRICS
// Reading thisShares the awslabs/mcp 8.9k star base. The IaC server is the validation layer that other AWS servers rely on for pre-deployment checks.
// Reading thisTop dev-tools MCP for IaC workflows. The combination of cfn-lint, cfn-guard, and CDK documentation search has no equivalent in the directory.
SOURCES & VERIFICATION
We don't take any single directory's word for it. Before scoring, we cross-reference 4 public MCP sources, install the server ourselves against the clients we cover, and record when we last re-verified.
The same server, 4 different lenses. We reconcile these signals into our editorial score, which is why our number sometimes diverges from a directory-aggregate star count.
| Source | Their rating | Their star count | Their downloads | Last synced |
|---|---|---|---|---|
| AutomationSwitch This page | 4editorial | 8,894 | — | APR 28, 2026 |
| PulseMCP | — unrated | unavailable | unavailable | APR 28, 2026 |
| Official MCP Registry | — unrated | unavailable | unavailable | APR 28, 2026 |
| Awesome MCP Servers | — unrated | unavailable | unavailable | APR 28, 2026 |
| Smithery | — unrated | unavailable | unavailable | APR 28, 2026 |
// Counts are directory-reported; we don't adjust them. Discrepancies usually come from different snapshot times or star-caching.
OTHER DEV TOOLS MCP SERVERS
GitHub
Codebase awareness layer for accessing repositories, pull requests, issues, code search, and GitHub Actions. Fine-grained PAT scopes keep access minimal.
OpenSpec
The leading spec-driven development workflow for AI agents. Implements the /opsx:propose → /opsx:apply → /opsx:archive cycle that scaffolds proposals, specs, design docs, and task checklists, then applies them and archives once shipped.
Chrome DevTools for Agents
Vendor-official Chrome DevTools MCP server from the Chrome DevTools team at Google. Lets agents control and inspect a live Chrome browser for automation, debugging, and performance analysis.
Terraform MCP Server
Vendor-official Terraform MCP server from HashiCorp. Integrates with the public Terraform Registry (providers, modules, policies) and HCP Terraform / Terraform Enterprise (workspace management, organisation listing, run management, private registry access).
Browserbase MCP Server
Vendor-built Browserbase MCP server combining cloud browser automation (Browserbase) with natural-language-to-action mapping (Stagehand). 6 tools: start, end, navigate, act, observe, extract. Available as a hosted endpoint at https://mcp.browserbase.com/mcp (LLM costs covered for Gemini) or self-hostable via @browserbasehq/mcp.
Context7
Documentation quality layer that fetches current, version-specific library documentation. Resolves library IDs and returns focused doc sections so your agent works with accurate API references.
DISCUSS YOUR
MCP REQUIREMENTS.
Evaluating a server, scoping an internal deployment, or working out whether MCP is the right fit at all. Start the conversation and we will point you at the right piece of the ecosystem.