AWS MCP Server (GA)

What it is

The AWS MCP Server (GA), part of the Agent Toolkit for AWS. A managed remote MCP server exposing 15,000+ AWS APIs to AI coding agents through four tools (call_aws, search_documentation, read_documentation, run_script). This note covers the concrete setup and the enterprise permission-separation pattern the summary only gestures at.

How it works

Local AWS credentials use IAM SigV4; MCP transport only supports OAuth 2.1. The gap is bridged by the MCP Proxy for AWS, an open-source proxy running on your machine that forwards to a regional endpoint (e.g. https://aws-mcp.us-east-1.api.aws/mcp). run_script executes agent-written Python server-side in a sandbox that inherits your IAM permissions but has no network access and no reach to your local filesystem or shell — so multi-API workflows happen in one round-trip.

What to do

Install uv first (per the uv installation guide), then register the server with Claude Code:

claude mcp add-json aws-mcp --scope user \
'{"command":"uvx","args":["mcp-proxy-for-aws==1.6.0","https://aws-mcp.us-east-1.api.aws/mcp","--metadata","AWS_REGION=us-west-2"]}'

Works with any MCP-capable agent (Cursor, Codex, Kiro, Kiro CLI, etc.), not just Claude Code.

For enterprise least-privilege separation:

• Use IAM context keys — with GA you no longer need a separate IAM permission to use the server; express access in a standard IAM policy.
• Use IAM policies or SCPs to let a human user perform mutating operations while restricting the MCP server itself to read-only actions.
• Observe agent activity via CloudWatch metrics under the AWS-MCP namespace (separate from direct human calls); CloudTrail captures the full API record.

Caveats

• The no-network sandbox is what makes run_script safe to grant — but that same isolation means scripts cannot reach external services.
• Documentation retrieval no longer requires authentication as of GA; call_aws/run_script still run under your IAM credentials.
• Version pin mcp-proxy-for-aws==1.6.0 and region metadata are from the post's example; adjust the endpoint/region to your deployment (two regional endpoints exist; only us-east-1 is named).
• The read-only restriction is only as good as the IAM/SCP policy you write — it is not a default.