Skip to content
Agentmart
Submit a tool

Yaw Labs AWS MCP

AWS MCP server — call any AWS API from AI assistants, with first-class SSO re-login

Connector by YawLabs · GitHub account verified by the MCP Registry

IndexedMITLocal (stdio)★ 5
Write a review

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/yawlabs-aws-mcp

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

AWS MCP server — call any AWS API from AI assistants, with first-class SSO re-login

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools
14 read · 5 write · 9 delete
Secrets
None asked for
Install scripts
None found
Runs as
Node.js package

Tools by what they do 28

Read from the source code; the running server may list different tools.

Read 14 · Look things up without changing anything.

  • aws_docs_read
  • aws_docs_search
  • aws_iam_simulate
  • aws_list_profiles
  • aws_logs_query
  • aws_logs_tail
  • aws_metrics_query
  • aws_paginate
  • aws_resource_diff
  • aws_resource_get
  • aws_resource_list
  • aws_resource_status
Show 2 more tools
  • aws_session_get
  • aws_whoami

Write 5 · Create, change, send or run things.

  • aws_login_complete
  • aws_login_start
  • aws_refresh_if_expiring_soon
  • aws_resource_create
  • aws_session_set

Delete 9 · Delete, drop, revoke or wipe things.

  • aws_assume_role
  • aws_call
  • aws_lambda_invoke
  • aws_multi_account
  • aws_multi_region
  • aws_resource_delete
  • aws_resource_update
  • aws_script
  • aws_session_clear

Secrets and settings it asks for

Other settings (environment variables or headers).

  • AWS_PROFILE
  • AWS_REGION

Network hosts it talks to 12

  • api.github.com · found in code
  • biomejs.dev · found in code
  • d-test.awsapps.com · found in code
  • device.sso.us-east-1.amazonaws.com · found in code
  • docs.aws.amazon.com · found in code
  • github.com · found in code
  • lambda.us-east-1.amazonaws.com · found in code
  • oamjs.org · found in code
  • oidc.us-east-1.amazonaws.com · found in code
  • proxy.search.docs.aws.com · found in code
  • sts.us-east-1.amazonaws.com · found in code
  • yaw.sh · found in code

Files it touches

  • /dev/shm
  • Your home directory (~)
  • ~/yaw/homebrew-yaw
  • ~/yaw/scoop-yaw

Tools (28)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • aws_assume_roleAssume an IAM role and stash creds as a profilecan change or delete data

    Call STS AssumeRole and stash the returned temporary credentials as a named profile in the shared credentials file ($AWS_SHARED_CREDENTIALS_FILE when set, otherwise ~/.aws/credentials; the resolved path is returned as credentialsPath). Subsequent calls to aws_call / aws_whoami / aws_paginate can use profile='mcp-<sessionName>' (or your overridden targetProfile name). The raw secret key / session token are NOT returned to the caller — only the profile name, expiration, and assumed identity. Use for cross-account access: a source profile (your SSO identity) assumes a role in another account. Def…

  • aws_callCall an AWS API operationcan change or delete data

    Run an arbitrary AWS API operation via the aws CLI. Use kebab-case service and operation names as in `aws help` (service='s3api', operation='list-buckets'). Pass params as a JSON object using the AWS API's PascalCase keys (e.g. {Bucket: 'foo'}); they go through --cli-input-json. Session profile/region (from aws_session_set) are used by default; override per-call when needed. Hand-written CLI commands (aws s3 cp/ls/sync, aws logs tail) and operations that stream their response to an output file (s3api get-object, bedrock-runtime invoke-model, bedrock-agentcore invoke-agent-runtime, lambda invok…

  • aws_docs_readRead an AWS documentation page as markdownread-only

    Fetch an AWS documentation page and return it as markdown. `url` must be an https://docs.aws.amazon.com/...html page (typically one returned by aws_docs_search). Long pages are paginated: pass `startIndex` (default 0) and `maxLength` (default 5000 chars); the response includes `hasMore` and `nextStartIndex` -- call again with nextStartIndex to continue. Strips nav/cookie-banner/feedback chrome before converting.

  • aws_docs_searchSearch live AWS documentationread-only

    Search the live AWS documentation (the same backend that powers the docs.aws.amazon.com search box). Use this to discover the right doc page for a service, API, or concept the model may not know about -- new services, recently changed APIs, exact parameter names. Returns ranked results as {title, url, summary, excerpt}. IMPORTANT: that backend always returns a full page of fuzzy matches and has no way to answer 'no good match' -- a nonsense query still comes back with ten confident-looking hits. So each result also carries `lexicalMatch` ({overlap 0-1, matchedTerms, unmatchedTerms}), computed …

  • aws_iam_simulateSimulate IAM permissions for a principalread-only

    Simulate IAM permissions for a principal: can principal X do actions Y on resources Z? Wraps `iam simulate-principal-policy`. Returns one entry per (action, resource) pair -- one per action, with resource '*', when `resources` is omitted -- with `decision` (allowed / explicitDeny / implicitDeny / unknown -- unknown is the malformed-response fallback when the decision is missing or unrecognised), `matchedStatementIds` (which IAM statements decided), `missingContextValues` (context keys the policy needed but you didn't provide -- common for tag-based policies), `permissionsBoundaryDecision`, and…

  • aws_lambda_invokeInvoke a Lambda functioncan change or delete data

    Invoke a Lambda function synchronously (RequestResponse) and return its response payload plus the DECODED tail of its execution log in one call. Use this instead of aws_call for Lambda invokes: `aws lambda invoke` needs a positional output file and rejects --cli-input-json, so aws_call structurally cannot reach it. The returned `logTail` is the last ~4 KB of the function's own log output, already base64-decoded, which removes the usual invoke -> find the log group -> tail it -> hope the window caught it loop. Functions on Lambda Managed Instances do not support the log tail; read their logs wi…

  • aws_list_profilesList configured AWS profilesread-only

    List AWS profiles configured in ~/.aws/config. Returns profile name, region, and SSO metadata (start URL, region, session name) where set, plus an `isSso` flag. Use when the user hasn't named a profile, when they ask to switch profiles, or when an SSO-expired error mentions a profile you haven't seen.

  • aws_login_completeWait for AWS SSO login to finish

    Block until the SSO login started by aws_login_start finishes (user completed auth in browser, or subprocess exited with error). Returns the new identity on success, or a structured error.

  • aws_login_startStart AWS SSO login (device code)

    Start an AWS SSO login via the device-code flow (no browser spawned from this process). Returns a verification URL and short code -- surface these to the user so they can open the URL in their own browser and paste the code. After they auth, call aws_login_complete with the returned sessionId to confirm completion.

  • aws_logs_queryRun a CloudWatch Logs Insights query and wait for resultsread-only

    Run a CloudWatch Logs Insights query and wait for it to finish -- StartQuery, poll GetQueryResults until the query reaches a terminal status, return the rows -- in ONE call, replacing the three-step start/poll/interpret-status dance you would otherwise write with aws_call. `logGroupNames` takes 1-50 bare group names ('/aws/lambda/my-fn'); a log-group ARN is accepted and its NAME extracted, which DISCARDS the ARN's account, so a cross-account ARN queries the same-named group in your own account -- real cross-account queries need logGroupIdentifiers, which this tool does not send. `queryString` …

  • aws_logs_tailFetch recent CloudWatch Logs events for a log groupread-only

    Description is built at runtime.

  • aws_metrics_queryQuery CloudWatch metrics (GetMetricData)read-only

    Query CloudWatch metrics via GetMetricData (the modern multi-metric / expression-capable API, not the legacy get-metric-statistics). Pass `queries` as a flat array of {id, namespace, metricName, dimensions?, statistic?, period?, expression?, label?}; the tool shapes them into MetricDataQueries for you. `startTime`/`endTime` accept relative shorthand ('15m', '1h', '1d', '1w'), 'now', or ISO 8601 WITH an explicit offset ('2026-05-16T10:00:00Z' / '...-04:00' -- an offset-less date-time is rejected rather than silently read in the host's local zone; a date-only '2026-05-16' is read as UTC midnight…

  • aws_multi_accountRun an AWS operation across multiple accounts in parallelcan change or delete data

    Run the same AWS API operation across multiple ACCOUNTS in parallel by assuming the same role name in each. Same shape as aws_call (service, operation, params?, query?, outputFormat?, region?, timeoutMs?) plus `accounts: string[]` of 12-digit account IDs and `roleName`. This is fan-out in one call, not new access: it is exactly what aws_assume_role in a loop would reach, minus the credentials-file churn -- each account's session is held in memory for the one subprocess that uses it and is NEVER written to ~/.aws/credentials, so a sweep that dies halfway leaves nothing on disk. If your org alre…

  • aws_multi_regionRun an AWS operation across multiple regions in parallelcan change or delete data

    Description is built at runtime.

  • aws_paginateFetch one page of a paginated AWS operationread-only

    Fetch one page of a paginated AWS list/describe operation. Identical to aws_call plus `maxItems` (page size) and `startingToken` (resume cursor). When `query` is supplied it is wrapped server-side as {NextToken, items: <query>} so pagination survives a projection that would otherwise drop NextToken; the handler unwraps `items` before returning. Returns the parsed response, a `nextToken` (null when the list is exhausted), and `hasMore`. Call again with the returned nextToken as startingToken until hasMore is false. Use this instead of aws_call for operations that might exceed the 5 MB stdout ca…

Show 13 more tools
  • aws_refresh_if_expiring_soonRefresh SSO token if it's expiring soon

    Proactive SSO token check. If the cached token has fewer than `thresholdMinutes` left (default 10), this kicks off aws_login_start and returns the verification URL + code in one round-trip. If plenty of time remains, returns `status: 'ok'` with the minutes left. Use at the start of a multi-step AWS workflow to avoid mid-session expiry. `status: 'ok'` is a point-in-time reading of the cache, not a lease: nothing re-checks afterwards, so a token that lapses mid-workflow still surfaces as an sso_expired error from the next aws_call / aws_whoami. Raise `thresholdMinutes` to cover the expected leng…

  • aws_resource_createCreate an AWS resource (async via CCAPI)

    Create an AWS resource via Cloud Control API. Async by default: returns a ProgressEvent with OperationStatus=IN_PROGRESS and a `requestToken` (top-level) -- poll aws_resource_status with that token, or pass `awaitCompletion: true` to have the server poll for you and return the terminal event. `desiredState` is the resource properties JSON matching the CloudFormation schema for `typeName`.

  • aws_resource_deleteDelete an AWS resource (async via CCAPI)can change or delete data

    Delete an AWS resource via Cloud Control API. Async by default: returns a ProgressEvent with OperationStatus=IN_PROGRESS and a top-level `requestToken`. Pass `awaitCompletion: true` to have the server poll until terminal. Destructive -- double-check `identifier` before calling.

  • aws_resource_diffPreview a CCAPI update without applying itread-only

    Dry-run a CCAPI update: fetch the current resource state, simulate applying a JSON Patch in memory, and return before/after plus a flat list of changed paths. No mutation is sent to AWS. Use this before aws_resource_update to verify the patch does what you expect. Supports the add/remove/replace subset of RFC 6902 (covers the vast majority of CCAPI updates); 'move'/'copy'/'test' are rejected at schema validation -- use aws_resource_update directly if you need those (CCAPI accepts them, this preview tool just doesn't simulate them locally).

  • aws_resource_getGet an AWS resource by type + identifierread-only

    Read a single AWS resource via Cloud Control API. Covers hundreds of resource types with a CloudFormation schema. `typeName` is '<Namespace>::<Service>::<Resource>' (e.g. 'AWS::Lambda::Function'); `identifier` is the primary key for that type (function name, bucket name, IAM role name, ARN, or composite id). Returns parsed Properties. For resources not covered by CCAPI or for data-plane operations, use aws_call.

  • aws_resource_listList AWS resources of a type (paginated)read-only

    List resources of a given type via Cloud Control API, paginated. Returns an array of {identifier, properties}, a `nextToken` (null when exhausted), and `hasMore`. Some types need parent identifiers (e.g. nested resources under a cluster); pass those as `resourceModel`.

  • aws_resource_statusGet the status of an async CCAPI requestread-only

    Poll the status of an async Cloud Control API request (create/update/delete). Pass the `requestToken` returned by those tools. Returns the current ProgressEvent with OperationStatus: PENDING | IN_PROGRESS | SUCCESS | FAILED | CANCEL_IN_PROGRESS | CANCEL_COMPLETE.

  • aws_resource_updateUpdate an AWS resource (async via CCAPI)can change or delete data

    Update an AWS resource via Cloud Control API using RFC 6902 JSON Patch. Async by default: returns a ProgressEvent with OperationStatus=IN_PROGRESS and a top-level `requestToken`. Pass `awaitCompletion: true` to have the server poll until terminal. Typical patch: [{op: 'replace', path: '/MemorySize', value: 512}].

  • aws_scriptRun a JS snippet that orchestrates AWS tool callscan change or delete data

    Run a short JavaScript snippet that orchestrates other aws-mcp tools (aws.call, aws.paginate, aws.paginateAll, aws.resource.*, aws.logsTail, aws.metricsQuery, aws.iamSimulate, aws.multiRegion, aws.assumeRole, aws.docs.{search,read}) and returns a combined result. Best for batched read+filter+aggregate workflows that would otherwise need N tool round-trips: 'list all Lambdas, fetch each one's config, return those with memory > 1024'. Use `return <value>` at the end to surface a result; console.log lines are captured and returned alongside. Helpers throw Errors on failure -- use try/catch. NOT A…

  • aws_session_clearClear session profile/region overrides

    Remove session-set profile and/or region overrides so subsequent calls fall back to env vars / defaults. No args clears both. Pass `profile: true` or `region: true` to clear just one. Use when the user says 'go back to the default profile,' 'unset the region,' or 'reset session.'

  • aws_session_getShow session default profile/regionread-only

    Show the current session's default AWS profile and region, and where each value came from ('session' = set by aws_session_set, 'env' = AWS_PROFILE/AWS_REGION env var, 'default' = built-in fallback). Useful for confirming state before running operations or debugging why a call hit the wrong account.

  • aws_session_setSet session default profile/region

    Set the default AWS profile and/or region for the rest of this MCP session. Subsequent calls to aws_whoami, aws_login_*, and other AWS tools will use these values unless they override explicitly. Use when the user says 'switch to prod', 'use us-west-2', 'look at the staging account', etc. Both params are optional; pass whichever changed. Returns the resulting session state.

  • aws_whoamiShow current AWS identityread-only

    Show the current AWS identity (account, role ARN, user ID) plus SSO token status and time remaining. Use this first to verify auth before running other AWS operations. Returns a structured fix-it message if SSO is expired.

Signals

Stars
5
Forks
1
Open issues
0
Last commit
Oct 15, 2026 (13 days ago)
Last release
Oct 11, 2026 (17 days ago)

From GitHub (fetched Oct 24, 2026).

Details

Registry name
io.github.YawLabs/aws-mcp
Version
2.6.0
Auth
No auth
Packages
npm @yawlabs/aws-mcp
License
MIT
Repository
github.com/YawLabs/aws-mcp
Website
yaw.sh/mcp-servers/aws-mcp/
First seen
Oct 24, 2026
Last checked
Oct 24, 2026
Source
Official MCP Registrygithub-graphql

More from YawLabs

Cite this page

Yaw Labs AWS MCP. Agent Mart. https://agentmart.dev/connectors/yawlabs-aws-mcp (last updated 2026-10-24)