{"engine": "chatgpt", "model": "gpt-5.5", "index": 0, "phrasing": "What is the best MCP server for connecting AI assistants to AWS infrastructure?", "text": "The best general-purpose MCP server for connecting AI assistants to AWS infrastructure is the **AWS API MCP Server** from **AWS Labs**.\n\nIt is designed to let MCP-compatible assistants interact with AWS services through AWS APIs, making it the most direct option for inspecting or managing AWS infrastructure.\n\nGitHub: `awslabs/mcp`  \nRelevant server: **AWS API MCP Server**\n\nUse it if you want an assistant to:\n\n- Query AWS resources\n- Inspect EC2, S3, IAM, Lambda, CloudWatch, etc.\n- Help troubleshoot infrastructure\n- Automate AWS API-based workflows\n\nFor more specialized use cases, AWS Labs also provides other MCP servers:\n\n- **AWS Documentation MCP Server** \u2014 best for asking questions about AWS docs\n- **AWS CDK MCP Server** \u2014 best for infrastructure-as-code with CDK\n- **AWS Terraform MCP Server** \u2014 best for Terraform-based AWS infrastructure\n- **CloudWatch MCP Server** \u2014 best for logs and observability\n- **Cost Explorer MCP Server** \u2014 best for AWS cost analysis\n\nMy recommendation: start with the **AWS API MCP Server**, but run it with **least-privilege IAM permissions**, ideally read-only at first.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 1, "phrasing": "Best Model Context Protocol server for Amazon Web Services", "text": "The best MCP server option for AWS is the **official AWS Labs MCP Servers collection**:\n\n**GitHub:** `awslabs/mcp`\n\nFor most AWS use cases, I\u2019d recommend:\n\n1. **AWS API MCP Server**  \n   Best general-purpose MCP server for interacting with AWS services through AWS APIs.\n\n2. **AWS Documentation MCP Server**  \n   Best for asking questions about AWS docs, service behavior, CLI/API usage, and architecture guidance.\n\n3. **AWS CDK MCP Server**  \n   Best if you build infrastructure with AWS CDK.\n\n4. **CloudWatch / Cost Analysis MCP Servers**  \n   Useful for operations, monitoring, billing, and cost optimization workflows.\n\nA good default setup would be:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-docs\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-documentation-mcp-server@latest\"]\n    },\n    \"aws-api\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-api-mcp-server@latest\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"default\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\nUse a dedicated AWS profile with **least-privilege IAM permissions**, preferably read-only at first.\n\n**Short answer:** use the official **AWS Labs MCP Servers**, especially **AWS API MCP Server + AWS Documentation MCP Server** for the best general AWS coverage.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 2, "phrasing": "We want our local AI coding assistant to query AWS S3 buckets and CloudWatch logs via MCP. What server should we use?", "text": "Use **AWS Labs\u2019 AWS API MCP Server**: `awslabs/aws-api-mcp-server`.\n\nIt\u2019s the best fit if your local AI coding assistant needs to query both:\n\n- **Amazon S3 buckets** \u2014 list buckets, list objects, read object metadata/content, etc.\n- **CloudWatch Logs** \u2014 query log groups/streams, run Logs Insights queries, fetch events, etc.\n\nIf your main focus is deep CloudWatch troubleshooting, you can also add the **AWS Labs CloudWatch MCP Server**, but for one server that covers both S3 and CloudWatch Logs, use the **AWS API MCP Server**.\n\nRecommended setup:\n\n- Run it locally.\n- Authenticate with your existing AWS profile/SSO credentials.\n- Give it a read-only IAM policy scoped to the buckets and log groups you want the assistant to access.\n- Avoid using an S3 Tables MCP server unless you specifically mean **S3 Tables**, not regular S3 buckets.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 3, "phrasing": "Recommend an AWS MCP server for a team managing multi-region cloud resources.", "text": "Recommend: **AWS API MCP Server (`awslabs/aws-api-mcp-server`)**\n\nIt is the best fit for a team managing **multi-region AWS resources** because it provides broad access to AWS service APIs through MCP, rather than being limited to one service or workflow.\n\nWhy it fits:\n\n- **Multi-region capable**: works with normal AWS SDK/CLI region and profile configuration.\n- **Broad AWS coverage**: can interact with many AWS services, useful for teams managing EC2, VPC, IAM, ECS, RDS, CloudWatch, etc.\n- **Good for operations teams**: useful for querying resources, checking configurations, and performing controlled changes.\n- **Works with existing AWS auth**: supports IAM roles, profiles, SSO, and least-privilege permissions.\n- **Can be restricted**: you can run it with read-only IAM permissions for safer day-to-day use.\n\nSuggested setup:\n\n- Use **AWS IAM Identity Center / SSO** or assumed roles per environment.\n- Create separate AWS profiles such as:\n  - `dev-us-east-1`\n  - `prod-us-east-1`\n  - `prod-eu-west-1`\n- Start with **read-only permissions**.\n- Allow write actions only through tightly scoped roles or approval workflows.\n\nIf your team primarily manages infrastructure as code, pair it with:\n\n- **AWS CDK MCP Server** if you use CDK\n- **Terraform MCP Server** if you use Terraform\n\nBut for general multi-region AWS resource management, I\u2019d start with **AWS API MCP Server**.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 4, "phrasing": "affordable and secure MCP server for AWS resource management", "text": "Best affordable + secure choice: **self-host an AWS MCP server using AWS\u2019s open-source MCP servers**, rather than using a third-party hosted service with broad AWS credentials.\n\n### Recommended option\n\nUse **AWS Labs MCP servers**:\n\n- GitHub: `awslabs/mcp`\n- Good for:\n  - AWS documentation lookup\n  - CDK/Terraform assistance\n  - AWS API/resource management depending on the specific server you enable\n\nFor direct AWS resource management, use an MCP server that wraps AWS APIs/CLI/Boto3 and run it under a tightly scoped IAM role.\n\n---\n\n## Secure deployment approach\n\n### 1. Run it yourself\n\nAffordable options:\n\n- **Local machine** for personal/admin use\n- **ECS Fargate** for team use\n- **EC2 t4g.micro/t4g.small** if you want lowest predictable cost\n- **Private VPC only**, no public inbound access\n\nAvoid exposing the MCP server directly to the internet.\n\n---\n\n### 2. Use IAM roles, not access keys\n\nBest practice:\n\n- Use **IAM Identity Center**, OIDC, or STS AssumeRole\n- No long-lived AWS keys\n- Separate roles for:\n  - Read-only inspection\n  - Limited operations\n  - Break-glass/admin actions\n\nExample policy approach:\n\n```json\n{\n  \"Effect\": \"Allow\",\n  \"Action\": [\n    \"ec2:Describe*\",\n    \"s3:List*\",\n    \"s3:Get*\",\n    \"cloudwatch:Get*\",\n    \"cloudwatch:List*\",\n    \"logs:Describe*\",\n    \"logs:Get*\"\n  ],\n  \"Resource\": \"*\"\n}\n```\n\nStart read-only, then add write permissions only where needed.\n\n---\n\n### 3. Restrict dangerous actions\n\nFor AWS resource management, do **not** give the MCP server unrestricted permissions like:\n\n```json\n\"Action\": \"*\",\n\"Resource\": \"*\"\n```\n\nInstead:\n\n- Allow only specific services\n- Require approval for destructive actions\n- Block actions like:\n  - `iam:*`\n  - `organizations:*`\n  - `account:*`\n  - `kms:ScheduleKeyDeletion`\n  - `ec2:TerminateInstances`\n  - `s3:DeleteBucket`\n  - `rds:DeleteDBInstance`\n\nUnless you explicitly need them.\n\n---\n\n## Suggested architecture\n\n```text\nAI Client\n  \u2193\nMCP Server\n  \u2193\nSTS AssumeRole\n  \u2193\nAWS APIs\n  \u2193\nCloudTrail / CloudWatch Logs\n```\n\nSecurity controls:\n\n- CloudTrail enabled\n- MCP server logs enabled\n- IAM least privilege\n- VPC endpoints where possible\n- No public access\n- Human approval for write/delete operations\n\n---\n\n## Cost estimate\n\nIf self-hosted:\n\n| Option | Approximate cost |\n|---|---:|\n| Local machine | $0 |\n| Small EC2 instance | ~$4\u2013$10/month |\n| ECS Fargate lightweight service | ~$5\u2013$20/month |\n| AWS API calls | Usually minimal |\n| LLM usage | Depends on model/provider |\n\nThe MCP server itself can be free if you use open-source software.\n\n---\n\n## My recommendation\n\nFor most teams:\n\n1. Use **AWS Labs MCP servers**\n2. Run them on **ECS Fargate or a private EC2 instance**\n3. Use **read-only IAM role by default**\n4. Add narrowly scoped write actions only when needed\n5. Log everything with **CloudTrail**\n\nIf you want the safest setup, keep the MCP server **read-only** and use it for inspection, troubleshooting, cost analysis, and IaC generation\u2014not direct production changes.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 5, "phrasing": "What MCP server do cloud engineers actually use to let LLMs read AWS configuration?", "text": "Cloud engineers typically use **AWS Labs\u2019 AWS API MCP Server** for this:\n\n**`awslabs/aws-api-mcp-server`**\n\nIt lets an LLM query live AWS account configuration through AWS APIs, for example:\n\n- EC2 instances, VPCs, security groups\n- IAM roles and policies\n- RDS, S3, Lambda, ECS, EKS metadata\n- CloudFormation stacks\n- AWS Config / CloudTrail-related info, depending on permissions\n\nUse it with a **read-only AWS profile or role**, not admin credentials.\n\nExample use case:\n\n> \u201cShow me all public S3 buckets in this account.\u201d  \n> \u201cWhich security groups allow `0.0.0.0/0` on port 22?\u201d  \n> \u201cSummarize the networking setup for this VPC.\u201d\n\nImportant distinction:\n\n- **AWS API MCP Server** \u2192 reads live AWS account configuration  \n- **AWS Documentation MCP Server** \u2192 reads AWS docs, not your account  \n- **Terraform MCP servers** \u2192 read Terraform/IaC, not necessarily live AWS state\n\nSo the practical answer is:\n\n> Use **AWS Labs\u2019 AWS API MCP Server**, connected to a tightly scoped read-only AWS IAM role/profile.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 6, "phrasing": "Best MCP server to connect AI agents to Amazon Web Services data stores", "text": "There isn\u2019t one \u201cbest\u201d MCP server for all AWS data stores. The best choice depends on whether you want **semantic/RAG access** or **direct database access**.\n\n## Best general recommendation\n\nUse the **AWS Labs MCP servers** from `awslabs/mcp`.\n\nThey are AWS-maintained/open-source and include MCP servers for AWS services and data systems.\n\nGitHub: `https://github.com/awslabs/mcp`\n\n## If your AI agent needs RAG / semantic search\n\nUse:\n\n**Amazon Bedrock Knowledge Bases Retrieval MCP Server**\n\nBest when your data is indexed through Amazon Bedrock Knowledge Bases, backed by services like:\n\n- Amazon S3\n- Amazon OpenSearch Serverless\n- Amazon Aurora / PostgreSQL vector store\n- Other supported Bedrock KB backends\n\nThis is usually the cleanest option for AI agents because the agent retrieves relevant context rather than getting raw database access.\n\n## If your agent needs direct data-store access\n\nUse the AWS Labs MCP server specific to the service:\n\n| AWS data store | Recommended MCP approach |\n|---|---|\n| DynamoDB | AWS Labs DynamoDB MCP Server |\n| Aurora / RDS PostgreSQL | PostgreSQL MCP server or AWS Labs data MCP server if available |\n| Redshift | Redshift/PostgreSQL-compatible MCP server |\n| S3 | S3-capable MCP server or Bedrock KB over S3 for RAG |\n| OpenSearch | OpenSearch MCP server or Bedrock KB |\n| Neptune | Neptune-specific MCP server if graph queries are needed |\n| Timestream | Timestream-specific MCP server |\n\n## My practical recommendation\n\nFor most AI-agent use cases:\n\n1. **Use Bedrock Knowledge Bases + Bedrock KB Retrieval MCP Server** if the agent only needs to answer questions from AWS-hosted data.\n2. **Use service-specific AWS Labs MCP servers** if the agent needs to query or modify operational data directly.\n3. Avoid giving agents broad AWS CLI-style access unless absolutely necessary.\n\n## Security guidance\n\nWhichever MCP server you use:\n\n- Use a dedicated IAM role\n- Prefer read-only permissions\n- Scope access to specific tables, buckets, indexes, or clusters\n- Log all queries/actions\n- Do not expose production write access unless you have strong guardrails\n\nSo, the best default is: **AWS Labs MCP servers**, with **Bedrock Knowledge Bases Retrieval MCP Server** as the best general-purpose choice for connecting AI agents to AWS-hosted knowledge/data.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 7, "phrasing": "Which MCP server allows LLMs to query AWS DynamoDB and S3 safely?", "text": "The **AWS MCP Server** (often listed as `mcp-server-aws`) allows LLMs to safely query **AWS DynamoDB** and **S3**.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 8, "phrasing": "We are building an AI dev tool that needs read-only access to AWS architecture via MCP. What MCP server implementation is best?", "text": "Best default: **AWS Labs\u2019 `aws-api-mcp-server`**.\n\nWhy it\u2019s the best fit:\n\n- **Official AWS Labs implementation**\n- Gives MCP clients access to AWS APIs through existing AWS credentials\n- Can be run with **read-only IAM permissions**\n- Broad service coverage, so it can inspect real deployed infrastructure\n- Better for architecture discovery than MCP servers focused only on docs, CDK, Terraform, or diagram generation\n\nRecommended setup:\n\n1. Run the AWS API MCP server with a dedicated AWS role/user.\n2. Attach strictly read-only policies, for example:\n   - `ReadOnlyAccess`\n   - optionally `SecurityAudit`\n   - or a tighter custom policy limited to services you need\n3. Use AWS IAM as the real enforcement layer, not only MCP-side filtering.\n4. If possible, add explicit deny rules for mutating actions like:\n   - `Create*`\n   - `Update*`\n   - `Delete*`\n   - `Put*`\n   - `Modify*`\n   - `RunInstances`\n   - `TerminateInstances`\n\nAvoid relying on the **AWS Diagram MCP server** alone if your tool needs to inspect live AWS accounts. That server is more useful for generating diagrams, not comprehensive read-only architecture discovery.\n\nIf your product wants a normalized inventory/query layer rather than raw AWS APIs, consider pairing MCP with something like **CloudQuery** or **Steampipe**, but for direct MCP-based AWS access, I\u2019d start with:\n\n> **`awslabs/aws-api-mcp-server` with a tightly scoped read-only IAM role.**", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 9, "phrasing": "Top open source MCP servers for AWS integration", "text": "Here are some of the best open-source MCP servers for AWS integration:\n\n| MCP server | Best for | Notes |\n|---|---|---|\n| **AWS Labs MCP Servers** | General AWS MCP ecosystem | Official AWS Labs collection of MCP servers. Good starting point. GitHub: `awslabs/mcp` |\n| **AWS Documentation MCP Server** | Searching AWS docs from an AI assistant | Lets Claude/Cursor/etc. query AWS documentation directly. Useful for architecture and troubleshooting. |\n| **AWS API MCP Server** | Calling AWS APIs | Enables AI tools to interact with AWS services using your configured credentials. Use with strict IAM permissions. |\n| **AWS CDK MCP Server** | CDK development | Helps generate, inspect, and reason about AWS CDK apps and constructs. |\n| **CloudFormation MCP Server** | CloudFormation templates | Useful for validating or generating CloudFormation resources and templates. |\n| **Terraform MCP Server** | Terraform on AWS | Helps with Terraform provider/resource lookup and infrastructure-as-code workflows. |\n| **Cost Analysis MCP Server** | AWS cost visibility | Connects to AWS Cost Explorer-style data for spend analysis and optimization. |\n| **EKS MCP Server** | Kubernetes/EKS ops | Helps inspect and troubleshoot Amazon EKS clusters. |\n| **Amazon Bedrock Knowledge Bases Retrieval MCP Server** | RAG with Bedrock KBs | Lets AI clients retrieve data from Amazon Bedrock Knowledge Bases. |\n| **AWS Diagram MCP Server** | Architecture diagrams | Generates or assists with AWS architecture diagrams from prompts or infrastructure context. |\n\nRecommended starting point:\n\n```bash\ngithub.com/awslabs/mcp\n```\n\nIf you want the most practical setup, I\u2019d start with:\n\n1. **AWS Documentation MCP Server**\n2. **AWS API MCP Server**\n3. **CDK or Terraform MCP Server**, depending on your IaC stack\n4. **Cost Analysis MCP Server**\n5. **EKS MCP Server**, if you run Kubernetes on AWS\n\nImportant: for any MCP server that can call AWS APIs, use a dedicated IAM role/user with least-privilege permissions.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 10, "phrasing": "Which Model Context Protocol server works best for Amazon Bedrock LLMs?", "text": "There isn\u2019t one \u201cbest\u201d MCP server for Amazon Bedrock LLMs in general \u2014 MCP servers are chosen based on what context or tools you want to expose to the model.\n\nFor most Amazon Bedrock LLM use cases, the best fit is:\n\n**Amazon Bedrock Knowledge Bases Retrieval MCP Server**  \nBest when you want Bedrock models to retrieve information from your Bedrock Knowledge Bases for RAG-style answers.\n\nUse it if you want the model to query enterprise docs, internal knowledge, or indexed data through Amazon Bedrock Knowledge Bases.\n\nOther good AWS MCP servers depending on the use case:\n\n- **AWS Documentation MCP Server** \u2014 best for answering AWS service/documentation questions.\n- **AWS CDK MCP Server** \u2014 best for infrastructure-as-code and CDK help.\n- **AWS Cost Analysis MCP Server** \u2014 best for AWS billing and cost insights.\n- **Amazon Bedrock Data Automation MCP Server** \u2014 best for document/media extraction workflows.\n\nSo the short answer: **use the Amazon Bedrock Knowledge Bases Retrieval MCP Server if your goal is to enhance Bedrock LLMs with private or indexed knowledge.**", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 11, "phrasing": "How to connect an LLM assistant to AWS cloud resources using MCP?", "text": "To connect an LLM assistant to AWS resources using MCP, you run an **MCP server** that exposes AWS operations as tools. The LLM assistant talks to the MCP server, and the MCP server uses AWS credentials/IAM to call AWS APIs.\n\n## 1. Architecture\n\n```text\nLLM Assistant / MCP Client\n        |\n        | MCP tool calls\n        v\nCustom or existing AWS MCP Server\n        |\n        | boto3 / AWS SDK / AWS CLI\n        v\nAWS Resources: S3, EC2, Lambda, CloudWatch, RDS, etc.\n```\n\nThe LLM should not receive raw AWS credentials. Only the MCP server should have AWS access.\n\n---\n\n## 2. Create least-privilege AWS credentials\n\nExample read-only IAM policy for S3:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"s3:ListAllMyBuckets\",\n        \"s3:ListBucket\",\n        \"s3:GetObject\"\n      ],\n      \"Resource\": \"*\"\n    }\n  ]\n}\n```\n\nPrefer:\n\n- IAM roles over long-lived access keys\n- Read-only access at first\n- Separate roles per environment\n- CloudTrail logging\n- Explicit deny for destructive actions if needed\n\n---\n\n## 3. Build a simple AWS MCP server\n\nExample using Python, `mcp`, and `boto3`.\n\nInstall dependencies:\n\n```bash\npip install mcp boto3\n```\n\nCreate `aws_mcp_server.py`:\n\n```python\nfrom mcp.server.fastmcp import FastMCP\nimport boto3\n\nmcp = FastMCP(\"aws-tools\")\n\ns3 = boto3.client(\"s3\")\nec2 = boto3.client(\"ec2\")\n\n@mcp.tool()\ndef list_s3_buckets() -> list[str]:\n    \"\"\"\n    List S3 bucket names in the AWS account.\n    \"\"\"\n    response = s3.list_buckets()\n    return [bucket[\"Name\"] for bucket in response[\"Buckets\"]]\n\n@mcp.tool()\ndef list_ec2_instances(region: str = \"us-east-1\") -> list[dict]:\n    \"\"\"\n    List EC2 instances in a region.\n    \"\"\"\n    ec2_regional = boto3.client(\"ec2\", region_name=region)\n    response = ec2_regional.describe_instances()\n\n    instances = []\n\n    for reservation in response[\"Reservations\"]:\n        for instance in reservation[\"Instances\"]:\n            instances.append({\n                \"instance_id\": instance[\"InstanceId\"],\n                \"state\": instance[\"State\"][\"Name\"],\n                \"type\": instance[\"InstanceType\"],\n                \"region\": region\n            })\n\n    return instances\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\nRun it:\n\n```bash\npython aws_mcp_server.py\n```\n\n---\n\n## 4. Configure your MCP-compatible assistant\n\nFor a local MCP client such as Claude Desktop or another MCP-compatible assistant, add a server config like this:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-tools\": {\n      \"command\": \"python\",\n      \"args\": [\"/absolute/path/to/aws_mcp_server.py\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"my-aws-profile\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\nYour AWS credentials can come from:\n\n```bash\naws configure --profile my-aws-profile\n```\n\nor from environment variables:\n\n```bash\nexport AWS_ACCESS_KEY_ID=...\nexport AWS_SECRET_ACCESS_KEY=...\nexport AWS_REGION=us-east-1\n```\n\nFor production, prefer IAM roles, OIDC, or workload identity instead of static keys.\n\n---\n\n## 5. Ask the assistant to use AWS tools\n\nExample prompts:\n\n```text\nList my S3 buckets.\n```\n\n```text\nShow EC2 instances running in us-east-1.\n```\n\n```text\nCheck whether any EC2 instances are stopped in us-west-2.\n```\n\nThe assistant will call the MCP tools, and the MCP server will call AWS.\n\n---\n\n## 6. Use existing AWS MCP servers if available\n\nYou can also use prebuilt MCP servers from AWS or the community, for example servers focused on:\n\n- AWS documentation\n- CDK\n- Terraform\n- Cost analysis\n- CloudWatch\n- CloudFormation\n- Bedrock\n- Lambda\n- ECS/EKS\n\nA common pattern is to use a prebuilt server for documentation or infrastructure-as-code workflows, and a custom MCP server for your organization-specific AWS operations.\n\n---\n\n## 7. Security recommendations\n\nImportant safeguards:\n\n- Start with read-only tools.\n- Use least-privilege IAM policies.\n- Avoid giving the LLM unrestricted `iam:*`, `ec2:*`, or `s3:*`.\n- Add confirmation gates for destructive actions.\n- Log all tool calls.\n- Validate user inputs before calling AWS APIs.\n- Use separate AWS accounts or roles for dev, staging, and prod.\n- Consider an allowlist of safe operations.\n\nFor example, instead of exposing a generic `run_aws_cli(command)` tool, expose specific tools like:\n\n```text\nlist_s3_buckets\nget_lambda_logs\ndescribe_ec2_instances\nget_cloudwatch_metric\n```\n\nThis is much safer.\n\n---\n\n## 8. Production deployment options\n\nYou can run the MCP server:\n\n- Locally on a developer machine\n- In a container on ECS/Fargate\n- On EKS\n- Behind an internal API gateway\n- On an EC2 instance with an IAM role\n- As part of a secure internal developer platform\n\nFor production, use:\n\n- IAM roles\n- VPC endpoints where possible\n- Centralized logging\n- Authentication between the MCP client and server\n- Rate limits and audit trails\n\n---\n\nIn short: **create an MCP server that wraps AWS SDK calls, give that server limited IAM permissions, configure your LLM assistant to use it, and expose only safe, well-defined AWS tools.**", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 12, "phrasing": "What is the most reliable MCP server for inspecting AWS IAM roles and Security Groups?", "text": "There isn\u2019t a universally ranked \u201cmost reliable\u201d MCP server, but for inspecting **AWS IAM roles** and **EC2 Security Groups**, the safest recommendation is:\n\n**AWS Labs / official AWS API MCP Server**\n\nWhy:\n- Uses the AWS APIs directly, not scraping or third-party parsing.\n- Works with normal AWS credentials and IAM permissions.\n- Can inspect IAM via APIs like `iam:ListRoles`, `iam:GetRole`, `iam:ListAttachedRolePolicies`.\n- Can inspect Security Groups via `ec2:DescribeSecurityGroups`.\n- Reliability depends mostly on AWS API behavior and your credentials/permissions.\n\nUse it with a read-only or security-audit role, for example permissions such as:\n\n```json\n{\n  \"Effect\": \"Allow\",\n  \"Action\": [\n    \"sts:GetCallerIdentity\",\n    \"iam:ListRoles\",\n    \"iam:GetRole\",\n    \"iam:ListAttachedRolePolicies\",\n    \"iam:ListRolePolicies\",\n    \"iam:GetRolePolicy\",\n    \"iam:GetPolicy\",\n    \"iam:GetPolicyVersion\",\n    \"ec2:DescribeSecurityGroups\",\n    \"ec2:DescribeVpcs\",\n    \"ec2:DescribeSubnets\",\n    \"ec2:DescribeNetworkInterfaces\"\n  ],\n  \"Resource\": \"*\"\n}\n```\n\nIf your goal is **security auditing**, not just inspection, consider pairing it with tools like **Prowler** or **Steampipe**, but for raw MCP-based AWS inspection, I\u2019d choose the **AWS API MCP Server** first.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 13, "phrasing": "Best MCP server for querying CloudWatch logs with natural language", "text": "Best choice: **AWS Labs CloudWatch Logs MCP Server** \u2014 if you specifically want natural-language access to CloudWatch Logs / Logs Insights.\n\nWhy it\u2019s the best fit:\n\n- Purpose-built for **CloudWatch Logs**\n- Lets an MCP client generate and run **CloudWatch Logs Insights** queries\n- Supports workflows like:\n  - \u201cFind errors in the last hour\u201d\n  - \u201cShow Lambda timeouts by function\u201d\n  - \u201cSummarize 5xx errors for this service\u201d\n- Uses native AWS APIs rather than scraping or custom indexing\n\nIf you want broader AWS access, use:\n\n- **AWS Labs AWS API MCP Server**  \n  Better if you want to query CloudWatch plus other AWS services, but less specialized.\n\nIf you use Grafana heavily:\n\n- **Grafana MCP Server + CloudWatch data source**  \n  Better for dashboard-oriented workflows across multiple observability backends.\n\nImportant note: the MCP server does not \u201cunderstand\u201d natural language by itself. Your MCP client/LLM, such as Claude Desktop, Cursor, or Cline, translates natural language into CloudWatch Logs Insights queries and calls the MCP tools.\n\nFor production, use a read-only IAM policy scoped to only the needed log groups, with permissions like:\n\n```json\n{\n  \"Effect\": \"Allow\",\n  \"Action\": [\n    \"logs:DescribeLogGroups\",\n    \"logs:DescribeLogStreams\",\n    \"logs:StartQuery\",\n    \"logs:GetQueryResults\",\n    \"logs:StopQuery\",\n    \"logs:FilterLogEvents\"\n  ],\n  \"Resource\": \"*\"\n}\n```\n\nMy recommendation: **start with the AWS Labs CloudWatch Logs MCP Server**. Use the generic AWS API MCP Server only if you need broader AWS operations beyond logs.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 14, "phrasing": "We need an MCP server that lets developers ask an AI agent about active AWS EC2 instances. What options exist?", "text": "Options for an MCP server that lets developers ask an AI agent about active AWS EC2 instances:\n\n## 1. Use an existing AWS API MCP server\n\nBest if you want broad AWS API access quickly.\n\nAWS Labs has MCP servers, including an AWS API-style MCP server that can expose AWS SDK/API calls to an agent. With proper IAM permissions, the agent could call EC2 APIs such as:\n\n- `DescribeInstances`\n- `DescribeInstanceStatus`\n- `DescribeTags`\n- `DescribeRegions`\n- optionally CloudWatch APIs for metrics\n\nExample developer questions it could answer:\n\n- \u201cWhich EC2 instances are running in us-east-1?\u201d\n- \u201cShow all running instances tagged `Environment=prod`.\u201d\n- \u201cWhich instances have no Name tag?\u201d\n- \u201cWhat instance types are currently active?\u201d\n\nPros:\n- Fastest path.\n- Works across many AWS services, not just EC2.\n- Uses standard AWS credentials/IAM.\n\nCons:\n- Broader attack surface.\n- You need to restrict tools/actions carefully.\n- The AI may get access to more AWS APIs than you intend unless configured tightly.\n\nRecommended IAM permissions:\n\n```json\n{\n  \"Effect\": \"Allow\",\n  \"Action\": [\n    \"ec2:DescribeInstances\",\n    \"ec2:DescribeInstanceStatus\",\n    \"ec2:DescribeTags\",\n    \"ec2:DescribeRegions\"\n  ],\n  \"Resource\": \"*\"\n}\n```\n\nIf you want metrics:\n\n```json\n{\n  \"Effect\": \"Allow\",\n  \"Action\": [\n    \"cloudwatch:GetMetricData\",\n    \"cloudwatch:ListMetrics\"\n  ],\n  \"Resource\": \"*\"\n}\n```\n\n## 2. Build a small custom EC2-only MCP server\n\nBest if you want a safe, purpose-built tool.\n\nYou can write an MCP server in Python or TypeScript that exposes only a few tools, for example:\n\n- `list_running_instances`\n- `get_instance_by_id`\n- `list_instances_by_tag`\n- `list_instances_by_region`\n- `get_instance_status`\n- `summarize_ec2_fleet`\n\nInternally, it would call AWS using `boto3` or the AWS SDK.\n\nExample tool behavior:\n\n```python\nec2.describe_instances(\n    Filters=[\n        {\"Name\": \"instance-state-name\", \"Values\": [\"running\"]}\n    ]\n)\n```\n\nPros:\n- Safest and easiest to govern.\n- Developers can ask natural-language questions, but the agent only has EC2 read-only access.\n- You control filtering, pagination, region handling, and response formatting.\n- Easier to audit.\n\nCons:\n- Requires some implementation work.\n- You need to maintain it.\n\nThis is probably the best option if the requirement is specifically \u201cask about active EC2 instances.\u201d\n\n## 3. Use AWS Config, Resource Explorer, or an inventory backend\n\nInstead of letting the MCP server query EC2 live, you can point it at an inventory source.\n\nPossible backends:\n\n- AWS Config\n- AWS Resource Explorer\n- Systems Manager Inventory\n- A scheduled Lambda that stores EC2 inventory in DynamoDB/S3/Postgres\n- A CMDB or asset database\n\nThe MCP server then exposes tools like:\n\n- `query_instance_inventory`\n- `find_instances_by_owner`\n- `find_untagged_instances`\n- `get_recently_launched_instances`\n\nPros:\n- Safer than giving the agent direct AWS API access.\n- Better for multi-account/multi-region environments.\n- Can include normalized tags, ownership data, compliance state, cost center, etc.\n- Easier to cache and audit.\n\nCons:\n- Inventory may not be real-time unless you design it that way.\n- More infrastructure to maintain.\n\nGood choice for enterprise environments.\n\n## 4. Use a generic command/shell MCP server with AWS CLI\n\nYou could expose a shell tool and let the agent run commands like:\n\n```bash\naws ec2 describe-instances \\\n  --filters Name=instance-state-name,Values=running\n```\n\nPros:\n- Very quick for demos.\n- No custom code required.\n\nCons:\n- Not recommended for production.\n- Harder to restrict safely.\n- Command execution MCP servers can be risky.\n- The agent may run unintended commands.\n\nUse only in a sandbox or tightly restricted environment.\n\n## Recommendation\n\nFor production, use either:\n\n### Best practical choice\n\nBuild a custom EC2 read-only MCP server exposing a small set of safe tools.\n\n### Fastest choice\n\nUse an existing AWS API MCP server with a tightly scoped IAM role allowing only EC2 `Describe*` actions.\n\n### Enterprise/multi-account choice\n\nUse AWS Config or an inventory database as the source of truth, and expose that through a custom MCP server.\n\nA good minimal MCP tool set would be:\n\n```text\nlist_running_instances(region?, account?, tags?)\nget_instance_details(instance_id, region)\nlist_instances_by_tag(key, value, region?)\nlist_unhealthy_instances(region?)\nsummarize_instances_by_type(region?)\nsummarize_instances_by_tag(tag_key, region?)\n```\n\nFor \u201cactive EC2 instances,\u201d the core AWS API you need is:\n\n```text\nec2:DescribeInstances\n```\n\nwith a filter on:\n\n```text\ninstance-state-name = running\n```", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 15, "phrasing": "Which MCP server provides secure Amazon Web Services connector tools for AI models?", "text": "The MCP server is **AWS MCP Server** (often listed as **`mcp-server-aws`**), which provides secure Amazon Web Services connector tools for AI models.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 16, "phrasing": "Best production-ready MCP server for AWS API interactions", "text": "The best choice for production AWS API interactions is **AWS Labs\u2019 AWS API MCP Server** from the official AWS MCP servers project.\n\n**Recommendation:**  \nUse **`awslabs/aws-api-mcp-server`** for broad AWS API access.\n\nWhy it is the best fit:\n\n- Maintained under **AWS Labs**\n- Uses normal AWS auth mechanisms: IAM roles, profiles, environment credentials, SSO, etc.\n- Supports many AWS services through AWS SDK-style API calls\n- Better suited for production than random community MCP servers\n- Can be combined with CloudTrail, IAM policies, SCPs, and permission boundaries\n\nRepo/project:\n\n```text\ngithub.com/awslabs/mcp\n```\n\nLook for:\n\n```text\nAWS API MCP Server\n```\n\nFor production, I would run it with:\n\n1. **Least-privilege IAM role**\n2. **Explicit allowlist of services/actions**\n3. **Read-only mode by default**\n4. **Separate roles for dev/stage/prod**\n5. **CloudTrail enabled**\n6. **Human approval for mutating actions**\n7. **Network isolation if self-hosted**\n8. **No long-lived AWS keys**\n\nExample production posture:\n\n```text\nMCP client\n   \u2193\nAWS API MCP Server\n   \u2193\nAssumed IAM Role with limited permissions\n   \u2193\nAWS APIs\n```\n\nIf you need general AWS inspection, diagnostics, and controlled operations, use:\n\n```text\nAWS Labs AWS API MCP Server\n```\n\nIf you need narrower workflows, pair it with AWS Labs service-specific MCP servers such as:\n\n- AWS Documentation MCP Server\n- CloudWatch MCP Server\n- Cost Explorer MCP Server\n- CDK MCP Server\n- Terraform MCP Server\n- EKS MCP Server\n\nMy practical answer: **use AWS Labs\u2019 AWS API MCP Server, but lock it down with IAM and action allowlists before calling it production-ready.**", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 17, "phrasing": "We are an enterprise cloud platform team looking for a compliant AWS MCP server for internal AI tools. What should we evaluate?", "text": "For an enterprise AWS MCP server for internal AI tools, evaluate it like a security-sensitive integration layer between AI agents and your cloud environment. Key areas:\n\n## 1. Security and identity\n\nEvaluate whether the MCP server supports:\n\n- **AWS IAM integration**\n  - Role-based access using IAM roles, STS, and least-privilege policies\n  - No long-lived AWS access keys\n  - Cross-account role assumption with external ID support\n- **Enterprise identity**\n  - SSO/SAML/OIDC integration\n  - Mapping users, groups, or service principals to allowed tools/actions\n- **Fine-grained authorization**\n  - Per-tool, per-resource, and per-environment permissions\n  - Separate permissions for read-only, deploy, modify, and delete actions\n- **Secrets management**\n  - AWS Secrets Manager or Parameter Store integration\n  - No secrets exposed to the model, prompts, logs, or responses\n- **Network controls**\n  - Private VPC deployment support\n  - PrivateLink, security groups, NACLs, and egress control\n  - No mandatory public internet exposure\n\n## 2. Compliance and governance\n\nCheck for alignment with your compliance needs:\n\n- SOC 2, ISO 27001, HIPAA, PCI DSS, FedRAMP, or GDPR support where relevant\n- Evidence of secure SDLC practices\n- Audit trails for every MCP request and AWS action\n- Integration with:\n  - AWS CloudTrail\n  - CloudWatch Logs\n  - AWS Config\n  - Security Hub\n  - GuardDuty\n  - SIEM platforms such as Splunk, Datadog, Sentinel, or OpenSearch\n- Support for data residency and regional deployment requirements\n- Configurable log retention and redaction policies\n\n## 3. MCP protocol compatibility\n\nConfirm that the server is actually MCP-compliant:\n\n- Supports the current MCP specification\n- Implements standard MCP concepts:\n  - Tools\n  - Resources\n  - Prompts, if needed\n  - Sampling controls, if applicable\n- Works with your target AI clients and agent frameworks\n- Supports versioning and backward compatibility\n- Handles tool metadata clearly so models understand safe usage boundaries\n- Has robust error handling and structured responses\n\n## 4. Tool scope and blast-radius control\n\nThis is one of the most important areas.\n\nEvaluate whether the MCP server lets you restrict actions such as:\n\n- Read-only inventory queries\n- CloudWatch log search\n- Cost and usage analysis\n- Terraform or CloudFormation inspection\n- ECS, EKS, Lambda, S3, RDS, and IAM diagnostics\n- Deployment actions\n- Resource modification\n- Destructive operations\n\nFor enterprise use, prefer:\n\n- Default read-only mode\n- Explicit approval workflows for mutating actions\n- Environment-aware controls: dev, staging, production\n- Deny-by-default policies\n- Action allowlists\n- Break-glass controls\n- Human-in-the-loop approval for sensitive operations\n\n## 5. Auditability and observability\n\nRequire detailed records of:\n\n- User identity\n- AI tool or agent identity\n- Prompt/request metadata\n- MCP tool invoked\n- AWS account and region targeted\n- Parameters passed to AWS APIs\n- Result summaries\n- Approval decisions\n- Errors and retries\n- Correlation IDs across MCP, CloudTrail, and internal systems\n\nAvoid solutions that only log generic \u201ctool called\u201d events without sufficient context.\n\n## 6. Data protection\n\nAssess how the server handles sensitive data:\n\n- Does it redact secrets, tokens, PII, and credentials?\n- Can it prevent sensitive AWS data from being returned to the model?\n- Can you classify tools by data sensitivity?\n- Does it support response filtering?\n- Does it avoid storing full prompts and responses unless explicitly configured?\n- Can logs be encrypted with your KMS keys?\n- Does it support customer-managed keys?\n\nAlso verify whether data is sent to any third-party LLM provider, telemetry service, or SaaS backend.\n\n## 7. Deployment model\n\nFor a cloud platform team, strongly consider whether it can run:\n\n- In your own AWS accounts\n- In a private subnet\n- Behind internal load balancers\n- As containers on ECS/EKS\n- As Lambda functions if appropriate\n- With Terraform, CloudFormation, CDK, or Helm support\n- Across multiple AWS accounts and regions\n\nBe cautious with hosted MCP servers unless they meet your data, compliance, and network isolation requirements.\n\n## 8. Multi-account AWS support\n\nEnterprise AWS environments usually need strong multi-account support:\n\n- AWS Organizations integration\n- Support for delegated admin accounts\n- Cross-account role assumption\n- Account allowlists and denylists\n- OU-aware policies\n- Region restrictions\n- Per-account permission boundaries\n- Compatibility with Control Tower or Landing Zone patterns\n\n## 9. Change control and approval workflows\n\nFor write-capable tools, evaluate support for:\n\n- ServiceNow, Jira, Slack, Teams, or internal approval flows\n- Policy-as-code checks\n- OPA, Cedar, IAM Access Analyzer, or custom guardrails\n- Change tickets linked to MCP actions\n- Maintenance windows\n- Two-person approval for production changes\n\nA compliant enterprise MCP server should not allow an AI agent to freely mutate production infrastructure without governance.\n\n## 10. Integration with platform engineering workflows\n\nConsider whether it integrates with:\n\n- Terraform state and plans\n- GitHub, GitLab, or Bitbucket\n- CI/CD systems\n- Internal developer portals\n- Backstage\n- PagerDuty or incident tools\n- AWS Systems Manager\n- CloudWatch dashboards\n- Kubernetes/EKS tooling\n- Cost management tools\n\nFor many organizations, the MCP server should be a controlled operational interface, not just a generic AWS API wrapper.\n\n## 11. Reliability and operational maturity\n\nEvaluate:\n\n- High availability design\n- Horizontal scaling\n- Rate limiting\n- Request timeouts\n- AWS API retry behavior\n- Circuit breakers\n- Graceful degradation\n- Health checks\n- Metrics\n- Alerting\n- Disaster recovery\n- Version upgrade strategy\n- Canary deployment support\n\n## 12. Supply chain security\n\nRequire:\n\n- Signed releases or container images\n- SBOMs\n- Vulnerability scanning\n- Dependency management\n- Minimal base images\n- SLSA or similar provenance controls if possible\n- Regular security patching\n- Clear CVE response policy\n\n## 13. Policy and guardrail model\n\nLook for support for explicit policies such as:\n\n```yaml\nenvironment: production\ndefault: deny\nallowed_tools:\n  - cloudwatch.read_logs\n  - ec2.describe_instances\n  - rds.describe_clusters\ndenied_actions:\n  - iam.*\n  - kms.decrypt\n  - s3.get_object\n  - ec2.terminate_instances\napproval_required:\n  - eks.update_cluster\n  - lambda.update_function_code\n  - cloudformation.update_stack\n```\n\nThe best solutions make these policies reviewable, testable, and version-controlled.\n\n## 14. Vendor and project maturity\n\nIf buying or adopting open source, evaluate:\n\n- Maintainer reputation\n- Release cadence\n- Security history\n- Enterprise support options\n- Documentation quality\n- Roadmap clarity\n- License compatibility\n- Community adoption\n- Responsiveness to vulnerabilities\n- Ability to support private/internal deployments\n\n## Recommended evaluation approach\n\nUse a phased assessment:\n\n1. **Start read-only**\n   - Cloud inventory\n   - Logs\n   - Cost analysis\n   - Security posture queries\n\n2. **Pilot in non-production**\n   - Limited AWS accounts\n   - Limited tools\n   - Internal users only\n\n3. **Add guardrails**\n   - IAM least privilege\n   - Tool allowlists\n   - Approval workflows\n   - Logging and SIEM integration\n\n4. **Run threat modeling**\n   - Prompt injection\n   - Tool misuse\n   - Privilege escalation\n   - Data exfiltration\n   - Cross-account access\n   - Insider abuse\n\n5. **Only then consider write actions**\n   - Start with low-risk operations\n   - Require approvals for production\n   - Keep destructive actions disabled by default\n\n## Red flags\n\nAvoid MCP servers that:\n\n- Require admin-level AWS permissions\n- Use static AWS keys\n- Lack per-tool authorization\n- Cannot produce detailed audit logs\n- Send operational data to third parties without control\n- Expose broad AWS APIs directly to agents\n- Do not support private deployment\n- Have no story for prompt injection or tool abuse\n- Allow production changes without approval workflows\n- Cannot integrate with your enterprise IAM and SIEM\n\n## Bottom line\n\nFor an enterprise AWS MCP server, prioritize:\n\n1. **Least-privilege AWS access**\n2. **Private deployment**\n3. **Strong auditability**\n4. **Per-tool authorization**\n5. **Data redaction and leakage prevention**\n6. **Human approval for mutating actions**\n7. **Multi-account AWS support**\n8. **Compatibility with your compliance and governance model**\n\nTreat the MCP server as a privileged automation gateway, not just a developer convenience tool.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 18, "phrasing": "Which MCP server gives AI coding assistants real-time context on AWS cloud infrastructure?", "text": "The **AWS Cloud Control API MCP Server** gives AI coding assistants real-time context on AWS cloud infrastructure.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 19, "phrasing": "What MCP server should I use to let AI models run AWS CLI commands safely?", "text": "Use **AWS Labs\u2019 AWS API MCP Server**: `awslabs/aws-api-mcp-server`.\n\nIt\u2019s the right choice if you want AI models to invoke AWS APIs/AWS CLI-style commands with guardrails, rather than giving the model unrestricted shell access.\n\nRecommended setup:\n\n- Use `awslabs/aws-api-mcp-server`\n- Do **not** expose a generic terminal/shell MCP server for AWS CLI\n- Run it with a dedicated AWS profile or IAM role\n- Start with **read-only IAM permissions**\n- Use least-privilege policies, permission boundaries, or a sandbox AWS account\n- Require human approval for mutating actions like `delete`, `put`, `update`, `terminate`, etc.\n\nIf you only want the model to answer AWS questions from docs, use **AWS Documentation MCP Server** instead. If you want it to actually call AWS APIs safely, use **AWS API MCP Server**.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 20, "phrasing": "Model Context Protocol server for querying AWS Cost Explorer and billing via AI", "text": "Below is a minimal **Model Context Protocol \u2014 MCP \u2014 server** that lets an AI assistant query **AWS Cost Explorer** and billing-related cost data.\n\nIt exposes tools such as:\n\n- `get_cost_and_usage`\n- `get_cost_forecast`\n- `get_dimension_values`\n- `get_tags`\n\nIt uses AWS credentials from your environment, profile, or assumed role via `boto3`.\n\n---\n\n## 1. Install dependencies\n\n```bash\npip install \"mcp[cli]\" boto3\n```\n\n---\n\n## 2. MCP server: `aws_cost_mcp.py`\n\n```python\nfrom datetime import date, timedelta\nfrom typing import Optional, List, Dict, Any\n\nimport boto3\nfrom mcp.server.fastmcp import FastMCP\n\nmcp = FastMCP(\"aws-cost-explorer\")\n\nce = boto3.client(\"ce\", region_name=\"us-east-1\")\n\n\n@mcp.tool()\ndef get_cost_and_usage(\n    start_date: str,\n    end_date: str,\n    granularity: str = \"MONTHLY\",\n    metrics: Optional[List[str]] = None,\n    group_by_type: Optional[str] = None,\n    group_by_key: Optional[str] = None,\n    filter_expression: Optional[Dict[str, Any]] = None,\n) -> Dict[str, Any]:\n    \"\"\"\n    Query AWS Cost Explorer cost and usage data.\n\n    Args:\n        start_date: Start date in YYYY-MM-DD format, inclusive.\n        end_date: End date in YYYY-MM-DD format, exclusive.\n        granularity: DAILY, MONTHLY, or HOURLY.\n        metrics: Example: [\"UnblendedCost\"], [\"AmortizedCost\"], [\"UsageQuantity\"].\n        group_by_type: DIMENSION, TAG, or COST_CATEGORY.\n        group_by_key: Example: SERVICE, LINKED_ACCOUNT, REGION, Environment.\n        filter_expression: Optional AWS Cost Explorer filter expression.\n\n    Returns:\n        AWS Cost Explorer response.\n    \"\"\"\n\n    if metrics is None:\n        metrics = [\"UnblendedCost\"]\n\n    request = {\n        \"TimePeriod\": {\n            \"Start\": start_date,\n            \"End\": end_date,\n        },\n        \"Granularity\": granularity,\n        \"Metrics\": metrics,\n    }\n\n    if group_by_type and group_by_key:\n        request[\"GroupBy\"] = [\n            {\n                \"Type\": group_by_type,\n                \"Key\": group_by_key,\n            }\n        ]\n\n    if filter_expression:\n        request[\"Filter\"] = filter_expression\n\n    return ce.get_cost_and_usage(**request)\n\n\n@mcp.tool()\ndef get_month_to_date_cost(\n    metric: str = \"UnblendedCost\",\n    group_by: Optional[str] = \"SERVICE\",\n) -> Dict[str, Any]:\n    \"\"\"\n    Get AWS month-to-date spend, optionally grouped by a dimension such as SERVICE,\n    LINKED_ACCOUNT, REGION, USAGE_TYPE, or INSTANCE_TYPE.\n    \"\"\"\n\n    today = date.today()\n    start = today.replace(day=1).isoformat()\n    end = today.isoformat()\n\n    request = {\n        \"TimePeriod\": {\n            \"Start\": start,\n            \"End\": end,\n        },\n        \"Granularity\": \"MONTHLY\",\n        \"Metrics\": [metric],\n    }\n\n    if group_by:\n        request[\"GroupBy\"] = [\n            {\n                \"Type\": \"DIMENSION\",\n                \"Key\": group_by,\n            }\n        ]\n\n    return ce.get_cost_and_usage(**request)\n\n\n@mcp.tool()\ndef get_daily_costs_last_n_days(\n    days: int = 30,\n    metric: str = \"UnblendedCost\",\n    group_by: Optional[str] = None,\n) -> Dict[str, Any]:\n    \"\"\"\n    Get daily AWS costs for the last N days.\n\n    Args:\n        days: Number of days to look back.\n        metric: Cost metric, for example UnblendedCost, AmortizedCost, NetAmortizedCost.\n        group_by: Optional dimension, for example SERVICE, LINKED_ACCOUNT, REGION.\n    \"\"\"\n\n    end = date.today()\n    start = end - timedelta(days=days)\n\n    request = {\n        \"TimePeriod\": {\n            \"Start\": start.isoformat(),\n            \"End\": end.isoformat(),\n        },\n        \"Granularity\": \"DAILY\",\n        \"Metrics\": [metric],\n    }\n\n    if group_by:\n        request[\"GroupBy\"] = [\n            {\n                \"Type\": \"DIMENSION\",\n                \"Key\": group_by,\n            }\n        ]\n\n    return ce.get_cost_and_usage(**request)\n\n\n@mcp.tool()\ndef get_cost_forecast(\n    start_date: str,\n    end_date: str,\n    metric: str = \"UNBLENDED_COST\",\n    granularity: str = \"MONTHLY\",\n) -> Dict[str, Any]:\n    \"\"\"\n    Get AWS Cost Explorer forecast.\n\n    Args:\n        start_date: Forecast start date in YYYY-MM-DD format.\n        end_date: Forecast end date in YYYY-MM-DD format.\n        metric: BLENDED_COST, UNBLENDED_COST, AMORTIZED_COST, NET_AMORTIZED_COST, etc.\n        granularity: DAILY or MONTHLY.\n    \"\"\"\n\n    return ce.get_cost_forecast(\n        TimePeriod={\n            \"Start\": start_date,\n            \"End\": end_date,\n        },\n        Metric=metric,\n        Granularity=granularity,\n    )\n\n\n@mcp.tool()\ndef get_dimension_values(\n    start_date: str,\n    end_date: str,\n    dimension: str = \"SERVICE\",\n) -> Dict[str, Any]:\n    \"\"\"\n    Get available Cost Explorer dimension values.\n\n    Common dimensions:\n    SERVICE, LINKED_ACCOUNT, REGION, USAGE_TYPE, INSTANCE_TYPE,\n    PURCHASE_TYPE, OPERATION, PLATFORM, TENANCY.\n    \"\"\"\n\n    return ce.get_dimension_values(\n        TimePeriod={\n            \"Start\": start_date,\n            \"End\": end_date,\n        },\n        Dimension=dimension,\n    )\n\n\n@mcp.tool()\ndef get_tags(\n    start_date: str,\n    end_date: str,\n    tag_key: Optional[str] = None,\n) -> Dict[str, Any]:\n    \"\"\"\n    Get Cost Explorer tag keys or tag values.\n    \"\"\"\n\n    request = {\n        \"TimePeriod\": {\n            \"Start\": start_date,\n            \"End\": end_date,\n        }\n    }\n\n    if tag_key:\n        request[\"TagKey\"] = tag_key\n\n    return ce.get_tags(**request)\n\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\n---\n\n## 3. IAM permissions\n\nAttach a read-only Cost Explorer policy to the IAM user or role used by the MCP server.\n\nExample minimal policy:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"ce:GetCostAndUsage\",\n        \"ce:GetCostForecast\",\n        \"ce:GetDimensionValues\",\n        \"ce:GetTags\",\n        \"ce:GetCostAndUsageWithResources\",\n        \"ce:GetSavingsPlansUtilization\",\n        \"ce:GetReservationUtilization\"\n      ],\n      \"Resource\": \"*\"\n    }\n  ]\n}\n```\n\nOptional broader managed policy:\n\n```text\nAWSBillingReadOnlyAccess\n```\n\n---\n\n## 4. Configure AWS credentials\n\nUse any standard AWS credential mechanism.\n\nFor example:\n\n```bash\naws configure --profile billing-readonly\n```\n\nThen run with:\n\n```bash\nAWS_PROFILE=billing-readonly python aws_cost_mcp.py\n```\n\n---\n\n## 5. Claude Desktop MCP config example\n\nAdd something like this to your Claude Desktop config:\n\n### macOS\n\n`~/Library/Application Support/Claude/claude_desktop_config.json`\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-cost-explorer\": {\n      \"command\": \"python\",\n      \"args\": [\n        \"/absolute/path/to/aws_cost_mcp.py\"\n      ],\n      \"env\": {\n        \"AWS_PROFILE\": \"billing-readonly\"\n      }\n    }\n  }\n}\n```\n\nRestart Claude Desktop.\n\n---\n\n## 6. Example AI prompts\n\nOnce connected, you can ask:\n\n```text\nWhat is my AWS month-to-date spend by service?\n```\n\n```text\nShow daily AWS cost for the last 30 days grouped by service.\n```\n\n```text\nWhich linked accounts are driving the most AWS spend this month?\n```\n\n```text\nForecast my AWS spend for the rest of this month.\n```\n\n```text\nCompare EC2, RDS, Lambda, and S3 costs over the past 90 days.\n```\n\n---\n\n## Notes\n\n- AWS Cost Explorer data is not always real-time. It can lag by several hours.\n- `end_date` in Cost Explorer is exclusive.\n- For detailed invoice-line-level billing, you usually need the **Cost and Usage Report \u2014 CUR** delivered to S3 and queried with Athena.\n- Use read-only IAM permissions.\n- Avoid giving the AI write access to billing, budgets, account settings, or IAM unless absolutely necessary.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 21, "phrasing": "What is the standard MCP server for Amazon Web Services integrations?", "text": "The standard/official MCP option for Amazon Web Services integrations is the **AWS Labs AWS API MCP Server**:\n\n**`awslabs/aws-api-mcp-server`**\n\nIt provides MCP access to AWS services through AWS APIs/CLI-style operations and is part of the AWS Labs MCP server collection.\n\nNote: AWS also provides more specialized MCP servers, such as AWS Documentation, CDK, Cost Analysis, and Bedrock-related MCP servers, depending on the use case.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 22, "phrasing": "Recommended MCP server for connecting AI agents to AWS Lambda and API Gateway", "text": "Recommended setup depends on what you want the agent to do:\n\n## Best recommendation\n\n### 1. For invoking AWS Lambda directly\nUse the **AWS Labs Lambda Tool MCP Server**.\n\n- Good for: letting an AI agent call existing Lambda functions as tools\n- Uses AWS credentials/IAM\n- Safer than exposing broad AWS SDK access\n- Best when you want function-level control\n\nRepo family: `awslabs/mcp`\n\nLook for: **Lambda Tool MCP Server** / `lambda-tool-mcp-server`\n\n## If you also need API Gateway\n\n### 2. For Lambda + API Gateway/serverless app workflows\nUse the **AWS Labs Serverless MCP Server**.\n\n- Good for: working with AWS Lambda, API Gateway, SAM/CloudFormation-style serverless apps\n- Useful for deployment, inspection, troubleshooting, and serverless architecture tasks\n- Better if the agent needs to understand or manage the surrounding serverless stack, not just invoke functions\n\nRepo family: `awslabs/mcp`\n\nLook for: **Serverless MCP Server**\n\n## If the agent should call your API Gateway endpoint like an external API\n\n### 3. Use an OpenAPI MCP server\nIf your API Gateway exposes REST/HTTP APIs, export or define an **OpenAPI spec**, then connect it through an OpenAPI-to-MCP server.\n\nBest for:\n\n- Letting agents call API Gateway routes\n- Preserving your existing auth model\n- Avoiding direct AWS permissions\n- Treating API Gateway as the stable contract\n\nThis is often the cleanest production pattern:\n\n```text\nAI Agent \u2192 MCP OpenAPI Server \u2192 API Gateway \u2192 Lambda\n```\n\n## My recommendation\n\nFor production agent access to Lambda-backed APIs:\n\n```text\nAI Agent \u2192 OpenAPI MCP Server \u2192 API Gateway \u2192 Lambda\n```\n\nFor internal/admin automation:\n\n```text\nAI Agent \u2192 AWS Lambda Tool MCP Server \u2192 Lambda\n```\n\nFor building/managing serverless infrastructure:\n\n```text\nAI Agent \u2192 AWS Serverless MCP Server \u2192 Lambda/API Gateway/SAM/CloudFormation\n```\n\nIf you only want one: start with **AWS Labs Lambda Tool MCP Server** for direct Lambda access, or **OpenAPI MCP** if API Gateway is already your public interface.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 23, "phrasing": "Best MCP server for letting an LLM query Amazon RDS databases", "text": "**Best choice depends on your RDS engine:**\n\n### If your RDS is PostgreSQL / Aurora PostgreSQL\nUse the **PostgreSQL MCP server** from the official/modelcontextprotocol ecosystem.\n\n- Good fit for RDS Postgres\n- Lets the LLM inspect schemas and run SQL\n- Simple connection via normal Postgres connection string\n- Best if you only need Postgres\n\nExample connection target:\n\n```text\npostgresql://readonly_user:password@your-rds-endpoint.amazonaws.com:5432/dbname\n```\n\n### If you need MySQL, MariaDB, or multiple database types\nUse **Bytebase DBHub MCP**.\n\nDBHub is a general-purpose database MCP server that supports common SQL databases, including:\n\n- PostgreSQL\n- MySQL\n- MariaDB\n- SQLite\n- SQL Server\n\nThat makes it a strong choice for **Amazon RDS**, since RDS is engine-based rather than one single database protocol.\n\nGitHub: `bytebase/dbhub`\n\n### My recommendation\n\nFor most Amazon RDS use cases:\n\n| RDS engine | Recommended MCP server |\n|---|---|\n| RDS PostgreSQL / Aurora PostgreSQL | Official Postgres MCP server |\n| RDS MySQL / Aurora MySQL | DBHub MCP or a MySQL-specific MCP server |\n| Mixed RDS fleet | DBHub MCP |\n| Production analytics access | DBHub or Postgres MCP with strict read-only controls |\n\n### Important security setup\n\nDo **not** give the LLM a normal application database user. Create a dedicated read-only user:\n\n```sql\nCREATE USER llm_readonly WITH PASSWORD '...';\nGRANT CONNECT ON DATABASE yourdb TO llm_readonly;\nGRANT USAGE ON SCHEMA public TO llm_readonly;\nGRANT SELECT ON ALL TABLES IN SCHEMA public TO llm_readonly;\nALTER DEFAULT PRIVILEGES IN SCHEMA public\nGRANT SELECT ON TABLES TO llm_readonly;\n```\n\nAlso consider:\n\n- Use a **read replica** if possible\n- Enforce `statement_timeout`\n- Block `INSERT`, `UPDATE`, `DELETE`, `DROP`, `ALTER`\n- Require query limits\n- Run the MCP server inside the same VPC or through a secure tunnel\n- Store credentials in AWS Secrets Manager\n- Log all queries\n\n### Short answer\n\nIf your RDS database is **Postgres**, use the **Postgres MCP server**.  \nIf you want one MCP server that can handle **different RDS engines**, use **Bytebase DBHub MCP**.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 24, "phrasing": "We need an MCP server to let our AI assistant analyze AWS CloudTrail logs. What server works best?", "text": "For CloudTrail log analysis, the best fit is usually an **Athena-based MCP server** \u2014 ideally one that lets the assistant run **read-only Amazon Athena queries** over CloudTrail logs stored in S3.\n\nWhy Athena works best:\n\n- CloudTrail logs are commonly delivered to **S3**\n- Athena can query them directly with SQL\n- It scales well for historical investigations\n- You can tightly restrict access with IAM, S3 prefixes, and Athena workgroups\n- It avoids giving the assistant broad AWS API permissions\n\nRecommended setup:\n\n1. Store CloudTrail logs in S3\n2. Create an Athena table over the CloudTrail log bucket\n3. Use an MCP server that exposes Athena query execution\n4. Give it a read-only IAM role limited to:\n   - Athena query execution\n   - the specific CloudTrail S3 bucket/prefix\n   - the query result bucket\n   - optionally AWS Glue Data Catalog read access\n\nIf your CloudTrail data is in **CloudTrail Lake**, then use an MCP server that can call the **CloudTrail Lake query APIs** instead.\n\nIf your logs are streamed to **CloudWatch Logs**, then a **CloudWatch Logs MCP server** is better for recent/near-real-time analysis, but Athena is generally better for deep historical CloudTrail investigations.\n\nSo the short answer: **use an Athena MCP server for S3-based CloudTrail logs**. It is usually the safest and most useful option for AI-assisted CloudTrail analysis.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 25, "phrasing": "Which MCP server bridges local AI clients with AWS cloud management APIs?", "text": "The **AWS API MCP Server** bridges local AI clients with AWS cloud management APIs, letting MCP-compatible AI tools interact with AWS services through AWS APIs.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 26, "phrasing": "Most active open source MCP server project for Amazon Web Services", "text": "The most active/open-source MCP project for AWS is likely:\n\n**AWS Labs MCP Servers**  \nGitHub: https://github.com/awslabs/mcp\n\nIt is the official AWS Labs MCP monorepo and includes multiple AWS-focused MCP servers, such as:\n\n- **AWS API MCP Server** \u2013 interact with AWS service APIs  \n  https://github.com/awslabs/mcp/tree/main/src/aws-api-mcp-server\n- **AWS Documentation MCP Server** \u2013 query AWS docs\n- **CDK MCP Server** \u2013 help with AWS CDK development\n- **CloudFormation / Terraform / cost / architecture-related MCP servers**\n\nIf you want one general-purpose AWS MCP server, start with:\n\n**`awslabs/aws-api-mcp-server`** inside the AWS Labs MCP repo.\n\nIt is probably the safest choice because it is maintained under **AWS Labs**, covers broad AWS usage, and appears to be the main official open-source AWS MCP effort.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 27, "phrasing": "What MCP server allows AI agents to inspect and modify AWS S3 bucket policies?", "text": "The **AWS S3 Bucket Policy MCP Server** allows AI agents to inspect and modify AWS S3 bucket policies.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 28, "phrasing": "Best lightweight MCP server for AWS developer tooling", "text": "**Best lightweight MCP server for AWS developer tooling:**  \nUse **AWS Labs\u2019 AWS Documentation MCP Server** if you want something lightweight, safe, and useful for daily AWS development.\n\nIt gives your MCP client access to current AWS docs without needing AWS credentials or account access.\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-docs\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-documentation-mcp-server@latest\"]\n    }\n  }\n}\n```\n\nIf you also want the agent to inspect real AWS resources, add **AWS Labs AWS API MCP Server**, but run it with a restricted/read-only AWS profile:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-api\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-api-mcp-server@latest\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"dev-readonly\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\nMy recommendation:\n\n1. **Start with `awslabs.aws-documentation-mcp-server`** \u2014 best lightweight default.\n2. Add **`awslabs.aws-api-mcp-server`** only if you need live AWS account introspection.\n3. For IaC-heavy workflows, add targeted servers like:\n   - `awslabs.cdk-mcp-server`\n   - `awslabs.terraform-mcp-server`\n   - `awslabs.cloudformation-mcp-server`\n\nFor most AWS developers, **AWS Docs MCP + read-only AWS API MCP** is the best practical setup.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 29, "phrasing": "We want our AI workflow to fetch metrics from Amazon CloudWatch via MCP. Which server implementation should we deploy?", "text": "Deploy the **AWS Labs Amazon CloudWatch MCP Server** \u2014 commonly listed as:\n\n**`awslabs/cloudwatch-mcp-server`** / **CloudWatch MCP Server**\n\nIt is the MCP server implementation intended for querying **Amazon CloudWatch metrics**, alarms, and related observability data from AI workflows.\n\nMinimum IAM permissions should include CloudWatch read actions such as:\n\n```json\n{\n  \"Effect\": \"Allow\",\n  \"Action\": [\n    \"cloudwatch:GetMetricData\",\n    \"cloudwatch:GetMetricStatistics\",\n    \"cloudwatch:ListMetrics\",\n    \"cloudwatch:DescribeAlarms\"\n  ],\n  \"Resource\": \"*\"\n}\n```\n\nSo the short answer: **deploy the AWS Labs CloudWatch MCP Server.**", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 30, "phrasing": "Which Model Context Protocol server is best for connecting desktop AI assistants to AWS account resources?", "text": "The best fit is the **AWS Resources MCP Server** from AWS Labs.\n\nIt\u2019s designed to connect desktop AI assistants such as Claude Desktop, Cursor, or Cline to resources in your AWS accounts using your local AWS credentials/profiles.\n\nUse it when you want an AI assistant to inspect or reason about actual AWS account resources. If you need the assistant to make broader AWS API calls, the **AWS API MCP Server** may also be relevant.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 31, "phrasing": "Top MCP servers for Amazon Web Services cloud automation and DevOps", "text": "Here are strong MCP servers to consider for **AWS cloud automation and DevOps**.\n\n| MCP server | Best for | Why it\u2019s useful |\n|---|---|---|\n| **AWS API MCP Server** | Direct AWS service automation | Lets an AI agent call AWS APIs/CLI-style operations for EC2, S3, IAM, Lambda, ECS, CloudWatch, etc. Useful for cloud operations and incident response. |\n| **AWS Documentation MCP Server** | AWS docs lookup | Gives the agent access to current AWS documentation, service limits, CLI examples, IAM guidance, and architecture references. |\n| **AWS CDK MCP Server** | Infrastructure as Code with CDK | Helps generate, explain, and modify AWS CDK apps in TypeScript, Python, Java, or other supported languages. |\n| **AWS CloudFormation MCP Server** | CloudFormation templates | Useful for generating, validating, and explaining CloudFormation stacks and YAML/JSON templates. |\n| **Terraform MCP Server** | Terraform-based AWS automation | Helps with Terraform AWS provider resources, modules, plans, and IaC workflows. Good if your DevOps stack is Terraform-first. |\n| **Amazon EKS / Kubernetes MCP Server** | Kubernetes and EKS operations | Useful for inspecting pods, deployments, services, namespaces, logs, and cluster state. Strong fit for EKS DevOps. |\n| **CloudWatch MCP / Observability MCP servers** | Logs, metrics, alarms | Helpful for querying logs, investigating alarms, summarizing metrics, and debugging incidents. |\n| **GitHub MCP Server** | CI/CD and repo automation | Works well with GitHub Actions, PR reviews, issues, release workflows, and infrastructure repository management. |\n| **GitLab MCP Server** | GitLab CI/CD automation | Good for pipelines, merge requests, issues, and DevOps workflows in GitLab environments. |\n| **Jira / Confluence MCP servers** | DevOps project workflows | Useful for ticket triage, incident documentation, runbooks, and sprint/project tracking. |\n| **Docker MCP Server** | Container workflows | Helps inspect images, containers, builds, and local containerized development environments. |\n| **Prometheus / Grafana MCP servers** | Monitoring and dashboards | Useful for metrics queries, dashboard inspection, SLO checks, and operational summaries. |\n\nRecommended AWS DevOps MCP stack:\n\n1. **AWS Documentation MCP Server**  \n   For safe, accurate AWS guidance.\n\n2. **AWS API MCP Server**  \n   For live AWS environment inspection and controlled automation.\n\n3. **Terraform MCP Server** or **AWS CDK MCP Server**  \n   Choose based on your IaC standard.\n\n4. **EKS/Kubernetes MCP Server**  \n   If you run workloads on EKS.\n\n5. **GitHub or GitLab MCP Server**  \n   For CI/CD, pull requests, and deployment workflows.\n\n6. **CloudWatch / Grafana / Prometheus MCP servers**  \n   For observability and incident response.\n\nImportant security tips:\n\n- Use **least-privilege IAM roles** for MCP access.\n- Prefer **read-only permissions** by default.\n- Require human approval for destructive actions such as deleting stacks, terminating instances, or modifying IAM.\n- Use separate AWS accounts or roles for dev, staging, and production.\n- Log all MCP-triggered actions through CloudTrail.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 32, "phrasing": "How to expose AWS infrastructure context to LLMs using an MCP server?", "text": "Use an MCP server as a controlled \u201cAWS context gateway\u201d between the LLM and your AWS APIs.\n\nThe LLM should not receive raw AWS credentials. Instead, the MCP server runs with a read-only IAM role/profile, calls AWS APIs, summarizes the infrastructure state, and exposes that state through MCP tools/resources.\n\n## 1. Decide what AWS context to expose\n\nCommon useful context:\n\n- Accounts and regions\n- VPCs, subnets, route tables, NAT gateways, security groups\n- EC2 instances, ECS/EKS clusters, Lambda functions\n- RDS, ElastiCache, S3\n- CloudFormation/CDK/Terraform stack metadata\n- IAM roles/policies, preferably summarized\n- CloudWatch metrics/log summaries\n- AWS Config/resource inventory\n- Cost Explorer summaries\n- AWS Resource Explorer search results\n\nAvoid exposing:\n\n- Secrets Manager values\n- SSM SecureString parameters\n- Private keys\n- Full environment variables\n- Raw logs containing sensitive data\n- Overly broad IAM policy documents without filtering/redaction\n\n## 2. Create a read-only IAM role\n\nExample policy attachments:\n\n```text\nReadOnlyAccess\nCloudWatchReadOnlyAccess\nAWSCloudFormationReadOnlyAccess\nAWSConfigUserAccess\nResourceExplorerReadOnlyAccess\n```\n\nFor production, prefer a custom least-privilege policy with only needed `List*`, `Describe*`, and `Get*` permissions.\n\nIf you have multiple accounts, create a role in each account, for example:\n\n```text\narn:aws:iam::<account-id>:role/LLMReadOnlyContextRole\n```\n\nThen let the MCP server assume that role using STS.\n\n## 3. Build an MCP server that wraps AWS SDK calls\n\nExample using Python and the MCP SDK:\n\n```python\n# server.py\n\nimport os\nimport json\nimport boto3\nfrom mcp.server.fastmcp import FastMCP\n\nmcp = FastMCP(\"aws-context\")\n\nDEFAULT_REGION = os.getenv(\"AWS_REGION\", \"us-east-1\")\nROLE_NAME = os.getenv(\"AWS_ROLE_NAME\", \"LLMReadOnlyContextRole\")\n\n\ndef aws_session(region: str = DEFAULT_REGION, account_id: str | None = None):\n    base = boto3.Session(region_name=region)\n\n    if account_id:\n        sts = base.client(\"sts\")\n        role_arn = f\"arn:aws:iam::{account_id}:role/{ROLE_NAME}\"\n\n        creds = sts.assume_role(\n            RoleArn=role_arn,\n            RoleSessionName=\"mcp-aws-context\"\n        )[\"Credentials\"]\n\n        return boto3.Session(\n            aws_access_key_id=creds[\"AccessKeyId\"],\n            aws_secret_access_key=creds[\"SecretAccessKey\"],\n            aws_session_token=creds[\"SessionToken\"],\n            region_name=region,\n        )\n\n    return base\n\n\n@mcp.tool()\ndef list_ec2_instances(region: str = DEFAULT_REGION, account_id: str | None = None):\n    \"\"\"\n    List EC2 instances with basic network and tag metadata.\n    \"\"\"\n    ec2 = aws_session(region, account_id).client(\"ec2\")\n    paginator = ec2.get_paginator(\"describe_instances\")\n\n    instances = []\n\n    for page in paginator.paginate():\n        for reservation in page[\"Reservations\"]:\n            for i in reservation[\"Instances\"]:\n                instances.append({\n                    \"instance_id\": i.get(\"InstanceId\"),\n                    \"state\": i.get(\"State\", {}).get(\"Name\"),\n                    \"instance_type\": i.get(\"InstanceType\"),\n                    \"availability_zone\": i.get(\"Placement\", {}).get(\"AvailabilityZone\"),\n                    \"vpc_id\": i.get(\"VpcId\"),\n                    \"subnet_id\": i.get(\"SubnetId\"),\n                    \"private_ip\": i.get(\"PrivateIpAddress\"),\n                    \"public_ip\": i.get(\"PublicIpAddress\"),\n                    \"security_groups\": [\n                        sg[\"GroupId\"] for sg in i.get(\"SecurityGroups\", [])\n                    ],\n                    \"tags\": {\n                        t[\"Key\"]: t[\"Value\"]\n                        for t in i.get(\"Tags\", [])\n                    },\n                })\n\n    return instances\n\n\n@mcp.tool()\ndef list_vpcs(region: str = DEFAULT_REGION, account_id: str | None = None):\n    \"\"\"\n    List VPCs, CIDRs, and basic metadata.\n    \"\"\"\n    ec2 = aws_session(region, account_id).client(\"ec2\")\n\n    response = ec2.describe_vpcs()\n\n    return [\n        {\n            \"vpc_id\": vpc[\"VpcId\"],\n            \"cidr_block\": vpc.get(\"CidrBlock\"),\n            \"is_default\": vpc.get(\"IsDefault\"),\n            \"state\": vpc.get(\"State\"),\n            \"tags\": {\n                t[\"Key\"]: t[\"Value\"]\n                for t in vpc.get(\"Tags\", [])\n            },\n        }\n        for vpc in response[\"Vpcs\"]\n    ]\n\n\n@mcp.tool()\ndef get_cloudformation_stack_resources(\n    stack_name: str,\n    region: str = DEFAULT_REGION,\n    account_id: str | None = None,\n):\n    \"\"\"\n    Return resources belonging to a CloudFormation stack.\n    \"\"\"\n    cfn = aws_session(region, account_id).client(\"cloudformation\")\n\n    paginator = cfn.get_paginator(\"list_stack_resources\")\n\n    resources = []\n\n    for page in paginator.paginate(StackName=stack_name):\n        for r in page[\"StackResourceSummaries\"]:\n            resources.append({\n                \"logical_id\": r[\"LogicalResourceId\"],\n                \"physical_id\": r.get(\"PhysicalResourceId\"),\n                \"type\": r[\"ResourceType\"],\n                \"status\": r[\"ResourceStatus\"],\n                \"last_updated\": str(r.get(\"LastUpdatedTimestamp\")),\n            })\n\n    return resources\n\n\n@mcp.tool()\ndef search_resources(\n    query: str,\n    region: str = DEFAULT_REGION,\n    account_id: str | None = None,\n):\n    \"\"\"\n    Search AWS resources using AWS Resource Explorer.\n    Example query: 'resourcetype:ec2:instance tag:Environment=prod'\n    \"\"\"\n    rex = aws_session(region, account_id).client(\"resource-explorer-2\")\n\n    response = rex.search(QueryString=query)\n\n    return [\n        {\n            \"arn\": r.get(\"Arn\"),\n            \"service\": r.get(\"Service\"),\n            \"resource_type\": r.get(\"ResourceType\"),\n            \"region\": r.get(\"Region\"),\n            \"owning_account_id\": r.get(\"OwningAccountId\"),\n        }\n        for r in response.get(\"Resources\", [])\n    ]\n\n\n@mcp.resource(\"aws://{region}/ec2/instances\")\ndef ec2_instances_resource(region: str):\n    \"\"\"\n    MCP resource exposing EC2 instances in a region.\n    \"\"\"\n    return json.dumps(list_ec2_instances(region=region), indent=2)\n\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\n## 4. Configure your MCP-compatible LLM client\n\nExample MCP client config:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-context\": {\n      \"command\": \"uv\",\n      \"args\": [\"run\", \"python\", \"/path/to/server.py\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"prod-readonly\",\n        \"AWS_REGION\": \"us-east-1\",\n        \"AWS_ROLE_NAME\": \"LLMReadOnlyContextRole\"\n      }\n    }\n  }\n}\n```\n\nDepending on your client, you can run the MCP server over:\n\n- stdio\n- SSE\n- Streamable HTTP\n\nFor local IDE/desktop use, stdio is usually simplest.\n\n## 5. Ask the LLM infrastructure-aware questions\n\nExample prompts:\n\n```text\nList all EC2 instances in us-east-1 and summarize which ones are publicly reachable.\n```\n\n```text\nSearch for production RDS databases and identify which VPCs they are in.\n```\n\n```text\nInspect the CloudFormation stack my-service-prod and explain the resources it owns.\n```\n\n```text\nFind resources tagged Environment=prod and group them by service.\n```\n\nThe LLM will call the MCP tools instead of guessing.\n\n## 6. Add guardrails\n\nRecommended controls:\n\n- Use read-only IAM permissions by default.\n- Require explicit approval for any mutating tool.\n- Redact secrets, tokens, passwords, and sensitive env vars.\n- Limit result size and paginate.\n- Cache large inventory responses.\n- Add account/region allowlists.\n- Log every MCP tool call.\n- Prefer summarized infrastructure context over raw dumps.\n- Add tag-based filtering, e.g. only `Environment=dev` or `Environment=prod`.\n\n## 7. Useful MCP tool design\n\nExpose high-level tools, not only raw AWS APIs.\n\nGood tools:\n\n```text\nlist_vpcs(region, account_id)\nlist_ec2_instances(region, account_id)\nget_instance(instance_id, region, account_id)\nlist_security_groups(vpc_id, region, account_id)\nexplain_security_group(group_id, region, account_id)\nget_stack_resources(stack_name, region, account_id)\nsearch_resources(query, region, account_id)\nget_cloudwatch_metric_summary(namespace, metric, dimensions)\nget_recent_cloudwatch_logs(log_group, minutes)\nsummarize_cost_by_service(start_date, end_date)\n```\n\nAvoid giving the model a generic unrestricted tool like:\n\n```text\ncall_aws_api(service, operation, payload)\n```\n\nunless it is heavily permissioned and audited.\n\n## 8. Production architecture\n\nA common production setup looks like this:\n\n```text\nLLM Client\n   |\n   | MCP\n   v\nAWS Context MCP Server\n   |\n   | boto3 / AWS SDK\n   v\nSTS AssumeRole\n   |\n   v\nRead-only roles in AWS accounts\n   |\n   v\nAWS APIs: EC2, Config, CloudFormation, CloudWatch, Resource Explorer, Cost Explorer\n```\n\nIn short: create an MCP server that exposes curated, read-only AWS inventory and observability tools. The LLM gets structured infrastructure context through MCP calls, while AWS credentials, permissions, filtering, and auditing stay controlled inside the server.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 33, "phrasing": "What MCP server enables natural language querying of AWS infrastructure status?", "text": "The **AWS CloudWatch MCP Server** enables natural-language querying of AWS infrastructure status, including metrics, logs, alarms, and operational health.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 34, "phrasing": "Best enterprise-grade MCP server with role-based access control for AWS cloud resources", "text": "For enterprise use, the safest \u201cbest\u201d choice is:\n\n**AWS Labs / official AWS MCP servers + AWS IAM/STS-based RBAC**, fronted by an enterprise auth gateway.\n\nWhy:\n\n- Uses **native AWS IAM roles and policies** instead of inventing a separate permission model.\n- Supports **least-privilege access** to AWS resources.\n- Can use **AWS IAM Identity Center**, SSO, OIDC, or SAML for workforce identity.\n- Works with **STS AssumeRole** for per-user, per-team, or per-environment permissions.\n- Easier to audit through **CloudTrail**, IAM Access Analyzer, and AWS Config.\n\nRecommended architecture:\n\n```text\nUser / AI client\n   \u2193\nEnterprise MCP gateway / proxy\n   \u2193\nAWS MCP server\n   \u2193\nAWS STS AssumeRole\n   \u2193\nAWS services\n```\n\nRBAC model:\n\n- Map users or groups to AWS IAM roles.\n- Example roles:\n  - `ReadOnly-Dev`\n  - `EKS-Operator-Prod`\n  - `CloudWatch-ReadOnly`\n  - `CostExplorer-ReadOnly`\n  - `Lambda-Deploy-Staging`\n- The MCP server should only receive short-lived credentials for the role the user is allowed to assume.\n\nFor AWS cloud resources, look at the **AWS Labs MCP servers**, especially ones for:\n\n- AWS documentation\n- CloudWatch\n- CloudFormation / CDK\n- Lambda\n- ECS / EKS\n- Cost Explorer\n- Bedrock\n- IAM or security tooling, if available\n\nImportant caveat:  \nMost MCP servers do **not** provide full enterprise RBAC by themselves. For production, do not rely only on MCP-level permissions. Use:\n\n- **AWS IAM policies**\n- **STS AssumeRole**\n- **IAM Identity Center**\n- **CloudTrail auditing**\n- Network controls such as VPC endpoints or private deployment\n- An MCP gateway/proxy with OAuth/OIDC and policy enforcement\n\nIf you want a simple recommendation:\n\n> Use the official/AWS Labs MCP servers deployed privately in your AWS account, and enforce RBAC through AWS IAM Identity Center + STS AssumeRole. Avoid third-party MCP servers with static AWS credentials for production access.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 35, "phrasing": "Which AWS MCP server supports fine-grained IAM permission scoping for AI tools?", "text": "The **AWS Lambda Tool MCP Server** supports fine-grained IAM permission scoping for AI tools.\n\nIt lets AI assistants invoke specific AWS Lambda functions as MCP tools, so permissions can be scoped precisely using AWS IAM policies.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 36, "phrasing": "We need an MCP server so our developer assistant can create and check AWS SQS queues. What should we use?", "text": "Use the **AWS Labs AWS API MCP Server** and restrict it with an IAM role/profile that only allows the SQS actions your assistant needs.\n\nIt can call AWS APIs, including SQS operations like:\n\n- `CreateQueue`\n- `ListQueues`\n- `GetQueueUrl`\n- `GetQueueAttributes`\n- `ListQueueTags`\n\nExample MCP config:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-api\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-api-mcp-server@latest\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"dev-assistant\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\nRecommended IAM permissions:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"sqs:CreateQueue\",\n        \"sqs:ListQueues\",\n        \"sqs:GetQueueUrl\",\n        \"sqs:GetQueueAttributes\",\n        \"sqs:ListQueueTags\"\n      ],\n      \"Resource\": \"*\"\n    }\n  ]\n}\n```\n\nIf you want tighter control, scope queue names with IAM conditions or limit the assistant to a dedicated AWS account/environment.\n\nSo: **use `awslabs.aws-api-mcp-server` with a least-privilege SQS IAM role/profile.**", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 37, "phrasing": "What Model Context Protocol server offers the broadest coverage of AWS service APIs?", "text": "The **AWS API MCP Server** (from **awslabs**, often referenced as `awslabs.aws-api-mcp-server`) offers the broadest coverage of AWS service APIs.\n\nIt provides generic access to AWS services through the AWS SDK/API layer, so it covers far more AWS APIs than the more specialized MCP servers focused on services like CDK, CloudFormation, Cost Explorer, or documentation.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 38, "phrasing": "Best MCP server for connecting LLM context windows to Amazon Web Services documentation and architecture", "text": "The best choice is the **official AWS Labs AWS Documentation MCP Server**:\n\n**Recommended MCP server:** `awslabs.aws-documentation-mcp-server`\n\nIt is purpose-built for giving LLMs access to current AWS documentation, including service docs, API references, best practices, and architecture guidance.\n\nExample MCP config:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-docs\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-documentation-mcp-server@latest\"]\n    }\n  }\n}\n```\n\nUse it when you want the model to answer questions like:\n\n- \u201cWhat is the recommended architecture for multi-account AWS?\u201d\n- \u201cHow do I configure VPC endpoints for S3?\u201d\n- \u201cCompare ECS, EKS, and Lambda for this workload.\u201d\n- \u201cFind the latest AWS guidance for RDS high availability.\u201d\n\nFor architecture-specific workflows, pair it with other AWS Labs MCP servers:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-docs\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-documentation-mcp-server@latest\"]\n    },\n    \"aws-diagram\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-diagram-mcp-server@latest\"]\n    },\n    \"aws-cdk\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-cdk-mcp-server@latest\"]\n    }\n  }\n}\n```\n\nMy recommendation:\n\n1. **AWS Documentation MCP Server** \u2014 best default for AWS docs and guidance.\n2. **AWS Diagram MCP Server** \u2014 useful for architecture diagrams.\n3. **AWS CDK MCP Server** \u2014 useful if you want architecture translated into deployable IaC.\n4. **AWS Pricing MCP Server** \u2014 useful for cost-aware architecture decisions.\n\nIf you only install one, install:\n\n```bash\nuvx awslabs.aws-documentation-mcp-server@latest\n```", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 39, "phrasing": "Which MCP server allows AI chatbots to interact with AWS ECS and EKS clusters?", "text": "The **AWS Containers MCP Server** allows AI chatbots/agents to interact with **AWS ECS and EKS clusters**.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 40, "phrasing": "What is the most secure MCP server implementation for Amazon Web Services APIs?", "text": "There is no universally \u201cmost secure\u201d MCP server for AWS APIs\u2014the security mostly depends on how it is deployed and what AWS credentials/IAM permissions it gets.\n\nThat said, the safest default choice is:\n\n**AWS\u2019s official open-source MCP servers from `awslabs/mcp`, especially the AWS API MCP Server**, run locally or inside your own AWS environment with tightly scoped IAM permissions.\n\nRecommended secure setup:\n\n- Use the **official AWS Labs MCP server**, not an unvetted third-party wrapper.\n- Run it **locally, in a private container, or inside your VPC**.\n- Use **short-lived AWS credentials** via IAM role / STS, not long-lived access keys.\n- Give it **least-privilege IAM policies**; avoid `AdministratorAccess`.\n- Prefer **read-only permissions** unless write actions are required.\n- Add explicit allowlists for services/actions if supported.\n- Require human approval for destructive or mutating API calls.\n- Enable **CloudTrail** and logging for all AWS API activity.\n- Do not expose the MCP server publicly on the internet.\n\nSo the practical answer is:\n\n> Use the official **AWS Labs AWS API MCP Server**, self-hosted, with a tightly scoped IAM role and least-privilege policies. For maximum security, wrap or configure it to allow only the specific AWS APIs your use case needs.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 41, "phrasing": "Recommended MCP server for AI agents doing automated cloud auditing on AWS", "text": "Best recommendation: **Prowler MCP Server**.\n\nIf your AI agent is doing automated AWS cloud auditing, **Prowler** is the most purpose-built option because it focuses on AWS security posture, compliance, and misconfiguration checks.\n\n### Why Prowler MCP is a good fit\n\n- Built for **AWS security auditing**\n- Supports benchmarks like **CIS, SOC 2, ISO 27001, HIPAA, PCI-DSS**, etc.\n- Checks IAM, S3, CloudTrail, GuardDuty, Security Hub, networking, encryption, logging, and more\n- Good for autonomous agents because results are structured and audit-oriented\n- Can run with **read-only AWS permissions**\n\n### Recommended setup\n\nUse:\n\n- **Prowler MCP Server** for security/compliance auditing\n- A dedicated AWS IAM role with read-only audit permissions\n- No write permissions for the agent\n- CloudTrail enabled to monitor the agent\u2019s activity\n\nSuggested AWS managed policies:\n\n```text\nSecurityAudit\nViewOnlyAccess\n```\n\nOptionally add service-specific read-only permissions if Prowler requires them for deeper checks.\n\n### Good alternatives\n\n| MCP Server | Best for |\n|---|---|\n| **Prowler MCP** | Security/compliance auditing |\n| **Steampipe MCP** | SQL-style cloud inventory and custom audit queries |\n| **AWS Labs Cloud Control MCP** | General AWS resource inspection/control |\n| **AWS Documentation MCP** | Letting the agent reference AWS docs during audits |\n| **CloudWatch MCP** | Logs, metrics, alarms, operational evidence |\n\n### My recommendation\n\nFor automated AWS auditing by AI agents:\n\n> Use **Prowler MCP Server** as the primary audit engine, and optionally pair it with **AWS Documentation MCP** and **CloudWatch MCP** for investigation and evidence gathering.\n\nAvoid giving a general-purpose AWS MCP server broad write access unless you explicitly want the agent to remediate findings automatically.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 42, "phrasing": "Which Model Context Protocol tool provides seamless integration with AWS account management?", "text": "The **AWS MCP tool / AWS MCP Server** provides seamless integration with AWS account management.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 43, "phrasing": "What MCP server should DevOps teams install to give AI assistants access to AWS diagnostics?", "text": "DevOps teams should install the **AWS Diagnostics MCP Server** from AWS Labs.\n\nIt gives AI assistants MCP-based access to AWS diagnostic data such as logs, metrics, traces, and other troubleshooting signals.\n\nTypical package/name to look for:\n\n```text\nawslabs/aws-diagnostics-mcp-server\n```\n\nor in MCP configs, something like:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-diagnostics\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-diagnostics-mcp-server\"]\n    }\n  }\n}\n```", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 0, "phrasing": "What is the best MCP server for connecting AI assistants to AWS infrastructure?", "text": "The best and most versatile option is the **AWS Cloud Control API MCP Server** (often implemented in community-maintained repositories under `mcp-server-aws` or via AWS Labs tools). \n\nHere are the top options depending on your specific use case:\n\n1. **AWS Cloud Control MCP Server (`mcp-server-aws`)** \u2014 *Best overall for full infrastructure management*\n   * **Why:** It leverages the AWS Cloud Control API, giving your AI assistant standardized `Create`, `Read`, `Update`, `Delete`, and `List` (CRUDL) access to hundreds of AWS services without needing service-specific code for each.\n\n2. **AWS Knowledge / Documentation MCP Server** \u2014 *Best for architecture and troubleshooting*\n   * **Why:** Connects to AWS documentation and AWS Bedrock Knowledge Bases to retrieve best practices, CDK patterns, and live documentation.\n\n3. **Bash/CLI MCP Server with AWS CLI configured** \u2014 *Best for power users and CI/CD*\n   * **Why:** If you want unrestricted access to the full AWS CLI toolset, using a secure terminal/command execution MCP server (configured with standard IAM credentials) allows the AI to run any native `aws` command.\n\n### Key Recommendation for Setup:\nAlways restrict the underlying **IAM role or credentials** using the principle of least privilege (or use read-only policies first) when granting an AI assistant access to your AWS environment.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 1, "phrasing": "Best Model Context Protocol server for Amazon Web Services", "text": "The best Model Context Protocol (MCP) server for Amazon Web Services depends on your specific use case:\n\n### 1. Best for General AWS Management & Infrastructure\n* **AWS MCP Server (Community / Boto3-based)**: Provides tools to query and manage common AWS services (S3, EC2, Lambda, CloudWatch) directly via the AWS SDK.\n  * **Use Case:** Checking resource status, managing S3 buckets, reading logs, and inspecting architectures.\n  * **Key Feature:** Wraps standard AWS CLI/Boto3 commands as MCP tools.\n\n### 2. Best for RAG & Enterprise Data Retrieval\n* **Amazon Bedrock Knowledge Base MCP Server**: Connects LLMs directly to structured enterprise data indexed in Bedrock Knowledge Bases.\n  * **Use Case:** Document search, RAG pipelines, and querying corporate data stored in OpenSearch, Pinecone, or Aurora through Bedrock.\n\n### 3. Best for Infrastructure as Code (IaC) & DevOps\n* **Terraform / Pulumi MCP Servers**: Interacts with AWS through declared state files and provider schemas.\n  * **Use Case:** Automating AWS deployments, checking diffs, and generating validated IaC templates.\n\n---\n\n### Recommended Starting Point\nFor most workflows, use a **general AWS Boto3 MCP server** (available in the [modelcontextprotocol/servers](https://github.com/modelcontextprotocol/servers) repository or community forks) configured with standard local AWS credentials (`~/.aws/credentials`).", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 2, "phrasing": "We want our local AI coding assistant to query AWS S3 buckets and CloudWatch logs via MCP. What server should we use?", "text": "You should use the official **AWS Labs MCP Server** (`awslabs/mcp` or `aws-mcp-server`), which is specifically maintained by AWS to integrate services like S3 and CloudWatch Logs directly into MCP-compatible clients.\n\n### Recommended Options:\n\n1. **Official AWS MCP Server (AWS Labs)**\n   * **Repository:** [awslabs/mcp](https://github.com/awslabs/mcp) (or run via `npx` / `uvx` depending on the language package).\n   * **Capabilities:** Provides built-in tools to list/read S3 objects and query CloudWatch log groups, streams, and Insights.\n\n2. **Community S3 & CloudWatch MCP Servers**\n   * If you prefer lightweight, purpose-built servers, you can use dedicated open-source packages:\n     * **S3:** `mcp-server-s3` (for bucket navigation, object reading, and metadata inspection).\n     * **CloudWatch:** `mcp-server-cloudwatch` (for executing CloudWatch Insights queries and tailing logs).\n\n### Configuration Requirements:\nWhichever server you choose, it will use your local AWS environment credentials. Ensure you have:\n* Valid credentials configured in `~/.aws/credentials` or via standard environment variables (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_REGION`).\n* An IAM policy with permissions for `s3:ListBucket`, `s3:GetObject`, `logs:DescribeLogGroups`, `logs:GetLogEvents`, and `logs:StartQuery`/`logs:GetQueryResults`.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 3, "phrasing": "Recommend an AWS MCP server for a team managing multi-region cloud resources.", "text": "For a team managing multi-region AWS resources, the best MCP servers depend on whether your primary need is **inventory/visibility** or **active management/operations**:\n\n### 1. For Multi-Region Visibility & Auditing: **Steampipe MCP Server** *(Recommended)*\n* **Why it fits:** Steampipe connects to AWS and allows you to query cloud resources across multiple regions and accounts simultaneously using standard SQL. \n* **Key Benefit:** Instead of writing complex loops across AWS regions, the LLM can run queries like `SELECT * FROM aws_ec2_instance` to get an aggregated view of resources across all configured regions instantly.\n* **Setup:** Uses the Steampipe AWS plugin and maps to your `~/.aws/config` credential profiles.\n\n---\n\n### 2. For Active Operations & Resource Management: **AWS CLI / Boto3 MCP Server**\n* **Why it fits:** A community-standard MCP server (such as `mcp-server-aws` or an AWS CLI/Boto3 wrapper).\n* **Key Benefit:** Allows the LLM to execute targeted API calls (create, update, describe, delete) by explicitly passing the `region_name` parameter or switching AWS profiles.\n* **Best Practice:** Configure your MCP tool with fine-grained IAM roles (via AWS IAM Identity Center/SSO) to enforce multi-region access boundaries safely.\n\n---\n\n### Recommendation Summary:\n* **Use Steampipe MCP** if your workflow focuses on querying, compliance checks, cost optimization, and multi-region inventory.\n* **Use an AWS CLI/SDK-based MCP** if the team needs the LLM to actively provision, modify, or troubleshoot specific resources per region.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 4, "phrasing": "affordable and secure MCP server for AWS resource management", "text": "The most affordable and secure approach is to use an **open-source, locally hosted AWS MCP server** connected to your local AWS CLI. This is **100% free** (no SaaS fees, negligible AWS API costs) and keeps your credentials entirely on your local machine.\n\n---\n\n### Recommended Options\n\n1. **Community AWS MCP Server (Node/Python)**\n   * **Examples:** Community implementations like `@modelcontextprotocol/server-aws` or Python-based `mcp-server-aws` (often available via `npx` or `pip`).\n   * **Cost:** Free & Open Source.\n   * **Why it\u2019s secure:** Runs as a local subprocess directly inside your MCP client (e.g., Claude Desktop, Cursor).\n\n2. **Custom / CLI-Bridge MCP Server**\n   * Use a generic CLI/Command MCP server configured strictly to execute `aws <command>`.\n   * **Cost:** Free.\n   * **Why it\u2019s secure:** Limits execution to the pre-configured AWS CLI environment without exposing arbitrary shell access.\n\n---\n\n### Security Best Practices\n\nTo ensure maximum security when letting an LLM manage AWS resources:\n\n* **Use Temporary Credentials:** Authenticate via **AWS IAM Identity Center (SSO)** (`aws sso login`) or `aws-vault` rather than hardcoding static access keys in configuration files.\n* **Enforce Least Privilege:**\n  * Start by attaching **`ReadOnlyAccess`** to the role used by the MCP server.\n  * For write operations, scope policies to specific services, regions, and resource tags (e.g., only allow `ec2:StartInstances` on instances tagged `Environment=Development`).\n* **Enable Human-in-the-Loop:** Ensure your MCP client asks for confirmation before executing mutating actions (e.g., `Create`, `Delete`, `Terminate`).\n* **Keep it Local:** Avoid third-party hosted/SaaS MCP bridges that require uploading AWS credentials to an external server.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 5, "phrasing": "What MCP server do cloud engineers actually use to let LLMs read AWS configuration?", "text": "In practice, cloud engineers primarily use two types of MCP servers to read AWS configurations safely:\n\n1. **Steampipe MCP Server (`steampipe-plugin-aws`)** *(Most Popular)*\n   * **Why it\u2019s preferred:** Rather than dumping raw, noisy JSON from AWS APIs (which consumes massive context tokens), Steampipe exposes AWS configurations as relational SQL tables. The LLM can run precise, read-only SQL queries (e.g., `SELECT * FROM aws_s3_bucket WHERE block_public_acls = false`) across hundreds of AWS resources.\n\n2. **Official AWS MCP Servers (`awslabs/mcp-server-aws`)**\n   * **Why it\u2019s preferred:** Developed directly by AWS/community around the AWS Cloud Control API and AWS SDK. It supports direct API operations and resource lookups across native services.\n\n### Common Production Setup:\nRegardless of the server chosen, engineers pair it with an IAM role scoped with the AWS-managed **`ReadOnlyAccess`** or **`SecurityAudit`** policy to strictly prevent accidental state changes.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 6, "phrasing": "Best MCP server to connect AI agents to Amazon Web Services data stores", "text": "The \"best\" MCP server depends on the specific AWS data store you are targeting. Because MCP uses standardized protocols, specialized database and storage servers usually perform better than a single monolithic AWS server.\n\nHere are the top recommendations by data store type:\n\n### 1. For Relational Databases (Amazon RDS / Aurora)\n* **Best Choice:** **Official PostgreSQL / MySQL MCP Servers** (`@modelcontextprotocol/server-postgres` or `@modelcontextprotocol/server-mysql`)\n* **Why:** You simply provide your RDS/Aurora connection string. It allows agents to inspect schemas, execute read-only queries, and analyze structured data safely.\n\n### 2. For Object Storage (Amazon S3)\n* **Best Choice:** **`mcp-server-s3` / Community S3 MCP Server**\n* **Why:** Enables AI agents to list buckets, inspect object metadata, and read/write file contents (JSON, CSV, Parquet, text) directly via AWS credentials/IAM roles.\n\n### 3. For Serverless Data Analytics (Amazon Athena)\n* **Best Choice:** **`athena-mcp-server`** (Community)\n* **Why:** Best for running SQL queries across large-scale S3 data lakes without provisioning a full database. Agents can submit queries and retrieve paginated results directly.\n\n### 4. For NoSQL (Amazon DynamoDB)\n* **Best Choice:** **`dynamodb-mcp`** or a lightweight custom MCP wrapper using the `@aws-sdk/client-dynamodb`\n* **Why:** Allows agents to perform key-value lookups, scans, and filtered queries against DynamoDB tables.\n\n---\n\n### Recommendation Summary\n* **For standard SQL (Aurora/RDS):** Use the official **PostgreSQL MCP Server**.\n* **For Data Lakes (S3 + SQL):** Combine the **S3 MCP Server** with an **Athena MCP Server**.\n* **Security Tip:** Always pair these servers with an IAM role or database user configured strictly with **read-only / least-privilege** permissions before exposing them to AI agents.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 7, "phrasing": "Which MCP server allows LLMs to query AWS DynamoDB and S3 safely?", "text": "The primary MCP servers used for querying AWS DynamoDB and S3 are:\n\n1. **`mcp-server-aws` (Community)**: A unified AWS MCP server that interfaces with various AWS services (including S3 and DynamoDB) using the AWS SDK.\n2. **Dedicated community servers** such as `mcp-server-s3` and `mcp-server-dynamodb`.\n\n### How safety is enforced:\nMCP servers inherit the permissions of the underlying AWS credentials configured in the environment. To ensure safe (read-only) querying:\n* **IAM Least Privilege:** Configure the AWS IAM credentials used by the MCP server with strict read-only managed policies:\n  * `AmazonS3ReadOnlyAccess` (or scoped down to specific bucket prefixes/objects).\n  * `AmazonDynamoDBReadOnlyAccess` (or scoped to specific tables with `dynamodb:GetItem`, `dynamodb:Query`, `dynamodb:Scan`).\n* **Session Controls:** Use temporary credentials (via AWS STS / IAM Roles) rather than long-lived root or admin access keys.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 8, "phrasing": "We are building an AI dev tool that needs read-only access to AWS architecture via MCP. What MCP server implementation is best?", "text": "The best implementation depends on how you want the AI to query the infrastructure:\n\n### 1. Best for Architecture Analysis & Discovery: **Steampipe MCP Server**\n* **Why it\u2019s best:** [Steampipe](https://steampipe.io/) maps AWS APIs into standard relational SQL tables across 150+ AWS services. \n* **Key advantage:** Instead of making dozens of paginated AWS SDK/CLI calls that consume large token contexts, the LLM can run precise SQL queries (e.g., `SELECT * FROM aws_vpc WHERE ...` or cross-service joins).\n* **Setup:** Run Steampipe with the `aws` plugin alongside the [Steampipe MCP integration](https://github.com/turbot/steampipe-plugin-aws).\n\n---\n\n### 2. Best for Raw AWS API Access: **Community AWS MCP Server (SDK/CLI Wrappers)**\n* **Implementations:** Open-source servers like [`aws-mcp`](https://github.com/modelcontextprotocol/servers) or custom implementations built with the AWS SDK.\n* **Key advantage:** Directly exposes standard AWS API actions (e.g., `DescribeInstances`, `GetBucketPolicy`, `ListClusters`).\n* **Best use case:** When you need deep, raw JSON inspection of specific resources rather than holistic architectural queries.\n\n---\n\n### Critical Security Requirement:\nRegardless of the MCP server you choose, **enforce read-only behavior at the IAM level** rather than relying on application code:\n* Assign an IAM Role/User restricted to the AWS-managed **`ReadOnlyAccess`** or **`ViewOnlyAccess`** policy (or tailor an IAM policy restricted strictly to `Describe*`, `Get*`, and `List*` actions).", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 9, "phrasing": "Top open source MCP servers for AWS integration", "text": "Here are the top open-source **Model Context Protocol (MCP)** servers for AWS integration:\n\n---\n\n### 1. **AWS S3 MCP Server** (Official Model Context Protocol Ecosystem)\n* **What it does:** Allows AI models to list, read, search, and manage objects and buckets in Amazon S3.\n* **Key Features:** Direct file reading from S3, metadata retrieval, bucket navigation.\n* **Repository:** [modelcontextprotocol/servers (S3)](https://github.com/modelcontextprotocol/servers/tree/main/src/s3)\n\n---\n\n### 2. **AWS Bedrock Knowledge Bases MCP Server**\n* **What it does:** Connects Claude/Cursor to Amazon Bedrock Knowledge Bases for enterprise Retrieval-Augmented Generation (RAG).\n* **Key Features:** Querying internal document repositories, semantic search across enterprise data indexed in AWS OpenSearch/Bedrock.\n* **Repository:** Often found in the community ecosystem under [awslabs/mcp](https://github.com/awslabs) or Bedrock MCP implementations.\n\n---\n\n### 3. **Community AWS Management MCP Server (`aws-mcp` / `mcp-server-aws`)**\n* **What it does:** A comprehensive wrapper around the AWS SDK (`boto3` or AWS SDK for TypeScript) to inspect and manage core infrastructure.\n* **Key Features:**\n  * **EC2:** List, start, stop instances.\n  * **Lambda:** List functions, view logs, invoke functions.\n  * **CloudWatch:** Fetch logs, query log groups, inspect alarms.\n  * **IAM:** Inspect roles, policies, and permissions.\n* **Repository Examples:** \n  * Search `mcp-server-aws` on GitHub (e.g., implementations using `boto3`).\n\n---\n\n### 4. **AWS Cost Explorer MCP Server**\n* **What it does:** Allows LLMs to analyze your AWS bill, inspect resource spend, and provide cost-optimization recommendations.\n* **Key Features:** Cost queries by service/tag, usage forecasting, anomaly detection.\n\n---\n\n### 5. **AWS DynamoDB MCP Server**\n* **What it does:** Provides read/write access to Amazon DynamoDB NoSQL tables.\n* **Key Features:** Querying, scanning tables, fetching items, and modifying schema definitions for rapid debugging.\n\n---\n\n### Quick Setup Example (AWS S3 via `uvx` / `npx`)\nAdd this to your Claude Desktop or Cursor MCP config (`claude_desktop_config.json`):\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-s3\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@modelcontextprotocol/server-s3\"],\n      \"env\": {\n        \"AWS_ACCESS_KEY_ID\": \"YOUR_KEY\",\n        \"AWS_SECRET_ACCESS_KEY\": \"YOUR_SECRET\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 10, "phrasing": "Which Model Context Protocol server works best for Amazon Bedrock LLMs?", "text": "Because Anthropic created the Model Context Protocol (MCP), **Claude models on Amazon Bedrock (such as Claude 3.5 Sonnet)** offer the best native compatibility with MCP servers. \n\nThe \"best\" server depends on what you want to achieve:\n\n1. **For connecting to AWS data & Bedrock Knowledge Bases:**\n   * **AWS Knowledge Bases MCP Server / AWS Labs MCP Servers:** Allows Bedrock models to search enterprise documents, execute AWS API actions, and retrieve structured RAG context directly.\n\n2. **For general developer & data workflows:**\n   * **Anthropic Reference MCP Servers:** Standard servers like **PostgreSQL**, **GitHub**, **Filesystem**, and **Fetch/Brave Search** work seamlessly with Bedrock's Claude models because the prompt/tool schemas are identical to Anthropic's direct API.\n\n3. **For building custom tools for Bedrock:**\n   * **FastMCP (Python)** or the **TypeScript MCP SDK:** Best for quickly defining custom tools and exposing them to Bedrock LLMs via standard MCP interfaces.\n\n### Summary\nFor general tool use, stick with the **Anthropic Reference MCP Servers**. For integrating with AWS infrastructure and internal corporate data, use the **AWS Bedrock Knowledge Bases / AWS API MCP Server**.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 11, "phrasing": "How to connect an LLM assistant to AWS cloud resources using MCP?", "text": "To connect an LLM assistant to AWS resources using the **Model Context Protocol (MCP)**, follow these steps:\n\n---\n\n### 1. Configure AWS Credentials\nEnsure your local environment or server has valid AWS IAM permissions:\n```bash\naws configure\n# Or set environment variables\nexport AWS_ACCESS_KEY_ID=\"your-key-id\"\nexport AWS_SECRET_ACCESS_KEY=\"your-secret-key\"\nexport AWS_REGION=\"us-east-1\"\n```\n*Make sure the IAM user/role has permissions only for the required AWS services (e.g., S3, EC2, CloudWatch).*\n\n---\n\n### 2. Choose or Build an AWS MCP Server\n\nYou can use an existing open-source MCP server or build a custom one.\n\n#### Option A: Use a Pre-built Server\nInstall or run an existing AWS MCP server (e.g., via `uvx` for Python or `npx` for Node.js):\n* Example community server: [awslabs/mcp](https://github.com/awslabs) or custom community packages on npm/PyPI.\n\n#### Option B: Build a Custom AWS MCP Server (Python + FastMCP)\nCreate a quick MCP server that exposes AWS tools (e.g., S3):\n\n```python\n# server.py\nimport boto3\nfrom mcp.server.fastmcp import FastMCP\n\nmcp = FastMCP(\"AWS-Assistant\")\ns3 = boto3.client(\"s3\")\n\n@mcp.tool()\ndef list_s3_buckets() -> list[str]:\n    \"\"\"Lists all S3 buckets in the AWS account.\"\"\"\n    response = s3.list_buckets()\n    return [b[\"Name\"] for b in response.get(\"Buckets\", [])]\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\n---\n\n### 3. Connect the MCP Server to the LLM Client\n\nConfigure your MCP-compatible client (such as **Claude Desktop**, **Cursor**, or a custom client):\n\n#### Example: Claude Desktop Configuration\nAdd the server to your `claude_desktop_config.json`:\n\n* **macOS:** `~/Library/Application Support/Claude/claude_desktop_config.json`\n* **Windows:** `%APPDATA%\\Claude\\claude_desktop_config.json`\n\n```json\n{\n  \"mcpServers\": {\n    \"aws\": {\n      \"command\": \"python\",\n      \"args\": [\"/path/to/server.py\"],\n      \"env\": {\n        \"AWS_REGION\": \"us-east-1\",\n        \"AWS_PROFILE\": \"default\"\n      }\n    }\n  }\n}\n```\n\n---\n\n### 4. Test the Connection\n1. Restart your MCP client (e.g., Claude Desktop).\n2. Look for the hammer/tools icon to confirm the AWS tools are available.\n3. Prompt the LLM: *\"List the S3 buckets in my AWS account.\"* The LLM will call the MCP tool and return the AWS data.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 12, "phrasing": "What is the most reliable MCP server for inspecting AWS IAM roles and Security Groups?", "text": "The most reliable and structured option is the **Steampipe MCP Server** (by Turbot) paired with the AWS plugin. \n\n### Why it is the best for this use case:\n* **Relational Querying:** It maps AWS APIs to SQL tables (e.g., `aws_iam_role`, `aws_vpc_security_group`, `aws_vpc_security_group_rule`), making it easy for an LLM to inspect, filter, and correlate complex IAM policies and security group rules.\n* **Reliability:** Built on the mature Steampipe engine, which natively handles AWS API pagination, credential resolution, and rate-limiting.\n\n### Alternative Option:\n* **Direct AWS CLI / Boto3 MCP Servers** (e.g., community `aws-mcp` wrappers): Good if you prefer direct 1:1 mapping to raw API calls (`ec2:DescribeSecurityGroups`, `iam:GetRole`), though LLMs generally handle Steampipe's structured SQL schema output with fewer hallucinations and token overhead.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 13, "phrasing": "Best MCP server for querying CloudWatch logs with natural language", "text": "The best approach is using an AWS-specific MCP server that exposes **CloudWatch Logs Insights** APIs (`StartQuery`, `GetQueryResults`). The connected LLM automatically translates your natural language requests into CloudWatch Logs Insights queries, executes them via MCP, and summarizes the output.\n\n### Top Options:\n\n1. **`aws-mcp` / `@awslabs` ecosystem (Recommended)**\n   * **Why:** Comprehensive AWS integration, actively maintained.\n   * **Tools included:** Supports CloudWatch Logs (`StartQuery`, `GetQueryResults`, `DescribeLogGroups`, `FilterLogEvents`) and Metrics.\n   * **Best for:** General AWS observability workflows alongside logs.\n\n2. **Custom / Community `cloudwatch-mcp-server`** (e.g., via `npm` or Python)\n   * **Why:** Lightweight and dedicated strictly to CloudWatch log groups and insights queries without requiring broad AWS IAM permissions for other services.\n\n---\n\n### Recommended Setup (Claude Desktop Example)\n\nYou can run a Node- or Python-based AWS MCP server configured with your AWS credentials.\n\nAdd this to your `claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"cloudwatch\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@matthewhand/mcp-server-aws\"],\n      \"env\": {\n        \"AWS_REGION\": \"us-east-1\",\n        \"AWS_PROFILE\": \"your-aws-profile\"\n      }\n    }\n  }\n}\n```\n\n### Example Natural Language Prompts to Use:\n* *\"Find all 500 status code errors in the `/aws/lambda/api-gateway` log group from the past 2 hours.\"*\n* *\"Show the top 10 slowest API requests from the production ECS logs today.\"*\n* *\"List recent log groups containing the keyword 'payment-service'.\"*", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 14, "phrasing": "We need an MCP server that lets developers ask an AI agent about active AWS EC2 instances. What options exist?", "text": "Here are the best options for connecting an AI agent to AWS EC2 via the Model Context Protocol (MCP):\n\n---\n\n### 1. Community & Open-Source AWS MCP Servers\n* **`mcp-server-aws` (Python / Boto3)**\n  * *Overview:* Several open-source community packages (searchable on GitHub/npm/PyPI) wrap common AWS services. \n  * *Features:* Typically provide read-only tools like `list_ec2_instances`, `describe_instance_status`, and `get_ec2_metrics`.\n* **Steampipe MCP Server (`steampipe-mcp`)**\n  * *Overview:* Steampipe treats cloud APIs as SQL databases. Using the **AWS Steampipe plugin**, the MCP server allows the agent to run SQL queries directly on AWS (e.g., `SELECT instance_id, instance_state, instance_type FROM aws_ec2_instance WHERE instance_state = 'running'`).\n  * *Best for:* Complex filtering, multi-account querying, and flexible read-only questions.\n\n---\n\n### 2. Build a Custom Lightweight MCP Server (Recommended)\nBecause EC2 queries only require a few specific API calls, building a custom server tailored to your exact security boundaries takes under an hour.\n\n* **Python (`FastMCP` + `boto3`):**\n  ```python\n  from mcp.server.fastmcp import FastMCP\n  import boto3\n\n  mcp = FastMCP(\"AWS-EC2-Helper\")\n  ec2 = boto3.client(\"ec2\")\n\n  @mcp.tool()\n  def list_active_ec2_instances() -> list:\n      \"\"\"Returns a list of running EC2 instances with IDs, types, and tags.\"\"\"\n      response = ec2.describe_instances(\n          Filters=[{\"Name\": \"instance-state-name\", \"Values\": [\"running\"]}]\n      )\n      instances = []\n      for res in response.get(\"Reservations\", []):\n          for inst in res.get(\"Instances\", []):\n              instances.append({\n                  \"id\": inst[\"InstanceId\"],\n                  \"type\": inst[\"InstanceType\"],\n                  \"launch_time\": str(inst[\"LaunchTime\"]),\n                  \"tags\": inst.get(\"Tags\", [])\n              })\n      return instances\n\n  if __name__ == \"__main__\":\n      mcp.run()\n  ```\n* **TypeScript (`@modelcontextprotocol/sdk` + `@aws-sdk/client-ec2`):**\n  * Use the standard MCP TypeScript SDK with the official AWS JS v3 SDK to expose a `describe_instances` tool.\n\n---\n\n### 3. Generic Terminal / CLI MCP Servers\n* **AWS CLI via Bash/Terminal MCP Server:**\n  * Configure an MCP server that can execute shell commands (e.g., official `@modelcontextprotocol/server-filesystem` style or generic bash execution tools).\n  * Give the agent permission to run `aws ec2 describe-instances --filters \"Name=instance-state-name,Values=running\"`.\n  * *Caution:* Requires strict sandboxing and scoped IAM credentials so the agent cannot run unauthorized AWS commands.\n\n---\n\n### Summary Recommendation\n* **For quick, robust, and safe read access:** Build a 20-line **Python FastMCP server** using `boto3`.\n* **For advanced querying across regions/accounts:** Use **Steampipe + AWS Plugin** via MCP.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 15, "phrasing": "Which MCP server provides secure Amazon Web Services connector tools for AI models?", "text": "The **AWS MCP Server** (commonly available as **`aws-mcp`** or **`mcp-server-aws`** in the open-source community) provides secure Amazon Web Services connector tools for AI models.\n\n### Key Details:\n* **Security & Authentication:** It uses standard AWS credential chains (IAM roles, AWS SSO, environment variables, or `~/.aws/credentials`), ensuring the AI model only operates within defined IAM permissions.\n* **Capabilities:** Enables LLMs to interact with AWS services such as **S3**, **EC2**, **Lambda**, **CloudWatch**, **IAM**, and **DynamoDB** to run queries, manage infrastructure, read logs, or inspect resources.\n* **Availability:** Available on GitHub/npm via the Model Context Protocol (MCP) ecosystem (e.g., `aws-mcp` / community packages).", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 16, "phrasing": "Best production-ready MCP server for AWS API interactions", "text": "Currently, there is no single, monolithic \"official\" MCP server from AWS that safely exposes the entire AWS API surface for production. \n\nThe best approach depends on your use case, with these top production-ready options:\n\n---\n\n### 1. For General AWS API & Resource Management: **Custom SDK-Scoped Server (Recommended for Production)**\nFor true production environments, exposing the entire raw AWS API to an LLM poses security and reliability risks. The industry standard is deploying a custom, lightweight MCP server (built with the [TypeScript SDK](https://github.com/modelcontextprotocol/typescript-sdk) or [Python SDK](https://github.com/modelcontextprotocol/python-sdk)) that wraps `boto3` / `@aws-sdk/client-*` calls with:\n* **Strict IAM Least-Privilege**: Inherits credentials via AWS IAM Roles / AWS SSO (never hardcoded keys).\n* **Guarded Tool Execution**: Exposes explicit, high-level intent tools (e.g., `restart_ecs_service`, `fetch_cloudwatch_metrics`) rather than raw SDK execution.\n\n---\n\n### 2. For General AWS Cloud Operations (Open Source): **`mcp-server-aws` / CLI Wrappers**\nIf you need multi-service management out of the box:\n* **[mcp-server-aws](https://github.com/modelcontextprotocol/servers)** (from community/reference catalogs): Provides tool sets for specific services (S3, EC2, Lambda, CloudWatch).\n* **Setup**: Connects directly using local AWS credentials (`~/.aws/credentials` or environment variables).\n\n---\n\n### 3. For AWS Documentation & Architecture: **AWS Knowledge Base MCP**\n* **Bedrock Knowledge Base MCP**: Official Anthropic/AWS pattern for querying enterprise documentation and infrastructure architecture securely through Amazon Bedrock Knowledge Bases.\n\n---\n\n### Production Checklist for AWS MCP:\n1. **Credential Safety**: Ensure the MCP server uses the standard AWS credential provider chain (IAM instance profiles, ECS Task Roles, or AWS IAM Identity Center).\n2. **Read vs. Write Separation**: Configure read-only tools by default and require explicit human-in-the-loop approvals for state-mutating actions (e.g., modifying Security Groups, terminating instances).\n3. **Execution Guardrails**: Pair with AWS GuardDuty and CloudTrail logging to trace all MCP-initiated API calls.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 17, "phrasing": "We are an enterprise cloud platform team looking for a compliant AWS MCP server for internal AI tools. What should we evaluate?", "text": "When evaluating an AWS Model Context Protocol (MCP) server for enterprise internal AI tools, focus on these key areas:\n\n### 1. Identity, Access, and Permissions\n* **IAM & Role Delegation:** Native support for AWS IAM roles (assumed roles, STS temporary credentials) rather than static access keys.\n* **Granular Tool Scoping:** Ability to restrict tools by environment, service, or specific read/write operations (least-privilege model).\n* **Identity Propagation:** Mechanism to map and pass the end-user\u2019s identity (via IdP/SSO) through to AWS execution logs rather than using a single shared service account.\n\n### 2. Guardrails and Execution Safety\n* **Read vs. Write Segregation:** Hard boundaries or configurations to disable destructive/mutating actions (e.g., `Delete*`, `Terminate*`) in production accounts.\n* **Human-in-the-Loop (HITL):** Built-in approval workflows or confirmation prompts before executing critical or mutating infrastructure changes.\n* **Rate Limiting & Throttling:** Controls to prevent runaway automated loops from exceeding AWS API service quotas or incurring unexpected costs.\n\n### 3. Observability, Logging, and Auditability\n* **AWS CloudTrail Integration:** Ensuring all actions taken by the MCP server are attributable to the specific prompt/user session in CloudTrail.\n* **Audit Trails:** Comprehensive logging of input parameters, tool invocations, and returned metadata (with sensitive data/PII redacted).\n* **Telemetry:** Support for exporting metrics and traces to systems like AWS CloudWatch, Datadog, or OpenTelemetry.\n\n### 4. Network and Deployment Architecture\n* **Private Network Isolation:** Ability to host the MCP server entirely within your own VPC with support for AWS PrivateLink/VPC Endpoints (no exposure to the public internet).\n* **Data Residency & Zero Retention:** Guarantee that prompts, context, and AWS responses are not stored externally or used for model training.\n* **Containerization & Orchestration:** Compatibility with your existing platform deployment stack (e.g., Amazon ECS, EKS, or AWS Fargate).\n\n### 5. Extensibility and Maintenance\n* **Service Coverage:** Depth of support for the specific AWS services your internal teams need (e.g., Bedrock, CloudWatch, Cost Explorer, EC2).\n* **Custom Tool Support:** Ease of adding custom internal APIs, scripts, or policy engines to the MCP server.\n* **Vendor & Community Support:** Up-to-date maintenance aligned with the evolving Model Context Protocol specifications and AWS SDK updates.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 18, "phrasing": "Which MCP server gives AI coding assistants real-time context on AWS cloud infrastructure?", "text": "The primary tool is the **AWS MCP Server** (such as the community `mcp-server-aws` or implementations from AWS/awslabs), which integrates with AWS APIs to fetch live data on resources, CloudWatch metrics, logs, and IAM configurations.\n\nOther notable options for live AWS context include:\n* **Steampipe MCP Server:** Allows the assistant to run live SQL queries across AWS infrastructure and APIs for real-time inventory and posture checks.\n* **Pulumi / Terraform MCP Servers:** Provide real-time context on deployed cloud state and Infrastructure as Code (IaC).", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 19, "phrasing": "What MCP server should I use to let AI models run AWS CLI commands safely?", "text": "To let AI models interact with AWS safely via the Model Context Protocol (MCP), you have two main approaches:\n\n### 1. Dedicated AWS MCP Servers (Recommended)\nInstead of giving raw CLI access, use an MCP server tailored for AWS APIs. This restricts the model to structured actions rather than arbitrary shell execution:\n* **Community AWS MCP Servers** (e.g., `mcp-server-aws` or `aws-mcp` on GitHub/npm): These wrap AWS SDK calls as structured tools (e.g., `describe_instances`, `get_logs`).\n\n### 2. Sandboxed Shell/Bash MCP Server\nIf you strictly need the **AWS CLI**, use a standard terminal/bash MCP server (such as `@modelcontextprotocol/server-bash`) inside a secured environment.\n\n---\n\n### How to Make AWS Execution Safe:\nRegardless of the server you choose, enforce safety at the infrastructure level:\n\n1. **Least-Privilege IAM Roles:** \n   * Attach an IAM role with strictly **read-only** permissions (e.g., `SecurityAudit` or `ReadOnlyAccess`) or scoped to non-production environments.\n   * Never provide administrative or destructive (`s3:Delete*`, `ec2:Terminate*`) permissions.\n2. **Human-in-the-Loop (Client Approvals):** \n   * Ensure your MCP client (e.g., Claude Desktop, Cursor) is configured to require user confirmation before executing commands.\n3. **Container Sandboxing:** \n   * Run the MCP server inside a Docker container with ephemeral credentials and no access to local files or other local network resources.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 20, "phrasing": "Model Context Protocol server for querying AWS Cost Explorer and billing via AI", "text": "To query AWS Cost Explorer and Billing using AI through the **Model Context Protocol (MCP)**, you can create a custom Python-based MCP server using the official MCP SDK and AWS `boto3`.\n\nHere is a ready-to-use implementation and setup guide.\n\n---\n\n### 1. Prerequisites and IAM Permissions\n\nEnsure your AWS credentials have the following IAM permissions:\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"ce:GetCostAndUsage\",\n        \"ce:GetCostForecast\",\n        \"ce:GetDimensionValues\"\n      ],\n      \"Resource\": \"*\"\n    }\n  ]\n}\n```\n\n---\n\n### 2. Implementation (`aws_cost_mcp.py`)\n\nInstall required dependencies:\n```bash\npip install mcp boto3\n```\n\nCreate `aws_cost_mcp.py`:\n\n```python\nimport json\nimport boto3\nfrom datetime import datetime, timedelta\nfrom mcp.server.fastmcp import FastMCP\n\nmcp = FastMCP(\"AWS Cost Explorer\")\nce_client = boto3.client(\"ce\", region_name=\"us-east-1\")  # Cost Explorer endpoint is us-east-1\n\n@mcp.tool()\ndef get_cost_and_usage(\n    start_date: str,\n    end_date: str,\n    granularity: str = \"DAILY\",\n    group_by_dimension: str = \"SERVICE\"\n) -> str:\n    \"\"\"\n    Get AWS costs and usage broken down by a specific dimension (e.g., SERVICE, REGION).\n    \n    :param start_date: Start date in 'YYYY-MM-DD' format.\n    :param end_date: End date in 'YYYY-MM-DD' format (exclusive).\n    :param granularity: 'DAILY', 'MONTHLY', or 'HOURLY'.\n    :param group_by_dimension: Dimension to group by, e.g., 'SERVICE', 'REGION', 'USAGE_TYPE'.\n    \"\"\"\n    response = ce_client.get_cost_and_usage(\n        TimePeriod={\"Start\": start_date, \"End\": end_date},\n        Granularity=granularity,\n        Metrics=[\"UnblendedCost\"],\n        GroupBy=[{\"Type\": \"DIMENSION\", \"Key\": group_by_dimension}]\n    )\n    \n    results = []\n    for period in response.get(\"ResultsByTime\", []):\n        time_frame = f\"{period['TimePeriod']['Start']} to {period['TimePeriod']['End']}\"\n        for group in period.get(\"Groups\", []):\n            item_name = group[\"Keys\"][0]\n            amount = group[\"Metrics\"][\"UnblendedCost\"][\"Amount\"]\n            unit = group[\"Metrics\"][\"UnblendedCost\"][\"Unit\"]\n            if float(amount) > 0.01:  # Filter out negligible costs\n                results.append({\n                    \"period\": time_frame,\n                    \"item\": item_name,\n                    \"amount\": round(float(amount), 2),\n                    \"currency\": unit\n                })\n                \n    return json.dumps(results, indent=2)\n\n@mcp.tool()\ndef get_cost_forecast(\n    start_date: str,\n    end_date: str,\n    granularity: str = \"MONTHLY\"\n) -> str:\n    \"\"\"\n    Get AWS cost forecast for a future date range.\n    \n    :param start_date: Future start date 'YYYY-MM-DD' (must be in the future).\n    :param end_date: Future end date 'YYYY-MM-DD'.\n    :param granularity: 'DAILY' or 'MONTHLY'.\n    \"\"\"\n    response = ce_client.get_cost_forecast(\n        TimePeriod={\"Start\": start_date, \"End\": end_date},\n        Metric=\"UNBLENDED_COST\",\n        Granularity=granularity\n    )\n    \n    forecast = {\n        \"total_amount\": round(float(response.get(\"Total\", {}).get(\"Amount\", 0)), 2),\n        \"currency\": response.get(\"Total\", {}).get(\"Unit\", \"USD\"),\n        \"details\": response.get(\"ForecastResultsByTime\", [])\n    }\n    return json.dumps(forecast, indent=2)\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\n---\n\n### 3. Claude Desktop Configuration\n\nAdd the server to your `claude_desktop_config.json` (located at `~/Library/Application Support/Claude/` on macOS or `%APPDATA%\\Claude\\` on Windows):\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-billing\": {\n      \"command\": \"python\",\n      \"args\": [\"/path/to/aws_cost_mcp.py\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"default\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\n---\n\n### 4. Example AI Prompts\n\nOnce configured, restart your AI client and prompt it:\n\n* *\"How much did we spend on AWS EC2 and RDS last month?\"*\n* *\"Show a daily breakdown of my AWS spend for the last 7 days.\"*\n* *\"What is the forecasted AWS cost for the rest of this month?\"*", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 21, "phrasing": "What is the standard MCP server for Amazon Web Services integrations?", "text": "There is no single, official monolithic AWS MCP server maintained by Anthropic or AWS that covers all AWS services. However, the standard and most widely used MCP implementations for AWS include:\n\n1. **Anthropic Reference Server (`aws-kb-retrieval-mcp`)**: Designed specifically for connecting to Amazon Bedrock Knowledge Bases to perform vector search and retrieval.\n2. **AWS Cloud Control / SDK Community Servers**: Tools like `mcp-server-aws` or custom wrappers utilizing the **AWS Cloud Control API** or **AWS CLI**, which allow LLMs to create, read, update, delete, and list resources across hundreds of AWS services via standardized APIs.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 22, "phrasing": "Recommended MCP server for connecting AI agents to AWS Lambda and API Gateway", "text": "Here are the best options depending on whether you want to **invoke existing AWS services** or **expose an API Gateway endpoint as a tool**:\n\n---\n\n### 1. For Direct AWS Management & Lambda Invocation\nIf your agent needs to directly invoke Lambda functions or manage AWS resources:\n\n* **Community AWS SDK MCP Servers** (e.g., via `boto3` / AWS JavaScript SDK)\n  * **Option:** Many developers use open-source AWS MCP wrappers (such as community repositories implementing AWS CLI/SDK actions like `lambda:InvokeFunction`).\n  * **Use Case:** Direct execution of Lambda functions without going through an HTTP layer, managing API Gateway routes, checking CloudWatch logs, etc.\n\n---\n\n### 2. For Connecting via API Gateway (REST/HTTP Endpoints)\nIf your Lambda functions are already behind API Gateway and exposed via HTTP/OpenAPI:\n\n* **Official `@modelcontextprotocol/server-fetch`**\n  * **What it does:** Allows agents to make arbitrary HTTP/REST requests directly to your API Gateway endpoints.\n  * **Setup:** Simple to configure; requires passing API keys or headers for authentication.\n\n* **OpenAPI / Swagger-to-MCP Gateways** (e.g., FastMCP OpenAPI integrations)\n  * **What it does:** Ingests your API Gateway\u2019s OpenAPI/Swagger export and automatically generates typed MCP tools for each endpoint.\n  * **Best For:** Complex APIs where you want the LLM to strictly adhere to your request/response schemas.\n\n---\n\n### 3. Build a Custom/Dedicated MCP Server (Recommended for Production)\nBecause production AWS setups typically require specific IAM roles, input validation, and security scopes, creating a lightweight custom MCP server is often the most reliable approach:\n\n* **Python (`FastMCP`)**:\n  ```python\n  import boto3\n  from mcp.server.fastmcp import FastMCP\n\n  mcp = FastMCP(\"AWS-Bridge\")\n  lambda_client = boto3.client(\"lambda\")\n\n\n  @mcp.tool()\n  def invoke_my_lambda(payload: dict) -> str:\n      \"\"\"Invokes a specific Lambda function.\"\"\"\n      response = lambda_client.invoke(\n          FunctionName=\"my-function-name\",\n          Payload=json.dumps(payload),\n      )\n      return response[\"Payload\"].read().decode(\"utf-8\")\n```\n* **TypeScript (`@modelcontextprotocol/sdk`)**: Use the official `@aws-sdk/client-lambda` to define scoped tools that agents can run safely.\n\n---\n\n### Summary Recommendation\n* **Quickest for existing HTTP APIs:** Use an **OpenAPI/HTTP Fetch MCP server** pointed at your API Gateway.\n* **Direct AWS operations:** Use a custom **FastMCP (Python) or TS SDK** server with the AWS SDK to keep IAM permissions tightly controlled.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 23, "phrasing": "Best MCP server for letting an LLM query Amazon RDS databases", "text": "The best MCP server depends on the specific database engine running on your Amazon RDS instance:\n\n### 1. For RDS PostgreSQL / Aurora PostgreSQL\n* **Best Choice:** **Official PostgreSQL MCP Server** (`@modelcontextprotocol/server-postgres`)\n* **How it connects:** Direct connection string via standard PostgreSQL credentials (`postgresql://user:password@rds-endpoint:5432/dbname`).\n* **Features:** Read-only query execution by default, schema inspection, and auto-table context.\n\n### 2. For RDS MySQL / Aurora MySQL\n* **Best Choice:** **MySQL MCP Server** (e.g., `mcp-server-mysql` via NPM/pip)\n* **How it connects:** Direct MySQL connection URI (`mysql://user:password@rds-endpoint:3306/dbname`).\n* **Features:** Schema exploration, table listing, and parameterized queries.\n\n---\n\n### Alternative: For Aurora with RDS Data API\nIf your RDS database is inside a private VPC and you do not want to expose public IP access or set up a VPN:\n* Use an **AWS RDS Data API MCP Server** (or a generic AWS SDK MCP server).\n* **Benefit:** Queries the database using standard AWS IAM credentials via HTTP/HTTPS through the AWS RDS Data API without managing persistent database connections or VPC peering.\n\n---\n\n### Key Requirements for Direct Connections:\n1. **Network Access:** Ensure the machine running the MCP server has network access to your RDS endpoint (via Public Access + Security Group rules, or through a local VPN/Tailscale/AWS Client VPN).\n2. **Permissions:** Best practice is to create a dedicated **read-only database user** for the MCP server to prevent accidental writes or drops.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 24, "phrasing": "We need an MCP server to let our AI assistant analyze AWS CloudTrail logs. What server works best?", "text": "The best approach depends on how your CloudTrail logs are stored and queried:\n\n### 1. **Best for Scale and Complex Queries: Amazon Athena MCP Server**\nIf your CloudTrail logs are delivered to an Amazon S3 bucket, using an **Athena MCP server** (such as community implementations like `mcp-server-athena` or a general SQL/database MCP server configured for Athena) is the most powerful option.\n* **Why:** CloudTrail produces massive JSON logs. Querying them via SQL in Athena allows the AI to filter, aggregate, and analyze events efficiently without exceeding LLM context windows.\n\n### 2. **Best for Recent / Simple Lookups: AWS SDK / Boto3 MCP Server**\nIf you only need to investigate recent management events (within the last 90 days) without setting up S3/Athena:\n* Use a community **AWS MCP Server** (or a lightweight custom server built with the Model Context Protocol SDK and Python `boto3`) exposing the `cloudtrail:LookupEvents` API.\n\n---\n\n### Recommended Setup (Athena Approach)\n1. Ensure CloudTrail is logging to S3 and integrated with Athena (via the CloudTrail console's *Create Athena table* feature).\n2. Deploy an **Athena MCP server** pointing to your AWS account/region and the CloudTrail database/table.\n3. Grant the server's IAM role permissions for:\n   * `athena:StartQueryExecution`\n   * `athena:GetQueryResults`\n   * `athena:GetQueryExecution`\n   * `s3:GetObject` on the CloudTrail bucket\n   * `s3:GetBucketLocation` and `s3:PutObject` on the Athena query results bucket", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 25, "phrasing": "Which MCP server bridges local AI clients with AWS cloud management APIs?", "text": "The **AWS MCP Server** (commonly available as open-source packages like `mcp-server-aws` or `aws-mcp`) bridges local AI clients with AWS cloud management APIs. \n\nThese servers use the AWS SDK or AWS CLI under the hood, allowing AI clients (such as Claude Desktop) to query, configure, and manage AWS services (like EC2, S3, Lambda, and CloudWatch) directly using your local AWS credentials.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 26, "phrasing": "Most active open source MCP server project for Amazon Web Services", "text": "The most active open-source Model Context Protocol (MCP) projects for AWS include:\n\n1. **[`awslabs/mcp`](https://github.com/awslabs)** (AWS Labs / Official ecosystem)\n   * AWS has been actively publishing MCP servers and sample implementations through `awslabs` repositories, notably for **Amazon Bedrock**, **Amazon Q**, and **AWS Knowledge Bases**.\n\n2. **[`mcp-server-aws`](https://github.com/) (Community / SDK Wrappers)**\n   * Several community projects (such as Python- and TypeScript-based `mcp-server-aws` implementations) provide general-purpose AWS integration. These wrap the AWS SDK/Boto3 to allow LLMs to query CloudWatch, manage EC2/S3 instances, execute AWS CLI commands, and inspect IAM policies directly.\n\nIf you need a general AWS management MCP server, the most widely used approach is using an **AWS CLI / Boto3-based MCP server** (such as community implementations published on npm/PyPI under `mcp-server-aws`) configured with your standard `~/.aws/credentials`.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 27, "phrasing": "What MCP server allows AI agents to inspect and modify AWS S3 bucket policies?", "text": "The **AWS MCP Server** (such as community implementations like `mcp-server-aws` or AWS CLI/Boto3-based MCP servers) allows AI agents to inspect and modify AWS S3 bucket policies. \n\nThese servers expose AWS SDK methods (via Boto3 or the AWS CLI) to the agent, providing tools to:\n\n* **Inspect:** Call `s3:GetBucketPolicy` to read existing bucket policies.\n* **Modify:** Call `s3:PutBucketPolicy` or `s3:DeleteBucketPolicy` to update or remove policies.\n\n### Example Options:\n1. **`mcp-server-aws` / AWS Boto3 MCP Servers:** Expose standard AWS SDK tools directly to MCP clients (e.g., Claude Desktop).\n2. **AWS CLI MCP Server:** Allows the agent to run structured `aws s3api get-bucket-policy` and `aws s3api put-bucket-policy` commands using the host's configured AWS credentials.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 28, "phrasing": "Best lightweight MCP server for AWS developer tooling", "text": "The best lightweight options for an AWS developer Model Context Protocol (MCP) server depend on whether you prefer targeted SDK tools or raw CLI access:\n\n---\n\n### 1. **`mcp-server-aws` (Python / `boto3`) \u2014 *Best for Structured Tools***\nA dedicated Python-based MCP server that exposes direct AWS actions (S3, CloudWatch, Lambda, DynamoDB, EC2) using your local AWS credentials.\n\n* **Why it\u2019s lightweight:** Zero-install execution via `uvx`, minimal overhead, uses native `boto3`.\n* **Quick Setup (`claude_desktop_config.json`):**\n  ```json\n  {\n    \"mcpServers\": {\n      \"aws\": {\n        \"command\": \"uvx\",\n        \"args\": [\"mcp-server-aws\"],\n        \"env\": {\n          \"AWS_PROFILE\": \"default\",\n          \"AWS_REGION\": \"us-east-1\"\n        }\n      }\n    }\n  }\n  ```\n\n---\n\n### 2. **`execute_command` / CLI Wrapper MCP \u2014 *Most Flexible & Minimal***\nIf you already have the **AWS CLI** installed, running a restricted command-runner MCP server is the lightest option because it requires no extra dependencies or specialized AWS tool definitions.\n\n* **Why it\u2019s lightweight:** Directly proxies standard AWS CLI commands (`aws s3 ls`, `aws lambda list-functions`, etc.) to your system.\n* **Package:** `@modelcontextprotocol/server-everything` (or similar shell/command MCP).\n* **Quick Setup:**\n  ```json\n  {\n    \"mcpServers\": {\n      \"aws-cli\": {\n        \"command\": \"npx\",\n        \"args\": [\"-y\", \"@modelcontextprotocol/server-commands\"]\n      }\n    }\n  }\n  ```\n\n---\n\n### Summary Recommendation\n* Choose **`uvx mcp-server-aws`** if you want structured, schema-validated tool calls (better safety and LLM reliability).\n* Choose a **CLI-based MCP server** if you need full coverage of the entire AWS ecosystem without maintaining separate tool schemas.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 29, "phrasing": "We want our AI workflow to fetch metrics from Amazon CloudWatch via MCP. Which server implementation should we deploy?", "text": "You have two main options depending on whether you want a pre-built solution or a lightweight custom implementation:\n\n### 1. Pre-Built Community / Open-Source Servers\n* **`mcp-server-cloudwatch` (or community AWS MCP servers on GitHub/npm):** Several open-source MCP implementations wrap the AWS SDK specifically for CloudWatch operations (e.g., `GetMetricData`, `ListMetrics`, `GetMetricStatistics`).\n* **AWS CLI MCP Server:** A generic AWS MCP server that allows the LLM to execute scoped AWS CLI commands against CloudWatch.\n\n### 2. Custom Server via FastMCP (Recommended for Production)\nBecause CloudWatch metric queries often require specific aggregation windows, dimensions, and strict IAM boundary controls, deploying a tailored MCP server using **Python (`FastMCP` + `boto3`)** is often the cleanest and most secure approach:\n\n```python\nfrom mcp.server.fastmcp import FastMCP\nimport boto3\nfrom datetime import datetime, timedelta\n\nmcp = FastMCP(\"CloudWatch-Metrics\")\ncw = boto3.client(\"cloudwatch\")\n\n@mcp.tool()\ndef get_metric_statistics(namespace: str, metric_name: str, dimension_name: str, dimension_value: str, hours_ago: int = 1) -> str:\n    \"\"\"Fetch average metric statistics for a specific AWS resource.\"\"\"\n    response = cw.get_metric_statistics(\n        Namespace=namespace,\n        MetricName=metric_name,\n        Dimensions=[{'Name': dimension_name, 'Value': dimension_value}],\n        StartTime=datetime.utcnow() - timedelta(hours=hours_ago),\n        EndTime=datetime.utcnow(),\n        Period=300,\n        Statistics=['Average']\n    )\n    return str(response.get('Datapoints', []))\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\n### Deployment Recommendations:\n* **Authentication:** Run the server in an environment utilizing AWS IAM Roles (e.g., ECS task role, EKS IAM Role for Service Accounts, or AWS Lambda) with least-privilege permissions (`cloudwatch:GetMetricData`, `cloudwatch:GetMetricStatistics`, `cloudwatch:ListMetrics`).\n* **Transport:** Use **stdio** if running locally inside an agent desktop environment, or **SSE (Server-Sent Events)** over HTTP/HTTPS if deploying as a remote shared service in your VPC.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 30, "phrasing": "Which Model Context Protocol server is best for connecting desktop AI assistants to AWS account resources?", "text": "The best and most versatile option is an **AWS Cloud Control API MCP server** (such as community implementations like `mcp-server-aws` or AWS Labs MCP servers).\n\n### Top Choices:\n\n1. **AWS Cloud Control API Server (`aws-mcp` / `mcp-server-aws`)** *(Best overall)*\n   * **Why:** It uses AWS's unified Cloud Control API, allowing the AI to create, read, update, delete, and list resources across hundreds of AWS services using standard schemas.\n   * **Authentication:** Automatically hooks into your local AWS profiles (`~/.aws/credentials` or AWS SSO).\n\n2. **AWS CLI MCP Wrapper** *(Best for flexibility)*\n   * **Why:** Exposes the AWS CLI directly to the model, allowing it to run arbitrary `aws <service> <command>` calls, fetch CloudWatch logs, or query complex configurations.\n\n### Key Setup Requirement:\nEnsure the AWS CLI is installed and authenticated on your desktop (e.g., via `aws configure` or `aws sso login`), as these MCP servers inherit your local active AWS session permissions.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 31, "phrasing": "Top MCP servers for Amazon Web Services cloud automation and DevOps", "text": "Here are the top Model Context Protocol (MCP) servers used for Amazon Web Services (AWS) automation, cloud management, and DevOps workflows:\n\n---\n\n### 1. Direct AWS Management\n* **`aws-mcp` / `mcp-server-aws`**\n  * **Function:** Directly interacts with the AWS SDK / AWS CLI.\n  * **Use Cases:** Querying resource states (EC2, Lambda, S3, IAM, VPC), starting/stopping instances, invoking Lambda functions, fetching CloudWatch logs, and checking AWS Cost Explorer data.\n* **`mcp-server-s3`**\n  * **Function:** Dedicated integration for Amazon S3 object storage.\n  * **Use Cases:** Uploading build artifacts, reading log files, auditing bucket policies, and managing storage lifecycles.\n\n---\n\n### 2. Infrastructure as Code (IaC) & Provisioning\n* **Terraform MCP Server (`mcp-server-terraform`)**\n  * **Function:** Interacts with the Terraform CLI and state files.\n  * **Use Cases:** Generating, validating, formatting HCL code, running `terraform plan`/`apply`, and inspecting resource drift on AWS infrastructure.\n* **Pulumi MCP Server**\n  * **Function:** Pulumi automation and state inspection.\n  * **Use Cases:** Programmatic cloud provisioning using standard programming languages targeting AWS.\n\n---\n\n### 3. Container & Cluster Orchestration\n* **Kubernetes MCP Server (`mcp-server-kubernetes` / `kubectl-mcp`)**\n  * **Function:** Connects to Amazon EKS or self-managed Kubernetes clusters via `kubectl`.\n  * **Use Cases:** Inspecting pod health, restarting deployments, managing namespaces, reading cluster events, and debugging failed nodes.\n* **Docker MCP Server (`mcp-server-docker`)**\n  * **Function:** Controls the local or remote Docker daemon.\n  * **Use Cases:** Building images, pushing container images to Amazon Elastic Container Registry (ECR), and running localized test containers.\n\n---\n\n### 4. CI/CD & Pipeline Automation\n* **GitHub / GitLab MCP Servers (`mcp-server-github`, `mcp-server-gitlab`)**\n  * **Function:** Interacts with code repositories, pull requests, and CI/CD pipelines.\n  * **Use Cases:** Triggering GitHub Actions/GitLab CI deployment pipelines to AWS, reviewing infrastructure PRs, managing secrets, and automating release tagging.\n\n---\n\n### 5. Observability & Incident Response\n* **Datadog / Prometheus / Grafana MCP Servers**\n  * **Function:** Interfaces with external monitoring stacks commonly layered on top of AWS.\n  * **Use Cases:** Querying metrics, diagnosing latency/error spikes in AWS-hosted services, checking alert states, and summarizing incident timelines.\n\n---\n\n### Recommended Setup for an AWS DevOps Engineer:\n1. **`mcp-server-aws`** \u2013 For ad-hoc querying, IAM audits, and CloudWatch log analysis.\n2. **`mcp-server-terraform`** \u2013 For reviewing and modifying AWS IaC configurations.\n3. **`kubectl-mcp`** \u2013 For managing Amazon EKS workloads.\n4. **`mcp-server-github`** \u2013 For CI/CD coordination and gitops-driven deployments.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 32, "phrasing": "How to expose AWS infrastructure context to LLMs using an MCP server?", "text": "To expose AWS infrastructure context to an LLM using the Model Context Protocol (MCP), follow these steps:\n\n---\n\n### 1. Set Up AWS Authentication\nEnsure the environment running your MCP server has AWS credentials configured (via `aws configure`, IAM roles, or environment variables like `AWS_PROFILE` or `AWS_ACCESS_KEY_ID`).\n\n> **Security Best Practice:** Use a **read-only IAM role** (e.g., `ReadOnlyAccess` or specific `Describe*` / `List*` policies) to prevent accidental modifications by the LLM.\n\n---\n\n### 2. Implement the MCP Server (Python Example)\nUse the official Python MCP SDK (`fastmcp` or `mcp`) alongside `boto3` to expose tools and resources.\n\n```bash\npip install mcp boto3\n```\n\nCreate `aws_mcp_server.py`:\n\n```python\nimport boto3\nfrom mcp.server.fastmcp import FastMCP\n\n# Initialize MCP server\nmcp = FastMCP(\"AWS-Infra-Context\")\n\n# Initialize AWS clients\nec2 = boto3.client(\"ec2\")\ncloudwatch = boto3.client(\"cloudwatch\")\n\n@mcp.tool()\ndef list_running_instances() -> list[dict]:\n    \"\"\"Lists all running EC2 instances with their IDs, types, and names.\"\"\"\n    response = ec2.describe_instances(\n        Filters=[{'Name': 'instance-state-name', 'Values': ['running']}]\n    )\n    instances = []\n    for reservation in response.get(\"Reservations\", []):\n        for inst in reservation.get(\"Instances\", []):\n            name = next((tag[\"Value\"] for tag in inst.get(\"Tags\", []) if tag[\"Key\"] == \"Name\"), \"N/A\")\n            instances.append({\n                \"InstanceId\": inst[\"InstanceId\"],\n                \"InstanceType\": inst[\"InstanceType\"],\n                \"Name\": name,\n                \"PrivateIpAddress\": inst.get(\"PrivateIpAddress\")\n            })\n    return instances\n\n@mcp.tool()\ndef get_cloudformation_stack_resources(stack_name: str) -> list[dict]:\n    \"\"\"Retrieves resources deployed in a specific CloudFormation stack.\"\"\"\n    cf = boto3.client(\"cloudformation\")\n    response = cf.describe_stack_resources(StackName=stack_name)\n    return [\n        {\n            \"LogicalResourceId\": r[\"LogicalResourceId\"],\n            \"ResourceType\": r[\"ResourceType\"],\n            \"ResourceStatus\": r[\"ResourceStatus\"]\n        }\n        for r in response.get(\"StackResources\", [])\n    ]\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\n---\n\n### 3. Connect the MCP Server to the LLM Client\nConfigure your MCP client (such as Claude Desktop or Cursor) to run the server.\n\nAdd the server to your client configuration file (e.g., `claude_desktop_config.json`):\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-infra\": {\n      \"command\": \"python\",\n      \"args\": [\"/path/to/aws_mcp_server.py\"],\n      \"env\": {\n        \"AWS_REGION\": \"us-east-1\",\n        \"AWS_PROFILE\": \"read-only-profile\"\n      }\n    }\n  }\n}\n```\n\n---\n\n### 4. Query the LLM\nOnce connected, you can ask the LLM context-aware questions directly, such as:\n* *\"What EC2 instances are currently running in us-east-1?\"*\n* *\"List the resources deployed by the 'Production-VPC' CloudFormation stack.\"*\n* *\"Are there any anomalies in our infrastructure setup?\"*", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 33, "phrasing": "What MCP server enables natural language querying of AWS infrastructure status?", "text": "The **Steampipe MCP Server** (used with the Steampipe AWS plugin) and dedicated **AWS MCP servers** (such as `mcp-server-aws` or the **AWS Resource Explorer MCP Server**) enable natural language querying of AWS infrastructure status.\n\n* **Steampipe MCP Server:** Maps AWS APIs to SQL tables, allowing an LLM to translate natural language prompts into live queries about your EC2 instances, S3 buckets, IAM roles, and overall cloud status.\n* **AWS MCP Server (`mcp-server-aws`):** Directly interfaces with AWS SDKs and services like AWS CloudWatch, Resource Explorer, and AWS Health to monitor and report infrastructure state.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 34, "phrasing": "Best enterprise-grade MCP server with role-based access control for AWS cloud resources", "text": "Because the Model Context Protocol (MCP) is an open standard, enterprise-grade access control for AWS resources is best achieved by combining the **official AWS MCP implementation** with **native AWS IAM / IAM Identity Center** or an **AI Gateway**.\n\nThe top approaches for an enterprise-grade AWS MCP setup with RBAC are:\n\n---\n\n### 1. The Native AWS Approach (Recommended)\n* **MCP Server:** **[`awslabs/mcp-server-aws`](https://github.com/awslabs)** (Official AWS Labs MCP tools)\n* **RBAC Engine:** **AWS IAM Identity Center (SSO) + AWS STS (Role Assumption)**\n* **How it works:** \n  * The MCP server runs within your secure perimeter (or as an ECS/EKS container).\n  * RBAC is enforced at the AWS API level using short-lived session credentials generated via AWS IAM Identity Center.\n  * Define IAM policies/roles (e.g., *ReadOnlyCloudWatch*, *DevS3Access*, *AdminEC2*) mapped to your enterprise IdP (Okta, Entra ID). The LLM's MCP calls can only execute operations permitted by the active assumed IAM role.\n  * Full auditability is captured natively in **AWS CloudTrail**.\n\n---\n\n### 2. Enterprise MCP Gateways (For Centralized LLM-to-Tool RBAC)\nIf you need multi-tenant RBAC at the MCP protocol/gateway layer before requests reach AWS:\n\n* **LiteLLM Enterprise / Portkey AI Gateway:**\n  * Sits between the AI client and MCP servers.\n  * Provides user/team-level RBAC, tool-whitelisting (e.g., allowing specific teams to call only specific AWS MCP functions), rate limiting, and audit logging.\n* **Kong AI Gateway / Cloudflare Zero Trust:**\n  * Places the MCP server behind an API Gateway enforcing OIDC/SAML authentication and fine-grained endpoint-level authorization.\n\n---\n\n### Summary Recommendation\nDeploy the **`awslabs` MCP servers** and enforce RBAC through **AWS IAM Identity Center** using least-privilege IAM roles and session tagging. If centralized management across multiple teams and non-AWS tools is required, front the MCP servers with an enterprise proxy like **LiteLLM Enterprise**.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 35, "phrasing": "Which AWS MCP server supports fine-grained IAM permission scoping for AI tools?", "text": "The **AWS MCP Server** (provided by AWS / AWS Labs) supports fine-grained IAM permission scoping for AI tools.\n\nIt enforces least-privilege access by integrating directly with standard AWS Identity and Access Management (IAM) mechanisms, allowing you to:\n\n* **Scope permissions using IAM policies:** Define granular permissions for specific AWS API actions, resources, and conditions.\n* **Use IAM Roles and AWS STS:** Assume temporary, scoped-down roles with session policies for specific AI tool executions.\n* **Support Least Privilege:** Restrict the AI model's access to only the specific services and resource ARNs required for the task.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 36, "phrasing": "We need an MCP server so our developer assistant can create and check AWS SQS queues. What should we use?", "text": "Here are the best options depending on your setup:\n\n### 1. Build a Lightweight Custom Server (Recommended)\nBecause SQS operations are straightforward, building a dedicated MCP server in Python or TypeScript using official SDKs (`boto3` or `@aws-sdk/client-sqs`) gives you the best control and security without over-permissioning the LLM.\n\n* **Python (`FastMCP` + `boto3`):**\n  ```python\n  from mcp.server.fastmcp import FastMCP\n  import boto3\n\n  mcp = FastMCP(\"SQS-Assistant\")\n  sqs = boto3.client(\"sqs\")\n\n  @mcp.tool()\n  def create_queue(queue_name: str, is_fifo: bool = False) -> dict:\n      \"\"\"Creates an AWS SQS queue.\"\"\"\n      attributes = {\"FifoQueue\": \"true\"} if is_fifo else {}\n      return sqs.create_queue(QueueName=queue_name, Attributes=attributes)\n\n  @mcp.tool()\n  def check_queue(queue_url: str) -> dict:\n      \"\"\"Checks status and message counts for a queue.\"\"\"\n      response = sqs.get_queue_attributes(\n          QueueUrl=queue_url,\n          AttributeNames=[\"All\"]\n      )\n      return response.get(\"Attributes\", {})\n\n  if __name__ == \"__main__\":\n      mcp.run()\n  ```\n\n---\n\n### 2. Community AWS MCP Servers\nIf you prefer a pre-built server that integrates with broader AWS services:\n* **[mcp-server-aws](https://github.com/search?q=mcp-server-aws)**: Several open-source implementations exist on GitHub that wrap the AWS SDK or AWS CLI into an MCP server.\n\n---\n\n### 3. CLI / Shell MCP Server (Quickest Setup)\nIf you already use a standard bash/CLI execution MCP server (e.g., `execute_command`), ensure the host machine has the **AWS CLI** configured (`aws configure`). The assistant can directly execute:\n* `aws sqs create-queue --queue-name <name>`\n* `aws sqs get-queue-attributes --queue-url <url> --attribute-names All`\n* `aws sqs list-queues`", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 37, "phrasing": "What Model Context Protocol server offers the broadest coverage of AWS service APIs?", "text": "The MCP servers that provide the broadest coverage of AWS APIs are those built on the **AWS Cloud Control API** or dynamic **Boto3/AWS CLI execution wrappers**:\n\n1. **AWS Cloud Control API\u2013based MCP servers:** \n   AWS Cloud Control API provides a standardized set of CRUDL (Create, Read, Update, Delete, List) operations that natively cover hundreds of AWS services and resource types without needing separate tool definitions for each service.\n\n2. **Dynamic AWS CLI / Boto3 MCP servers (e.g., community `aws-cli-mcp`):**\n   These servers expose generic execution tools that interface directly with the AWS SDK or AWS CLI, granting direct access to virtually all ~300+ AWS services and thousands of individual API endpoints (provided the underlying IAM credentials permit them).", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 38, "phrasing": "Best MCP server for connecting LLM context windows to Amazon Web Services documentation and architecture", "text": "The best option is the **AWS Documentation MCP Server** (maintained under `awslabs`).\n\n### Why it's the best:\n* **Official & Accurate:** Directly indexes official AWS Documentation, API References, and the AWS Well-Architected Framework.\n* **Architecture-focused:** Includes AWS Whitepapers and Solutions Architecture Patterns, preventing hallucinations on service limits and best practices.\n* **Context Efficient:** Retrieves targeted snippets and markdown representations of docs rather than dumping raw HTML.\n\n---\n\n### Key Options:\n\n1. **AWS Documentation MCP Server (`awslabs`)** *(Best for Docs & Architecture)*\n   * **Use case:** Reading guides, architecture patterns, SDK references, and Well-Architected reviews.\n   * **Typical setup (Claude Desktop / MCP client):**\n     ```json\n     {\n       \"mcpServers\": {\n         \"aws-docs\": {\n           \"command\": \"npx\",\n           \"args\": [\"-y\", \"@awslabs/mcp-server-aws-documentation\"]\n         }\n       }\n     }\n     ```\n\n2. **AWS Knowledge Base / Bedrock MCP Server** *(Best for Enterprise Custom Docs)*\n   * If you have customized AWS architecture blueprints or internal standards stored in an Amazon Bedrock Knowledge Base.\n\n3. **General AWS MCP Server (`mcp-server-aws`)** *(Best for Live Infrastructure)*\n   * Use this if you need the LLM to inspect live AWS environments (via AWS SDK/IAM) alongside reading documentation.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 39, "phrasing": "Which MCP server allows AI chatbots to interact with AWS ECS and EKS clusters?", "text": "To interact with AWS ECS and EKS clusters, you can use:\n\n1. **AWS MCP Server** (e.g., community/AWS-based MCP servers using the AWS SDK/Boto3):\n   * Best for managing AWS-level cluster infrastructure, such as listing, describing, starting, and stopping **ECS** tasks/services and provisioning or managing **EKS** cluster resources.\n\n2. **Kubernetes MCP Server** (`mcp-server-kubernetes`):\n   * Best for interacting directly with the workloads inside **EKS** clusters (e.g., managing pods, deployments, logs, and namespaces using standard `kubectl`/Kubernetes API access).", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 40, "phrasing": "What is the most secure MCP server implementation for Amazon Web Services APIs?", "text": "The most secure approach to running a Model Context Protocol (MCP) server for AWS is using a well-maintained, standard SDK-based implementation (such as those in the official [modelcontextprotocol/servers](https://github.com/modelcontextprotocol/servers) repository or audited open-source `boto3`/Node.js SDK wrappers) configured with the following security practices:\n\n### Key Elements of a Secure AWS MCP Implementation:\n\n1. **Short-Lived Credentials (AWS IAM Identity Center / STS):**\n   * Avoid hardcoding static `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`.\n   * Use temporary credentials retrieved via `aws sso login` or IAM roles assumed through AWS STS.\n\n2. **Strict IAM Least Privilege:**\n   * Restrict the IAM role or user to specific actions (e.g., `s3:GetObject` only) and explicit resource ARNs rather than broad administrative policies (`AdministratorAccess` or `*`).\n\n3. **Read-Only / Sandboxed Scope:**\n   * Choose implementations that support read-only mode by default to prevent LLMs from inadvertently executing destructive actions (e.g., `ec2:TerminateInstances`, `s3:DeleteObject`).\n\n4. **Local Transport (`stdio`):**\n   * Run the MCP server as a local sub-process using standard I/O (`stdio`) rather than exposing an unauthenticated or poorly secured Server-Sent Events (SSE) / HTTP endpoint across the network.\n\n5. **Human-in-the-Loop (HITL) for Mutations:**\n   * Configure your MCP client (such as Claude Desktop or custom agents) to require manual confirmation before executing state-changing API calls.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 41, "phrasing": "Recommended MCP server for AI agents doing automated cloud auditing on AWS", "text": "For automated cloud security and configuration auditing on AWS using the Model Context Protocol (MCP), the following MCP servers and tools are recommended:\n\n---\n\n### 1. **Steampipe MCP Server** (*Top Recommendation*)\n* **Why it fits:** Steampipe treats AWS APIs as relational database tables. An AI agent can use SQL to query configurations across hundreds of AWS services, check against compliance frameworks (CIS AWS Foundations, NIST, PCI-DSS), and detect misconfigurations (e.g., open S3 buckets, overly permissive IAM policies).\n* **Key capabilities:**\n  * Fast, structured read-only queries across multiple AWS accounts and regions.\n  * Rich pre-built compliance mods for standardized reporting.\n  * Low token overhead compared to raw CLI outputs because responses are tabular/structured.\n\n---\n\n### 2. **Official / Open-Source AWS MCP Servers**\n* **Why it fits:** Several community and vendor-provided MCP servers wrap the AWS SDK (`boto3` / `@aws-sdk`) directly.\n* **Key capabilities:**\n  * Direct access to AWS APIs like IAM, EC2, CloudTrail, AWS Config, and Security Hub.\n  * Supports dynamic tool calling for real-time state inspection (e.g., `describe_security_groups`, `get_bucket_policy`).\n  * Best for targeted investigations and drilling down into specific resource definitions.\n\n---\n\n### 3. **Prowler (via Custom / Stdio MCP)**\n* **Why it fits:** Prowler is an industry-standard open-source cloud security auditing tool. Exposing Prowler through a lightweight MCP wrapper allows agents to trigger audits and parse structured JSON findings.\n* **Key capabilities:**\n  * Turnkey CIS, SOC2, HIPAA, and ISO 27001 auditing.\n  * Pre-categorized severity levels (Critical, High, Medium, Low) for prioritized remediation advice.\n\n---\n\n### Best Practices for AWS Auditing via MCP\n* **Enforce Least Privilege:** Run the MCP server with read-only AWS IAM policies (such as `SecurityAudit` or `ViewOnlyAccess`).\n* **Session Boundaries:** If auditing multiple accounts, use an MCP server that supports AWS Organizations / AssumeRole to switch contexts securely without hardcoding credentials.\n* **Result Summarization:** Prefer query-based tools (like Steampipe) to keep raw API response sizes within the LLM's context window.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 42, "phrasing": "Which Model Context Protocol tool provides seamless integration with AWS account management?", "text": "The **AWS MCP Server** (specifically repositories like AWS Labs' `mcp-server-aws` or community implementations like `aws-mcp`) provides seamless integration with AWS account management. It leverages the AWS SDK and CLI to allow LLMs to manage AWS resources, IAM roles, permissions, and account configurations directly through the Model Context Protocol.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 43, "phrasing": "What MCP server should DevOps teams install to give AI assistants access to AWS diagnostics?", "text": "DevOps teams typically use one of the following MCP (Model Context Protocol) servers depending on the scope of diagnostics needed:\n\n1. **Amazon CloudWatch MCP Server** (Recommended for diagnostics):\n   * Best for querying CloudWatch Logs (Insights), fetching metrics, checking alarm statuses, and analyzing performance anomalies.\n\n2. **AWS CLI / AWS SDK MCP Server** (e.g., `mcp-server-aws` or custom community implementations):\n   * Best for broader infrastructure diagnostics, allowing the AI to query the status and configuration of resources across EC2, ECS, EKS, Lambda, RDS, and AWS Health.\n\n### Best Practice for DevOps:\n* Run the MCP server using an **IAM role with read-only permissions** (e.g., `CloudWatchReadOnlyAccess` and `ViewOnlyAccess`) to allow safe diagnostics without granting the AI mutation/write privileges.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 0, "phrasing": "What is the best MCP server for connecting AI assistants to AWS infrastructure?", "text": "For **AWS infrastructure**, the best default choice is the **managed AWS MCP Server**: AWS says it is generally available and provides secure, authenticated access to **all AWS services** through a small fixed set of tools.[12] If your main task is *planning, explaining, or automating infrastructure workflows*, AWS\u2019s newer **Infrastructure-as-Code MCP Server** is also a strong specialized option for CDK and CloudFormation assistance.[16]\n\nIf you want the shortest practical answer:  \n- **Best overall:** **AWS MCP Server** for broad AWS access and general assistant integration.[12]  \n- **Best for IaC:** **AWS Infrastructure-as-Code MCP Server** for CDK/CloudFormation work.[16]  \n- **Best for service-specific workflows:** pick a narrower server aligned to your main service, since community guidance recommends starting with a focused server rather than a broad SDK wrapper.[1]\n\nA few points to help you choose:\n- AWS does **not** appear to offer a separate general-purpose first-party MCP server beyond the managed AWS MCP Server; community summaries note that AWS teams have mainly had to choose between broad SDK wrappers and narrow service-focused servers.[1]\n- AWS Labs maintains an open-source family of MCP servers for AWS, which can be useful when you want to self-host or integrate specific AWS capabilities.[8][9]\n- Independent roundups also describe the general-purpose AWS MCP Server as the best place to start for cloud workflows because it connects agents to AWS docs, API references, and SOPs.[10]\n\nIf you tell me your use case\u2014**read-only inventory, incident response, IaC, cost analysis, or deployment automation**\u2014I can recommend the single best AWS MCP server for that scenario.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 1, "phrasing": "Best Model Context Protocol server for Amazon Web Services", "text": "The **best choice depends on what you mean by \u201cfor Amazon Web Services\u201d**: for most users, the **AWS MCP Server** is the strongest default because AWS describes it as a managed remote MCP server that gives AI agents authenticated access to *all AWS services* through a small fixed set of tools.[1][10]\n\nIf your goal is more specific, the best option changes:\n\n- **General AWS tasking / broad service coverage:** **AWS MCP Server**.[1][10]\n- **Documentation and code generation using current AWS docs:** **AWS Documentation MCP Server** from AWS Labs.[6]\n- **Deploying your own MCP server on AWS infrastructure:** AWS\u2019s deployment guidance and patterns for MCP on AWS.[2][4]\n- **Serverless/container-focused workflows:** AWS\u2019s specialized MCP servers for **Lambda, ECS, and EKS**.[7][11]\n\nA practical recommendation is:\n- Use **AWS MCP Server** if you want one server for day-to-day AWS operations and agent workflows.[1][10]\n- Use **AWS Documentation MCP Server** alongside it if you want better research, architecture guidance, or code generation grounded in current AWS docs.[6]\n- Use the specialized **serverless/container MCP servers** only when your use case is concentrated on those services.[7][11]\n\nIf you want, I can also give you a **\u201cbest AWS MCP server by use case\u201d table** for DevOps, Bedrock, Lambda, ECS/EKS, and documentation.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 2, "phrasing": "We want our local AI coding assistant to query AWS S3 buckets and CloudWatch logs via MCP. What server should we use?", "text": "Use **two MCP servers**, not one: **Amazon CloudWatch MCP Server** for CloudWatch logs/metrics/alarms, and an **Amazon S3 MCP server** for S3 buckets and objects.[1][2][11][15]\n\nIf you want the most AWS-native setup for a local coding assistant:\n- **CloudWatch logs**: `awslabs.cloudwatch-mcp-server`.[1][2]\n- **S3 buckets**: an S3-specific MCP server such as `aws-s3-mcp` if you want a dedicated S3 toolset.[11]\n\nA few important notes:\n- The AWS Labs **CloudWatch MCP Server** is designed for CloudWatch telemetry and can be run locally with your AI client.[2][15]\n- The **AWS MCP Server** generally provides broader AWS service access through a managed remote MCP server, but the AWS Labs CloudWatch server is the direct fit for CloudWatch logs.[6][10][15]\n- There is also an **AWS API MCP Server** in AWS Labs, but the search results do not show it as the dedicated choice for S3 plus CloudWatch together.[3]\n\nIf you want, I can give you a ready-to-paste `mcp.json` configuration for both servers.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 3, "phrasing": "Recommend an AWS MCP server for a team managing multi-region cloud resources.", "text": "For a team managing **multi-region AWS resources**, the best default choice is the **AWS MCP Server**. It is a managed remote MCP server with secure, authenticated access to AWS services, can make API calls to *any* Region, and is designed for multi-step operational tasks across services.[2][4][8]\n\nIf your team also needs **region-awareness and documentation-driven guidance**\u2014for example, deciding which services are available in which Regions during expansion\u2014the **AWS Knowledge MCP Server** is a strong companion, because it includes authoritative AWS documentation and regional availability for AWS APIs and CloudFormation resources.[1][5][11]\n\nA practical recommendation would be:\n\n- **Primary server:** **AWS MCP Server** for creating, updating, troubleshooting, and managing AWS resources across Regions.[2][4][8]\n- **Supplementary server:** **AWS Knowledge MCP Server** for planning, validation, and Region-specific guidance.[1][5][11]\n\nIf you want the simplest setup for a team, use the **AWS MCP Server** first; if your workflows are heavy on architecture decisions or regional expansion planning, add the **AWS Knowledge MCP Server** as well.[2][5][10]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 4, "phrasing": "affordable and secure MCP server for AWS resource management", "text": "The **best affordable and secure choice** for AWS resource management is the **AWS MCP Server** from AWS: it is generally available, gives agents secure authenticated access to AWS services, and has **no additional charge** beyond the AWS resources your agents use.[1][3] It is also described as providing **auditable access** to AWS services and is available as a managed server.[1][13]\n\nIf you want an **open-source option you can run yourself**, AWS Labs\u2019 **AWS API MCP Server** is the main general-purpose choice for managing infrastructure, exploring resources, and executing AWS operations with **IAM-based permissions, zero credential exposure, and CloudTrail audit logging**.[2][12] AWS also notes that the open-source MCP servers are built with safety and control in mind and support comprehensive resource management.[2][5]\n\nA practical way to choose:\n\n- **Lowest operational effort / managed:** **AWS MCP Server**.[1][3]\n- **Self-hosted / more control:** **AWS API MCP Server** from AWS Labs.[2][12]\n- **Best if you need extra deployment hardening:** AWS\u2019s guidance for running MCP servers on AWS adds **OAuth 2.0**, **Amazon Cognito**, and layered network protections such as **CDNs** and **WAFs**.[6][8]\n\nIf your priority is **security plus predictable cost**, the managed AWS MCP Server is the strongest default recommendation because AWS says the server itself is free and handles authentication and auditability for you.[1][3] If you need to host it yourself and enforce your own boundary, the AWS Labs open-source server is the better fit.[2][12]\n\n", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 5, "phrasing": "What MCP server do cloud engineers actually use to let LLMs read AWS configuration?", "text": "Cloud engineers who want LLMs to **read AWS configuration** most commonly use the **AWS MCP Server** itself, especially the **AWS API MCP Server** for general AWS interaction and the newer managed **AWS MCP Server** that AWS now recommends switching to.[1][7][13]\n\nIf the goal is specifically **reading AWS resource/configuration state** rather than changing it, AWS positions the **AWS API MCP Server** as the \u201cstart here\u201d option for general AWS interactions, including exploring resources and accessing all AWS services through MCP.[13] AWS also says the managed **AWS MCP Server** provides secure authenticated access to AWS services and can be restricted to **read-only** actions via IAM or SCPs, which makes it suitable for configuration inspection.[3][7]\n\nIf you mean **reading documentation or service guidance** about AWS configuration, then the **AWS Knowledge MCP Server** is the one for docs and references, not live account config.[13]\n\nIn practice:\n- **Live AWS account config / resource state:** **AWS API MCP Server** or the managed **AWS MCP Server**.[1][13]\n- **AWS docs and best practices:** **AWS Knowledge MCP Server**.[13]\n- **Infrastructure CRUDL via natural language:** **AWS Cloud Control API MCP Server**.[4]\n\nIf you want, I can also tell you **which one is best for Claude, Amazon Q Developer, or Cursor**, because the recommended setup differs a bit by client.[7][12][16]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 6, "phrasing": "Best MCP server to connect AI agents to Amazon Web Services data stores", "text": "If you want the **best single MCP server for AWS data stores**, the strongest default choice is **AWS\u2019s official MCP server suite from awslabs/mcp**, because it includes official tools for **DynamoDB**, **Amazon S3**, and **PostgreSQL via RDS Data API** rather than just one database type.[2][4][6]\n\nFor a more specific recommendation:\n\n- **DynamoDB**: use the **AWS DynamoDB MCP server** in the AWS MCP suite, which supports complete DynamoDB operations and table management.[2][4]\n- **Amazon S3**: use the **AWS S3 MCP server** for listing, reading, and writing objects in buckets.[3]\n- **Aurora / PostgreSQL**: use the **PostgreSQL database operations via RDS Data API** MCP server for relational data access.[2]\n- **Broader AWS infrastructure/data workflows**: the **AWS MCP Server** GA offering gives authenticated access to AWS services through a fixed set of tools, which is useful when agents need to move beyond a single datastore.[7]\n\nIf your goal is **one server that covers the most AWS data-store use cases**, start with **awslabs/mcp / AWS MCP Servers**, then add the datastore-specific server that matches your primary backend.[2][4][6]\n\nIf you want, I can also give you a **best MCP server by datastore** table for DynamoDB, S3, Aurora/Postgres, Redshift, and Bedrock.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 7, "phrasing": "Which MCP server allows LLMs to query AWS DynamoDB and S3 safely?", "text": "The safest AWS-managed option is the **AWS MCP Server**. It gives LLMs authenticated access to AWS services, including **Amazon S3** and **Amazon DynamoDB**, through a small fixed set of tools and IAM-scoped permissions, with CloudTrail audit logging and no credential exposure.[6][7][3]\n\nIf you want the **service-specific open-source servers**, AWS Labs also provides separate **Amazon DynamoDB MCP Server** and **AWS S3 MCP Server / S3 Tables MCP Server** options, but the managed **AWS MCP Server** is the clearest answer for \u201csafely\u201d accessing both services through one MCP layer.[4][11][8]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 8, "phrasing": "We are building an AI dev tool that needs read-only access to AWS architecture via MCP. What MCP server implementation is best?", "text": "For **read-only access to AWS architecture**, the best default choice is the **managed AWS MCP Server** if your goal is broad, secure, authenticated access to AWS services with minimal operational overhead.[8] AWS describes it as a managed remote MCP server that gives AI agents and coding assistants access to AWS services through a small, fixed set of tools, and it can be constrained with IAM or SCPs to read-only behavior.[8]\n\nIf you want a **purpose-built, safer-by-default server for serverless/infra exploration**, the **AWS Serverless MCP Server** is the strongest implementation choice because it runs in **read-only mode by default** and explicitly restricts mutating actions unless you enable them.[5][7] AWS also recommends separate IAM roles and least-privilege controls for this server, which fits a read-only developer tool well.[5]\n\nIf your product needs **custom AWS-architecture introspection** beyond the built-in AWS tools, the best implementation pattern is to **build your own MCP server using the AWS deployment guidance** rather than starting from scratch.[2][3] AWS provides deployment patterns for Lambda/API Gateway, ECS, and EKS, and the official guidance demonstrates secure containerized deployments with OAuth 2.0 / MCP spec support.[2][3][6]\n\n**Practical recommendation:**\n- Choose **AWS MCP Server** if you want **broad AWS coverage** and the least infrastructure work.[8]\n- Choose **AWS Serverless MCP Server** if your tool is mainly about **serverless architecture visibility** and you want **read-only by default** guardrails.[5][7]\n- Choose a **custom MCP server on AWS** if you need to expose only the specific architecture data your tool needs, with tighter control over tools, auth, and permissions.[2][3][6]\n\nFor an AI dev tool that needs **read-only AWS architecture access via MCP**, I\u2019d start with **AWS Serverless MCP Server** if your scope is serverless-centric, or **AWS MCP Server** if you need broader AWS service coverage; in both cases, enforce **IAM read-only permissions** and server-side guardrails.[5][8]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 9, "phrasing": "Top open source MCP servers for AWS integration", "text": "The **best open-source AWS MCP option** is AWS Labs\u2019 **`awslabs/mcp`** collection, because it is the official AWS-maintained catalog of MCP servers for AWS services and workflows.[1][3][5] If you want broader AWS coverage in one place, AWS also offers the **AWS API MCP Server** in the same ecosystem for natural-language interaction with AWS services and resources.[15][20]\n\nFor AWS integration, the most relevant open-source options from the results are:\n\n- **AWS Labs MCP catalog (`awslabs/mcp`)** \u2014 official open-source collection with many AWS-focused servers across core AWS access, documentation, analytics, databases, and infrastructure workflows.[1][5]\n- **AWS API MCP Server** \u2014 open-source server for interacting with AWS services and resources through AWS CLI-style operations and AWS APIs.[15][20]\n- **AWS Serverless MCP Server** \u2014 focused on serverless development and available from AWS via GitHub or PyPI.[12]\n- **AWS Data Processing MCP Server** \u2014 built for analytics and data pipelines across AWS Glue, EMR, and Athena.[14]\n- **Service-specific AWS MCP servers** in the AWS Labs catalog, such as Amazon OpenSearch, SageMaker AI, DynamoDB, Aurora PostgreSQL, Aurora MySQL, Aurora DSQL, and DocumentDB.[10]\n\nIf you want a quick recommendation by use case:\n\n| Use case | Best pick |\n|---|---|\n| Broad AWS coverage | **awslabs/mcp** catalog[1][5] |\n| General AWS API interaction | **AWS API MCP Server**[15][20] |\n| Serverless apps | **AWS Serverless MCP Server**[12] |\n| Data/analytics pipelines | **AWS Data Processing MCP Server**[14] |\n| Database-specific AWS tasks | Relevant service MCP server in AWS Labs catalog[10] |\n\nA practical way to think about it is that **AWS Labs\u2019 catalog** is the safest starting point for open-source AWS integration, while the **specialized servers** are better when you want a narrower blast radius and a workflow tailored to one AWS service.[1][5][4]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 10, "phrasing": "Which Model Context Protocol server works best for Amazon Bedrock LLMs?", "text": "There is no single **best** MCP server for all Amazon Bedrock LLM use cases; the best choice depends on *what data or tools the model needs*. AWS\u2019s own guidance says to select the MCP servers that match your data sources and use case, and it highlights different servers for different jobs such as knowledge-base retrieval, Kendra search, document parsing, and custom model management.[5][7][9]\n\nIf you want the most broadly useful option for Bedrock LLMs doing enterprise RAG, the **Amazon Bedrock Knowledge Bases Retrieval MCP Server** is usually the strongest default because it is purpose-built to query Bedrock knowledge bases with **citation support**.[7][9][14]\n\nA practical ranking for common Bedrock scenarios is:\n\n- **Enterprise RAG / grounded answers:** **Amazon Bedrock Knowledge Bases Retrieval MCP Server**.[7][9][14]\n- **Enterprise search across indexed content:** **Amazon Kendra Index MCP Server**.[7][9]\n- **Document, image, video, or audio analysis:** **AWS Bedrock Data Automation MCP Server**.[9]\n- **Managing or using custom Bedrock models:** **Amazon Bedrock Custom Model Import MCP Server**.[7][9]\n- **If you want to expose your own APIs or workflows as MCP tools:** **Amazon Bedrock AgentCore Gateway** or a stateless MCP server deployed on AgentCore Runtime.[2][8][10][18]\n\nIf your question is really \u201cwhich MCP server is best overall for building an agent on Bedrock,\u201d AWS\u2019s docs point more toward **AgentCore Gateway/Runtime plus the right specialized MCP server(s)** rather than one universal server, because Bedrock\u2019s MCP contract supports stateless and stateful servers, session handling, and orchestration patterns depending on the workload.[6][8][10]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 11, "phrasing": "How to connect an LLM assistant to AWS cloud resources using MCP?", "text": "To connect an LLM assistant to AWS cloud resources with MCP, you typically **run or use an AWS MCP server**, then **configure your MCP-capable assistant as the client** so it can discover and call AWS tools through that server.[1][3][7]\n\nThe basic flow is:\n\n- **Choose an MCP-capable assistant/client** such as Claude Desktop, Amazon Q CLI, Cursor, Kiro, or another agent that supports MCP.[1][5][16]\n- **Pick the AWS MCP server** you need, for example:\n  - **AWS API MCP Server** for AWS CLI-based access to AWS services and resources.[12][14]\n  - **AWS Cloud Control API MCP Server** for natural-language infrastructure management.[2]\n  - **Service-specific servers** like the EKS MCP Server or OpenSearch-related MCP support.[9][17]\n- **Set up authentication and network access** so the server can reach AWS resources and act with the right permissions.[13][17]\n- **Register the MCP server in the assistant\u2019s config** so the client can start it and connect to it.[1][2][11]\n- **Restart the assistant and test a prompt** that uses AWS resources, such as creating an S3 bucket or querying a cluster.[2][18]\n\nA common architecture is:\n\n- The **assistant** is the MCP client.\n- The **AWS MCP server** exposes tools/capabilities.\n- The assistant first **discovers the tools**, then decides which ones to call, and the server executes the AWS-side actions or queries.[3][6][8]\n\nIf you want the simplest implementation path, AWS\u2019s guidance and examples show two practical options:\n\n- **Local/client-side bridge:** use something like the **MCP Proxy for AWS** to connect desktop assistants or agent frameworks to AWS MCP servers.[7]\n- **Managed/service integration:** use AWS-hosted MCP server offerings where available, then connect your agent via the provided endpoint and auth method.[2][17]\n\nA minimal setup pattern looks like this:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws\": {\n      \"command\": \"npm\",\n      \"args\": [\"--silent\", \"--prefix\", \"/path/to/aws-mcp\", \"start\"]\n    }\n  }\n}\n```\n\nThat example is for a locally run MCP server wired into an MCP client such as Claude Desktop; the exact command depends on which AWS MCP server you choose.[11]\n\nIf you tell me which assistant you\u2019re using (Claude Desktop, Cursor, Amazon Q, OpenCode, etc.) and which AWS resources you want to access, I can give you the exact setup steps and config.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 12, "phrasing": "What is the most reliable MCP server for inspecting AWS IAM roles and Security Groups?", "text": "For **reliability and security**, the best choice is the **AWS-managed AWS MCP Server** rather than a self-hosted MCP server. AWS describes it as a managed remote MCP server with IAM-based access controls, CloudTrail logging, and no separate permission needed just to invoke the server, which makes it the most operationally robust option in the results you provided.[9][14][1]\n\nIf your specific goal is **inspecting IAM roles and Security Groups**, the **AWS IAM MCP Server** is the most directly relevant open-source server for IAM roles, because it explicitly supports comprehensive IAM operations and listing roles.[4][11] However, it is focused on IAM and does not appear, from the provided results, to be the best single server for both IAM roles *and* Security Groups.\n\nFor **both IAM roles and Security Groups in one place**, the most reliable approach is likely the **AWS MCP Server GA / managed AWS MCP Server** with least-privilege IAM and service-level controls, because it is the most strongly governed option in the results and is meant for broad AWS API access.[9][10][14]\n\n- **Best overall reliability:** AWS-managed **AWS MCP Server**[9][14]\n- **Best for IAM roles specifically:** **AWS IAM MCP Server**[4][11]\n- **Best for both IAM roles + Security Groups:** **AWS MCP Server** with scoped IAM permissions[9][10][14]\n\nIf you want, I can also recommend the **exact tool/server setup** for \u201cread-only inspection of IAM roles and Security Groups\u201d based on least privilege.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 13, "phrasing": "Best MCP server for querying CloudWatch logs with natural language", "text": "The best **MCP server for querying CloudWatch logs with natural language** appears to be **AWS Labs\u2019 Log-Analyzer-with-MCP** / its CloudWatch Logs MCP server, because it is explicitly designed to let AI assistants **search, analyze, and correlate CloudWatch Logs** and exposes log-search tools such as `search_logs` and `list_log_groups`.[13][16]\n\nA few other options exist, but they are either narrower or less directly focused on natural-language log analysis:\n\n- **CloudWatch Logs MCP Server - The Insight Generator** is described as querying logs with natural language and identifying patterns, but the source is a blog-style roundup rather than the primary project documentation.[1]\n- **madhurprash/AWS_CloudGuardMCP** is incident-focused and can fetch CloudWatch logs for a service, but it is broader than pure log querying and includes alarms and JIRA ticket creation.[2]\n- **AWS\u2019s official CloudWatch MCP integration** in Kiro supports CloudWatch MCP configuration and natural-language workflows, but the docs emphasize setup rather than a standalone, log-analysis-first MCP server.[5][7]\n- **AWS CloudWatch Logs Insights Query Assist** is strong for natural-language query generation, but it is a CloudWatch feature rather than an MCP server.[9]\n\nIf you want the **closest fit for \u201cask questions about CloudWatch logs in plain English\u201d**, I would pick **AWS Labs Log-Analyzer-with-MCP** first.[13][16] If you want, I can also compare the top 3 options by **setup difficulty, AWS support status, and query capabilities**.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 14, "phrasing": "We need an MCP server that lets developers ask an AI agent about active AWS EC2 instances. What options exist?", "text": "Several MCP server options can help developers ask an AI agent about **active AWS EC2 instances**, but they differ in scope and how directly they expose EC2 data.\n\n- **AWS Instances MCP / EC2 Instance MCP server**: This is the most direct fit if the goal is simply to list running EC2 instances in a region. It uses the AWS SDK to retrieve running instances and can return details like instance ID, type, IP address, and status; one package version also exposes `list_instances` and `get_instance_details`. [2][4][5]\n- **AWS API MCP Server**: This is a broader AWS integration that lets AI assistants interact with AWS services through AWS CLI commands, so EC2 instance queries are possible but not limited to EC2. It is better when you want a general AWS control surface rather than a dedicated EC2 inventory tool. [7]\n- **AWS Cloud Control API MCP Server**: This is designed for CRUDL-style infrastructure management through natural language and explicitly supports resource discovery and list operations, including EC2-related prompts such as finding EC2 instances that do not match a given type. It is broader than EC2-only inventory but well-suited if you want natural-language resource inspection across AWS. [19]\n- **AWS MCP Server (managed service)**: AWS\u2019s managed MCP server lets agents search AWS documentation and retrieve service information without authentication, so it is more useful for reference and guidance than for directly enumerating your active EC2 instances. [9]\n- **Open-source AWS MCP servers hosted in the AWS Labs ecosystem**: AWS maintains a catalog of open-source MCP servers, which is useful for finding purpose-built servers like the EC2-focused one or broader servers such as API-oriented or monitoring-oriented options. [6][16]\n\nIf your primary requirement is **\u201cask an AI agent about active EC2 instances\u201d**, the best match is the **AWS Instances / EC2 Instance MCP server** because it is explicitly built to list running EC2 instances and expose instance details. [2][4][5]\n\nIf you want, I can also compare these options by **deployment model, auth requirements, and tool coverage** for a production setup.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 15, "phrasing": "Which MCP server provides secure Amazon Web Services connector tools for AI models?", "text": "The **AWS MCP Server** provides secure Amazon Web Services connector tools for AI models.[1][5][13]\n\nIt is described by AWS as a managed, remote Model Context Protocol server that gives AI agents **secure, authenticated access** to AWS services through a small, fixed set of tools, with **IAM-based access controls** and enhanced security controls.[1][5][13] It also consolidates the earlier AWS Knowledge MCP Server and AWS API MCP Server into a single interface.[6][13]\n\nIf you meant a server for exposing *your own SaaS* to AI models via MCP, that would be the **MCP Server on AWS \u2013 Connector Platform for Secure Agent Access** in AWS Marketplace, which is a separate offering.[2]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 16, "phrasing": "Best production-ready MCP server for AWS API interactions", "text": "For **production-ready AWS API interactions**, the strongest default choice is the **AWS API MCP Server** because AWS positions it as the general-purpose server for AWS interactions and says it enables foundation models to interact with **any AWS API** by generating valid CLI commands.[12][13]\n\nIf your use case is more specific, the best production-ready choice depends on the scope:\n\n- **General AWS operations:** **AWS API MCP Server** \u2014 best starting point for broad AWS service coverage and natural-language-to-CLI execution.[12][13]\n- **Infrastructure management with stricter governance:** **AWS Cloud Control API MCP Server** \u2014 useful when you want infrastructure-oriented operations through Cloud Control rather than direct service-by-service calls.[19]\n- **Serverless-focused AWS workflows:** **AWS Serverless MCP Server** \u2014 AWS explicitly documents it for production use cases, with **read-only by default**, separate IAM roles, CloudTrail auditing, and disabling auto-approve as recommended controls.[9]\n\nFor production specifically, AWS\u2019s own guidance points to these safeguards: **least-privilege IAM**, **read-only mode by default**, **separate read/write roles**, **CloudTrail auditing**, and avoiding secret leakage through prompts or templates.[9] AWS also states the AWS MCP Server is generally available and can make API calls to any Region, which strengthens it as an enterprise-ready option for broad AWS API access.[1]\n\nIf you want one answer: choose **AWS API MCP Server** for the broadest, most production-relevant AWS API interaction layer, and pair it with strict IAM scoping and audit controls.[12][13][1][9]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 17, "phrasing": "We are an enterprise cloud platform team looking for a compliant AWS MCP server for internal AI tools. What should we evaluate?", "text": "For a **compliant AWS MCP server** for internal AI tools, evaluate it first as a **security-and-governance component**, not just an AI integration. The most important checks are **authentication**, **authorization**, **data handling**, **auditability**, and whether the deployment model matches your compliance requirements[2][10][13].\n\nWhat to evaluate:\n\n- **Authentication model**: Confirm the server supports a standard, enforceable auth method such as **OAuth 2.0**, **AWS SigV4**, or **API key/token-based auth**, and verify how sessions are established and expired[6][4][16].\n- **Authorization and least privilege**: Check whether the server can enforce **scoped-down permissions** and distinguish read-only from write actions, with IAM policies aligned to the minimum required access[11][13][17].\n- **Deployment model**: Determine whether it is **managed by AWS**, **self-managed on your infrastructure**, or **local-only**. This affects your ability to control network exposure, credentials, and compliance boundaries[10][13][16].\n- **Transport and protocol support**: Verify support for the **Streamable HTTP transport protocol** if you plan to connect it to AWS DevOps Agent or similar managed integrations[6].\n- **Compliance scope**: Ask which AWS compliance programs the underlying AWS services are in scope for, and confirm whether the server\u2019s dependencies inherit the compliance posture you need[2][5][3].\n- **Logging and audit trails**: Ensure actions are captured in **CloudTrail** and that logs are sufficient for incident response, access reviews, and forensic analysis[13][15].\n- **Credential handling**: Confirm secrets are stored in **AWS Secrets Manager** or equivalent secure storage, with no hard-coded credentials or tokens in code, config, or logs[1][13].\n- **Network controls**: Require **TLS 1.2 or higher** for all communications; AWS recommends **TLS 1.3**. Also verify whether the service can be placed behind controlled network boundaries such as WAF/CDN/private networking where appropriate[3][13][10].\n- **Data minimization**: Check whether prompts, tool outputs, and retrieved context are minimized so sensitive data does not unnecessarily enter model context or diagnostic logs[11][13].\n- **Tool safety and input validation**: Validate that tool parameters are checked server-side and that the server avoids unsafe execution paths that could bypass policy controls[13][15].\n- **Separation of duties**: Confirm whether you can separate **read** and **write** access, and whether user-specific permissions are preserved when the AI agent invokes tools[11][15].\n- **Direct access bypass risk**: Evaluate whether users or agents also have shell, SDK, or other direct access paths that could bypass the MCP server\u2019s controls[15].\n- **Monitoring and alerting**: Check for alerting on sensitive operations, policy violations, and anomalous agent activity, not just basic uptime monitoring[15].\n- **Compliance evidence**: Ask for documentation showing how the server supports your required controls, such as IAM policy examples, audit log samples, deployment architecture, and any mapped compliance attestations[2][5][10].\n- **Operational fit**: Verify scalability, rate limiting, reliability controls, and whether the server can be reused safely across teams without cross-tenant data leakage[11].\n\nA practical enterprise review checklist would also include:\n\n- **Who owns the trust boundary**: AWS-managed service, your platform team, or a third-party vendor[10][19].\n- **Whether IAM conditions can differentiate AI-driven access**: For AWS-managed MCP, look for support for condition keys like **`aws:ViaAWSMCPService`** and **`aws:CalledViaAWSMCP`** in policy design[15][19].\n- **Whether the server is suitable for your internal threat model**: especially if it can access production resources, secrets, or sensitive configuration data[13][15].\n- **Whether compliance controls are tested**: such as template validation, policy enforcement, and log review in non-production before production rollout[17][18].\n\nIf you want, I can turn this into a **vendor evaluation scorecard** or a **procurement questionnaire** tailored to AWS, SOC 2, ISO 27001, and internal security review.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 18, "phrasing": "Which MCP server gives AI coding assistants real-time context on AWS cloud infrastructure?", "text": "The **AWS MCP Server** is the one that gives AI coding assistants real-time context on AWS cloud infrastructure, because AWS says it provides secure, authenticated access to AWS services and real-time access to AWS documentation and context without consuming the model\u2019s context window.[1][5][9]\n\nIf you mean a server focused on a *specific* infrastructure area, AWS also offers specialized MCP servers such as the **AWS Infrastructure-as-Code MCP Server** for CloudFormation/CDK workflows and the **Amazon ECS MCP Server** for ECS workload visibility and troubleshooting.[4][7]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 19, "phrasing": "What MCP server should I use to let AI models run AWS CLI commands safely?", "text": "If your goal is to let AI models run **AWS CLI commands safely**, the best choice is the **AWS MCP Server** from AWS, specifically the newer managed remote server that AWS now recommends over older options like `aws-api-mcp-server`.[11][13][15]\n\nWhy it\u2019s the strongest fit:\n\n- AWS says that if you are currently using **AWS API MCP Server** or **AWS Knowledge MCP Server**, you should **switch to the AWS MCP Server**.[11]\n- The AWS MCP Server is described as a **managed remote MCP server** with **enhanced security controls through IAM condition keys**.[11]\n- AWS also says it uses a **small, fixed set of tools** and gives agents access through your **existing IAM credentials**, which helps keep access controlled and auditable.[13][15]\n\nIf you specifically want a server that focuses on **AWS CLI execution**, the open-source **AWS API MCP Server** and the `use_aws_mcp` / `aws-cli-mcp-server` projects also exist, but they are generally more \u201cexecute CLI command\u201d oriented and less clearly positioned as the current preferred AWS-maintained option.[1][4][7][12]\n\nA practical recommendation:\n\n- Choose **AWS MCP Server** if you want the **official, current AWS-recommended** option with stronger managed security controls.[11][13]\n- Choose **AWS API MCP Server** only if you need the older open-source CLI-oriented server behavior and are comfortable managing the security model yourself.[5][6][15]\n- If you want to run arbitrary terminal commands beyond AWS, use a separate **command-line MCP server** with strict allowlists, not an AWS-focused server.[9]\n\nFor safety, the key controls are:\n- **Least-privilege IAM**\n- **Read-only mode where possible**\n- **Audit logging / CloudTrail**\n- Avoid exposing the MCP server broadly, since CLI-execution servers can still perform destructive actions if permissions allow it.[5][10][12][15]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 20, "phrasing": "Model Context Protocol server for querying AWS Cost Explorer and billing via AI", "text": "If you want an **AI-accessible Model Context Protocol (MCP) server** for AWS billing, the right backend is usually the **AWS Cost Explorer API**, because it exposes programmatic query access to cost and usage data, including aggregated and filtered views across dimensions like service, linked account, tags, and day/month granularity.[1][2] AWS also documents that users need **explicit IAM permission** to query this API, and the service endpoint is `ce.us-east-1.amazonaws.com`.[1][10]\n\nA practical MCP server design would typically provide tools such as:\n\n- **get_cost_and_usage** for daily/monthly spend and usage queries.[2][3]\n- **get_dimension_values** for discovering valid filter/grouping values.[2]\n- **get_tags** for tag key/value discovery.[2]\n- **get_reservation_utilization** if you need RI utilization analytics.[2]\n\nFor an AI assistant, the most useful pattern is to expose these as MCP tools with a natural-language layer on top, for example:\n\n- \u201cShow last month\u2019s blended cost by service.\u201d\n- \u201cBreak down this month\u2019s spend by linked account and tag.\u201d\n- \u201cWhat are the top cost drivers for the current month?\u201d\n\nA few implementation notes matter:\n\n- **Cost Explorer API calls are billable**: AWS states the API costs **$0.01 per request** for the primary billing view, with custom billing views billed per source.[2][12]\n- **Use tight filters**: AWS recommends narrowing the time range and applying filters to reduce result size and improve efficiency.[10]\n- **Region/endpoints**: the API endpoint is in **us-east-1** and returns usage data for all public AWS Regions.[1][2]\n\nIf you\u2019re building this now, the cleanest architecture is:\n\n- MCP server\n- AWS SDK client for Cost Explorer\n- IAM role with Cost Explorer read permissions\n- Optional caching layer to reduce repeated API calls\n- Guardrails for time ranges, grouping cardinality, and cost-aware querying\n\nIf you want, I can draft:\n- an **MCP server spec** for Cost Explorer,\n- a **Python or Node.js implementation skeleton**,\n- or a **tool schema** for natural-language billing queries.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 21, "phrasing": "What is the standard MCP server for Amazon Web Services integrations?", "text": "The standard MCP server for general **AWS integrations** is the **AWS MCP Server**. AWS now recommends switching to it from the older **AWS API MCP Server** and **AWS Knowledge MCP Server** because it is a managed remote MCP server with broader AWS API coverage and stronger security controls.[11][16]\n\nIf you mean a server for a specific AWS use case, AWS also offers specialized MCP servers such as the **AWS Marketplace MCP server**, **AWS Serverless MCP Server**, and **AWS Data Processing MCP Server**.[4][14][18]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 22, "phrasing": "Recommended MCP server for connecting AI agents to AWS Lambda and API Gateway", "text": "For most teams on AWS, the **best recommended MCP server/gateway option** for connecting AI agents to **AWS Lambda and API Gateway** is **Amazon Bedrock AgentCore** if you want an AWS-managed gateway that fits existing IAM, CloudTrail, and CloudWatch operations.[3][5] If you specifically want to run the MCP server *directly* on serverless infrastructure, AWS guidance and multiple implementation guides support **Lambda + API Gateway** as the standard pattern.[7][12][13]\n\nThe choice depends on what you mean by \u201crecommended\u201d:\n\n- **Best AWS-native managed gateway:** **Amazon Bedrock AgentCore** for teams already standardized on AWS and wanting Lambda, APIs, and remote MCP servers in one control plane.[3][5]\n- **Best direct serverless hosting pattern:** **AWS Lambda + API Gateway** for a remote MCP server exposed to agents over HTTP.[7][12][13]\n- **Best for internal/private Lambda tool access:** **AWS Lambda Tool MCP Server** from AWS, which lets AI models invoke existing Lambda functions as MCP tools without code changes.[11][17]\n\nIf your goal is to connect AI agents to **your own MCP server hosted on AWS**, the practical recommendation is:\n\n- Use **API Gateway HTTP API + Lambda** for ordinary request/response workloads.[1][15]\n- Use **Lambda Function URL** only when you want a simpler internal setup and do not need the extra API Gateway features.[10]\n- Use **Lambda Web Adapter** only if you need streaming/progressive responses, because it adds complexity.[1][18]\n\nIn short: **AgentCore** is the best \u201crecommended MCP gateway\u201d for AWS-centric agent platforms, while **Lambda + API Gateway** is the best direct hosting pattern for a remote MCP server on AWS.[3][7][12]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 23, "phrasing": "Best MCP server for letting an LLM query Amazon RDS databases", "text": "For **Amazon RDS**, the best choice is usually the **AWS Labs RDS/Aurora-specific MCP server that matches your database engine** rather than a generic database server. AWS publishes dedicated MCP servers for **Aurora PostgreSQL**, **Aurora MySQL**, **RDS Oracle**, and **RDS SQL Server**, with the PostgreSQL server explicitly supporting natural-language-to-SQL conversion and execution against an Aurora PostgreSQL database via the **RDS Data API**.[2][9]\n\nIf your goal is specifically to let an LLM **query the database** (not manage instances), the strongest fit from the results is:\n\n- **Aurora PostgreSQL MCP Server** for PostgreSQL workloads.[2][9]\n- **Amazon Aurora MySQL MCP Server** for MySQL workloads.[9][15]\n- **RDS Oracle MCP Server** or **RDS SQL Server MCP Server** for those engines.[9]\n\nIf you need something broader than AWS\u2019s engine-specific servers, the results also mention **DBHub** and other universal database MCP servers that support multiple database types, but those are not AWS-native and are less purpose-built for RDS.[7][18]\n\nA practical recommendation:\n- Use **AWS Labs\u2019 engine-specific MCP server** if you want the best AWS integration and are querying a known RDS engine.[2][9]\n- Use a **universal database MCP server** only if you need one tool across many database types.[7][18]\n\nIf you want, I can also compare the **Aurora PostgreSQL vs Aurora MySQL MCP servers** for security, setup complexity, and read/write capability.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 24, "phrasing": "We need an MCP server to let our AI assistant analyze AWS CloudTrail logs. What server works best?", "text": "The **AWS CloudTrail MCP Server** from **AWS Labs** is the best fit for analyzing AWS CloudTrail logs because it is purpose-built for **CloudTrail events** and **CloudTrail Lake analytics**, including user activity analysis, API call tracking, and security/compliance investigations.[1][3]\n\nIf your goal is specifically to let an AI assistant inspect **AWS account activity** from CloudTrail, this server is the most directly relevant option in the AWS MCP catalog.[1][8] AWS describes it as providing standardized MCP access to CloudTrail data so agents can perform security investigations, compliance auditing, and operational troubleshooting without custom integrations.[1]\n\nA good alternative is the broader **AWS Security MCP Server**, which includes **Athena-powered log analytics** for CloudTrail, VPC Flow Logs, and other security events.[2] That is useful if you want a more general security-analysis server across multiple AWS log sources, but for **CloudTrail-first** use cases, the dedicated CloudTrail server is the better choice.[1][2]\n\nIf you want, I can also recommend the best setup for:\n- **Amazon Q / Claude Desktop / Cursor**\n- **Docker vs `uvx` installation**\n- **minimum IAM permissions for CloudTrail analysis**", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 25, "phrasing": "Which MCP server bridges local AI clients with AWS cloud management APIs?", "text": "The **AWS API MCP Server** is the MCP server that bridges local AI clients with AWS cloud management APIs.[6][10][12]\n\nIf you mean the newer, managed offering, AWS also introduced the **AWS MCP Server**, which consolidates the AWS API MCP Server and AWS Knowledge server into a unified interface for AI agents and coding assistants.[3][5][9]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 26, "phrasing": "Most active open source MCP server project for Amazon Web Services", "text": "The **most active open-source AWS MCP server project** appears to be **`awslabs/mcp`**, the AWS Labs umbrella repository for open-source MCP servers for AWS, because it is the central AWS-maintained project listing **62 servers** and serving as the official hub for AWS MCP servers.[1][9]\n\nIf you mean a **single MCP server** rather than the umbrella repo, the strongest candidate in the results is the **AWS API MCP Server**, which AWS announced as an **open-source project** and later described as generally available as a managed remote MCP server for authenticated access to AWS services.[4][8][15]\n\nA few useful distinctions:\n\n- **`awslabs/mcp`** = the main open-source repository and catalog for AWS MCP servers.[1][9]\n- **AWS API MCP Server** = one specific, widely promoted AWS MCP server project within that ecosystem.[4][15]\n- **AWS Serverless MCP Server** and **AWS Knowledge MCP Server** are also active AWS-open-source MCP projects, but the provided results do not show evidence that they are more active than the umbrella repo or the API server.[10][13]\n\nIf you want, I can also rank the AWS MCP server projects by **GitHub stars, release activity, or ecosystem usage** based on the available sources.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 27, "phrasing": "What MCP server allows AI agents to inspect and modify AWS S3 bucket policies?", "text": "The **AWS S3 MCP Server** is the MCP server used to inspect and modify S3 bucket policies, with tools such as `get_bucket_policy` and `put_bucket_policy`/`set_bucket_policy` described in multiple server listings.[6][18]\n\nIf you mean the **official AWS-managed** MCP option, the broader **AWS MCP Server** can call AWS APIs, including S3 operations, but the S3-specific MCP server listings are the ones that explicitly expose bucket policy read/write tools.[1][2][6][18]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 28, "phrasing": "Best lightweight MCP server for AWS developer tooling", "text": "If you want the **lightest-weight option for AWS developer tooling**, the best fit is usually **`alexei-led/aws-mcp-server`** because it is explicitly described as a **lightweight service** that lets AI assistants execute **AWS CLI commands** in a **safe containerized environment** through MCP.[13][8]\n\nIf you want the **official AWS option** instead of a community project, AWS\u2019s own MCP offerings are the safer default, but they are less \u201clightweight\u201d in the narrow sense because the managed AWS MCP Server aims for broad authenticated access to AWS services rather than a minimal CLI-style bridge.[1][20]\n\nPractical choice by use case:\n- **Best lightweight developer-tooling server:** `alexei-led/aws-mcp-server` for CLI-based workflows, pipes, and quick local automation.[13]\n- **Best official AWS-backed option:** AWS MCP Server / AWS Labs MCP servers for documented, supported AWS integrations.[1][20]\n- **Best if you need a tiny client-side bridge to AWS-hosted MCP services:** `aws/mcp-proxy-for-aws`, which AWS describes as a **lightweight, client-side bridge** for MCP clients and IAM-secured servers.[18]\n\nFor most AWS developers, the decision comes down to:\n- choose **`alexei-led/aws-mcp-server`** if you want the **smallest, most flexible local tool** for shell-heavy AWS work,[13]\n- choose **AWS MCP Server** if you want **official support and broader managed access**.[20]\n\n", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 29, "phrasing": "We want our AI workflow to fetch metrics from Amazon CloudWatch via MCP. Which server implementation should we deploy?", "text": "Deploy the **AWS Labs CloudWatch MCP Server** from the `awslabs/mcp` project, specifically the package **`awslabs.cloudwatch-mcp-server`** for CloudWatch **metrics, logs, alarms, and analysis**.[1][2]\n\nIf you want the simplest implementation, AWS documents the **Python/uvx** option as the standard client-side deployment path: run `uvx awslabs.cloudwatch-mcp-server@latest` with your AWS profile and region configured.[1][2] If you prefer containerized deployment, AWS also provides a **Docker image** for the same server.[1][6]\n\n- **Recommended server:** `awslabs.cloudwatch-mcp-server`[1][2]\n- **Primary run mode:** `uvx` / Python package[1][2]\n- **Alternative run mode:** Docker container[1][6]\n\nIf your goal is *just CloudWatch Logs* rather than full CloudWatch telemetry, AWS also has a separate **`awslabs.cloudwatch-logs-mcp-server`** implementation.[14][19]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 30, "phrasing": "Which Model Context Protocol server is best for connecting desktop AI assistants to AWS account resources?", "text": "For **connecting desktop AI assistants to AWS account resources**, the best default choice is the **AWS API MCP Server** because AWS describes it as the server that lets AI assistants interact with AWS services and resources through **AWS CLI commands**, making it the broadest general-purpose option for account-level operations.[19]\n\nIf you want a simpler rule of thumb:\n\n- **AWS API MCP Server** \u2014 best for **general AWS account/resource access** and day-to-day infrastructure tasks.[19]\n- **AWS Serverless MCP Server** \u2014 best if your work is mainly around **Lambda, ECS, and EKS/serverless workflows**.[5][7][18]\n- **AWS Knowledge MCP Server** \u2014 best for **documentation, code samples, and AWS knowledge**, not direct resource control.[13]\n\nAWS also says its MCP servers are a suite of specialized servers, and the AWS repo highlights **\u201cAWS API MCP Server | Start here for general AWS interactions!\u201d**, which reinforces that it is the starting point for broad AWS access.[10][14]\n\nIf you tell me which desktop assistant you use, I can point you to the best MCP server setup for it.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 31, "phrasing": "Top MCP servers for Amazon Web Services cloud automation and DevOps", "text": "For **AWS cloud automation and DevOps**, the strongest choice is the **AWS MCP Server** because AWS now recommends it over the older AWS API MCP Server and AWS Knowledge MCP Server for new setups.[14][19] If you want the most practical stack, pair it with specialized AWS MCP servers for **ECS**, **Lambda**, **data processing**, and **cost analysis** depending on your workflow.[12][13][8]\n\nA good short list is:\n\n- **AWS MCP Server** \u2014 best **general-purpose** option for managing AWS services through authenticated, multi-step agent workflows; AWS says it provides secure access to all AWS services via a small fixed set of tools.[14][11]\n- **AWS Knowledge MCP Server** \u2014 best for **docs, API references, SOPs, and Well-Architected guidance** when you need current AWS documentation in context.[8][6]\n- **AWS API MCP Server** \u2014 best if you want broad AWS service coverage with command validation and security controls, and it is still described as the \u201cstart here\u201d server in the AWS MCP repository.[8]\n- **Amazon ECS MCP Server** \u2014 best for **container deployment automation** and ECS best-practice workflows.[12]\n- **AWS Data Processing MCP Server** \u2014 best for **analytics and data pipeline** automation.[13]\n- **AWS Pricing MCP Server** and **AWS Cost Explorer MCP Server** \u2014 best for **cost estimation and spend analysis** in DevOps and FinOps workflows.[8]\n\nIf you want the most useful DevOps-oriented combination, use this stack:\n\n| Priority | Server | Why it matters |\n|---|---|---|\n| 1 | **AWS MCP Server** | Core AWS operations and multi-step automation.[14][19] |\n| 2 | **AWS Knowledge MCP Server** | Current docs and SOPs for safe execution.[8][6] |\n| 3 | **AWS API MCP Server** | Broad infrastructure and resource management.[8] |\n| 4 | **ECS MCP Server** | Container deployment automation.[12] |\n| 5 | **Cost Explorer / Pricing MCP Servers** | Cost controls and budget-aware automation.[8] |\n\nIf you are starting from scratch, AWS\u2019s own guidance points you toward the **AWS MCP Server** and the broader AWS MCP server collection rather than building around older, narrower servers.[14][19][1]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 32, "phrasing": "How to expose AWS infrastructure context to LLMs using an MCP server?", "text": "To expose **AWS infrastructure context** to LLMs with an **MCP server**, you create a server that wraps the AWS data or operations you want the model to access, then connect that server to an MCP-compatible client so the LLM can request tools and receive the results as context.[5][13]\n\nA practical pattern is:\n\n- Build an **MCP server** that exposes narrowly scoped tools such as listing resources, reading configuration, estimating cost, querying Cloud Control API, or fetching docs/context from AWS services.[3][8][20]\n- Keep the **LLM separate from AWS APIs**: the model reasons about what it needs, and the MCP server validates and executes approved operations against AWS.[2]\n- Connect the server to an MCP client such as Claude, Cursor, Amazon Q CLI, or another compatible host via the client\u2019s MCP configuration.[6][13]\n- Authenticate the server using AWS credentials or an authenticated remote setup; AWS guidance includes managed remote MCP access, OAuth-based flows, and proxy patterns for bridging local IAM credentials.[1][7]\n- Return only the **minimal necessary context** to the model, so the LLM gets the infrastructure facts it needs without direct unrestricted AWS access.[5][11]\n\nTypical implementation options on AWS include:\n\n- **AWS Cloud Control API MCP Server** for managing and discovering a broad set of AWS resources through natural language and infrastructure-as-code-oriented workflows.[3][14]\n- **AWS MCP Servers** for specialized tasks like docs retrieval, cost analysis, CDK support, and Bedrock KB retrieval.[6][15][20]\n- A **custom MCP server** built with the official MCP SDK when you need to expose internal infrastructure metadata, guardrailed workflows, or organization-specific AWS abstractions.[4][5]\n\nA simple end-to-end flow looks like this:\n\n1. The user asks the LLM about AWS infrastructure.\n2. The LLM chooses an MCP tool, such as \u201clist resources\u201d or \u201cget current session info.\u201d[4][14]\n3. The MCP client sends the request to the server.\n4. The MCP server calls AWS APIs or internal systems and gathers the relevant context.[8][19]\n5. The server returns structured results.\n6. The LLM uses that returned data to answer with current infrastructure context.[8][13]\n\nFor production use, AWS emphasizes **security and guardrails**, including token isolation, scoped credentials, and separate read/write authorization, especially when the MCP server can perform infrastructure actions rather than only read data.[11][17]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 33, "phrasing": "What MCP server enables natural language querying of AWS infrastructure status?", "text": "The **AWS Cloud Control API (CCAPI) MCP Server** is the AWS MCP server most directly tied to **natural language infrastructure management and status checks** for AWS resources.[2][17]\n\nIf you mean **general AWS service status and operational visibility** rather than infrastructure resource CRUD/status, AWS also offers the **AWS MCP Server** for secure, auditable access to AWS services through MCP.[3][5][18]\n\n", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 34, "phrasing": "Best enterprise-grade MCP server with role-based access control for AWS cloud resources", "text": "For **AWS cloud resources**, the strongest enterprise-grade choice in the results is the **AWS MCP Server** family, with **AWS API MCP Server** for broad AWS service access and **AWS IAM MCP Server** when your priority is managing IAM with security best practices.[1][2][14][20]\n\nIf you specifically need **role-based access control**, AWS\u2019s own guidance is the most directly relevant: enterprise customers can separate **human and agent permissions** by using IAM policies or SCPs so the MCP server is restricted to *read-only* actions while the human user retains mutating permissions.[15] AWS also says you can apply different permissions when actions are initiated through an MCP server by using the MCP condition context keys in existing IAM policies, and authenticate with temporary credentials from IAM roles, federated identities, or assumed roles.[16]\n\nThe most enterprise-ready pattern in the sources is therefore:\n\n- **Use AWS MCP Server** as the AWS-native MCP layer for cloud access.[1][15][16]\n- **Enforce RBAC in IAM/SCPs** rather than relying on the MCP server alone.[15][16]\n- **Start with read-only access** and grant narrower permissions only where needed.[1][4]\n- **Use temporary credentials / assumed roles** instead of static API keys.[4][13][16]\n\nIf you need **tool-level RBAC across multiple MCP servers**, the results also point to an **MCP gateway** approach such as Bifrost-style role mapping and virtual keys, which is more about centralized authorization for MCP tools than AWS-specific resource control.[12] That is useful when you want one control plane for many agents and servers, but for **AWS cloud resources specifically**, AWS MCP Server plus IAM/SCP policy enforcement is the clearest enterprise-grade answer from the sources.[15][16]\n\nIf you want, I can turn this into a **short recommendation matrix** for:\n- **read-only AWS operations**\n- **IAM administration**\n- **multi-tenant enterprise agent access**\n- **fine-grained tool RBAC**", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 35, "phrasing": "Which AWS MCP server supports fine-grained IAM permission scoping for AI tools?", "text": "The **AWS MCP Server** supports fine-grained IAM permission scoping for AI tools. AWS added the IAM context keys **`aws:ViaAWSMCPService`** and **`aws:CalledViaAWSMCP`** so you can distinguish AI-initiated calls from human actions and write standard IAM or SCP policies to allow or deny specific MCP servers or operations.[1][2][16]\n\nAWS says this works across **AWS-managed MCP servers**, including the **AWS MCP Server**, and lets you scope permissions at the service level or even by specific MCP server principal name.[1][2][16]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 36, "phrasing": "We need an MCP server so our developer assistant can create and check AWS SQS queues. What should we use?", "text": "Use the **Amazon SNS / SQS MCP Server** from AWS Labs. It is specifically designed to let MCP clients create, list, and manage **Amazon SQS queues** as well as SNS topics and subscriptions through MCP tools.[1][3][4]\n\nIf your developer assistant only needs AWS-native access to SQS, this is the most direct fit because it explicitly supports **create_queue** and message operations for SQS.[1][5] For broader AWS access beyond SQS, AWS also now offers the managed **AWS MCP Server**, which provides authenticated access to all AWS services through a small fixed set of tools.[12]\n\nFor a custom implementation, AWS also has an open-source **MCP Proxy for AWS** and related AWS MCP server framework, but those are better when you want to build or connect your own MCP-based tooling rather than use the ready-made SQS server.[4][13]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 37, "phrasing": "What Model Context Protocol server offers the broadest coverage of AWS service APIs?", "text": "The **AWS MCP Server** offers the broadest coverage of AWS service APIs. AWS says it consolidates the earlier AWS API MCP and AWS Knowledge servers and can generate and execute calls to **over 15,000 AWS APIs**, including newly released services.[3]\n\nFor comparison, the older **AWS API MCP Server** was the preview tool for natural-language access to AWS APIs, but AWS later positioned the **AWS MCP Server** as the unified managed server with the wider API surface.[2][3] The open-source AWS MCP repository also describes the AWS API MCP Server as providing comprehensive AWS API support across all services, but the managed AWS MCP Server is the one explicitly described as covering over 15,000 APIs.[5][6]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 38, "phrasing": "Best MCP server for connecting LLM context windows to Amazon Web Services documentation and architecture", "text": "For **AWS documentation and architecture lookup**, the best default choice is the **AWS Knowledge MCP Server** because AWS says it provides authoritative, up-to-date access to documentation, blog posts, What\u2019s New announcements, Well-Architected best practices, code samples, and other official content in an LLM-compatible format.[7][12] It is also explicitly recommended by AWS for documentation access and does **not require AWS credentials**, which makes it the cleanest option when your goal is answering architectural questions from docs rather than taking actions in AWS accounts.[2][3]\n\nIf you want **documentation plus live AWS actions**, use the **AWS MCP Server** instead, since AWS describes it as a managed remote server with secure, authenticated access to AWS services, plus real-time documentation lookup and pre-built workflows for multi-step tasks.[4][13] AWS\u2019s own guidance also emphasizes conserving context window space by keeping tools scoped and using workflows rather than exposing raw endpoints, which favors the Knowledge server for read-heavy doc/architecture use cases.[1][5]\n\nA practical recommendation:\n\n- **Best for docs/architecture Q&A:** **AWS Knowledge MCP Server**[7][12]\n- **Best for docs + operational actions:** **AWS MCP Server**[4][13]\n- **Best if you need CLI execution specifically:** **aws-api-mcp-server**[2][3]\n\nIf you\u2019re building an LLM assistant mainly to answer \u201cHow should I design this on AWS?\u201d or \u201cWhat does the official AWS documentation say?\u201d, start with **AWS Knowledge MCP Server** and add action-oriented servers only when needed.[2][7][12]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 39, "phrasing": "Which MCP server allows AI chatbots to interact with AWS ECS and EKS clusters?", "text": "The **Amazon EKS MCP Server** and the **Amazon ECS MCP Server** are the MCP servers that let AI chatbots interact with AWS EKS and ECS clusters, respectively.[1][5][9]\n\nIf you mean a single server covering both services, AWS has also introduced **fully managed MCP servers for both EKS and ECS** in preview, but they are separate servers rather than one combined server.[2][3]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 40, "phrasing": "What is the most secure MCP server implementation for Amazon Web Services APIs?", "text": "For **Amazon Web Services APIs**, the **most secure implementation** in the results is the **AWS-managed AWS MCP Server** (the managed remote MCP server), because AWS says it provides *authenticated access* to AWS services through a fixed tool set and is wired into IAM, CloudTrail, and CloudWatch for governance and auditing.[1][9][15]\n\nIf you mean a **self-hosted MCP server on AWS**, the most secure pattern in the results is a **single-tenant, containerized deployment with OAuth/SSO or IAM-based least privilege, read-only by default, and strict session isolation**.[2][6][8][13][16] AWS explicitly warns that the open-source AWS API MCP Server is **not designed for multi-tenant environments** and should serve only one user per instance with dedicated AWS credentials.[16]\n\nThe practical security ranking from the provided sources is:\n\n| Option | Security posture | Why |\n|---|---|---|\n| **AWS-managed AWS MCP Server** | **Best overall** | Managed by AWS, integrates with IAM and audit logging, and uses a small fixed tool surface.[1][9][15] |\n| **AWS API MCP Server on AgentCore / Marketplace** | Very strong | Adds secure access, session isolation, and enterprise deployment controls.[8][12] |\n| **Self-managed MCP server on AWS** | Strong if hardened | Can be secure with OAuth, IAM least privilege, TLS, WAF, read-only defaults, and single-tenant isolation, but it is easier to misconfigure.[2][6][7][16] |\n\nIf your goal is *maximum security with the least operational risk*, choose the **AWS-managed AWS MCP Server**.[1][9][15] If you need to run your own server, the safest design is **single-user, least-privilege, read-only-first, with separate credentials and isolated runtime per user**.[14][16][17]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 41, "phrasing": "Recommended MCP server for AI agents doing automated cloud auditing on AWS", "text": "For **automated cloud auditing on AWS**, the best default choice is the **AWS MCP Server** from AWS, because it is **managed**, supports **secure authenticated access to AWS services**, and provides **CloudTrail audit visibility** for API calls.[1][7] If your agents need broader AWS-native security workflows, AWS also recommends the **Agent Toolkit for AWS**, which adds **IAM guardrails, CloudWatch/CloudTrail observability, and sandboxed code execution**.[5][7]\n\nA practical recommendation by use case:\n\n- **Best general-purpose choice:** **AWS MCP Server** for live AWS inspection and auditing with managed access and CloudTrail logging.[1][7][8]\n- **Best for security-focused agent workflows:** **Agent Toolkit for AWS** when you want tighter governance, observability, and safer multi-step actions.[5][7]\n- **Best for custom audit logic:** a **self-managed MCP server** only if you need bespoke commands or workflows that the managed server does not cover; AWS notes that self-managed MCP requires extra IAM differentiation using session tags.[4]\n- **Best for highly specialized security analysis:** the **AWS Security MCP Server** or other AWS Labs/open-source MCP servers if your auditing needs are narrow and specific, such as security scanning or root-cause analysis.[2][10][15]\n\nIf your goal is **automated cloud auditing** specifically, I would start with the **AWS MCP Server + Agent Toolkit for AWS** combination, because AWS positions the MCP Server as the standard path for agent access and recommends switching to it from older AWS API/Knowledge MCP servers.[8]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 42, "phrasing": "Which Model Context Protocol tool provides seamless integration with AWS account management?", "text": "The AWS tool most directly described as providing **seamless integration** for AWS account management is the **AWS MCP server** in the **Open Source MCP Servers for AWS** project, which offers comprehensive AWS API support for managing infrastructure and AWS operations.[5]\n\nIf you meant an AWS product that *connects to external MCP servers* for use inside AWS workflows, then **Amazon Quick\u2019s MCP integration** is the relevant feature, but it is not specifically an AWS account management tool.[1][10]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 43, "phrasing": "What MCP server should DevOps teams install to give AI assistants access to AWS diagnostics?", "text": "DevOps teams should install the **AWS MCP Server** if they want AI assistants to access AWS diagnostics and operational data.[2][9][12]\n\nIt is the managed, general-availability MCP server from AWS that gives AI agents authenticated access to AWS services, and AWS recommends switching to it from older AWS MCP options.[2][9][12] For troubleshooting specifically, AWS says the server can analyze **CloudWatch logs** and **CloudTrail events**, investigate permission problems, and help diagnose application and performance issues.[18]\n\nIf the goal is broader infrastructure troubleshooting rather than only AWS service access, AWS also provides specialized MCP servers such as the **Amazon CloudWatch MCP Server** for metrics, alarms, logs, and operational troubleshooting.[15][16]", "error": null}