{"engine": "chatgpt", "model": "gpt-5.5", "index": 0, "phrasing": "What is the best MCP server for connecting AI assistants to AWS infrastructure?", "text": "The best general-purpose MCP server for connecting AI assistants to AWS infrastructure is the **AWS Labs AWS API MCP Server** from the official AWS Labs MCP project.\n\n**Recommended choice:** `awslabs/aws-api-mcp-server`\n\nWhy it\u2019s a good default:\n\n- Maintained by AWS Labs\n- Lets AI assistants interact with AWS APIs\n- Uses normal AWS authentication mechanisms such as IAM credentials/profiles\n- Works across many AWS services rather than being limited to one tool\n- Better suited for infrastructure inspection, automation, and operations than most community servers\n\nGitHub: **https://github.com/awslabs/mcp**\n\nIf your use case is more specific, you may want one of the specialized AWS MCP servers instead:\n\n| Use case | Better MCP server |\n|---|---|\n| General AWS API access | **AWS API MCP Server** |\n| AWS CDK projects | AWS CDK MCP Server |\n| Terraform-based infrastructure | Terraform MCP Server / AWS Terraform MCP Server |\n| CloudFormation stacks | CloudFormation MCP Server |\n| AWS documentation lookup | AWS Documentation MCP Server |\n| Cost analysis | AWS Cost Analysis MCP Server |\n\nFor most AI assistant + AWS infrastructure workflows, I\u2019d start with the **AWS API MCP Server**, configured with a **read-only IAM role** first, then add narrowly scoped permissions only where automation is needed.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 1, "phrasing": "Best Model Context Protocol server for Amazon Web Services", "text": "The best choice is usually the **official AWS Labs MCP servers**:\n\n**Recommended:**  \n**AWS Labs MCP \u2014 AWS API / AWS Documentation servers**  \nGitHub: `awslabs/mcp`\n\nUse:\n\n- **AWS API MCP Server** \u2014 best for interacting with AWS services through your IAM credentials.\n- **AWS Documentation MCP Server** \u2014 best for asking architecture, CLI, SDK, CloudFormation, CDK, and service-specific questions.\n- **AWS CDK / Terraform MCP servers** \u2014 useful if your workflow is infrastructure-as-code focused.\n- **Cost / Pricing MCP servers** \u2014 useful for FinOps and cost analysis.\n\nIf you want one general-purpose AWS MCP setup, I\u2019d use:\n\n1. **AWS Documentation MCP Server** for accurate AWS guidance  \n2. **AWS API MCP Server** for live account/resource interaction  \n3. Optionally **CDK or Terraform MCP Server** depending on your IaC stack\n\nSecurity tip: run it with a dedicated IAM role/profile using least-privilege permissions, preferably read-only unless you explicitly need write access.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 2, "phrasing": "We want our local AI coding assistant to query AWS S3 buckets and CloudWatch logs via MCP. What server should we use?", "text": "Use **AWS Labs\u2019 AWS API MCP Server**: `awslabs.aws-api-mcp-server`.\n\nIt\u2019s the best fit if your local AI coding assistant needs to query multiple AWS services such as:\n\n- **Amazon S3** buckets/objects\n- **CloudWatch Logs**\n- Other AWS APIs via your normal AWS credentials/IAM permissions\n\nExample MCP config:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-api\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-api-mcp-server@latest\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"your-aws-profile\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\nRecommendation: give the AWS profile **read-only IAM permissions** for S3 and CloudWatch Logs unless you explicitly want the assistant to mutate resources. For example, attach policies scoped to actions like:\n\n- `s3:ListBucket`\n- `s3:GetObject`\n- `logs:DescribeLogGroups`\n- `logs:DescribeLogStreams`\n- `logs:GetLogEvents`\n- `logs:StartQuery`\n- `logs:GetQueryResults`\n\nIf you only needed CloudWatch Logs, a dedicated CloudWatch Logs MCP server could work, but for **S3 + CloudWatch Logs together**, use the **AWS API MCP Server**.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 3, "phrasing": "Recommend an AWS MCP server for a team managing multi-region cloud resources.", "text": "Recommend: **AWS API MCP Server (`awslabs.aws-api-mcp-server`)**\n\nIt\u2019s the best fit for a team managing **multi-region AWS resources** because it lets an MCP-compatible assistant interact with AWS service APIs directly across regions and services.\n\nWhy it fits:\n\n- Supports broad AWS service coverage via AWS APIs\n- Works with standard AWS credentials/profiles\n- Can operate across multiple regions by specifying the target region\n- Useful for operational tasks like inspecting resources, checking configurations, and automating changes\n- Can be constrained with IAM permissions for team safety\n\nSuggested setup:\n\n- Use separate AWS IAM roles per environment, e.g. `dev`, `staging`, `prod`\n- Grant least-privilege permissions\n- Enable read-only access by default for most users\n- Allow write actions only through approved roles or workflows\n- Require the assistant to explicitly confirm region and account before making changes\n\nIf your main need is **discovering resources across regions**, pair it with **AWS Resource Explorer** or an MCP server/tool that queries AWS Resource Explorer. But for actual multi-region management, the **AWS API MCP Server** is the most flexible choice.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 4, "phrasing": "affordable and secure MCP server for AWS resource management", "text": "Best affordable + secure option: **self-host the official AWS Labs MCP servers**, especially the **AWS API MCP Server**, and connect it to AWS using **IAM Identity Center / SSO or short-lived STS credentials**.\n\n### Recommendation\n\nUse:\n\n- **AWS Labs AWS API MCP Server** for AWS resource inspection/management\n- Optional AWS Labs MCP servers for:\n  - AWS documentation\n  - CloudWatch/logs\n  - Cost analysis\n  - CDK/Terraform assistance\n\nThis is usually the cheapest and safest setup because it can run locally or inside your own AWS account, with no third-party service holding AWS credentials.\n\n---\n\n## Secure low-cost setup\n\n### 1. Run the MCP server locally\n\nCost: essentially **$0**, apart from normal AWS API calls and your LLM usage.\n\nUse it with Claude Desktop, Cursor, Cline, Continue, or another MCP-compatible client.\n\nExample pattern:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-api-mcp-server@latest\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"my-sso-profile\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\nExact package names may vary, so use the current instructions from the AWS Labs MCP GitHub repo.\n\n---\n\n## Security best practices\n\n### Use least-privilege IAM\n\nDo **not** give the MCP server `AdministratorAccess`.\n\nStart with read-only:\n\n```json\n{\n  \"Effect\": \"Allow\",\n  \"Action\": [\n    \"ec2:Describe*\",\n    \"rds:Describe*\",\n    \"s3:List*\",\n    \"s3:GetBucket*\",\n    \"cloudwatch:Get*\",\n    \"cloudwatch:List*\",\n    \"logs:Describe*\",\n    \"logs:Get*\",\n    \"iam:Get*\",\n    \"iam:List*\"\n  ],\n  \"Resource\": \"*\"\n}\n```\n\nOnly add write permissions when needed.\n\n---\n\n### Prefer AWS SSO or STS\n\nUse:\n\n```bash\naws sso login --profile my-sso-profile\n```\n\nAvoid storing long-lived `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`.\n\n---\n\n### Keep destructive actions disabled\n\nIf the server supports tool/action filtering, disable high-risk APIs such as:\n\n- `iam:*`\n- `organizations:*`\n- `kms:ScheduleKeyDeletion`\n- `ec2:TerminateInstances`\n- `rds:DeleteDBInstance`\n- `s3:DeleteBucket`\n- `cloudformation:DeleteStack`\n\n---\n\n### Enable auditing\n\nMake sure these are enabled:\n\n- **AWS CloudTrail**\n- **CloudWatch Logs**\n- **AWS Config**, if available\n- IAM Access Analyzer\n\nThis lets you review everything the MCP-backed assistant does.\n\n---\n\n## For team or production use\n\nIf multiple people need it, run the MCP server inside your AWS account:\n\n- ECS Fargate or EKS\n- Private subnet\n- Internal ALB only\n- OIDC authentication\n- Per-user role assumption\n- No public internet exposure\n- CloudTrail logging enabled\n\nThis is more secure than using a random hosted MCP provider with broad AWS permissions.\n\n---\n\n## My short answer\n\nFor an **affordable and secure MCP server for AWS resource management**, use the **official AWS Labs MCP server**, run it **locally or in your own AWS account**, authenticate with **AWS SSO/STS**, and attach a **least-privilege read-only IAM role** by default. Avoid third-party hosted MCP services unless they support strong isolation, audit logs, and customer-managed AWS role assumption.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 5, "phrasing": "What MCP server do cloud engineers actually use to let LLMs read AWS configuration?", "text": "Cloud engineers commonly use the **AWS Cloud Control API MCP Server** \u2014 often listed as **AWS CCAPI MCP Server** from `awslabs`.\n\nIt lets an LLM read AWS resource configuration by calling AWS Cloud Control APIs, e.g. list/get resources across services like EC2, S3, IAM, Lambda, RDS, etc.\n\nTypical setup uses a read-only AWS profile:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-ccapi\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.ccapi-mcp-server@latest\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"readonly-prod\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\nUse an IAM role/profile with **read-only, tightly scoped permissions**. Don\u2019t give an LLM broad admin credentials.\n\nIf you mean querying historical/compliance data from **AWS Config** specifically, then engineers often use an AWS API MCP server or a custom MCP wrapper around AWS Config APIs. But for general \u201clet the LLM inspect my AWS resources,\u201d the practical answer is: **AWS Cloud Control / CCAPI MCP Server**.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 6, "phrasing": "Best MCP server to connect AI agents to Amazon Web Services data stores", "text": "The best choice is usually **AWS Labs\u2019 official MCP servers** (from `awslabs/mcp`) because they are AWS-maintained and work cleanly with IAM, Bedrock, and AWS APIs.\n\n### Best default recommendation\n\n**Amazon Bedrock Knowledge Bases Retrieval MCP Server**\n\nUse this if your goal is to let AI agents query enterprise/AWS data through RAG.\n\nIt works well when your data is in or indexed from:\n\n- Amazon S3\n- Amazon OpenSearch Serverless\n- Amazon Aurora / RDS-backed knowledge bases\n- Amazon Bedrock Knowledge Bases\n- Other sources connected into Bedrock KBs\n\nThis is the safest and most agent-friendly option because the agent retrieves relevant context rather than getting broad database access.\n\n---\n\n### If you need direct access to AWS data stores\n\nUse the most specific MCP server for the data store:\n\n| AWS data store | Recommended MCP approach |\n|---|---|\n| Amazon S3 | S3 MCP server or Athena/Glue MCP for querying data lakes |\n| Amazon DynamoDB | DynamoDB MCP server |\n| Amazon RDS / Aurora PostgreSQL | PostgreSQL MCP server with IAM/VPC controls |\n| Amazon RDS / Aurora MySQL | MySQL MCP server |\n| Amazon Redshift | Redshift or PostgreSQL-compatible MCP server |\n| Amazon OpenSearch | OpenSearch MCP server |\n| AWS Glue / Athena | Athena MCP server for SQL over S3/data lake |\n\n---\n\n### My practical recommendation\n\nIf you want a secure, production-ready setup:\n\n1. **Use Bedrock Knowledge Bases Retrieval MCP** for semantic/RAG access.\n2. Use **Athena MCP** for analytical queries over S3/Glue data.\n3. Use **PostgreSQL/MySQL/DynamoDB-specific MCP servers** only when the agent truly needs direct structured data access.\n4. Give the MCP server a **least-privilege IAM role**, ideally read-only at first.\n\nSo, the \u201cbest\u201d general MCP server for AWS data stores is:\n\n> **AWS Labs Amazon Bedrock Knowledge Bases Retrieval MCP Server**\n\nBut for direct database operations, use the data-store-specific MCP server instead.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 7, "phrasing": "Which MCP server allows LLMs to query AWS DynamoDB and S3 safely?", "text": "The **AWS MCP Server** (often listed as `mcp-server-aws`) allows LLMs to safely query AWS services such as **DynamoDB** and **S3**.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 8, "phrasing": "We are building an AI dev tool that needs read-only access to AWS architecture via MCP. What MCP server implementation is best?", "text": "Use the **official AWS Labs AWS API MCP Server** as the primary implementation.\n\nBest fit:\n\n**`awslabs/aws-api-mcp-server`**\n\nWhy it\u2019s the best choice for read-only AWS architecture access:\n\n- Maintained by AWS Labs\n- Uses normal AWS authentication: profiles, IAM roles, STS, etc.\n- Can expose AWS service APIs through MCP\n- Supports read-only usage patterns\n- Works well for discovering real deployed architecture: VPCs, subnets, EC2, ECS, EKS, Lambda, RDS, IAM, CloudFormation, Load Balancers, etc.\n- Better suited for architecture inventory than documentation-focused or diagram-only MCP servers\n\nRecommended setup:\n\n1. Run the AWS API MCP server.\n2. Configure it with an IAM role dedicated to your tool.\n3. Give that role read-only permissions.\n4. Prefer a custom least-privilege policy over broad `ReadOnlyAccess`.\n5. Enable CloudTrail logging.\n6. Optionally pair it with an AWS diagram MCP server if you want generated architecture diagrams.\n\nExample IAM baseline:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"ec2:Describe*\",\n        \"elasticloadbalancing:Describe*\",\n        \"autoscaling:Describe*\",\n        \"ecs:Describe*\",\n        \"ecs:List*\",\n        \"eks:Describe*\",\n        \"eks:List*\",\n        \"lambda:Get*\",\n        \"lambda:List*\",\n        \"rds:Describe*\",\n        \"cloudformation:Describe*\",\n        \"cloudformation:List*\",\n        \"cloudwatch:Describe*\",\n        \"cloudwatch:List*\",\n        \"logs:Describe*\",\n        \"iam:Get*\",\n        \"iam:List*\",\n        \"route53:Get*\",\n        \"route53:List*\",\n        \"s3:GetBucket*\",\n        \"s3:List*\"\n      ],\n      \"Resource\": \"*\"\n    }\n  ]\n}\n```\n\nAvoid granting broad access to sensitive read APIs such as:\n\n- `secretsmanager:GetSecretValue`\n- `ssm:GetParameter`\n- `kms:Decrypt`\n- `s3:GetObject`\n- `dynamodb:GetItem`\n- `rds-data:*`\n\nSo the short answer is:\n\n> Use **AWS Labs AWS API MCP Server** for discovery, backed by a tightly scoped read-only IAM role. Add the AWS Diagram MCP server only if you also need visual architecture diagrams.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 9, "phrasing": "Top open source MCP servers for AWS integration", "text": "Here are strong open-source MCP servers for AWS integration, especially if you\u2019re using Claude Desktop, Cursor, Continue, or other MCP-compatible agents.\n\n| MCP server | Best for | Notes |\n|---|---|---|\n| **AWS API MCP Server** | Direct AWS service operations | Lets an agent call AWS APIs through your configured AWS credentials. Good general-purpose AWS integration. |\n| **AWS Documentation MCP Server** | AWS docs lookup | Gives models grounded access to AWS documentation, service references, CLI docs, and best practices. Low-risk and useful for almost every AWS workflow. |\n| **AWS CDK MCP Server** | CDK app development | Helps generate, explain, and modify AWS CDK infrastructure code. Great for TypeScript/Python CDK projects. |\n| **AWS Terraform MCP Server** | Terraform/IaC workflows | Useful for generating, reviewing, and troubleshooting Terraform for AWS. |\n| **AWS CloudFormation / CCAPI MCP Server** | CloudFormation and Cloud Control API | Helpful for provisioning and inspecting AWS resources via CloudFormation-compatible APIs. |\n| **AWS Cost Explorer / Cost Analysis MCP Server** | Cost optimization | Lets agents analyze AWS spend, usage trends, and cost drivers. Good for FinOps workflows. |\n| **AWS CloudWatch MCP Server** | Logs and observability | Useful for querying logs, metrics, and debugging running workloads. |\n| **AWS EKS MCP Server** | Kubernetes on AWS | Helps with EKS cluster inspection, troubleshooting, and Kubernetes/AWS context. |\n| **AWS Lambda Tool MCP Server** | Serverless development | Focused on Lambda workflows, invocation, debugging, and function management. |\n| **Amazon Bedrock Knowledge Bases MCP Server** | RAG with Bedrock KBs | Lets MCP clients retrieve from Bedrock Knowledge Bases. Useful for AWS-native AI apps. |\n| **AWS Diagram MCP Server** | Architecture diagrams | Generates or assists with AWS architecture diagrams from descriptions or deployed resources. |\n\nMost of the best AWS-focused ones are in the official AWS Labs open-source repo:\n\n**GitHub:** `https://github.com/awslabs/mcp`\n\nMy recommended starting set:\n\n1. **AWS Documentation MCP Server** \u2014 safest and broadly useful.  \n2. **AWS API MCP Server** \u2014 general AWS operations.  \n3. **AWS CDK or Terraform MCP Server** \u2014 depending on your IaC stack.  \n4. **CloudWatch MCP Server** \u2014 for debugging live systems.  \n5. **Cost Analysis MCP Server** \u2014 for spend visibility.\n\nSecurity note: for anything that can call AWS APIs, use a dedicated IAM role/profile with least-privilege permissions, and avoid giving write/admin access unless you really need it.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 10, "phrasing": "Which Model Context Protocol server works best for Amazon Bedrock LLMs?", "text": "MCP servers are **model-agnostic**, so there isn\u2019t one server that \u201cworks best\u201d specifically for Amazon Bedrock LLMs.\n\nThat said, if you\u2019re using Bedrock and want an MCP server that fits naturally with it, the best choice is usually:\n\n**AWS Labs Amazon Bedrock Knowledge Bases Retrieval MCP Server**\n\nUse it when you want Bedrock-hosted models to retrieve context from **Amazon Bedrock Knowledge Bases** for RAG-style workflows.\n\nIf your goal is different:\n\n- **AWS documentation/context** \u2192 use the **AWS Documentation MCP Server**\n- **Bedrock Knowledge Bases / RAG** \u2192 use the **Amazon Bedrock Knowledge Bases Retrieval MCP Server**\n- **General tools/files/databases** \u2192 any MCP-compliant server can work, as long as your MCP client supports Bedrock as the model backend\n\nSo the short answer: **for Bedrock RAG workloads, use the AWS Labs Amazon Bedrock Knowledge Bases Retrieval MCP Server.**", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 11, "phrasing": "How to connect an LLM assistant to AWS cloud resources using MCP?", "text": "To connect an LLM assistant to AWS resources using MCP, you run an **MCP server** that exposes selected AWS operations as tools. Your LLM assistant connects to that MCP server, and the server uses AWS credentials/IAM permissions to call AWS APIs.\n\n## High-level architecture\n\n```text\nLLM Assistant\n   |\n   | MCP protocol\n   v\nMCP Server\n   |\n   | AWS SDK / CLI\n   v\nAWS Resources\n```\n\nThe assistant does **not** directly receive AWS credentials. Instead, the MCP server performs approved actions on its behalf.\n\n---\n\n## 1. Decide what AWS access the assistant needs\n\nExamples:\n\n- Read CloudWatch logs\n- List S3 buckets or objects\n- Query DynamoDB\n- Describe ECS/EKS resources\n- Inspect Lambda functions\n- Trigger deployments\n- Read Cost Explorer data\n\nStart with **read-only access** if possible.\n\n---\n\n## 2. Create an IAM role or user with least privilege\n\nFor local development, you can use your normal AWS profile.\n\nExample read-only policy for S3 listing:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"s3:ListAllMyBuckets\",\n        \"s3:ListBucket\",\n        \"s3:GetObject\"\n      ],\n      \"Resource\": \"*\"\n    }\n  ]\n}\n```\n\nFor production, prefer:\n\n- IAM roles\n- AWS SSO\n- STS AssumeRole\n- Short-lived credentials\n- Least-privilege policies\n\nAvoid giving the LLM raw AWS keys.\n\n---\n\n## 3. Use or create an MCP server for AWS\n\nYou have two common options:\n\n### Option A: Use an existing AWS MCP server\n\nAWS and the community provide MCP servers for services such as:\n\n- AWS documentation\n- CloudWatch\n- Lambda\n- ECS/EKS\n- CDK\n- Terraform on AWS\n- Cost analysis\n- Security analysis\n\nIf using an existing server, install it and configure your assistant to launch it.\n\nExample MCP config style:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-documentation-mcp-server@latest\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"default\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\nExact package names depend on the MCP server you choose.\n\n---\n\n### Option B: Build your own MCP server\n\nFor custom AWS operations, create an MCP server that wraps AWS SDK calls.\n\nExample using Python-style pseudocode:\n\n```python\nfrom mcp.server.fastmcp import FastMCP\nimport boto3\n\nmcp = FastMCP(\"aws-tools\")\n\ns3 = boto3.client(\"s3\")\n\n@mcp.tool()\ndef list_s3_buckets() -> list[str]:\n    \"\"\"List S3 bucket names in the AWS account.\"\"\"\n    response = s3.list_buckets()\n    return [bucket[\"Name\"] for bucket in response[\"Buckets\"]]\n\n@mcp.tool()\ndef list_s3_objects(bucket: str, prefix: str = \"\") -> list[str]:\n    \"\"\"List objects in an S3 bucket.\"\"\"\n    response = s3.list_objects_v2(Bucket=bucket, Prefix=prefix)\n    return [obj[\"Key\"] for obj in response.get(\"Contents\", [])]\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\nThe MCP server uses the normal AWS credential chain:\n\n```bash\naws configure\n# or\nexport AWS_PROFILE=my-profile\nexport AWS_REGION=us-east-1\n```\n\n---\n\n## 4. Configure your LLM assistant to use the MCP server\n\nFor an MCP-compatible assistant, add a server entry.\n\nExample:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-tools\": {\n      \"command\": \"python\",\n      \"args\": [\"/path/to/aws_mcp_server.py\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"my-profile\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\nWhen the assistant starts, it discovers the tools exposed by the MCP server, such as:\n\n```text\nlist_s3_buckets\nlist_s3_objects\ndescribe_lambda_function\nquery_cloudwatch_logs\n```\n\nThe assistant can then call those tools when needed.\n\n---\n\n## 5. Add safety controls\n\nFor AWS access, this is important.\n\nRecommended controls:\n\n- Use read-only IAM permissions by default\n- Require approval for destructive actions\n- Separate dev, staging, and prod AWS profiles\n- Log every tool call\n- Validate tool inputs\n- Avoid exposing broad tools like `run_aws_cli_command`\n- Use allowlists for services, regions, and resource ARNs\n- Use short-lived credentials\n- Never pass AWS secret keys into the conversation context\n\nFor dangerous operations, design tools like this:\n\n```python\n@mcp.tool()\ndef delete_s3_object(bucket: str, key: str, confirm: bool = False) -> str:\n    \"\"\"Delete an S3 object only when confirm=True.\"\"\"\n    if not confirm:\n        return \"Deletion requires confirm=True.\"\n    s3.delete_object(Bucket=bucket, Key=key)\n    return f\"Deleted s3://{bucket}/{key}\"\n```\n\n---\n\n## 6. Example use cases\n\nOnce connected, you can ask the assistant:\n\n```text\nList my S3 buckets in us-east-1.\n```\n\n```text\nShow recent CloudWatch errors for my Lambda function.\n```\n\n```text\nSummarize my ECS service status.\n```\n\n```text\nFind large S3 objects under this prefix.\n```\n\n```text\nCheck why my Lambda failed in the last hour.\n```\n\nThe assistant calls the MCP tool, the MCP server queries AWS, and the result is returned to the model.\n\n---\n\n## Minimal checklist\n\n1. Create/select IAM credentials or role.\n2. Install or build an AWS MCP server.\n3. Configure the MCP client/assistant with the server command.\n4. Set `AWS_PROFILE` and `AWS_REGION`.\n5. Expose only safe, specific AWS tools.\n6. Test with read-only AWS actions first.\n\nIn short: **MCP acts as a controlled bridge between your LLM assistant and AWS APIs, with IAM permissions and MCP tool definitions determining exactly what the assistant can do.**", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 12, "phrasing": "What is the most reliable MCP server for inspecting AWS IAM roles and Security Groups?", "text": "For inspecting **AWS IAM roles** and **Security Groups**, the most reliable choice is usually the **official AWS Labs AWS API MCP Server**.\n\n**Recommended:** `awslabs/aws-api-mcp-server`\n\nWhy:\n\n- Uses real AWS APIs via AWS credentials, not screen scraping or third-party inventory\n- Can inspect both:\n  - IAM roles, policies, trust relationships\n  - EC2 Security Groups, ingress/egress rules\n- Maintained by AWS Labs\n- Works across accounts/regions if your AWS credentials and permissions allow it\n- More complete for security inspection than Cloud Control\u2013only MCP servers\n\nFor read-only inspection, run it with a tightly scoped IAM role, for example permissions like:\n\n```json\n{\n  \"Effect\": \"Allow\",\n  \"Action\": [\n    \"iam:GetRole\",\n    \"iam:ListRoles\",\n    \"iam:GetRolePolicy\",\n    \"iam:ListRolePolicies\",\n    \"iam:ListAttachedRolePolicies\",\n    \"iam:GetPolicy\",\n    \"iam:GetPolicyVersion\",\n    \"ec2:DescribeSecurityGroups\",\n    \"ec2:DescribeSecurityGroupRules\",\n    \"ec2:DescribeVpcs\",\n    \"ec2:DescribeSubnets\"\n  ],\n  \"Resource\": \"*\"\n}\n```\n\nIf you only need generic AWS resource inventory, the **AWS Cloud Control MCP Server** is also useful, but for **IAM and Security Group security review**, the **AWS API MCP Server** is the better primary option.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 13, "phrasing": "Best MCP server for querying CloudWatch logs with natural language", "text": "The best choice is the **AWS Labs CloudWatch MCP server** \u2014 specifically the CloudWatch / CloudWatch Logs MCP server from the official `awslabs/mcp` project.\n\nIt is the safest recommendation because it is:\n\n- Maintained by AWS Labs\n- Purpose-built for CloudWatch Logs and metrics\n- Works well with Claude Desktop, Cursor, Windsurf, etc.\n- Lets the LLM translate natural language into CloudWatch Logs Insights queries\n- Supports read-only IAM access patterns\n\nGitHub:  \n`https://github.com/awslabs/mcp`\n\nLook for the CloudWatch-related server, commonly referenced as:\n\n- `awslabs.cloudwatch-mcp-server`\n- or CloudWatch Logs MCP server, depending on the package version\n\nTypical use case:\n\n> \u201cShow me errors from the Lambda function `payments-api` in the last 2 hours grouped by exception type.\u201d\n\nThe model can turn that into a CloudWatch Logs Insights query and execute it through MCP.\n\nRecommended IAM permissions:\n\n```json\n{\n  \"Effect\": \"Allow\",\n  \"Action\": [\n    \"logs:DescribeLogGroups\",\n    \"logs:DescribeLogStreams\",\n    \"logs:GetLogEvents\",\n    \"logs:FilterLogEvents\",\n    \"logs:StartQuery\",\n    \"logs:GetQueryResults\",\n    \"logs:StopQuery\"\n  ],\n  \"Resource\": \"*\"\n}\n```\n\nIf you want broader AWS access, use the **AWS API MCP server**, but for natural-language CloudWatch Logs querying, the dedicated **AWS Labs CloudWatch MCP server** is the better default.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 14, "phrasing": "We need an MCP server that lets developers ask an AI agent about active AWS EC2 instances. What options exist?", "text": "Options for an MCP server to let developers ask an AI agent about active EC2 instances:\n\n| Option | Description | Best for | Tradeoffs |\n|---|---|---|---|\n| **1. Use AWS Labs AWS API MCP Server** | AWS Labs has an open-source **AWS API MCP Server** that can call AWS APIs through the SDK/CLI. The agent could call `ec2:DescribeInstances`, `ec2:DescribeInstanceStatus`, etc. | Fastest path if you want general AWS API access | Potentially broad access; needs tight IAM and tool restrictions |\n| **2. Build a narrow custom EC2 MCP server** | Create your own MCP server exposing tools like `list_running_instances`, `get_instance_details`, `find_instances_by_tag`, using `boto3`, AWS SDK for JS, Go, etc. | Most secure and predictable option | Requires some engineering work |\n| **3. Query AWS Config or Resource Explorer through MCP** | Instead of calling EC2 live, query AWS Config, AWS Resource Explorer, or an inventory database for EC2 resources. | Multi-account / multi-region inventory, auditability | Data may not be real-time depending on source |\n| **4. Use CloudQuery / Steampipe + SQL MCP** | Sync AWS assets into Postgres or query them via Steampipe, then expose SQL through a Postgres/SQL MCP server. Example query: `select * from aws_ec2_instance where state = 'running'`. | Teams that already use SQL-based cloud inventory | Extra infrastructure; sync latency possible |\n| **5. Use a community AWS MCP server** | There are community MCP servers that wrap AWS CLI/SDK calls. | Prototyping | Review maturity, permissions, maintenance, and security carefully |\n\nRecommended approach:\n\n- For a quick prototype: **AWS Labs AWS API MCP Server**\n- For production developer access: **custom narrow EC2 MCP server**\n- For multi-account inventory: **AWS Config / Resource Explorer / CloudQuery-backed MCP**\n\nMinimum IAM permissions for a read-only EC2 MCP server:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"ec2:DescribeInstances\",\n        \"ec2:DescribeInstanceStatus\",\n        \"ec2:DescribeTags\",\n        \"ec2:DescribeRegions\",\n        \"sts:GetCallerIdentity\"\n      ],\n      \"Resource\": \"*\"\n    }\n  ]\n}\n```\n\nFor cross-account access, add `sts:AssumeRole` and have the MCP server assume a read-only role in each AWS account.\n\nA good custom MCP tool surface would be:\n\n```text\nlist_active_ec2_instances(region?, account?, tags?, include_pending?)\nget_ec2_instance(instance_id, region, account?)\nsummarize_ec2_by_region(account?)\nfind_ec2_instances_by_tag(key, value, region?, account?)\n```\n\n\u201cActive\u201d should usually mean EC2 instances with state `running`, optionally including `pending`.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 15, "phrasing": "Which MCP server provides secure Amazon Web Services connector tools for AI models?", "text": "The **AWS MCP Server** provides secure Amazon Web Services connector tools for AI models.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 16, "phrasing": "Best production-ready MCP server for AWS API interactions", "text": "The best default choice for production AWS API interactions is **AWS Labs\u2019 AWS API MCP Server**.\n\n**Recommended:** `awslabs/aws-api-mcp-server` from the AWS Labs MCP servers collection  \n**Use case:** Direct interaction with AWS APIs through MCP using normal AWS IAM credentials.\n\nWhy it is the best production-oriented option:\n\n- Maintained by/associated with AWS Labs rather than an unknown third party\n- Uses standard AWS authentication/IAM patterns\n- Can interact with many AWS services through AWS APIs\n- Fits well with CloudTrail, IAM policies, SCPs, and normal AWS governance\n- Better choice than giving an LLM shell access with the AWS CLI\n\nFor production, I would run it with strong guardrails:\n\n1. **Use a dedicated IAM role**\n   - No admin permissions\n   - Least-privilege policies only\n   - Separate roles for read-only vs write access\n\n2. **Prefer read-only by default**\n   - Allow write/destructive actions only for specific workflows\n\n3. **Restrict scope**\n   - Limit AWS accounts\n   - Limit regions\n   - Limit services/actions where possible\n\n4. **Run it privately**\n   - Do not expose the MCP server directly to the public internet\n   - Run inside your trusted network, VPC, workstation, or controlled agent environment\n\n5. **Enable auditability**\n   - CloudTrail\n   - AWS Config\n   - GuardDuty/Security Hub where relevant\n   - MCP server logs\n\n6. **Use human approval for mutations**\n   - Especially for IAM, EC2, RDS, S3 deletion, KMS, Route53, and billing-related APIs\n\nIf your goal is **infrastructure management**, consider using an MCP server around **Terraform, CloudFormation, or CDK** instead of direct AWS API calls. But if you specifically want an MCP server for **AWS API interactions**, the AWS Labs AWS API MCP Server is the most sensible production-ready starting point.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 17, "phrasing": "We are an enterprise cloud platform team looking for a compliant AWS MCP server for internal AI tools. What should we evaluate?", "text": "For an enterprise AWS MCP server, evaluate it like a privileged automation service, not just a developer tool. Key areas:\n\n## 1. Deployment and trust model\n\nEvaluate whether the MCP server runs:\n\n- In your AWS accounts/VPCs\n- In a vendor-managed SaaS environment\n- Locally on developer machines\n- Inside your AI platform runtime\n\nFor enterprise compliance, prefer:\n\n- Self-hosted or customer-managed deployment\n- Private networking support\n- No mandatory data egress to vendor systems\n- Clear isolation between environments: dev, staging, prod\n\nAsk:\n\n- Does the MCP server need internet access?\n- Does AWS metadata, logs, resource names, ARNs, tags, or secrets leave our account?\n- Can it run in ECS, EKS, Lambda, EC2, or private containers?\n\n## 2. IAM and least privilege\n\nThe MCP server will often have the ability to inspect or mutate AWS resources, so IAM design is critical.\n\nEvaluate:\n\n- Support for IAM roles instead of static credentials\n- STS AssumeRole support across accounts\n- Fine-grained tool permissions\n- Read-only vs write-capable modes\n- Per-user or per-agent authorization\n- Session duration limits\n- External ID support for cross-account access\n- Permission boundaries and SCP compatibility\n\nLook for the ability to restrict tools such as:\n\n- `ec2:*`\n- `iam:*`\n- `s3:GetObject`\n- `lambda:UpdateFunctionCode`\n- `cloudformation:*`\n- `eks:*`\n- `secretsmanager:GetSecretValue`\n\nA compliant MCP server should not require broad `AdministratorAccess`.\n\n## 3. Human approval and guardrails\n\nFor internal AI tools, separate read, plan, and execute actions.\n\nEvaluate whether the server supports:\n\n- Read-only mode\n- Dry-run mode\n- Human approval before mutations\n- Policy checks before execution\n- Change-management integration\n- Blocklists for dangerous actions\n- Environment-based restrictions, for example no prod writes\n- Approval workflows for IAM, networking, data, and encryption changes\n\nHigh-risk operations should require explicit approval, especially:\n\n- IAM policy changes\n- Public S3 bucket changes\n- Security group ingress changes\n- KMS key changes\n- CloudTrail or GuardDuty changes\n- Production deployments\n- Deleting resources\n\n## 4. Auditability\n\nYou need complete traceability from AI request to AWS action.\n\nEvaluate:\n\n- CloudTrail compatibility\n- Structured MCP audit logs\n- User identity propagation\n- Request/response logging controls\n- Correlation IDs across AI tool, MCP server, and AWS API calls\n- Immutable log storage support\n- SIEM integration\n- Ability to log tool calls without leaking secrets\n\nYou should be able to answer:\n\n- Who requested the action?\n- Which model or agent called the tool?\n- What tool was invoked?\n- What parameters were passed?\n- Which AWS role was assumed?\n- What AWS APIs were called?\n- Was the action approved?\n- What changed?\n\n## 5. Data protection\n\nMCP servers can expose sensitive cloud context to LLMs.\n\nEvaluate:\n\n- Data minimization\n- Redaction of secrets, tokens, ARNs, account IDs, customer data\n- Configurable allow/deny lists\n- Encryption in transit and at rest\n- No logging of credentials or secret values\n- Secret retrieval controls\n- Prompt-injection protection\n- Protection against data exfiltration through tool outputs\n\nBe especially careful with tools that read:\n\n- S3 objects\n- CloudWatch logs\n- Secrets Manager values\n- Parameter Store secure strings\n- RDS snapshots\n- Lambda environment variables\n- ECS task definitions\n- Glue/Athena data\n- Support cases\n\n## 6. Authentication and authorization to the MCP server\n\nThe MCP server itself needs enterprise-grade access controls.\n\nEvaluate support for:\n\n- SSO/OIDC/SAML\n- mTLS or private service authentication\n- Per-user authorization\n- Service-to-service auth\n- RBAC/ABAC\n- Integration with your IdP\n- Short-lived tokens\n- Network-level restrictions\n\nAvoid designs where every user or agent shares the same AWS role without attribution.\n\n## 7. Multi-account and multi-region support\n\nEnterprise AWS environments are usually multi-account.\n\nEvaluate:\n\n- AWS Organizations support\n- Account allowlists\n- OU-based restrictions\n- Region allowlists\n- Cross-account role assumption\n- Environment tagging awareness\n- Support for Control Tower-managed accounts\n- SCP-aware behavior\n\nThe MCP server should not let an AI agent accidentally operate across every account and region.\n\n## 8. Compliance alignment\n\nMap the server to your control frameworks.\n\nCommon requirements include:\n\n- SOC 2\n- ISO 27001\n- HIPAA\n- PCI DSS\n- FedRAMP\n- GDPR\n- NIST 800-53\n- CIS AWS Foundations Benchmark\n\nEvaluate:\n\n- Vendor attestations, if SaaS\n- Data processing agreements\n- Subprocessor list\n- Data residency\n- Retention controls\n- Security architecture documentation\n- Pen test reports\n- Vulnerability management\n- Incident response commitments\n\nIf self-hosted, evaluate whether it can be deployed into your compliant AWS landing zone.\n\n## 9. Tool surface area\n\nA compliant MCP server should expose only necessary AWS capabilities.\n\nEvaluate:\n\n- Which AWS services are supported\n- Whether tools are modular and disable-able\n- Read-only inventory tools\n- Cost and billing tools\n- Security posture tools\n- Infrastructure-as-code integration\n- Operational runbook tools\n- Write/deploy tools\n\nPrefer explicit tools such as:\n\n- `list_ec2_instances`\n- `describe_security_groups`\n- `get_cloudwatch_metrics`\n- `query_cloudtrail_events`\n\nOver overly broad tools such as:\n\n- `run_aws_cli_command`\n- `execute_python`\n- `invoke_shell`\n- `call_any_aws_api`\n\nGeneric command execution is powerful but much harder to govern.\n\n## 10. Prompt-injection and agent safety\n\nCloud environments contain untrusted text: logs, tickets, tags, object names, commit messages, and documentation.\n\nEvaluate whether the MCP server or surrounding platform protects against:\n\n- Prompt injection in AWS resource metadata\n- Malicious CloudWatch log entries\n- Poisoned runbooks or README files\n- Tool-output manipulation\n- Instructions embedded in S3 objects\n- Agent confusion between data and instructions\n\nThe MCP server should treat AWS data as untrusted input.\n\n## 11. Secrets handling\n\nEvaluate:\n\n- Does it ever expose raw secrets to the model?\n- Can secret-reading tools be disabled?\n- Are secrets redacted from logs and tool responses?\n- Does it support scoped access to Secrets Manager or SSM?\n- Are temporary credentials used?\n- Are credentials rotated automatically?\n\nIn most enterprise cases, AI tools should not receive plaintext production secrets.\n\n## 12. Change-management integration\n\nFor production use, evaluate integrations with:\n\n- ServiceNow\n- Jira\n- GitHub/GitLab\n- CI/CD pipelines\n- Terraform/CloudFormation/CDK\n- Policy-as-code tools\n- Slack or Teams approvals\n\nPrefer workflows where the AI proposes a change, opens a PR, runs policy checks, and waits for approval rather than directly mutating production.\n\n## 13. Observability and operations\n\nEvaluate:\n\n- Metrics\n- Health checks\n- Tracing\n- Error reporting\n- Rate limiting\n- AWS API throttling behavior\n- Timeout controls\n- Queueing/retry behavior\n- High availability\n- Disaster recovery\n- Versioning and rollback\n\nYou need to operate the MCP server like a production platform component.\n\n## 14. Supply-chain security\n\nEvaluate:\n\n- Source availability\n- Signed releases\n- Container image provenance\n- SBOM availability\n- Dependency scanning\n- CVE response process\n- Reproducible builds\n- Runtime hardening\n- Minimal container images\n- No unnecessary shell or package managers\n\nIf open source, review code paths for credential handling, logging, and arbitrary command execution.\n\n## 15. Vendor and ecosystem maturity\n\nIf evaluating a vendor or open-source MCP server, consider:\n\n- Maintainer credibility\n- Release cadence\n- Security disclosure process\n- Enterprise support\n- Documentation quality\n- Backward compatibility\n- Community adoption\n- Roadmap\n- AWS service coverage\n- License compatibility\n\n## Suggested evaluation scorecard\n\n| Area | What to look for |\n|---|---|\n| Deployment | Self-hosted, private networking, no required data egress |\n| IAM | Least privilege, STS, per-user attribution, no admin role requirement |\n| Guardrails | Read-only mode, approvals, policy checks, dangerous-action blocking |\n| Audit | Full traceability from AI prompt to AWS API call |\n| Data protection | Redaction, encryption, secret blocking, data minimization |\n| Compliance | SOC 2/ISO evidence or deployable into compliant AWS environment |\n| Multi-account | AWS Organizations, account/region allowlists, role assumption |\n| Safety | Prompt-injection defenses, tool-output controls |\n| Operations | HA, metrics, rate limits, versioning, support |\n| Supply chain | SBOM, signed images, vulnerability management |\n\n## Practical recommendation\n\nStart with a read-only AWS MCP server for inventory, troubleshooting, cost, and security posture use cases. Then introduce write capabilities only behind approval workflows and policy-as-code controls.\n\nFor production enterprise use, the strongest pattern is:\n\n1. MCP server runs inside your AWS environment.\n2. It uses short-lived IAM role assumption.\n3. Tools are explicitly allowlisted.\n4. Production mutations require human approval.\n5. All tool calls are logged and correlated with CloudTrail.\n6. Secrets and sensitive data are redacted or blocked.\n7. Changes are preferably made through IaC pull requests, not direct API calls.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 18, "phrasing": "Which MCP server gives AI coding assistants real-time context on AWS cloud infrastructure?", "text": "The **AWS Cloud Control API MCP Server** gives AI coding assistants real-time context on AWS cloud infrastructure by letting them inspect and interact with AWS resources through the AWS Cloud Control API.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 19, "phrasing": "What MCP server should I use to let AI models run AWS CLI commands safely?", "text": "Use **AWS Labs\u2019 AWS API MCP Server**: `awslabs.aws-api-mcp-server`.\n\nIt\u2019s the right choice if you want AI models to interact with AWS via AWS CLI/API calls with safety controls, rather than giving the model unrestricted shell access.\n\nExample MCP config:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-api\": {\n      \"command\": \"uvx\",\n      \"args\": [\n        \"awslabs.aws-api-mcp-server@latest\",\n        \"--readonly\"\n      ],\n      \"env\": {\n        \"AWS_PROFILE\": \"your-safe-profile\",\n        \"AWS_REGION\": \"us-east-1\",\n        \"FASTMCP_LOG_LEVEL\": \"ERROR\"\n      }\n    }\n  }\n}\n```\n\nRecommended safety setup:\n\n- Use `--readonly` by default.\n- Use a dedicated AWS IAM role/profile with least-privilege permissions.\n- Do not use an admin profile.\n- Require manual approval for mutating actions.\n- Enable CloudTrail so all API calls are auditable.\n- Prefer this server over a generic shell/terminal MCP server.\n\nIf the model only needs AWS documentation help, use `awslabs.aws-documentation-mcp-server` instead.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 20, "phrasing": "Model Context Protocol server for querying AWS Cost Explorer and billing via AI", "text": "Below is a simple **Model Context Protocol MCP server** that lets an AI client query **AWS Cost Explorer** using AWS credentials.\n\n## 1. Install dependencies\n\n```bash\npip install \"mcp[cli]\" boto3 python-dateutil\n```\n\n## 2. IAM permissions\n\nUse a read-only IAM user/role with permissions like:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"ce:GetCostAndUsage\",\n        \"ce:GetCostForecast\",\n        \"ce:GetDimensionValues\",\n        \"ce:GetTags\",\n        \"ce:GetCostCategories\"\n      ],\n      \"Resource\": \"*\"\n    }\n  ]\n}\n```\n\n## 3. MCP server: `aws_cost_mcp.py`\n\n```python\nimport os\nimport json\nfrom datetime import date, timedelta\n\nimport boto3\nfrom mcp.server.fastmcp import FastMCP\n\nmcp = FastMCP(\"aws-cost-explorer\")\n\nce = boto3.client(\n    \"ce\",\n    region_name=os.getenv(\"AWS_REGION\", \"us-east-1\")\n)\n\n\ndef default_month_range():\n    today = date.today()\n    start = today.replace(day=1).isoformat()\n    end = today.isoformat()\n    return start, end\n\n\n@mcp.tool()\ndef get_cost_and_usage(\n    start: str | None = None,\n    end: str | None = None,\n    granularity: str = \"MONTHLY\",\n    metric: str = \"UnblendedCost\",\n    group_by: str = \"SERVICE\"\n) -> dict:\n    \"\"\"\n    Query AWS Cost Explorer costs.\n\n    Args:\n        start: Start date in YYYY-MM-DD format.\n        end: End date in YYYY-MM-DD format. AWS treats this as exclusive.\n        granularity: DAILY or MONTHLY.\n        metric: UnblendedCost, BlendedCost, AmortizedCost, NetAmortizedCost, UsageQuantity.\n        group_by: SERVICE, LINKED_ACCOUNT, REGION, USAGE_TYPE, PURCHASE_TYPE, etc.\n    \"\"\"\n\n    if not start or not end:\n        start, end = default_month_range()\n\n    params = {\n        \"TimePeriod\": {\n            \"Start\": start,\n            \"End\": end\n        },\n        \"Granularity\": granularity,\n        \"Metrics\": [metric],\n        \"GroupBy\": [\n            {\n                \"Type\": \"DIMENSION\",\n                \"Key\": group_by\n            }\n        ]\n    }\n\n    response = ce.get_cost_and_usage(**params)\n\n    results = []\n\n    for period in response.get(\"ResultsByTime\", []):\n        for group in period.get(\"Groups\", []):\n            amount = group[\"Metrics\"][metric][\"Amount\"]\n            unit = group[\"Metrics\"][metric][\"Unit\"]\n\n            results.append({\n                \"start\": period[\"TimePeriod\"][\"Start\"],\n                \"end\": period[\"TimePeriod\"][\"End\"],\n                \"group\": group[\"Keys\"][0],\n                \"amount\": float(amount),\n                \"unit\": unit\n            })\n\n    return {\n        \"query\": params,\n        \"results\": results\n    }\n\n\n@mcp.tool()\ndef get_total_cost(\n    start: str | None = None,\n    end: str | None = None,\n    granularity: str = \"MONTHLY\",\n    metric: str = \"UnblendedCost\"\n) -> dict:\n    \"\"\"\n    Get total AWS cost without grouping.\n    \"\"\"\n\n    if not start or not end:\n        start, end = default_month_range()\n\n    response = ce.get_cost_and_usage(\n        TimePeriod={\n            \"Start\": start,\n            \"End\": end\n        },\n        Granularity=granularity,\n        Metrics=[metric]\n    )\n\n    results = []\n\n    for period in response.get(\"ResultsByTime\", []):\n        total = period[\"Total\"][metric]\n\n        results.append({\n            \"start\": period[\"TimePeriod\"][\"Start\"],\n            \"end\": period[\"TimePeriod\"][\"End\"],\n            \"amount\": float(total[\"Amount\"]),\n            \"unit\": total[\"Unit\"]\n        })\n\n    return {\n        \"start\": start,\n        \"end\": end,\n        \"metric\": metric,\n        \"results\": results\n    }\n\n\n@mcp.tool()\ndef get_cost_forecast(\n    start: str | None = None,\n    end: str | None = None,\n    granularity: str = \"MONTHLY\",\n    metric: str = \"UNBLENDED_COST\"\n) -> dict:\n    \"\"\"\n    Forecast future AWS cost.\n\n    Args:\n        start: Forecast start date in YYYY-MM-DD.\n        end: Forecast end date in YYYY-MM-DD.\n        granularity: DAILY or MONTHLY.\n        metric: BLENDED_COST, UNBLENDED_COST, AMORTIZED_COST, NET_AMORTIZED_COST, USAGE_QUANTITY.\n    \"\"\"\n\n    today = date.today()\n\n    if not start:\n        start = today.isoformat()\n\n    if not end:\n        end = today.replace(day=28).isoformat()\n\n    response = ce.get_cost_forecast(\n        TimePeriod={\n            \"Start\": start,\n            \"End\": end\n        },\n        Metric=metric,\n        Granularity=granularity\n    )\n\n    return response\n\n\n@mcp.tool()\ndef get_dimension_values(\n    dimension: str = \"SERVICE\",\n    start: str | None = None,\n    end: str | None = None\n) -> dict:\n    \"\"\"\n    List available AWS Cost Explorer dimension values.\n\n    Examples of dimensions:\n    SERVICE, LINKED_ACCOUNT, REGION, USAGE_TYPE, OPERATION,\n    PURCHASE_TYPE, INSTANCE_TYPE, AZ, PLATFORM\n    \"\"\"\n\n    if not start or not end:\n        start, end = default_month_range()\n\n    response = ce.get_dimension_values(\n        TimePeriod={\n            \"Start\": start,\n            \"End\": end\n        },\n        Dimension=dimension\n    )\n\n    return {\n        \"dimension\": dimension,\n        \"values\": [\n            item[\"Value\"]\n            for item in response.get(\"DimensionValues\", [])\n        ]\n    }\n\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\n## 4. Run locally\n\nMake sure AWS credentials are available:\n\n```bash\naws configure\n```\n\nOr use an AWS profile:\n\n```bash\nAWS_PROFILE=my-profile python aws_cost_mcp.py\n```\n\n## 5. Claude Desktop MCP config example\n\nAdd this to your Claude Desktop config:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-cost-explorer\": {\n      \"command\": \"python\",\n      \"args\": [\n        \"/absolute/path/to/aws_cost_mcp.py\"\n      ],\n      \"env\": {\n        \"AWS_PROFILE\": \"my-profile\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\n## Example AI prompts\n\nYou can then ask:\n\n```text\nWhat are my AWS costs this month by service?\n```\n\n```text\nShow daily AWS spend for the last 14 days.\n```\n\n```text\nWhich AWS services are driving the highest cost this month?\n```\n\n```text\nForecast my AWS bill for this month.\n```\n\n```text\nShow costs grouped by linked account for July 2025.\n```\n\nCost Explorer is not real-time; AWS billing data can lag by several hours. Use read-only IAM permissions and avoid exposing root credentials.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 21, "phrasing": "What is the standard MCP server for Amazon Web Services integrations?", "text": "The standard/general MCP server for Amazon Web Services integrations is the **AWS API MCP Server** from **AWS Labs**.\n\nRepository: `awslabs/aws-api-mcp-server`\n\nIt lets MCP-compatible clients interact with AWS services through AWS APIs, typically using your configured AWS credentials/profile.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 22, "phrasing": "Recommended MCP server for connecting AI agents to AWS Lambda and API Gateway", "text": "Recommended choice depends on what you mean by \u201cconnect\u201d:\n\n## Best recommendation\n\n### 1. To let AI agents call existing AWS Lambda functions as tools\nUse **AWS Labs Lambda Tool MCP Server**.\n\n- Best for exposing Lambda functions to an MCP-compatible agent.\n- Each Lambda can become an MCP tool.\n- Good when your business logic already lives in Lambda.\n- Use IAM permissions to restrict which functions the agent can invoke.\n\nGitHub: `awslabs/mcp` \u2014 look for the Lambda Tool MCP server.\n\n## If the agent needs to manage AWS resources\n\n### 2. To let agents inspect or operate AWS Lambda and API Gateway resources\nUse **AWS Labs AWS API MCP Server**.\n\n- Provides access to AWS APIs.\n- Can interact with Lambda, API Gateway, CloudWatch, IAM, etc.\n- Better for infrastructure/admin workflows such as:\n  - listing Lambda functions\n  - checking API Gateway routes\n  - reading logs\n  - updating configuration\n  - invoking AWS service APIs\n\nUse this carefully with least-privilege IAM.\n\n## Recommended architecture\n\nIf your goal is agent-to-application integration:\n\n```text\nAI Agent\n   \u2193 MCP\nLambda Tool MCP Server\n   \u2193 AWS SDK / IAM\nAWS Lambda functions\n   \u2193 optional\nAPI Gateway / backend services\n```\n\nIf your goal is agent-to-infrastructure control:\n\n```text\nAI Agent\n   \u2193 MCP\nAWS API MCP Server\n   \u2193 AWS APIs\nLambda, API Gateway, CloudWatch, IAM, etc.\n```\n\n## Practical recommendation\n\nFor most use cases:\n\n- Use **Lambda Tool MCP Server** to expose specific Lambda functions safely as tools.\n- Use **AWS API MCP Server** only for DevOps/admin-style access to Lambda and API Gateway.\n- Avoid giving the agent broad AWS permissions.\n- Use IAM roles with least privilege.\n- Allowlist specific Lambda functions or API Gateway resources.\n- Log all invocations with CloudTrail and CloudWatch.\n\nIf you want the agent to call an API Gateway endpoint rather than invoke Lambda directly, you may also expose a simple custom MCP tool that wraps HTTP calls to the API Gateway URL.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 23, "phrasing": "Best MCP server for letting an LLM query Amazon RDS databases", "text": "For **letting an LLM query Amazon RDS data**, the best MCP server usually depends on the RDS engine:\n\n### Best choice for RDS PostgreSQL / Aurora PostgreSQL\n\nUse the official/reference PostgreSQL MCP server:\n\n**`@modelcontextprotocol/server-postgres`**\n\nIt is simple, widely used, and works well with RDS PostgreSQL because RDS exposes a normal PostgreSQL endpoint.\n\nExample config:\n\n```json\n{\n  \"mcpServers\": {\n    \"rds-postgres\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"@modelcontextprotocol/server-postgres\",\n        \"postgresql://readonly_user:password@your-rds-endpoint.amazonaws.com:5432/dbname\"\n      ]\n    }\n  }\n}\n```\n\n### Best choice for RDS MySQL / Aurora MySQL\n\nUse a community MySQL MCP server, for example:\n\n**`mcp-server-mysql`** or similar MySQL MCP implementations.\n\nExample pattern:\n\n```json\n{\n  \"mcpServers\": {\n    \"rds-mysql\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"mcp-server-mysql\"\n      ],\n      \"env\": {\n        \"MYSQL_HOST\": \"your-rds-endpoint.amazonaws.com\",\n        \"MYSQL_PORT\": \"3306\",\n        \"MYSQL_USER\": \"readonly_user\",\n        \"MYSQL_PASSWORD\": \"password\",\n        \"MYSQL_DATABASE\": \"dbname\"\n      }\n    }\n  }\n}\n```\n\n### Recommendation\n\nIf you are on **PostgreSQL**, use:\n\n> **`@modelcontextprotocol/server-postgres`**\n\nIf you are on **MySQL**, use a dedicated MySQL MCP server, but be more careful since the ecosystem is less standardized than Postgres.\n\n### Important security setup\n\nFor RDS access, do not give the LLM a production admin account. Use:\n\n- A dedicated **read-only database user**\n- Network restrictions: VPC, VPN, bastion, or RDS Proxy\n- Query timeouts\n- Row limits\n- No `INSERT`, `UPDATE`, `DELETE`, `DROP`, or `ALTER`\n- Logging/auditing enabled\n- Ideally connect to a read replica, not the primary database\n\n### Short answer\n\nFor most teams using RDS PostgreSQL or Aurora PostgreSQL, the best MCP server is:\n\n> **`@modelcontextprotocol/server-postgres`**\n\nIt is the safest default, easiest to configure, and works directly with Amazon RDS PostgreSQL endpoints.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 24, "phrasing": "We need an MCP server to let our AI assistant analyze AWS CloudTrail logs. What server works best?", "text": "Best choice: **AWS Labs CloudWatch Logs MCP Server** \u2014 if your CloudTrail events are delivered to **CloudWatch Logs**.\n\nIt lets an AI assistant run CloudWatch Logs Insights queries against CloudTrail log groups, which is usually the most practical way to investigate:\n\n- Who made an API call\n- Failed or denied actions\n- IAM changes\n- Console logins\n- Suspicious source IPs\n- Resource creation/deletion events\n- Timeline reconstruction\n\nUse it with a tightly scoped read-only IAM role allowing things like:\n\n```json\n{\n  \"Effect\": \"Allow\",\n  \"Action\": [\n    \"logs:StartQuery\",\n    \"logs:GetQueryResults\",\n    \"logs:DescribeLogGroups\",\n    \"logs:DescribeLogStreams\"\n  ],\n  \"Resource\": \"*\"\n}\n```\n\nIf your CloudTrail logs are primarily stored in **S3**, then the better option is an **Athena MCP server**, because Athena is better for large historical CloudTrail analysis over S3.\n\nSo the recommendation is:\n\n| CloudTrail storage | Best MCP server |\n|---|---|\n| CloudWatch Logs | **AWS Labs CloudWatch Logs MCP Server** |\n| S3 data lake | **Athena MCP server** |\n| CloudTrail Lake | Custom MCP wrapper around CloudTrail Lake query APIs |\n\nFor most assistant-driven investigations, I\u2019d start with **CloudWatch Logs MCP Server** because it gives fast, natural-language-driven querying over recent CloudTrail events with minimal setup.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 25, "phrasing": "Which MCP server bridges local AI clients with AWS cloud management APIs?", "text": "The **AWS Cloud Control API MCP Server** bridges local AI clients with AWS cloud management APIs, enabling AI assistants to manage AWS resources through the AWS Cloud Control API.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 26, "phrasing": "Most active open source MCP server project for Amazon Web Services", "text": "The most active/open-source AWS MCP project to start with is likely:\n\n**AWS Labs MCP Servers**  \nGitHub: https://github.com/awslabs/mcp\n\nIt\u2019s an AWS Labs-maintained monorepo containing multiple MCP servers for AWS, including servers for:\n\n- AWS API access\n- AWS documentation\n- CDK\n- Terraform on AWS\n- Cost analysis\n- CloudFormation / infrastructure workflows\n- Other AWS developer tooling\n\nIf you specifically want a general-purpose AWS MCP server, look for the **AWS API MCP Server** inside that repo.\n\nNote: \u201cmost active\u201d can change quickly, so I\u2019d verify by checking recent commits, releases, open issues/PRs, and maintainer activity on GitHub.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 27, "phrasing": "What MCP server allows AI agents to inspect and modify AWS S3 bucket policies?", "text": "The **AWS S3 Bucket Policy MCP Server** allows AI agents to inspect and modify AWS S3 bucket policies. It typically exposes tools for actions like reading, updating, and validating S3 bucket policy JSON.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 28, "phrasing": "Best lightweight MCP server for AWS developer tooling", "text": "**Best lightweight MCP server for AWS developer tooling:**  \nUse the **AWS Labs AWS API MCP Server**.\n\nIt\u2019s the best general-purpose option if you want an MCP client like Claude Desktop, Cursor, Continue, or Cline to inspect and interact with AWS using your existing AWS credentials.\n\nGitHub: `awslabs/aws-api-mcp-server`\n\nTypical config:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-api\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-api-mcp-server@latest\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"dev\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\nFor a safer, very lightweight setup, pair it with the **AWS Documentation MCP Server**:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-docs\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-documentation-mcp-server@latest\"]\n    }\n  }\n}\n```\n\n### Recommendation\n\n- **Need live AWS account visibility/actions?** Use `aws-api-mcp-server`.\n- **Need AWS docs, CLI/API guidance, service references?** Use `aws-documentation-mcp-server`.\n- **Using CDK heavily?** Add `aws-cdk-mcp-server`.\n- **Using Terraform?** Add `terraform-mcp-server`.\n\nFor most AWS developers, I\u2019d start with:\n\n1. `aws-documentation-mcp-server`\n2. `aws-api-mcp-server` with a **read-only or least-privilege AWS profile**\n\nAvoid using an admin AWS profile unless you fully trust the MCP client and workflow.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 29, "phrasing": "We want our AI workflow to fetch metrics from Amazon CloudWatch via MCP. Which server implementation should we deploy?", "text": "Deploy the **AWS Labs CloudWatch MCP Server**:\n\n**Implementation:** `awslabs/cloudwatch-mcp-server`  \n**Purpose:** Provides MCP tools for Amazon CloudWatch, including fetching CloudWatch metrics.\n\nUse it with AWS credentials/IAM permissions that allow CloudWatch metric access, such as:\n\n- `cloudwatch:GetMetricData`\n- `cloudwatch:GetMetricStatistics`\n- `cloudwatch:ListMetrics`\n\nSo the server you want is the **CloudWatch MCP Server from AWS Labs**, not a generic AWS SDK wrapper.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 30, "phrasing": "Which Model Context Protocol server is best for connecting desktop AI assistants to AWS account resources?", "text": "The best fit is **AWS Labs\u2019 AWS API MCP Server**.\n\nIt lets desktop AI assistants such as Claude Desktop or other MCP-compatible clients connect to and interact with resources in your AWS account using your local AWS credentials/configuration.\n\nIf you only need AWS documentation lookup, use the **AWS Documentation MCP Server** instead. For actual account/resource access, choose **AWS API MCP Server**.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 31, "phrasing": "Top MCP servers for Amazon Web Services cloud automation and DevOps", "text": "Here are strong MCP server choices for **AWS cloud automation and DevOps**, grouped by use case.\n\n## Top AWS-focused MCP servers\n\n| MCP server | Best for | Notes |\n|---|---|---|\n| **AWS Documentation MCP Server** | AWS docs lookup, service guidance, API references | Great baseline server for any AWS coding/automation workflow. |\n| **AWS CDK MCP Server** | Infrastructure as Code with AWS CDK | Useful for generating CDK constructs, explaining patterns, and improving CDK projects. |\n| **Terraform MCP Server** | Terraform-based AWS automation | Helpful for AWS provider docs, Terraform modules, IaC generation, and validation workflows. |\n| **AWS CloudFormation MCP Server** | CloudFormation/SAM templates | Good if your org uses native AWS IaC. |\n| **AWS Cost Explorer MCP Server** | Cost analysis and FinOps | Useful for cost breakdowns, optimization, anomaly investigation, and spend reporting. |\n| **AWS Diagram MCP Server** | Architecture diagrams | Can help generate AWS architecture diagrams from descriptions or existing designs. |\n| **Amazon Bedrock Knowledge Base Retrieval MCP Server** | Internal AWS knowledge retrieval | Useful for searching internal runbooks, architecture docs, and operational knowledge. |\n\n## DevOps-adjacent MCP servers that pair well with AWS\n\n| MCP server | Best for |\n|---|---|\n| **GitHub MCP Server** | GitHub repos, pull requests, issues, Actions, CI/CD workflows |\n| **GitLab MCP Server** | GitLab CI/CD pipelines, merge requests, repo automation |\n| **Kubernetes MCP Server** | EKS cluster troubleshooting, manifests, deployments |\n| **Docker MCP Server** | Container builds, Dockerfiles, local container workflows |\n| **PostgreSQL / MySQL MCP Servers** | RDS/Aurora database inspection and SQL assistance |\n| **Prometheus / Grafana MCP Servers** | Observability, metrics queries, dashboard assistance |\n| **Slack MCP Server** | ChatOps, incident coordination, deployment notifications |\n\n## Best stack for AWS DevOps automation\n\nFor most AWS teams, I\u2019d start with:\n\n1. **AWS Documentation MCP Server**  \n2. **AWS CDK MCP Server** or **Terraform MCP Server**  \n3. **AWS Cost Explorer MCP Server**  \n4. **GitHub or GitLab MCP Server**  \n5. **Kubernetes MCP Server** if you use EKS  \n6. **Grafana/Prometheus MCP Server** for observability  \n\n## Safety recommendations\n\nFor AWS automation, avoid giving an MCP server broad admin credentials. Use:\n\n- Read-only roles where possible  \n- Separate IAM roles per environment  \n- Explicit approval for destructive actions  \n- CloudTrail logging  \n- Permission boundaries or SCPs  \n- Sandbox accounts for testing automation  \n\nIf you want the safest setup, use MCP servers first for **planning, documentation, IaC generation, and review**, then run actual AWS changes through your normal CI/CD pipeline.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 32, "phrasing": "How to expose AWS infrastructure context to LLMs using an MCP server?", "text": "Use an MCP server as a thin, controlled \u201cAWS context gateway\u201d between the LLM and AWS APIs.\n\nAt a high level:\n\n```text\nLLM client, e.g. Claude/Cursor/agent\n        |\n        | MCP\n        v\nCustom AWS MCP server\n        |\n        | boto3 / AWS SDK\n        v\nAWS accounts, regions, CloudFormation, EC2, EKS, CloudWatch, IAM, etc.\n```\n\n## 1. Decide what AWS context to expose\n\nGood read-only context to expose:\n\n- AWS account and region inventory\n- EC2 instances, VPCs, subnets, security groups\n- ECS/EKS clusters and workloads\n- RDS/ElastiCache resources\n- CloudFormation/CDK stack metadata\n- CloudWatch metrics and logs\n- IAM roles and policies, carefully filtered\n- AWS Config or Resource Explorer queries\n\nAvoid exposing:\n\n- Secrets Manager secret values\n- SSM secure parameter values\n- Full IAM credentials\n- Sensitive tags or user data\n- Private keys, environment variables, tokens\n\n## 2. Create a minimal MCP server\n\nExample using Python, `mcp`, and `boto3`.\n\nInstall dependencies:\n\n```bash\npip install mcp boto3\n```\n\nCreate `aws_context_server.py`:\n\n```python\nimport os\nimport boto3\nfrom mcp.server.fastmcp import FastMCP\n\nmcp = FastMCP(\"aws-context\")\n\nDEFAULT_REGION = os.getenv(\"AWS_REGION\", \"us-east-1\")\n\n\ndef session():\n    return boto3.Session(region_name=DEFAULT_REGION)\n\n\n@mcp.tool()\ndef list_regions() -> list[str]:\n    \"\"\"List enabled AWS regions for the current account.\"\"\"\n    ec2 = session().client(\"ec2\", region_name=\"us-east-1\")\n    response = ec2.describe_regions(AllRegions=False)\n    return [r[\"RegionName\"] for r in response[\"Regions\"]]\n\n\n@mcp.tool()\ndef list_ec2_instances(region: str = DEFAULT_REGION) -> list[dict]:\n    \"\"\"List EC2 instances in a region with basic metadata.\"\"\"\n    ec2 = session().client(\"ec2\", region_name=region)\n\n    instances = []\n    paginator = ec2.get_paginator(\"describe_instances\")\n\n    for page in paginator.paginate():\n        for reservation in page[\"Reservations\"]:\n            for instance in reservation[\"Instances\"]:\n                instances.append({\n                    \"InstanceId\": instance[\"InstanceId\"],\n                    \"InstanceType\": instance.get(\"InstanceType\"),\n                    \"State\": instance[\"State\"][\"Name\"],\n                    \"PrivateIpAddress\": instance.get(\"PrivateIpAddress\"),\n                    \"PublicIpAddress\": instance.get(\"PublicIpAddress\"),\n                    \"VpcId\": instance.get(\"VpcId\"),\n                    \"SubnetId\": instance.get(\"SubnetId\"),\n                    \"Tags\": instance.get(\"Tags\", []),\n                })\n\n    return instances\n\n\n@mcp.tool()\ndef list_vpcs(region: str = DEFAULT_REGION) -> list[dict]:\n    \"\"\"List VPCs in a region.\"\"\"\n    ec2 = session().client(\"ec2\", region_name=region)\n    response = ec2.describe_vpcs()\n\n    return [\n        {\n            \"VpcId\": vpc[\"VpcId\"],\n            \"CidrBlock\": vpc.get(\"CidrBlock\"),\n            \"IsDefault\": vpc.get(\"IsDefault\"),\n            \"Tags\": vpc.get(\"Tags\", []),\n        }\n        for vpc in response[\"Vpcs\"]\n    ]\n\n\n@mcp.tool()\ndef describe_security_group(group_id: str, region: str = DEFAULT_REGION) -> dict:\n    \"\"\"Describe a specific EC2 security group.\"\"\"\n    ec2 = session().client(\"ec2\", region_name=region)\n    response = ec2.describe_security_groups(GroupIds=[group_id])\n    return response[\"SecurityGroups\"][0]\n\n\n@mcp.tool()\ndef list_cloudformation_stacks(region: str = DEFAULT_REGION) -> list[dict]:\n    \"\"\"List active CloudFormation stacks in a region.\"\"\"\n    cfn = session().client(\"cloudformation\", region_name=region)\n\n    stacks = []\n    paginator = cfn.get_paginator(\"describe_stacks\")\n\n    for page in paginator.paginate():\n        for stack in page[\"Stacks\"]:\n            if stack[\"StackStatus\"] != \"DELETE_COMPLETE\":\n                stacks.append({\n                    \"StackName\": stack[\"StackName\"],\n                    \"StackId\": stack[\"StackId\"],\n                    \"StackStatus\": stack[\"StackStatus\"],\n                    \"CreationTime\": str(stack[\"CreationTime\"]),\n                    \"Description\": stack.get(\"Description\"),\n                    \"Tags\": stack.get(\"Tags\", []),\n                })\n\n    return stacks\n\n\n@mcp.tool()\ndef get_cloudwatch_alarms(region: str = DEFAULT_REGION) -> list[dict]:\n    \"\"\"List CloudWatch alarms in a region.\"\"\"\n    cloudwatch = session().client(\"cloudwatch\", region_name=region)\n\n    alarms = []\n    paginator = cloudwatch.get_paginator(\"describe_alarms\")\n\n    for page in paginator.paginate():\n        for alarm in page[\"MetricAlarms\"]:\n            alarms.append({\n                \"AlarmName\": alarm[\"AlarmName\"],\n                \"StateValue\": alarm[\"StateValue\"],\n                \"MetricName\": alarm.get(\"MetricName\"),\n                \"Namespace\": alarm.get(\"Namespace\"),\n                \"Dimensions\": alarm.get(\"Dimensions\", []),\n            })\n\n    return alarms\n\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\n## 3. Configure AWS credentials\n\nUse normal AWS credential mechanisms:\n\n```bash\naws configure sso\n```\n\nor:\n\n```bash\nexport AWS_PROFILE=dev\nexport AWS_REGION=us-east-1\n```\n\nPrefer an IAM role or SSO profile with read-only permissions.\n\nExample IAM policy baseline:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"ec2:Describe*\",\n        \"cloudformation:Describe*\",\n        \"cloudformation:List*\",\n        \"cloudwatch:Describe*\",\n        \"cloudwatch:GetMetricData\",\n        \"logs:Describe*\",\n        \"logs:StartQuery\",\n        \"logs:GetQueryResults\",\n        \"eks:Describe*\",\n        \"eks:List*\",\n        \"ecs:Describe*\",\n        \"ecs:List*\",\n        \"rds:Describe*\",\n        \"elasticloadbalancing:Describe*\",\n        \"resource-explorer-2:Search\",\n        \"tag:GetResources\"\n      ],\n      \"Resource\": \"*\"\n    }\n  ]\n}\n```\n\nBe careful with permissions like:\n\n```text\nsecretsmanager:GetSecretValue\nssm:GetParameter\nkms:Decrypt\n```\n\nUsually, do not grant those to the MCP server.\n\n## 4. Register the MCP server with your LLM client\n\nFor Claude Desktop, add something like this to the Claude config file:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-context\": {\n      \"command\": \"python\",\n      \"args\": [\"/absolute/path/to/aws_context_server.py\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"dev\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\nThen restart the client.\n\nYour LLM can now ask questions like:\n\n```text\nList EC2 instances in us-east-1 and identify which are publicly reachable.\n```\n\nor:\n\n```text\nInspect my VPCs and summarize security group rules that allow 0.0.0.0/0 ingress.\n```\n\n## 5. Add richer AWS tools\n\nUseful MCP tools to add:\n\n```text\nsearch_resources(query)\ndescribe_resource(arn)\nlist_security_groups(region)\nfind_public_ingress(region)\nlist_eks_clusters(region)\ndescribe_eks_cluster(name, region)\nlist_rds_instances(region)\nget_cloudwatch_metrics(namespace, metric_name, dimensions)\nquery_cloudwatch_logs(log_group, query, start_time, end_time)\nget_stack_resources(stack_name, region)\n```\n\nFor multi-account AWS environments, expose tools like:\n\n```text\nlist_accounts()\nassume_account_role(account_id, role_name)\nlist_resources(account_id, region)\n```\n\nUse AWS Organizations and STS:\n\n```python\nsts = boto3.client(\"sts\")\ncreds = sts.assume_role(\n    RoleArn=f\"arn:aws:iam::{account_id}:role/ReadOnlyInfraRole\",\n    RoleSessionName=\"mcp-aws-context\"\n)[\"Credentials\"]\n```\n\nThen create a scoped session from those temporary credentials.\n\n## 6. Consider AWS Resource Explorer or AWS Config\n\nFor broad infrastructure context, AWS Resource Explorer is often better than calling every service API directly.\n\nExample MCP tool:\n\n```python\n@mcp.tool()\ndef search_aws_resources(query: str, region: str = \"us-east-1\") -> list[dict]:\n    \"\"\"Search AWS resources using AWS Resource Explorer.\"\"\"\n    client = session().client(\"resource-explorer-2\", region_name=region)\n    response = client.search(QueryString=query)\n\n    return [\n        {\n            \"Arn\": item.get(\"Arn\"),\n            \"ResourceType\": item.get(\"ResourceType\"),\n            \"Service\": item.get(\"Service\"),\n            \"Region\": item.get(\"Region\"),\n        }\n        for item in response.get(\"Resources\", [])\n    ]\n```\n\nThen the LLM can ask:\n\n```text\nFind all internet-facing load balancers.\n```\n\nor:\n\n```text\nSearch for untagged production resources.\n```\n\n## 7. Security recommendations\n\nUse these guardrails:\n\n- Make the MCP server read-only by default.\n- Use least-privilege IAM.\n- Do not expose secret values.\n- Redact sensitive tags or metadata.\n- Log all tool calls.\n- Rate-limit expensive APIs.\n- Add pagination limits.\n- Require explicit approval for mutating actions.\n- Separate dev/stage/prod MCP profiles.\n- Use short-lived STS credentials.\n- Run the server locally or inside a private network.\n\n## 8. Production architecture option\n\nFor team usage:\n\n```text\nLLM client\n   |\n   | MCP over HTTP/SSE/stdio depending on client\n   v\nAWS Context MCP Server\n   |\n   | STS AssumeRole\n   v\nMultiple AWS accounts\n   |\n   | Resource Explorer / Config / CloudWatch / CloudTrail\n   v\nInfrastructure context\n```\n\nDeploy the MCP server on:\n\n- ECS Fargate\n- EKS\n- EC2\n- Internal developer workstation\n- Lambda behind an adapter, if your MCP client supports remote HTTP transport\n\n## Summary\n\nTo expose AWS infrastructure context to LLMs:\n\n1. Build an MCP server with AWS SDK calls.\n2. Add read-only tools for EC2, VPC, CloudFormation, CloudWatch, EKS, ECS, RDS, etc.\n3. Register the MCP server with your LLM client.\n4. Use tightly scoped IAM permissions.\n5. Avoid exposing secrets.\n6. Optionally use AWS Resource Explorer or AWS Config for cross-account inventory.\n\nThis gives the LLM structured, real-time AWS context without giving it unrestricted AWS access.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 33, "phrasing": "What MCP server enables natural language querying of AWS infrastructure status?", "text": "The **AWS MCP Server** enables natural language querying of AWS infrastructure status.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 34, "phrasing": "Best enterprise-grade MCP server with role-based access control for AWS cloud resources", "text": "**Best choice for enterprise AWS access:**  \nUse the **AWS Labs AWS API MCP Server** deployed inside your AWS environment, with access controlled by **AWS IAM / IAM Identity Center / STS AssumeRole**.\n\n### Recommended architecture\n\n**MCP client / agent**  \n\u2192 **Enterprise MCP gateway or proxy with SSO/RBAC**  \n\u2192 **AWS API MCP Server**  \n\u2192 **AWS IAM roles with least privilege**  \n\u2192 **AWS resources**\n\n### Why this is the best pattern\n\nFor AWS cloud resources, **RBAC should not primarily live inside the MCP server**. It should be enforced by:\n\n- **AWS IAM roles**\n- **IAM Identity Center / SSO groups**\n- **STS temporary credentials**\n- **Permission boundaries**\n- **Service Control Policies**\n- **CloudTrail audit logging**\n\nThe MCP server should expose tools, but AWS IAM should decide what those tools can actually do.\n\n### Best MCP server option\n\n| Use case | Recommended MCP server |\n|---|---|\n| General AWS resource operations | **AWS Labs AWS API MCP Server** |\n| AWS docs and architecture help | AWS Documentation MCP Server |\n| CDK workflows | AWS CDK MCP Server |\n| Terraform/IaC workflows | Terraform MCP Server |\n| Cost visibility | AWS Cost Analysis MCP Server |\n| CloudWatch/logs/metrics | CloudWatch MCP Server |\n\n### Enterprise RBAC approach\n\nMap users or groups to AWS roles, for example:\n\n| User group | IAM role |\n|---|---|\n| Developers | `ReadOnlyAccess` + limited deploy permissions |\n| SRE | CloudWatch, ECS, EKS, Lambda operations |\n| Security | IAM Access Analyzer, CloudTrail, GuardDuty read access |\n| Platform admins | Broader infra-management role with approvals |\n| Finance | Cost Explorer and Billing read-only |\n\nThen configure the MCP server to use **per-session STS credentials** rather than a shared long-lived AWS key.\n\n### Important recommendation\n\nDo **not** run an MCP server with broad `AdministratorAccess` credentials and expose it to multiple users. For enterprise use, require:\n\n- SSO/OIDC authentication\n- Per-user or per-group role mapping\n- Least-privilege IAM policies\n- Audit logging through CloudTrail\n- Approval gates for destructive actions\n- Network isolation, e.g. private VPC/EKS/ECS deployment\n\n### Short answer\n\nIf you want an enterprise-grade MCP setup for AWS, the best option is:\n\n**AWS Labs AWS API MCP Server + AWS IAM Identity Center + STS AssumeRole + an MCP gateway/proxy for user-level RBAC.**\n\nUse AWS IAM as the source of truth for permissions, and use the MCP layer only to expose and route tools safely.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 35, "phrasing": "Which AWS MCP server supports fine-grained IAM permission scoping for AI tools?", "text": "The **AWS API MCP Server** supports fine-grained IAM permission scoping for AI tools.\n\nIt lets AI assistants access AWS APIs while using standard **AWS IAM policies** to control exactly which services and actions the tools are allowed to invoke.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 36, "phrasing": "We need an MCP server so our developer assistant can create and check AWS SQS queues. What should we use?", "text": "Use the **AWS Labs Amazon SQS MCP Server** \u2014 typically published as:\n\n```bash\nuvx awslabs.sqs-mcp-server@latest\n```\n\nExample MCP config:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-sqs\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.sqs-mcp-server@latest\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"dev\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\nGive the AWS identity least-privilege SQS permissions such as:\n\n```json\n{\n  \"Effect\": \"Allow\",\n  \"Action\": [\n    \"sqs:CreateQueue\",\n    \"sqs:GetQueueUrl\",\n    \"sqs:GetQueueAttributes\",\n    \"sqs:ListQueues\",\n    \"sqs:TagQueue\"\n  ],\n  \"Resource\": \"*\"\n}\n```\n\nThis will let your developer assistant create queues and inspect/check existing SQS queues.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 37, "phrasing": "What Model Context Protocol server offers the broadest coverage of AWS service APIs?", "text": "The **AWS API MCP Server** (`awslabs/aws-api-mcp-server`) offers the broadest coverage of AWS service APIs.\n\nIt is designed to expose AWS service operations broadly through AWS SDK/Boto3-style API access, rather than focusing on a single service or workflow. Its actual capabilities depend on your configured AWS credentials and IAM permissions.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 38, "phrasing": "Best MCP server for connecting LLM context windows to Amazon Web Services documentation and architecture", "text": "The best choice is the **official AWS Labs MCP server for AWS documentation**:\n\n## Recommended MCP server\n\n### **AWS Documentation MCP Server**\nGitHub: `awslabs/mcp` / `awslabs.aws-documentation-mcp-server`\n\nIt is purpose-built to let an LLM query and cite AWS documentation, including service docs, user guides, API references, and architecture-related AWS docs.\n\nUse it if you want your LLM to answer questions like:\n\n- \u201cWhat is the recommended VPC architecture for ECS?\u201d\n- \u201cCompare API Gateway REST API vs HTTP API.\u201d\n- \u201cFind the latest IAM policy condition keys for S3.\u201d\n- \u201cSummarize AWS Well-Architected guidance for serverless workloads.\u201d\n\nExample MCP config:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-docs\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-documentation-mcp-server@latest\"]\n    }\n  }\n}\n```\n\n## For architecture diagrams\n\nPair it with:\n\n### **AWS Diagram MCP Server**\nUseful for generating or reasoning about AWS architecture diagrams.\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-diagrams\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-diagram-mcp-server@latest\"]\n    }\n  }\n}\n```\n\n## Best practical setup\n\nFor AWS architecture work, I\u2019d use:\n\n1. **AWS Documentation MCP Server** \u2014 authoritative AWS docs and service guidance  \n2. **AWS Diagram MCP Server** \u2014 architecture diagrams  \n3. Optionally **AWS CDK MCP Server** \u2014 if you want the LLM to turn architecture into CDK/IaC patterns  \n\nSo the short answer is:\n\n> Use the **official AWS Documentation MCP Server** from AWS Labs, and pair it with the **AWS Diagram MCP Server** for architecture workflows.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 39, "phrasing": "Which MCP server allows AI chatbots to interact with AWS ECS and EKS clusters?", "text": "The **AWS MCP Server** allows AI chatbots to interact with AWS services including **Amazon ECS** and **Amazon EKS clusters**.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 40, "phrasing": "What is the most secure MCP server implementation for Amazon Web Services APIs?", "text": "The safest choice is usually **AWS\u2019s official AWS Labs MCP server**, specifically the **AWS API MCP Server** from the `awslabs/mcp` / AWS MCP Servers project.\n\nHowever, the \u201cmost secure\u201d implementation depends more on **how you deploy and permission it** than on the MCP server itself.\n\nRecommended secure setup:\n\n- Use the **official AWS Labs AWS API MCP Server**, not an untrusted third-party server.\n- Run it **locally or inside a private/VPC-controlled environment**, not exposed publicly.\n- Use **short-lived AWS credentials** via IAM Identity Center, STS, OIDC, or an assumed role.\n- Grant the MCP server a **least-privilege IAM role**, not `AdministratorAccess`.\n- Prefer **read-only mode** where possible.\n- Use **service/action allowlists** if supported.\n- Add AWS-side guardrails such as:\n  - IAM permission boundaries\n  - Service Control Policies\n  - CloudTrail logging\n  - MFA / approval workflows for sensitive operations\n- Pin the MCP server version or container digest and keep it updated.\n\nIf you only need access to a specific AWS service, a **narrow, service-specific MCP server with a tightly scoped IAM policy** is more secure than a generic \u201call AWS APIs\u201d server.\n\nSo the direct answer is: **use the official AWS Labs AWS API MCP Server, configured with least-privilege, short-lived credentials, and preferably read-only/allowlisted access.**", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 41, "phrasing": "Recommended MCP server for AI agents doing automated cloud auditing on AWS", "text": "Recommended: **Prowler MCP Server** for AI agents doing automated AWS cloud auditing.\n\nWhy it\u2019s a good fit:\n\n- Purpose-built for AWS security auditing\n- Supports CIS, AWS Foundational Security Best Practices, PCI, SOC2, ISO, HIPAA, GDPR, etc.\n- Produces structured findings that agents can reason over\n- Works well for multi-account AWS environments\n- Can complement or feed into AWS Security Hub\n- Safer than giving an agent broad raw AWS API access\n\nSuggested setup:\n\n1. Deploy **Prowler MCP Server**\n2. Give it a dedicated AWS IAM role with read-only audit permissions\n3. Use policies such as:\n   - `SecurityAudit`\n   - optionally `ViewOnlyAccess`\n4. Scope access by AWS account, region, or organization as needed\n5. Let the AI agent query findings, compliance status, risks, and remediation guidance through MCP\n\nIf the agent also needs raw AWS inspection, pair it with:\n\n- **AWS Labs AWS API MCP Server** \u2014 for controlled read-only AWS API calls\n- **AWS Security Hub** \u2014 as the central findings aggregation layer\n\nBest practical recommendation:\n\n> Use **Prowler MCP Server** as the primary auditing MCP server, and optionally add **AWS API MCP Server** with strict read-only permissions for deeper investigation.\n\nAvoid giving the agent write permissions unless you have a separate, approval-gated remediation workflow.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 42, "phrasing": "Which Model Context Protocol tool provides seamless integration with AWS account management?", "text": "The **AWS Account Management MCP tool/server** provides seamless integration with AWS account management.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 43, "phrasing": "What MCP server should DevOps teams install to give AI assistants access to AWS diagnostics?", "text": "DevOps teams should install the **AWS Diagnostic MCP Server** \u2014 the AWS Labs MCP server that lets AI assistants access AWS diagnostics for troubleshooting and operational analysis.\n\nIt\u2019s commonly referenced as:\n\n**`awslabs.aws-diagnostic-mcp-server`**\n\nIt enables AI assistants to inspect AWS diagnostic data, helping with issues around logs, metrics, resources, and operational troubleshooting.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 0, "phrasing": "What is the best MCP server for connecting AI assistants to AWS infrastructure?", "text": "The best overall MCP server for AWS is the **AWS Cloud Control API MCP Server** (such as `mcp-server-aws` or `aws-mcp`). \n\n### Why it\u2019s the best choice:\n* **Universal Coverage:** It leverages the **AWS Cloud Control API**, giving your AI assistant read, create, update, and delete access to almost all AWS resources (EC2, S3, Lambda, DynamoDB, IAM, etc.) through standard AWS resource schemas.\n* **Native Security:** It respects your existing AWS credentials and IAM permissions (via environment variables, standard AWS profiles, or AWS SSO).\n* **No Extra Maintenance:** Because it relies on Cloud Control API schemas, it automatically supports new AWS features and services without needing manual tool updates.\n\n### Popular Implementations:\n1. **AWS Cloud Control MCP (`mcp-server-aws`):** Best for full, uniform infrastructure management via natural language.\n2. **AWS CLI MCP Server:** Best if you want the AI assistant to execute specific `aws-cli` commands directly on your behalf.\n\nYou can typically run it directly via `npx` or `uvx` inside your MCP client (like Claude Desktop or Cursor) using your local AWS profile credentials.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 1, "phrasing": "Best Model Context Protocol server for Amazon Web Services", "text": "The \"best\" AWS Model Context Protocol (MCP) server depends on your specific use case, as the ecosystem is divided into specific roles:\n\n### 1. Best for General AWS Resource & Infrastructure Management\n* **`mcp-server-aws`** (Community / Open Source)\n  * **What it does:** Allows AI models to interact directly with your AWS environment via the AWS SDK/CLI (S3, EC2, Lambda, CloudWatch, IAM, etc.).\n  * **Best for:** Querying infrastructure status, reading logs, listing resources, and running controlled operational tasks.\n\n### 2. Best for AWS Bedrock & Knowledge Bases\n* **`aws-kb-retrieval-mcp-server`** (by AWS Labs)\n  * **What it does:** Connects your MCP client to **Amazon Bedrock Knowledge Bases** for retrieval-augmented generation (RAG).\n  * **Best for:** Enterprise search and querying private internal documents stored in AWS vector databases.\n\n### 3. Best for AWS Documentation & Architecture\n* **`aws-documentation-mcp-server`**\n  * **What it does:** Gives the AI real-time, up-to-date access to official AWS documentation, SDK references, and architecture best practices.\n  * **Best for:** Writing accurate Infrastructure-as-Code (Terraform, AWS CDK) and troubleshooting configuration errors using current documentation.\n\n---\n\n### Recommendation\nIf you want an all-in-one starting point, install a **General AWS MCP Server** (like `mcp-server-aws`) configured with your local AWS credentials (`~/.aws/credentials`) set to **read-only permissions** for safety.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 2, "phrasing": "We want our local AI coding assistant to query AWS S3 buckets and CloudWatch logs via MCP. What server should we use?", "text": "To query AWS S3 and CloudWatch via MCP, you have three primary options depending on your security and setup preferences:\n\n### 1. Community Open-Source AWS MCP Server (Fastest Setup)\nUse **`mcp-server-aws`** (available via Python/PyPI or Node.js/NPM), which wraps the AWS SDK (`boto3` or `@aws-sdk`) to expose S3 and CloudWatch tools to your AI assistant.\n\n* **Setup (via `uvx` / `pipx`):**\n  Add the following to your AI assistant\u2019s MCP configuration (e.g., Cursor, Claude Desktop, or Roo-Code):\n  ```json\n  {\n    \"mcpServers\": {\n      \"aws\": {\n        \"command\": \"uvx\",\n        \"args\": [\"mcp-server-aws\"],\n        \"env\": {\n          \"AWS_PROFILE\": \"your-profile-name\",\n          \"AWS_REGION\": \"us-east-1\"\n        }\n      }\n    }\n  }\n  ```\n\n---\n\n### 2. Custom Python FastMCP Server (Recommended for Security & Enterprise)\nBecause S3 and CloudWatch access can expose sensitive data, many teams build a minimal, custom server using **FastMCP** and **Boto3**. This allows you to strictly control which read-only functions (e.g., `list_objects`, `get_log_events`) the AI can call.\n\n* **Example implementation (`server.py`):**\n  ```python\n  import boto3\n  from mcp.server.fastmcp import FastMCP\n\n  mcp = FastMCP(\"AWS Assistant\")\n  s3 = boto3.client('s3')\n  logs = boto3.client('logs')\n\n  @mcp.tool()\n  def list_s3_objects(bucket: str, prefix: str = \"\") -> list:\n      \"\"\"List objects in an S3 bucket.\"\"\"\n      res = s3.list_objects_v2(Bucket=bucket, Prefix=prefix)\n      return [obj['Key'] for obj in res.get('Contents', [])]\n\n  @mcp.tool()\n  def get_cloudwatch_logs(log_group: str, log_stream: str, limit: int = 50) -> list:\n      \"\"\"Fetch recent logs from CloudWatch.\"\"\"\n      res = logs.get_log_events(logGroupName=log_group, logStreamName=log_stream, limit=limit)\n      return [e['message'] for e in res.get('events', [])]\n\n  if __name__ == \"__main__\":\n      mcp.run()\n  ```\n\n---\n\n### 3. AWS CLI / Shell MCP Server\nIf your developers already have the official `aws-cli` configured locally, you can use a generic CLI execution MCP server (like **`mcp-server-commands`** or **`bash-mcp`**). This lets the AI run standard `aws s3` and `aws logs` commands directly using the user's existing AWS credentials.\n\n---\n\n### Key Prerequisite\nWhichever option you choose, ensure the user's environment has local AWS credentials configured (via `~/.aws/credentials`, `aws configure`, or AWS SSO/identity center).", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 3, "phrasing": "Recommend an AWS MCP server for a team managing multi-region cloud resources.", "text": "For managing multi-region AWS cloud resources, the recommended choice is the **AWS CLI / SDK-based MCP Server** (such as the community standard **`mcp-server-aws`** or a custom AWS SDK MCP wrapper).\n\n### Why it works well for multi-region environments:\n* **Native AWS Config Support:** It leverages your standard `~/.aws/config` and `~/.aws/credentials` files, allowing seamless switching between regional profiles and accounts.\n* **Explicit Region Targeting:** Enables the AI model to execute commands against specific regions (e.g., passing `--region us-east-1` or `--region eu-west-1`) or loop through multiple regions to aggregate resource data.\n* **Role Chaining & STS:** Supports AWS STS `AssumeRole` operations, making it easy to manage multi-region and multi-account architectures securely.\n\n### Quick Setup Tip:\nEnsure your local environment uses named profiles in `~/.aws/config` specifying the default region for each profile:\n\n```ini\n[profile us-west-2]\nregion = us-west-2\n\n[profile eu-central-1]\nregion = eu-central-1\n```\n\nThis allows the MCP server to interact across regions effortlessly by referencing the appropriate profile or region flag in prompt commands.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 4, "phrasing": "affordable and secure MCP server for AWS resource management", "text": "For a secure and 100% free (affordable) solution, the best approach is to run an **open-source, locally hosted AWS MCP server** that leverages your existing AWS CLI credentials and IAM security policies.\n\n### Recommended Solutions\n\n1. **Community Open-Source AWS MCP Servers (Free)**\n   * **`mcp-server-aws` / `aws-mcp` (GitHub)**: Various open-source TypeScript or Python implementations utilize standard AWS SDKs (`boto3` or `@aws-sdk`) to interact with AWS services (EC2, S3, CloudWatch, Lambda, etc.).\n   * **Execution Method**: Runs locally via `stdio` through desktop clients like Claude Desktop or Cursor. Because code runs locally, your AWS credentials and data are never sent to a third-party MCP host.\n\n2. **Custom FastMCP Server (Python/TypeScript)**\n   * If you want maximum control, build a minimal local server using Python (`fastmcp` + `boto3`). This limits AI access strictly to the exact AWS API actions you permit.\n\n---\n\n### Key Security Setup (Best Practices)\n\nTo ensure your setup remains secure:\n\n1. **Use Temporary Credentials / AWS SSO:**\n   Avoid long-lived access keys. Authenticate via `aws sso login` or AWS IAM Identity Center so the MCP server uses temporary STS tokens.\n2. **Enforce Least Privilege (IAM):**\n   Attach restrictive IAM policies to the profile used by the MCP server (e.g., start with `ReadOnlyAccess` or restrict actions to specific S3 buckets/EC2 tags).\n3. **Keep Transport Local:**\n   Configure the MCP server via `stdio` inside your desktop application (`claude_desktop_config.json`) so external networks cannot access the MCP endpoint.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 5, "phrasing": "What MCP server do cloud engineers actually use to let LLMs read AWS configuration?", "text": "In practice, cloud engineers typically use one of three main MCP servers depending on how they want the LLM to access AWS configurations:\n\n1. **`mcp-server-aws` / `aws-mcp` (AWS SDK/CLI Wrappers)**\n   * **What it does:** Uses the AWS SDK (Boto3/Node) under the hood to allow LLMs to run read-only commands (e.g., `ec2 describe-instances`, `s3 list-buckets`, `iam get-policy`). \n   * **Best for:** Direct, live inspection of deployed cloud resources using standard AWS IAM credentials.\n\n2. **Steampipe MCP Server (`steampipe-mcp`)**\n   * **What it does:** Exposes AWS resources as SQL tables via Steampipe, allowing the LLM to write SQL queries to audit AWS configurations (e.g., `SELECT * FROM aws_s3_bucket WHERE block_public_acls = false`).\n   * **Best for:** Complex structural audits, cross-account queries, and compliance checks.\n\n3. **Terraform / OpenTofu MCP Servers**\n   * **What it does:** Lets LLMs read state files (`.tfstate`) and HCL configuration files.\n   * **Best for:** Analyzing Infrastructure as Code (IaC) configurations before or alongside deployment.\n\n**Most common choice:** For live environment context, engineers most frequently use **`mcp-server-aws`** paired with read-only AWS credentials (`ReadOnlyAccess`).", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 6, "phrasing": "Best MCP server to connect AI agents to Amazon Web Services data stores", "text": "The best MCP (Model Context Protocol) server depends on the specific AWS data store you are targetting:\n\n### 1. For Managed Relational Databases (AWS RDS / Aurora)\n* **Best Choice:** **Official Anthropic Postgres / MySQL MCP Servers** (`@modelcontextprotocol/server-postgres`)\n* **Why:** RDS and Aurora expose standard database endpoints. The official Anthropic database MCP servers connect directly via your AWS database connection strings, allowing full SQL querying, schema inspection, and data retrieval.\n\n### 2. For Object Storage (Amazon S3) & DynamoDB\n* **Best Choice:** **Community `mcp-server-aws` / `mcp-aws-s3`** \n* **Why:** Uses the AWS SDK (via local AWS credentials) to list, read, write, and query S3 objects or perform operations on DynamoDB tables directly.\n\n### 3. For Enterprise RAG & Multi-Source Search (S3, Redshift, OpenSearch)\n* **Best Choice:** **Amazon Bedrock Knowledge Bases MCP Server**\n* **Why:** If your data is indexed in AWS Knowledge Bases, this MCP server allows AI agents to perform managed vector search, retrieve context, and query connected AWS data stores securely using native IAM permissions.\n\n---\n\n### Quick Recommendation\n* **Structured SQL Data (RDS):** Use `@modelcontextprotocol/server-postgres` or its MySQL equivalent.\n* **Unstructured / Documents (S3):** Use `mcp-aws-s3` or route through **Amazon Bedrock Knowledge Bases** for built-in vector search.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 7, "phrasing": "Which MCP server allows LLMs to query AWS DynamoDB and S3 safely?", "text": "The **AWS MCP Server** (often implemented as `mcp-server-aws` or community tools like `aws-mcp`) allows LLMs to interact with AWS services, including DynamoDB and S3. \n\nIt ensures safety by relying on **AWS IAM (Identity and Access Management)**, allowing administrators to restrict the LLM's access using read-only policies (e.g., `AmazonDynamoDBReadOnlyAccess` and `AmazonS3ReadOnlyAccess`) and scoped permissions.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 8, "phrasing": "We are building an AI dev tool that needs read-only access to AWS architecture via MCP. What MCP server implementation is best?", "text": "The best implementation for read-only access to AWS architecture is the **Steampipe MCP Server** (using the Steampipe AWS plugin).\n\n### Why Steampipe MCP is best for this use case:\n1. **Token-Efficient Queries:** Instead of dumping massive raw JSON API responses, it exposes your AWS infrastructure as SQL tables, allowing the LLM to query exact resource architectures cleanly.\n2. **Comprehensive Coverage:** Supports 100+ AWS services out-of-the-box (VPCs, EC2, IAM, S3, RDS, Serverless, etc.).\n3. **Inherent Read-Only Design:** Steampipe is built strictly for querying/reading infrastructure state, preventing accidental mutation or destructive actions.\n\n### Alternative:\n* **`awslabs/mcp-server-aws` (or AWS SDK-based MCP wrappers):** Better if your LLM needs direct interaction with specific AWS APIs, but generates larger context payloads and requires strict IAM `ReadOnlyAccess` scoping on the execution role.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 9, "phrasing": "Top open source MCP servers for AWS integration", "text": "Here are the top open-source Model Context Protocol (MCP) servers for AWS integration:\n\n### 1. **AWS Cloud Control MCP Server**\n* **Best for:** General AWS resource management (EC2, S3, RDS, Lambda, IAM, etc.).\n* **Features:** Uses the AWS Cloud Control API to CRUD (Create, Read, Update, Delete) almost any AWS resource using standardized schemas.\n* **Use Case:** Provisioning, inspecting, and modifying infrastructure via natural language.\n\n### 2. **Amazon S3 MCP Server**\n* **Best for:** File and object storage interactions.\n* **Features:** Read, search, write, upload, and list objects and buckets within S3.\n* **Use Case:** Analyzing logs stored in S3, uploading generated assets, or querying documents.\n\n### 3. **AWS CloudWatch MCP Server**\n* **Best for:** Monitoring, observability, and debugging.\n* **Features:** Query CloudWatch Logs (Insights), fetch metrics, inspect active alarms, and analyze error traces.\n* **Use Case:** Letting AI diagnose application errors directly by pulling live CloudWatch log groups.\n\n### 4. **AWS DynamoDB MCP Server**\n* **Best for:** NoSQL database interaction.\n* **Features:** Query, scan, put items, update schemas, and inspect DynamoDB table structures.\n* **Use Case:** Fetching application context, updating user records, or inspecting database state.\n\n### 5. **AWS Bedrock MCP Server**\n* **Best for:** AI/ML pipeline integration.\n* **Features:** Connects to AWS Bedrock Knowledge Bases, retrieves embeddings, and invokes custom Bedrock models/agents.\n* **Use Case:** Augmenting local AI clients with enterprise context stored in Bedrock.\n\n---\n\n### How to Find & Install\nMost of these servers can be found on GitHub or installed directly via `npx` / `uvx`:\n* **Awesome MCP Servers Directory:** [github.com/punkpeye/awesome-mcp-servers](https://github.com/punkpeye/awesome-mcp-servers)\n* **Anthropic Reference Servers:** [github.com/modelcontextprotocol/servers](https://github.com/modelcontextprotocol/servers)", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 10, "phrasing": "Which Model Context Protocol server works best for Amazon Bedrock LLMs?", "text": "Because the Model Context Protocol (MCP) is model-agnostic, **MCP servers work with any LLM that supports tool/function calling**. \n\nHowever, since MCP was created by Anthropic, **Anthropic Claude models hosted on Amazon Bedrock** (specifically **Claude 3.5 Sonnet** and **Claude 3.5 Haiku**) offer the highest reliability and best native performance with MCP servers.\n\nDepending on your goal:\n\n1. **To connect Bedrock LLMs to standard tools/data:** Any standard MCP server (e.g., Postgres, GitHub, Filesystem, Google Drive) works seamlessly when paired with Claude 3.5 on Bedrock as your LLM backend.\n2. **To query AWS Bedrock / AWS services via MCP:** Use open-source AWS-focused MCP servers such as the **AWS Knowledge Bases MCP Server** (for Bedrock RAG) or community servers like **`mcp-server-aws`** to interact with AWS resources directly.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 11, "phrasing": "How to connect an LLM assistant to AWS cloud resources using MCP?", "text": "To connect an LLM assistant to AWS resources using the **Model Context Protocol (MCP)**, you need an **MCP Client** (like Claude Desktop or Cursor), an **AWS MCP Server**, and configured **AWS Credentials**.\n\nHere is the step-by-step process:\n\n---\n\n### 1. Authenticate with AWS\nEnsure your local environment has valid AWS credentials configured via the AWS CLI or environment variables:\n```bash\naws configure\n```\nAlternatively, set the environment variables:\n* `AWS_ACCESS_KEY_ID`\n* `AWS_SECRET_ACCESS_KEY`\n* `AWS_REGION`\n\n---\n\n### 2. Choose or Run an AWS MCP Server\nMCP servers translate LLM tool calls into AWS SDK (Boto3 or JS SDK) requests. You can use an existing open-source server (such as AWS's official experimental servers or community servers like `mcp-server-aws` / `mcp-server-s3`).\n\nFor example, using `npx` or `uvx` to run an AWS MCP server:\n* **Node.js:** `npx -y @awslabs/mcp-server-aws` (or specific community packages)\n* **Python:** `uvx mcp-server-aws`\n\n---\n\n### 3. Configure Your MCP Client\nAdd the AWS MCP server configuration to your MCP client's configuration file (e.g., `claude_desktop_config.json` for Claude Desktop).\n\n#### Configuration Example (`claude_desktop_config.json`):\n\n**Using Node.js/npx:**\n```json\n{\n  \"mcpServers\": {\n    \"aws\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@awslabs/mcp-server-aws\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"default\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\n**Using Python/uvx:**\n```json\n{\n  \"mcpServers\": {\n    \"aws\": {\n      \"command\": \"uvx\",\n      \"args\": [\"mcp-server-aws\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"default\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\n---\n\n### 4. Restart and Test\n1. Restart your MCP Client (e.g., Claude Desktop).\n2. The LLM will automatically detect the AWS tools exposed by the MCP server.\n3. Test with prompts such as:\n   * *\"List all my S3 buckets.\"*\n   * *\"Show me the status of my EC2 instances in us-east-1.\"*\n   * *\"Fetch recent logs from CloudWatch log group `/aws/lambda/my-function`.\"*\n\n---\n\n### Alternative: Build a Custom AWS MCP Server\nIf you need custom AWS workflows, build your own server using the FastMCP (Python) or MCP SDK (TypeScript):\n\n**Python (`server.py`):**\n```python\nimport boto3\nfrom mcp.server.fastmcp import FastMCP\n\nmcp = FastMCP(\"AWS Assistant\")\ns3 = boto3.client(\"s3\")\n\n@mcp.tool()\ndef list_s3_buckets() -> list:\n    \"\"\"Lists all S3 buckets in the AWS account.\"\"\"\n    response = s3.list_buckets()\n    return [b[\"Name\"] for b in response.get(\"Buckets\", [])]\n\nif __name__ == \"__main__\":\n    mcp.run()\n```", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 12, "phrasing": "What is the most reliable MCP server for inspecting AWS IAM roles and Security Groups?", "text": "The most reliable option is the official **AWS Cloud Control API MCP Server** (maintained in the **`awslabs`** GitHub repository) or an AWS SDK-backed MCP server such as **`mcp-server-aws`**.\n\n### Why it is the most reliable:\n* **Official AWS SDK/API Integration:** It routes requests through official AWS APIs (IAM and EC2 endpoints), ensuring accurate, real-time read operations for IAM roles, policies, and Security Group rules.\n* **IAM Security Compliance:** It strictly respects your local AWS CLI credentials, profiles, and IAM policies (`iam:GetRole`, `iam:ListAttachedRolePolicies`, `ec2:DescribeSecurityGroups`, etc.).\n* **Standardized Schema:** By leveraging the AWS Cloud Control API, resource definitions remain up to date without requiring frequent server updates when AWS adds new properties.\n\n**Repository:** Search for `awslabs/aws-mcp-server` on GitHub or install via the official Model Context Protocol server directory.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 13, "phrasing": "Best MCP server for querying CloudWatch logs with natural language", "text": "The best options for querying AWS CloudWatch logs using natural language via MCP (Model Context Protocol) are:\n\n### 1. **`mcp-server-aws` (by AWS / Community)**\n* **Best for:** Direct integration with AWS services via the standard AWS SDK.\n* **How it works:** Exposes CloudWatch Logs Insights tools (`StartQuery`, `GetQueryResults`, `DescribeLogGroups`) to your LLM (like Claude Desktop or Cursor). The LLM translates your natural language prompt into CloudWatch Logs Insights syntax automatically.\n* **Installation:** \n  ```bash\n  npx -y @modelcontextprotocol/server-aws\n  ```\n\n### 2. **`aws-cloudwatch-mcp` (Dedicated CloudWatch MCP)**\n* **Best for:** Lightweight, log-focused workflows.\n* **Key Features:** Specifically tailored for log tailing, searching log groups, and running Insights queries without extra AWS service bloat.\n\n---\n\n### Recommended Setup (Claude Desktop / Cursor)\nAdd this to your `claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-cloudwatch\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"mcp-server-aws-cloudwatch\"],\n      \"env\": {\n        \"AWS_REGION\": \"us-east-1\",\n        \"AWS_PROFILE\": \"your-aws-profile\"\n      }\n    }\n  }\n}\n```\n\n*Tip: CloudWatch has native Natural Language Query generation built-in; combining an MCP server with an LLM allows you to ask questions like *\"Show me all 500 errors in the api-gateway log group from the last 2 hours\"* and get parsed results immediately.*", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 14, "phrasing": "We need an MCP server that lets developers ask an AI agent about active AWS EC2 instances. What options exist?", "text": "To connect an AI agent to AWS EC2 using the Model Context Protocol (MCP), you have three primary options:\n\n### 1. Pre-built Community AWS MCP Servers\nSeveral open-source community projects wrap AWS SDKs into MCP servers:\n* **`mcp-server-aws` / Community GitHub Repos:** Packages available on GitHub (searchable via the [MCP Server Directory](https://github.com/modelcontextprotocol/servers)) expose basic AWS read operations\u2014like listing EC2 instances, checking states, and reading tags\u2014to LLMs via standard tools.\n\n### 2. Steampipe MCP Server\n* **How it works:** [Steampipe](https://steampipe.io/) exposes infrastructure state as SQL tables. The Steampipe MCP server allows your AI agent to query AWS resources (including `aws_ec2_instance`) using standard SQL queries via MCP.\n* **Best for:** Complex queries, filtering across multiple regions/accounts, and consistent schema management.\n\n### 3. Custom MCP Server (Python or TypeScript)\nBecause listing active EC2 instances requires minimal code, building a custom, lightweight MCP server tailored to your exact needs is often the fastest and most secure route.\n\n* **Python (`mcp` + `boto3`):**\n  Create an MCP tool that wraps `boto3.client('ec2').describe_instances(Filters=[{'Name': 'instance-state-name', 'Values': ['running']}])`.\n* **TypeScript (`@modelcontextprotocol/sdk` + `@aws-sdk/client-ec2`):**\n  Create an MCP server using the official Node SDK wrapping the `DescribeInstancesCommand`.\n\n---\n\n### Recommended Choice\n* **For quick setup with standard tools:** Search GitHub for an existing `mcp-server-aws` implementation.\n* **For ad-hoc/advanced querying:** Use the **Steampipe MCP Server**.\n* **For tight security and specific outputs:** Build a **Custom Python/TypeScript MCP Server** with minimal IAM permissions (`ec2:DescribeInstances`).", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 15, "phrasing": "Which MCP server provides secure Amazon Web Services connector tools for AI models?", "text": "The official **AWS MCP Server** (maintained by AWS in the [`awslabs/mcp-server-aws`](https://github.com/awslabs/mcp-server-aws) GitHub repository) provides secure Amazon Web Services connector tools for AI models. \n\nIt allows models to securely interface with AWS services (such as AWS Bedrock, S3, DynamoDB, and CloudWatch) using standard AWS authentication and IAM permissions.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 16, "phrasing": "Best production-ready MCP server for AWS API interactions", "text": "The most robust option for AWS API interactions via Model Context Protocol (MCP) depends on whether you need **broad AWS CLI coverage** or **targeted SDK service integrations**:\n\n### 1. Best for Full AWS API Coverage: `mcp-server-aws-cli` / AWS CLI Wrappers\n* **What it is:** MCP servers that wrap the official **AWS CLI** (using Python or TypeScript).\n* **Why it\u2019s production-ready:** It leverages your existing AWS CLI installation, default credential chains (IAM roles, SSO, environment variables), and standard AWS configuration without hardcoding credentials.\n* **Best implementation pattern:** Use a Python-based **FastMCP** wrapper around `boto3` or the AWS CLI.\n\n### 2. Best for Enterprise Infrastructure (IaC): Pulumi / Terraform MCP\nIf your AWS interactions are meant for provisioning and managing resources rather than raw ad-hoc API calls, the **Pulumi MCP Server** or **Terraform MCP Server** are the most stable, declarative, and production-ready tools available.\n\n---\n\n### Production Best Practices for AWS MCP\n\nTo make *any* AWS MCP server truly production-ready:\n\n1. **Strict IAM Least Privilege:** Attach the MCP host process to a specific IAM Role (via AWS IAM Identity Center or AWS SSO) restricted only to the necessary read/write actions.\n2. **Audit Logging:** Ensure standard AWS CloudTrail logging is active for all API calls initiated by the MCP server.\n3. **Use Environment Credentials:** Rely on standard AWS SDK credential resolution (e.g., `AWS_PROFILE` or IAM EC2/ECS roles) rather than passing access keys through AI prompts or MCP configs.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 17, "phrasing": "We are an enterprise cloud platform team looking for a compliant AWS MCP server for internal AI tools. What should we evaluate?", "text": "To evaluate a compliant Model Context Protocol (MCP) server for AWS in an enterprise environment, focus on these five core pillars:\n\n---\n\n### 1. Authentication & IAM Integration\n* **Identity Delegation:** Does it support native enterprise auth (AWS IAM Identity Center, SSO, or temporary STS credentials) rather than hardcoded access keys?\n* **Contextual Scoping:** Can IAM policies be dynamically scoped based on the specific end-user initiating the request, rather than running all commands under a single, highly privileged service role?\n\n### 2. Guardrails & Execution Safety\n* **Mode Enforcement:** Does it support a strict **Read-Only mode** for basic context gathering, with explicit opt-in for Read-Write actions?\n* **API Whitelisting:** Can you restrict the available AWS APIs (e.g., allow `Describe*` and `List*`, block `Delete*` or `Update*`)?\n* **Human-in-the-Loop (HITL):** Does the architecture support mandatory approval workflows for destructive or high-risk actions before execution?\n\n### 3. Auditability & Observability\n* **End-to-End Traceability:** Does the server log the mapping of **LLM Prompt Context \u2192 User Identity \u2192 MCP Command \u2192 AWS CloudTrail Event**?\n* **SIEM Integration:** Can logs be streamed directly to your central enterprise logging tools (e.g., Datadog, Splunk, CloudWatch) for compliance monitoring?\n\n### 4. Data Privacy & Network Isolation\n* **Deployment Footprint:** Can the MCP server be fully self-hosted inside your AWS VPC / private network without routing traffic through third-party SaaS proxies?\n* **PII/Secret Masking:** Does the server sanitize command outputs (e.g., masking API keys, connection strings, or PII returned from AWS services) before passing data back to the LLM?\n\n### 5. Scope & State Management\n* **Multi-Account & Multi-Region Support:** Can it safely assume roles across multi-account structures (AWS Organizations) without leaking state across sessions?\n* **Token & Payload Limits:** Does it handle large AWS API responses (e.g., large `DescribeInstances` outputs) efficiently without blowing out LLM context limits or causing cost spikes?", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 18, "phrasing": "Which MCP server gives AI coding assistants real-time context on AWS cloud infrastructure?", "text": "The primary Model Context Protocol (MCP) server for this is the **AWS MCP Server** (often implemented as `mcp-server-aws` or `aws-mcp`). It connects AI assistants directly to the AWS SDK/CLI, allowing them to query live resource states (such as S3, EC2, CloudWatch, and Lambda) in real time. \n\nAnother popular option is the **Steampipe MCP Server**, which allows AI assistants to query real-time AWS infrastructure data using SQL.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 19, "phrasing": "What MCP server should I use to let AI models run AWS CLI commands safely?", "text": "To run AWS commands safely with AI models via Model Context Protocol (MCP), you should use a dedicated **AWS MCP server** (such as `mcp-server-aws` or specialized community implementations) or a standard terminal MCP server (`@modelcontextprotocol/server-bash`) bound to a heavily restricted AWS profile.\n\nFor maximum safety, combine the MCP server with these three guardrails:\n\n1. **Least-Privilege IAM Scoping:** Pass a dedicated AWS profile to the MCP server that uses a strictly scoped IAM role (e.g., `ReadOnlyAccess` or limited to specific services). Never give the AI access to administrative credentials or destructive permissions like `s3:DeleteBucket` or `ec2:TerminateInstances`.\n2. **Human-in-the-Loop Approvals:** Ensure your MCP client (such as Claude Desktop or Cursor) is set to require explicit user approval before executing any tool/command call.\n3. **Dedicated AWS Credentials File:** Hardcode an isolated, low-privilege `AWS_PROFILE` directly into the MCP server configuration in your `claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@modelcontextprotocol/server-bash\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"ai-restricted-readonly\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\n*Note: Safety is enforced at the **AWS IAM layer**, not by the MCP protocol itself. Restricting the IAM credentials assigned to the MCP process is the most critical step.*", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 20, "phrasing": "Model Context Protocol server for querying AWS Cost Explorer and billing via AI", "text": "An **AWS Cost Explorer Model Context Protocol (MCP) server** allows AI assistants (like Claude, Cursor, or custom agents) to securely query your AWS spending, analyze billing trends, and forecast future costs directly through conversational prompts.\n\n---\n\n### Key Capabilities Provided to the AI\n\nA standard AWS Cost Explorer MCP server exposes the following tools to the LLM:\n\n1. **`get_cost_and_usage`**: Retrieves historical cost and usage data grouped by dimensions (Service, Region, Usage Type, Linked Account, Tag).\n2. **`get_cost_forecast`**: Generates spending forecasts for future time periods.\n3. **`get_dimension_values`**: Lists available filter values (e.g., all AWS services active in the account).\n4. **`get_anomalies`**: (Optional) Detects unusual spending spikes using AWS Cost Anomaly Detection.\n\n---\n\n### Existing Open-Source Options\n\nYou can use community-maintained MCP servers from GitHub or registry platforms:\n\n* **Python/FastMCP implementation**: Often distributed via `uvx` or `pip`. Look for projects like `mcp-server-aws-cost-explorer` or `aws-mcp`.\n* **Node.js implementation**: Distributed via `npx` (e.g., `@mcp/aws-cost-explorer`).\n\n---\n\n### Quick Setup Guide (Example for Claude Desktop)\n\n1. **Required IAM Permissions**: Ensure your AWS credentials have the following IAM policy attached:\n   ```json\n   {\n     \"Version\": \"2012-10-17\",\n     \"Statement\": [\n       {\n         \"Effect\": \"Allow\",\n         \"Action\": [\n           \"ce:GetCostAndUsage\",\n           \"ce:GetCostForecast\",\n           \"ce:GetDimensionValues\",\n           \"ce:GetAnomalies\"\n         ],\n         \"Resource\": \"*\"\n       }\n     ]\n   }\n   ```\n\n2. **Add to MCP Configuration** (`claude_desktop_config.json`):\n   ```json\n   {\n     \"mcpServers\": {\n       \"aws-cost-explorer\": {\n         \"command\": \"uvx\",\n         \"args\": [\"mcp-server-aws-cost-explorer\"],\n         \"env\": {\n           \"AWS_REGION\": \"us-east-1\",\n           \"AWS_PROFILE\": \"your-aws-profile\"\n         }\n       }\n     }\n   }\n   ```\n\n---\n\n### Example AI Prompts Once Configured\n\n* *\"How much did we spend on AWS EC2 vs S3 last month?\"*\n* *\"Show me a daily breakdown of AWS costs for the past 7 days grouped by service.\"*\n* *\"What is our projected AWS spending for the end of this month?\"*\n* *\"Identify the top 3 most expensive AWS regions in our primary account.\"*", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 21, "phrasing": "What is the standard MCP server for Amazon Web Services integrations?", "text": "There is no single, monolithic \"standard\" MCP server for all of Amazon Web Services. Instead, integrations are typically handled by a few key servers depending on the use case:\n\n1. **AWS Infrastructure & Resource Management:**\n   * **AWS Cloud Control API MCP Server:** The primary standard for managing AWS resources (EC2, S3, IAM, etc.) programmatically using AWS's unified Cloud Control API.\n2. **AWS Documentation:**\n   * **AWS Documentation MCP Server:** The official/standard server provided by AWS to search, query, and fetch official AWS documentation directly within LLM workflows.\n3. **Community/Tool-Specific Servers:**\n   * Popular community servers like `mcp-server-aws` or `aws-mcp` (available on GitHub and via `npx`) bridge LLM contexts with the AWS CLI and AWS SDKs.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 22, "phrasing": "Recommended MCP server for connecting AI agents to AWS Lambda and API Gateway", "text": "The recommended MCP server setup depends on whether your AI agent needs to **invoke/manage Lambdas directly via the AWS SDK** or **call HTTP endpoints behind API Gateway**.\n\n---\n\n### 1. For Direct AWS Lambda Access (SDK Invocation & Management)\n**Recommended:** **`awslabs/mcp-server-aws`** (Official AWS Labs) or **`mcp-server-aws`**\n\n* **Best for:** Invoking functions directly (`lambda:InvokeFunction`), inspecting code/logs, and managing Lambda/API Gateway resources.\n* **How it works:** It wraps AWS SDK/CLI capabilities into MCP tools using your local AWS credentials (`~/.aws/credentials` or environment variables).\n* **Key Tools Provided:**\n  * `lambda_invoke`\n  * `lambda_list_functions`\n  * `apigateway_get_rest_apis`\n\n---\n\n### 2. For Interacting with APIs Deployed on API Gateway\n**Recommended:** **`@modelcontextprotocol/server-openapi`**\n\n* **Best for:** Letting agents interact with HTTP REST APIs deployed on API Gateway using your existing API schema.\n* **How it works:** Export the OpenAPI (Swagger) specification from your API Gateway and pass it to this generic OpenAPI MCP server. It automatically generates standard MCP tools for each endpoint.\n\n---\n\n### Summary Recommendation\n* **Use `awslabs/mcp-server-aws`** if the agent needs administrative control or direct Lambda execution.\n* **Use `@modelcontextprotocol/server-openapi`** if the agent should treat your API Gateway as a standard REST API.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 23, "phrasing": "Best MCP server for letting an LLM query Amazon RDS databases", "text": "The best MCP server depends on the specific database engine running on your Amazon RDS instance (e.g., PostgreSQL, MySQL, or SQL Server):\n\n1. **For RDS PostgreSQL / Aurora PostgreSQL:**\n   * **`@modelcontextprotocol/server-postgres`** (Official Anthropic MCP Server)\n   * **Why:** It is directly maintained by the Model Context Protocol team, highly secure, and provides schema inspection, query execution, and safety controls.\n   * **Connection:** Works seamlessly with your RDS connection string (`postgresql://user:password@rds-endpoint:5432/dbname`).\n\n2. **For RDS MySQL / Aurora MySQL:**\n   * **`mcp-server-mysql`** (Community Standard)\n   * **Why:** Provides full MySQL/MariaDB schema inspection and query capabilities for RDS instances.\n\n3. **For Multi-Database / Universal Access:**\n   * **`mcp-server-sql`** or **DBeaver MCP Integration**\n   * **Why:** Useful if you manage multiple RDS database types (Postgres, MySQL, SQL Server, Oracle) under one MCP interface.\n\n### Recommended Best Practice\nFor production RDS instances, point the MCP server to a **read-only database replica** or a user role restricted with strict `SELECT`-only permissions to prevent accidental data modification by the LLM.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 24, "phrasing": "We need an MCP server to let our AI assistant analyze AWS CloudTrail logs. What server works best?", "text": "The best approach depends on the depth and timeframe of your analysis, as CloudTrail logs are typically analyzed in one of two ways:\n\n### 1. **Best Overall (Deep/Historical Analysis): AWS Athena MCP Server**\nBecause raw CloudTrail logs are stored in S3, querying them via **Amazon Athena** using SQL is the industry best practice for log analysis. \n\n* **Recommended Server:** An **Athena MCP Server** (such as the community [`mcp-server-athena`](https://github.com/search?q=mcp-server-athena) or a custom FastMCP Athena wrapper).\n* **Why it works best:**\n  * Handles complex queries, large date ranges, and massive volumes of data.\n  * Avoids AWS CloudTrail API rate limits and cost constraints.\n  * Allows the AI to write standard ANSI SQL to filter by IP, event name, IAM user, error codes, etc.\n\n---\n\n### 2. **Best for Quick Lookups (< 90 Days): AWS CloudTrail / Boto3 MCP Server**\nIf you only need to inspect recent management events without setting up Athena, you can use a general AWS MCP server that wraps the `cloudtrail:LookupEvents` API.\n\n* **Recommended Server:** \n  * A community AWS MCP server like **`mcp-server-aws`** (Python/TypeScript).\n  * A lightweight custom Python server built with **FastMCP** and `boto3`.\n* **Why it works best:**\n  * Zero infrastructure required beyond AWS credentials.\n  * Ideal for simple queries like *\"Who deleted this S3 bucket yesterday?\"* or *\"Show recent failed login attempts for user X.\"*\n\n---\n\n### Summary Recommendation\n* **Use Athena MCP** if you already export CloudTrail to S3 / Lake and want deep, flexible query capabilities.\n* **Build/Use a FastMCP CloudTrail wrapper (`boto3.client('cloudtrail')`)** if you need a quick setup for recent event lookups.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 25, "phrasing": "Which MCP server bridges local AI clients with AWS cloud management APIs?", "text": "The **AWS MCP Server** (often implemented as `mcp-server-aws` or `aws-mcp`) bridges local AI clients with AWS cloud management APIs. \n\nIt exposes AWS SDK and CLI capabilities as Model Context Protocol tools, allowing local AI assistants (such as Claude Desktop or Cursor) to inspect, manage, and deploy AWS infrastructure using natural language.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 26, "phrasing": "Most active open source MCP server project for Amazon Web Services", "text": "The most active open-source Model Context Protocol (MCP) server project for Amazon Web Services is **`mcp-server-aws`** (maintained across key community repositories like `stefanpejcic/mcp-server-aws` and `qodo-ai/aws-mcp`). \n\n### Key Features:\n* **AWS SDK / Boto3 Integration:** Allows Claude and other MCP-compliant clients to interact with AWS services (EC2, S3, CloudWatch, Lambda, DynamoDB, IAM, etc.).\n* **Read & Write Capabilities:** Supports querying infrastructure status, fetching logs, managing S3 buckets, and invoking Lambda functions.\n* **Security:** Uses local AWS credentials (via standard AWS CLI profiles/environment variables) to ensure secure authentication.\n\nYou can find the implementations and installation instructions on GitHub by searching for **`mcp-server-aws`** or browsing the official [MCP Server Registry](https://github.com/modelcontextprotocol/servers).", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 27, "phrasing": "What MCP server allows AI agents to inspect and modify AWS S3 bucket policies?", "text": "The **AWS MCP Server** (such as `aws-mcp-server` or generic AWS SDK/CLI-based MCP servers) allows AI agents to inspect and modify AWS S3 bucket policies. \n\nThese servers expose AWS S3 API operations to the agent, specifically:\n* **Inspection:** `GetBucketPolicy`\n* **Modification:** `PutBucketPolicy` (and `DeleteBucketPolicy`)", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 28, "phrasing": "Best lightweight MCP server for AWS developer tooling", "text": "The best lightweight MCP servers for AWS developer tooling depend on whether you need **AWS resource management** or **AWS documentation/reference lookup**:\n\n### 1. For Resource Management & Deployment: `mcp-server-aws` (or FastMCP + Boto3)\n* **Best Choice:** **`mcp-server-aws`** (Node.js/TypeScript) or a minimal Python-based **FastMCP** server using `boto3`.\n* **Why it\u2019s great:**\n  * Runs directly via `npx` without heavy local setup.\n  * Uses standard AWS credential chains (`~/.aws/credentials` or environment variables).\n  * Exposes lightweight tools for core services like S3, Lambda, CloudWatch, and ECS.\n* **Quick Run:**\n  ```bash\n  npx -y @modelcontextprotocol/server-aws\n  ```\n\n### 2. For AWS Docs & Developer Reference: `@awslabs/aws-documentation-mcp-server`\n* **Best Choice:** Official AWS Documentation MCP Server.\n* **Why it\u2019s great:** \n  * Extremely fast and lightweight (doesn't perform heavy cloud operations).\n  * Gives the LLM direct, up-to-date access to AWS SDK references, CLI commands, and architecture patterns.\n* **Quick Run:**\n  ```bash\n  npx -y @awslabs/aws-documentation-mcp-server\n  ```\n\n### Recommendation\nFor the cleanest developer setup with minimal footprint, use **`npx -y @awslabs/aws-documentation-mcp-server`** for code generation/docs, paired with local **AWS CLI** pass-through via a lightweight CLI MCP wrapper for executing commands safely.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 29, "phrasing": "We want our AI workflow to fetch metrics from Amazon CloudWatch via MCP. Which server implementation should we deploy?", "text": "To fetch Amazon CloudWatch metrics via MCP, you should deploy one of the following implementations depending on your preference for official vs. community support:\n\n1. **AWS Labs MCP Server (`awslabs/mcp-server-aws` or official AWS MCP integrations)**\n   * **Best for:** Native support and official AWS alignment.\n   * **Details:** Maintained under the AWS Labs GitHub organization, providing standard MCP tools wrapping AWS SDKs (Boto3) for CloudWatch query operations.\n\n2. **Community `mcp-server-cloudwatch` (Python/Boto3 based)**\n   * **Best for:** Lightweight, dedicated CloudWatch deployments.\n   * **Details:** Available on GitHub/PyPI, this server specifically exposes CloudWatch tools (`get_metric_data`, `list_metrics`, `get_metric_statistics`) directly to your AI agent.\n\n### Required Prerequisites\nWhichever server you choose, deploy it with an IAM role/credentials configured with the following read-only CloudWatch permissions:\n* `cloudwatch:GetMetricData`\n* `cloudwatch:GetMetricStatistics`\n* `cloudwatch:ListMetrics`", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 30, "phrasing": "Which Model Context Protocol server is best for connecting desktop AI assistants to AWS account resources?", "text": "The best and most standard option is the official **AWS Labs MCP Server** (available via the `awslabs/mcp-server-aws` repository on GitHub) or the **AWS Cloud Control API MCP Server**.\n\n### Why it\u2019s the best choice:\n* **Official Support:** Maintained directly by AWS Labs.\n* **Broad Resource Coverage:** Uses the AWS Cloud Control API, giving your AI assistant access to manage, query, and configure hundreds of AWS resources out of the box.\n* **Seamless Authentication:** Automatically leverages your local AWS credentials (`~/.aws/credentials`, environment variables, or SSO sessions) configured via the standard AWS CLI. \n\n### Quick Setup Example (Claude Desktop)\nAdd it to your `claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws\": {\n      \"command\": \"uvx\",\n      \"args\": [\"mcp-server-aws\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"your-profile-name\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 31, "phrasing": "Top MCP servers for Amazon Web Services cloud automation and DevOps", "text": "Here are the top Model Context Protocol (MCP) servers used for AWS cloud automation, Infrastructure as Code (IaC), and DevOps workflows:\n\n### 1. Direct AWS & Infrastructure Servers\n* **AWS Core MCP Server (`mcp-server-aws`)**\n  * **Capabilities:** Executes AWS CLI commands, lists and inspects resources (EC2, S3, IAM, CloudWatch, Lambda), and queries account state directly through natural language prompts.\n* **AWS Documentation MCP Server**\n  * **Capabilities:** Pulls up-to-date AWS documentation, API reference guides, and architecture best-practice templates (Well-Architected Framework) directly into your context window.\n\n### 2. Infrastructure as Code (IaC) & Provisioning\n* **Terraform MCP Server (`mcp-server-terraform`)**\n  * **Capabilities:** Generates HCL code for AWS resources, runs `terraform plan`/`apply`, inspects state files, and troubleshoots deployment errors.\n* **CloudFormation / AWS CDK MCP Server**\n  * **Capabilities:** Generates, updates, and validates CloudFormation templates or CDK (TypeScript/Python) constructs for automated stack deployment.\n\n### 3. Kubernetes & Container Management (EKS)\n* **Kubernetes MCP Server (`mcp-server-kubernetes`)**\n  * **Capabilities:** Interacts with Amazon EKS clusters via `kubectl` to inspect pod logs, manage deployments, describe cluster resources, and troubleshoot failing containers.\n* **Docker MCP Server**\n  * **Capabilities:** Builds, tags, scans, and pushes container images directly to Amazon Elastic Container Registry (ECR).\n\n### 4. CI/CD & Pipeline Automation\n* **GitHub / GitLab MCP Servers**\n  * **Capabilities:** Triggers GitHub Actions or GitLab CI/CD pipelines targeting AWS, manages repository secrets, inspects build logs, and automates pull requests for infrastructure changes.\n\n### 5. Observability & FinOps\n* **Prometheus / Grafana / Datadog MCP Servers**\n  * **Capabilities:** Queries cloud metrics, alerts, and performance logs across your AWS environment.\n* **AWS Cost & Usage MCP Server**\n  * **Capabilities:** Queries the AWS Cost Explorer API to analyze spend, identify idle resources, and forecast infrastructure costs.\n\n---\n\n### How to Get Started\nMost of these servers can be added to your MCP-compatible client (e.g., Claude Desktop, Cursor) via their respective NPM, Python (`uvx`), or Docker packages. \n\n*Example configuration in `claude_desktop_config.json`:*\n```json\n{\n  \"mcpServers\": {\n    \"aws\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@modelcontextprotocol/server-aws\"]\n    }\n  }\n}\n```", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 32, "phrasing": "How to expose AWS infrastructure context to LLMs using an MCP server?", "text": "To expose AWS infrastructure context to an LLM using the Model Context Protocol (MCP), you create or run an **MCP server** that queries AWS APIs (via the AWS SDK) and exposes that data as MCP **Resources** (read-only data) and **Tools** (executable actions).\n\nHere is the direct approach to setting this up:\n\n---\n\n### Step 1: Choose or Build an MCP Server\n\n#### Option A: Use an Existing Open-Source AWS MCP Server (Fastest)\nSeveral community servers exist (e.g., using Node.js or Python). You can run them via `npx` or `uvx`:\n* Example: `mcp-server-aws` or AWS-specific tools for CloudWatch, S3, and EC2.\n\n#### Option B: Build a Custom Server (Python Example)\nUse the official MCP SDK and `boto3` to expose specific AWS contexts.\n\n```python\n# aws_mcp_server.py\nimport boto3\nfrom mcp.server.fastmcp import FastMCP\n\nmcp = FastMCP(\"AWS Context Provider\")\nec2 = boto3.client('ec2')\n\n# Expose as a Tool for the LLM to call dynamically\n@mcp.tool()\ndef get_running_instances() -> str:\n    \"\"\"Fetches a list of running EC2 instances and their details.\"\"\"\n    response = ec2.describe_instances(\n        Filters=[{'Name': 'instance-state-name', 'Values': ['running']}]\n    )\n    instances = []\n    for reservation in response['Reservations']:\n        for inst in reservation['Instances']:\n            instances.append(f\"ID: {inst['InstanceId']}, Type: {inst['InstanceType']}\")\n    return \"\\n\".join(instances)\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\n---\n\n### Step 2: Configure Authentication & Security\n\nEnsure the environment running the MCP server has access to AWS credentials without hardcoding them into the LLM context.\n\n1. **Least Privilege:** Attach a Read-Only IAM policy (e.g., `ReadOnlyAccess` or specific policies like `AmazonEC2ReadOnlyAccess`) to the credentials used by the MCP server.\n2. **Local Auth:** Rely on standard AWS environment variables (`AWS_PROFILE`, `AWS_REGION`) or AWS SSO.\n\n---\n\n### Step 3: Connect the MCP Server to the LLM Client\n\nAdd the MCP server configuration to your LLM interface (e.g., Claude Desktop, Cursor, or a custom app).\n\nExample configuration for **Claude Desktop** (`claude_desktop_config.json`):\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-infra\": {\n      \"command\": \"python\",\n      \"args\": [\"/path/to/aws_mcp_server.py\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"my-read-only-profile\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\n---\n\n### Key Concepts for Exposing AWS Context Effectively\n\n1. **Resources for Static Context:** Use MCP *Resources* to expose context that rarely changes during a session (e.g., active VPC IDs, CloudFormation stack outputs, architecture diagrams stored in S3).\n2. **Tools for Dynamic Queries:** Use MCP *Tools* to let the LLM fetch dynamic runtime info (e.g., recent CloudWatch logs, CPU utilization metrics, current active alarms).\n3. **Context Truncation:** Limit the payload size returned by AWS SDKs before passing it to the LLM to avoid exceeding context windows (e.g., summarize JSON responses to only return critical fields like `State`, `Tags`, and `IPs`).", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 33, "phrasing": "What MCP server enables natural language querying of AWS infrastructure status?", "text": "The primary server for this is the **AWS MCP Server** (often available as `mcp-server-aws`), which connects an LLM directly to AWS APIs and the AWS CLI to query, inspect, and manage infrastructure status using natural language.\n\nAnother popular option is the **Steampipe MCP Server**, which uses Steampipe's AWS plugin to translate natural language requests into SQL queries against live AWS infrastructure data.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 34, "phrasing": "Best enterprise-grade MCP server with role-based access control for AWS cloud resources", "text": "The best enterprise-grade approach for Model Context Protocol (MCP) with AWS cloud resources depends on whether you want a native AWS implementation or a managed agent platform:\n\n---\n\n### 1. **Best Native/Self-Hosted: AWS Cloud Control API MCP Server (with AWS IAM)**\n* **Repository:** `aws-labs/mcp-server-aws` (or `awslabs/aws-mcp`)\n* **Why it\u2019s enterprise-grade:** Backed directly by AWS, utilizing the **AWS Cloud Control API**, which covers hundreds of AWS services out of the box.\n* **How RBAC works:** It defers authorization directly to **AWS IAM** and **AWS IAM Identity Center (SSO)**. \n  * Granular, least-privilege policies are enforced via temporary AWS STS credentials (`AssumeRole`).\n  * Every AI action is audited via **AWS CloudTrail**.\n\n---\n\n### 2. **Best Managed Enterprise Platform: Kubiya.ai**\n* **Platform:** Kubiya Enterprise MCP & Agent Framework\n* **Why it\u2019s enterprise-grade:** Built specifically for DevOps, SREs, and cloud infrastructure management. It acts as an enterprise gateway for MCP.\n* **How RBAC works:**\n  * Native fine-grained Role-Based Access Control (RBAC) and Just-In-Time (JIT) access approvals.\n  * Policy-as-Code enforcement (OPA/Rego integration) before any tool call reaches your AWS environment.\n  * Full audit logs, session recording, and identity mapping (Okta, Entra ID/Azure AD).\n\n---\n\n### 3. **Best Enterprise Proxy/Gateway Layer: Custom MCP Gateway behind Cloudflare / Envoy**\nIf you are deploying open-source MCP servers in a strict enterprise architecture:\n* Deploy standard community AWS MCP servers (e.g., `@modelcontextprotocol/server-aws`) inside a container network.\n* Wrap the MCP transport layer (SSE/HTTP) with **Cloudflare Access / Enterprise API Gateway** to enforce OAuth2/OIDC RBAC before traffic hits the MCP server itself.\n\n---\n\n### Recommendation Summary\n* For **pure AWS-native security & standard IAM policies**, use the **Official AWS MCP Server** powered by AWS IAM roles.\n* For **turnkey enterprise governance, approval workflows, and multi-cloud RBAC**, choose **Kubiya.ai**.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 35, "phrasing": "Which AWS MCP server supports fine-grained IAM permission scoping for AI tools?", "text": "The official **AWS MCP Server** (and specifically implementations utilizing the **AWS Cloud Control API**) supports fine-grained IAM permission scoping for AI tools. \n\nBecause it maps MCP tool calls directly to underlying AWS APIs, it inherits AWS Identity and Access Management (IAM) controls. This allows administrators to enforce least-privilege access using standard IAM policies, roles, condition keys, and resource-level permissions to restrict exactly what actions an AI agent can execute.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 36, "phrasing": "We need an MCP server so our developer assistant can create and check AWS SQS queues. What should we use?", "text": "You have two main options depending on whether you want a pre-built solution or strict control over security and permissions:\n\n---\n\n### Option 1: Use an Existing Community AWS MCP Server\nYou can use standard community-built AWS MCP servers available via `npm` or GitHub (such as `mcp-server-aws` or `@mcp-get/aws`). \n\nThese typically leverage your local AWS CLI credentials (`~/.aws/credentials` or environment variables) and expose standard AWS actions to the assistant.\n\n---\n\n### Option 2: Build a Custom, Lightweight MCP Server (Recommended)\nBecause AWS access can be risky if over-exposed to an AI agent, the safest and cleanest approach is a simple custom MCP server using Python (`boto3` + FastMCP) or Node.js (`@aws-sdk/client-sqs` + `@modelcontextprotocol/sdk`).\n\nHere is a minimal, complete Python example using the official `mcp` SDK:\n\n#### 1. Install dependencies\n```bash\npip install mcp boto3\n```\n\n#### 2. Create `sqs_mcp.py`\n```python\nfrom mcp.server.fastmcp import FastMCP\nimport boto3\n\nmcp = FastMCP(\"AWS-SQS-Server\")\nsqs = boto3.client(\"sqs\")\n\n@mcp.tool()\ndef list_queues(prefix: str = \"\") -> list:\n    \"\"\"List AWS SQS queue URLs, optionally filtered by prefix.\"\"\"\n    response = sqs.list_queues(QueueNamePrefix=prefix)\n    return response.get(\"QueueUrlList\", [])\n\n@mcp.tool()\ndef get_queue_attributes(queue_url: str) -> dict:\n    \"\"\"Check status and metadata for a specific SQS queue.\"\"\"\n    response = sqs.get_queue_attributes(\n        QueueUrl=queue_url, \n        AttributeNames=[\"All\"]\n    )\n    return response.get(\"Attributes\", {})\n\n@mcp.tool()\ndef create_queue(queue_name: str, is_fifo: bool = False) -> str:\n    \"\"\"Create a new SQS queue and return its URL.\"\"\"\n    attributes = {}\n    if is_fifo:\n        if not queue_name.endswith(\".fifo\"):\n            queue_name += \".fifo\"\n        attributes[\"FifoQueue\"] = \"true\"\n\n    response = sqs.create_queue(\n        QueueName=queue_name,\n        Attributes=attributes\n    )\n    return response.get(\"QueueUrl\")\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\n#### 3. Add to your AI Client Config (e.g., `claude_desktop_config.json`)\n```json\n{\n  \"mcpServers\": {\n    \"sqs\": {\n      \"command\": \"python\",\n      \"args\": [\"/path/to/sqs_mcp.py\"],\n      \"env\": {\n        \"AWS_REGION\": \"us-east-1\",\n        \"AWS_PROFILE\": \"your-dev-profile\"\n      }\n    }\n  }\n}\n```\n\n### Recommendation\nIf you only need **SQS create and check operations**, **Option 2 (Custom MCP Server)** is best. It takes less than 10 minutes to set up, ensures the AI cannot perform unintended actions on other AWS services, and runs entirely using your team's existing AWS credentials.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 37, "phrasing": "What Model Context Protocol server offers the broadest coverage of AWS service APIs?", "text": "The broadest coverage of AWS service APIs is provided by **generic AWS SDK / Boto3-based MCP servers** (such as community implementations like `mcp-server-aws` or dynamic Boto3 wrappers). \n\nUnlike service-specific MCP servers (which only handle individual services like S3 or EC2), generic AWS MCP servers use dynamic tools (e.g., a universal `call_aws_api` or `execute_command` function) backed directly by the AWS SDK or Boto3. This architecture gives them near-100% coverage across all 300+ AWS services and their underlying API actions.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 38, "phrasing": "Best MCP server for connecting LLM context windows to Amazon Web Services documentation and architecture", "text": "The best options for connecting LLMs to AWS documentation and architecture via Model Context Protocol (MCP) depend on your specific setup:\n\n### 1. **`mcp-server-aws-docs` (Dedicated AWS Documentation MCP)**\n* **Best for:** Fast, accurate retrieval of official AWS Documentation, API References, and the AWS Well-Architected Framework.\n* **Why use it:** It directly queries AWS documentation sources, formatting the output specifically to fit efficiently inside an LLM context window without cluttering it with HTML.\n* **Key capabilities:** Live search of `docs.aws.amazon.com`, service limit lookups, and architecture pattern references.\n\n### 2. **`aws-mcp` / `mcp-server-aws` (AWS Environment & Architecture MCP)**\n* **Best for:** Evaluating existing AWS cloud architecture alongside documentation.\n* **Why use it:** Combines read-only access to your active AWS infrastructure (via AWS SDK/CLI) with reference lookup. This allows the LLM to analyze your real-world resource configurations against AWS best practices and architecture patterns.\n\n### 3. **`fetch` or `brave-search` MCP (Targeted to AWS Domains)**\n* **Best for:** Accessing brand-new AWS features, recent re:Invent announcements, and AWS Architecture Center blogs.\n* **Why use it:** Standard MCP search/fetch tools configured to scope queries strictly to `docs.aws.amazon.com` or `aws.amazon.com/architecture` ensure real-time, up-to-the-minute coverage without needing a specialized vector index.\n\n---\n\n### **Recommendation**\nFor purely looking up **AWS documentation and architectural patterns**, use **`mcp-server-aws-docs`**. If you want the LLM to inspect **your live architecture** and recommend fixes based on AWS docs, use an environment-aware server like **`aws-mcp`**.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 39, "phrasing": "Which MCP server allows AI chatbots to interact with AWS ECS and EKS clusters?", "text": "The **AWS MCP Server** (such as `mcp-server-aws` or AWS SDK-based MCP servers) allows AI chatbots to manage and interact with AWS services, including **ECS** and **EKS**, via the AWS API.\n\nAdditionally, for direct, in-depth management of **EKS** clusters at the Kubernetes level (pods, deployments, services), the **Kubernetes MCP Server** (`@modelcontextprotocol/server-kubernetes`) is commonly used.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 40, "phrasing": "What is the most secure MCP server implementation for Amazon Web Services APIs?", "text": "Because Model Context Protocol (MCP) is an open standard, security depends less on a single \"brand\" of server and more on **how credentials and API access are scoped**. \n\nThe most secure approach for an AWS MCP server uses **AWS Cloud Control API** integrated with **temporary AWS STS/SSO credentials** and **least-privilege IAM policies**.\n\nHere are the key implementations and architectural choices that provide the highest security:\n\n### 1. Best Implementation Pattern: AWS Cloud Control MCP Server\nAn MCP server built around the **AWS Cloud Control API** (such as standard community implementations like `mcp-server-aws` using standard AWS SDKs) is the most secure design because:\n* **Standardized API Surface:** It acts as a single, consistent interface for CRUD operations on supported AWS resources, making audit logging (via AWS CloudTrail) straightforward.\n* **Schema Validation:** AWS Cloud Control automatically validates payloads against official resource schemas before execution, preventing malformed or malicious API injections.\n\n---\n\n### 2. Core Security Requirements for any AWS MCP Implementation\n\nTo ensure your AWS MCP server setup is truly secure, it must adhere to these practices:\n\n* **Short-Lived Credentials (AWS STS / AWS IAM Identity Center):** \n  Never hardcode static AWS Access Keys (`AKIA...`) in the MCP server configuration. Instead, configure the server to use the standard AWS SDK Credential Chain (e.g., `aws sso login` or IAM roles for EC2/EKS).\n* **Granular IAM Policies (Least Privilege):** \n  Assign the MCP server an IAM role restricted strictly to read-only actions (e.g., `ReadOnlyAccess` or specific `Describe`/`List` calls) unless write capabilities are strictly required and explicitly restricted.\n* **Local or Private VPC Execution:** \n  Run the MCP server locally (via `stdio`) or inside a private AWS VPC (if using HTTP/SE) so your AWS API credentials and conversation context never cross third-party infrastructure.\n* **Human-in-the-Loop Safeguards:** \n  Configure your MCP client (e.g., Claude Desktop) to require explicit user confirmation before executing any state-changing tools (e.g., creating, updating, or deleting resources).", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 41, "phrasing": "Recommended MCP server for AI agents doing automated cloud auditing on AWS", "text": "For automated AWS cloud auditing with AI agents, the most recommended MCP servers are:\n\n### 1. **Steampipe MCP Server** (*Best for Structured Audits & Compliance*)\n* **Repository/Tool:** `turbot/steampipe` (using the Steampipe MCP plugin)\n* **Why it\u2019s best:** Steampipe translates AWS resources into queryable SQL tables. This allows AI agents to run precise, low-token SQL queries to audit infrastructure (e.g., checking for unencrypted S3 buckets, overly permissive Security Groups, or stale IAM keys) without parsing massive JSON API outputs.\n* **Key capabilities:** Supports CIS benchmarks, PCI-DSS, and 100+ AWS service tables out of the box.\n\n### 2. **AWS CLI / AWS SDK MCP Server** (*Best for Direct Resource Inspection*)\n* **Repository/Tool:** `awslabs/mcp-server-aws` (or community variants like `mcp-server-aws`)\n* **Why it\u2019s best:** Provides native wrappers around AWS SDK/Boto3 read-only calls (`Describe*`, `List*`, `Get*`). \n* **Key capabilities:** Best when your agent needs to deep-dive into specific configuration details or metadata of an individual resource discovered during an audit.\n\n### 3. **Prowler (Custom MCP Wrapper)** (*Best for Automated Security Benchmarking*)\n* **Tool:** Prowler CLI integrated via a standard Command-Line MCP runner (like `mcp-server-commander`).\n* **Why it\u2019s best:** Prowler is the industry-standard AWS security assessment tool (CIS, NIST, HIPAA). Wrapping it in an MCP server lets the agent trigger automated full-account scans and interpret the generated security findings.\n\n---\n\n### **Recommended Setup for Auditing:**\nUse **Steampipe MCP** as your primary tool for querying state and finding misconfigurations, combined with a **Read-Only IAM Role** (`SecurityAudit` + `ViewOnlyAccess`) to ensure your AI agent operates under strict least-privilege principles.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 42, "phrasing": "Which Model Context Protocol tool provides seamless integration with AWS account management?", "text": "The **AWS MCP Server** (commonly available as **`mcp-server-aws`** or via integrations using the AWS SDK / AWS Cloud Control API) provides Model Context Protocol integration for managing AWS accounts, services, and infrastructure.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 43, "phrasing": "What MCP server should DevOps teams install to give AI assistants access to AWS diagnostics?", "text": "DevOps teams should install the **AWS MCP Server** (such as the open-source `aws-mcp` or `@awslabs` MCP tools) or a dedicated **AWS CloudWatch MCP Server**. \n\nThese servers grant AI assistants read-only or administrative access to AWS APIs, allowing them to query CloudWatch logs, retrieve metrics, inspect EC2/EKS statuses, check IAM permissions, and run diagnostic commands across your AWS environment.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 0, "phrasing": "What is the best MCP server for connecting AI assistants to AWS infrastructure?", "text": "There is **no single best MCP server** for AWS infrastructure in all cases; the best choice depends on whether you want **broad AWS coverage** or a **narrow, service-specific tool**.[1][2]\n\nFor most AWS-focused teams, the strongest default starting point is the **AWS MCP Server** from **awslabs/mcp**, because AWS now offers an official open-source collection of MCP servers for AWS workflows, and AWS states that its MCP server is generally available.[5][13][16] If your use case is specifically infrastructure-as-code, AWS also has a dedicated **AWS Infrastructure as Code MCP Server** for **CDK and CloudFormation assistance**.[15]\n\nA practical recommendation:\n\n- **Best general AWS option:** **AWS MCP Server / awslabs/mcp** for broad AWS service access and official AWS-backed support.[5][13][16]\n- **Best for IaC workflows:** **AWS Infrastructure as Code MCP Server** for CloudFormation and CDK tasks.[15]\n- **Best for a single service or narrower workflow:** use a service-specific MCP server rather than a broad SDK wrapper, which is the guidance from current MCP server roundups.[1]\n\nIf you want, I can also give you a **pick-by-use-case shortlist** for EC2, S3, CloudWatch, Bedrock, and CloudFormation.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 1, "phrasing": "Best Model Context Protocol server for Amazon Web Services", "text": "The **best AWS MCP server depends on your use case**, but for most AWS users the **AWS MCP Server** is the strongest default choice because AWS itself now offers it as a generally available MCP server for interacting with AWS services and code-assistant workflows.[1][7]\n\nIf your goal is to **deploy MCP servers on AWS**, the best choice is not a single server but AWS\u2019s **official deployment guidance** for running MCP servers on ECS, Lambda, and related AWS patterns.[2][3][9][16]\n\nA practical way to choose is:\n\n| Use case | Best fit | Why |\n|---|---|---|\n| General AWS service interaction | **AWS MCP Server** | Official AWS offering, GA, designed for code assistants and AWS workflows.[1][7] |\n| Building your own MCP server on AWS | **AWS deployment guidance / AgentCore / ECS / Lambda** | AWS provides patterns and tooling for hosting MCP servers.[2][3][16][17] |\n| Open-source AWS-focused tools | **awslabs/mcp** | Collection of AWS MCP servers and examples maintained by AWS Labs.[6][8] |\n| Community-wide MCP server catalog | **modelcontextprotocol/servers** | Broad registry of MCP servers, including non-AWS options.[4] |\n\nIf you mean **\u201cbest server for managing AWS infrastructure with an AI assistant\u201d**, the **AWS MCP Server** is the most relevant answer.[1][7] If you mean **\u201cbest platform to host an MCP server on AWS\u201d**, AWS\u2019s **official guidance for ECS/Lambda/AgentCore** is the better answer.[2][3][16]\n\nIf you want, I can also narrow this down to the **best AWS MCP server for a specific task** like **CloudWatch, EC2, Bedrock, EKS, or Terraform-style infrastructure review**.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 2, "phrasing": "We want our local AI coding assistant to query AWS S3 buckets and CloudWatch logs via MCP. What server should we use?", "text": "Use **two AWS Labs MCP servers**: **`awslabs.cloudwatch-mcp-server`** for **CloudWatch logs** and **`awslabs` S3 MCP server** for **S3 buckets**.[1][2][10][11]\n\n- For **CloudWatch logs/alarms/metrics**, AWS Labs documents the **CloudWatch MCP Server** and shows it being configured as `awslabs.cloudwatch-mcp-server`.[1][2]\n- For **S3 bucket/object access**, use an **S3 MCP server** such as the AWS Labs S3 server if you want AWS-native tooling, or another S3 MCP server if you just need bucket operations.[10][11]\n- If you want a **single managed AWS-wide MCP option** instead of separate service-specific servers, AWS now offers the **AWS MCP Server** general availability, which gives agents secure access to AWS services through one fixed toolset.[3][9]\n\nIf your goal is specifically \u201c**query S3 buckets and CloudWatch logs via MCP**,\u201d the practical setup is usually:\n- **CloudWatch MCP Server** for logs\n- **S3 MCP Server** for buckets\n\nIf you want, I can also give you the exact MCP config snippets for **Claude Desktop**, **Cursor**, or **Amazon Q**.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 3, "phrasing": "Recommend an AWS MCP server for a team managing multi-region cloud resources.", "text": "For a team managing **multi-region cloud resources**, the best default choice is the **AWS MCP Server** because it provides secure, authenticated access to AWS services, supports multi-step operational tasks, and can make API calls to **any Region** while being available in **US East (N. Virginia)** and **Europe (Frankfurt)**.[2][3][6][9]\n\nIf your team also needs to **plan or validate regional expansion**, pair it with the **AWS Knowledge MCP Server**, which includes authoritative AWS docs and **regional availability of AWS APIs and CloudFormation resources**.[1][5]\n\nA practical recommendation is:\n\n- **Primary server:** **AWS MCP Server** for provisioning, troubleshooting, and day-to-day resource management across regions.[2][3][6]\n- **Add-on server:** **AWS Knowledge MCP Server** for up-to-date documentation and region-availability checks.[1][5]\n\nWhy this combination works for multi-region teams:\n- The AWS MCP Server supports real AWS operations with **IAM-based access control** and **CloudTrail audit logging**, which is useful when multiple teams or environments are involved.[3][6]\n- The AWS Knowledge MCP Server helps reduce mistakes when deciding what is available in each Region and when designing region-expansion workflows.[1][5]\n\nIf you want, I can also recommend the best setup by toolchain, for example **Cursor, Claude Desktop, Kiro, or VS Code**.[9]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 4, "phrasing": "affordable and secure MCP server for AWS resource management", "text": "The best fit is the **managed AWS MCP Server**: it is **free of charge**, hosted by AWS, and designed for **secure, authenticated, auditable** access to AWS services, so you avoid operating your own server infrastructure.[3][5][15][20]\n\nIf you want a more customizable self-hosted option, the **AWS API MCP Server** in the open-source `awslabs/mcp` project is the main alternative for broad AWS resource management with security controls and access to all AWS services.[10][12] For cheaper, narrower EC2-only management, `awslabs.ec2-mcp-server` is focused on EC2 resources and explicitly emphasizes **cost-effective KMS-encrypted key pair storage**.[2]\n\nFor **security**, AWS recommends managed remote MCP servers because they provide **automatic updates, resiliency, scalability, and CloudTrail audit logging**, and the Agent Toolkit docs note enhanced security controls via **IAM condition keys**.[20][16] The open-source Cloud Control API MCP Server also recommends **IAM least privilege**, **CloudTrail auditing**, and a **read-only mode** for safer operations.[6]\n\nFor **cost**, the managed AWS MCP Server has **no additional charge**; you only pay for AWS resources your agents use.[3][5][7] If you self-host a secure remote MCP deployment, the AWS guidance shows the default setup can run around **$194.18/month** in us-east-1, so it is not the most affordable option unless you specifically need that architecture.[9]\n\nIf you want the simplest recommendation:\n- **Best overall:** **AWS MCP Server** for secure, low-maintenance AWS resource management.[3][16][20]\n- **Best open-source general-purpose alternative:** **AWS API MCP Server** from `awslabs/mcp`.[10][12]\n- **Best low-scope/low-cost option:** **`awslabs.ec2-mcp-server`** for EC2-focused workflows.[2]\n\nIf you want, I can also compare these three by **setup effort, security model, and cost** in a short table.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 5, "phrasing": "What MCP server do cloud engineers actually use to let LLMs read AWS configuration?", "text": "Cloud engineers usually mean the **AWS MCP Server**\u2014the managed remote MCP server AWS now recommends for giving LLMs and coding agents access to AWS services and documentation.[1][13] It is the current replacement if you were using the older **AWS API MCP Server** or **AWS Knowledge MCP Server**.[1]\n\nIf your goal is specifically to let an LLM **read AWS configuration / inspect AWS state**, the usual setup is the **AWS MCP Server** with a **proxy** when you need to bridge local AWS credentials into the server\u2019s OAuth-based flow.[9] AWS says that to use local AWS credentials over MCP, you can configure the agent to call the AWS MCP Server through the open-source **MCP Proxy for AWS**.[9]\n\nThere is also a different option, the **AWS Cloud Control API MCP Server**, which is aimed more at **infrastructure CRUDL** operations\u2014create, read, update, delete, and list resources\u2014rather than general AWS service access.[3] So for \u201cread AWS configuration,\u201d the most accurate answer is usually **AWS MCP Server**; for \u201cmanage infrastructure resources via natural language,\u201d the **Cloud Control API MCP Server** may be the better fit.[1][3]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 6, "phrasing": "Best MCP server to connect AI agents to Amazon Web Services data stores", "text": "For **Amazon Web Services data stores**, the best default choice is the **AWS MCP Servers** suite from AWS Labs, because it is the official open-source set of MCP servers for AWS and includes tools for AWS services such as database-related workflows, Bedrock knowledge bases, cost analysis, Lambda, and ECS.[1][6][8]\n\nIf your goal is specifically **AWS database/data-store work**, the most relevant companion is the **AWS Data Processing MCP Server**, which AWS highlights for accelerating development and querying in data-processing workflows.[11] For broader AWS service access, the AWS MCP Server was also announced as generally available, which makes it the strongest \u201cofficial\u201d option to start with.[5]\n\nA practical way to choose:\n\n- **Best overall for AWS data stores and AWS-native workflows:** **AWS MCP Servers** from AWS Labs.[1][6][8]\n- **Best for data-processing-oriented tasks:** **AWS Data Processing MCP Server**.[11]\n- **Best if you only want database connectivity across many systems, not AWS-specific tooling:** consider a dedicated database MCP server instead, but that is less AWS-native.[12]\n\nIf you want, I can narrow this down further by your exact data store, such as **Aurora**, **RDS**, **DynamoDB**, **Redshift**, or **S3**.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 7, "phrasing": "Which MCP server allows LLMs to query AWS DynamoDB and S3 safely?", "text": "The **AWS MCP Server** is the official managed MCP server that lets LLMs access AWS services, including **DynamoDB** and **S3**, through a small fixed set of tools and the caller\u2019s IAM credentials.[2][18]\n\nIf you mean the **safest** option, AWS recommends using the **AWS MCP Server** with least-privilege IAM, read-only defaults where possible, and session-level restrictions such as inline session policies or service-specific conditions for S3 and DynamoDB access.[1][3][4]\n\nA related distinction:\n- **AWS MCP Server**: official, managed, secure access to AWS APIs.[2]\n- **Amazon DynamoDB MCP Server**: focused specifically on DynamoDB.[9]\n- **S3 Tables MCP Server**: focused on S3 Tables, not general S3 objects.[10][13]\n\nIf you want, I can also tell you which MCP server to use for **read-only querying only** versus **read/write access**.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 8, "phrasing": "We are building an AI dev tool that needs read-only access to AWS architecture via MCP. What MCP server implementation is best?", "text": "For **read-only access to AWS architecture**, the best default choice is the **managed AWS MCP Server** from AWS, because it is now generally available, gives secure authenticated access to AWS services through a small fixed set of tools, and can be constrained to **read-only** behavior with IAM or SCPs rather than by trusting the server alone.[12][18]\n\nIf your goal is specifically to *inspect and explain AWS infrastructure* rather than manage a single service, AWS\u2019s own guidance also points to **pre-existing MCP servers being sufficient in many cases**, and it highlights the AWS MCP Server as the managed remote option for AWS service access.[2] For a server you host yourself, AWS\u2019s **Guidance for Deploying MCP Servers on AWS** is the most standards-based approach: it shows how to run MCP servers on AWS with OAuth 2.0 security controls and the 2025-06-18 MCP spec.[1][13]\n\nA practical recommendation is:\n\n- **Use AWS MCP Server** if you want the safest, lowest-ops, AWS-native option for read-only cloud inspection.[12][18]\n- **Use a self-hosted MCP server on AWS** only if you need custom tools, custom auth, or tighter internal integration than the managed server provides.[1][13]\n- **Use the AWS Serverless MCP Server** if your use case is specifically serverless/application development; it defaults to read-only mode and is designed around safe development workflows, but it is narrower in scope than the general AWS MCP Server.[7][9]\n\nFor your exact requirement\u2014an AI dev tool needing **read-only access to AWS architecture via MCP**\u2014I would choose the **AWS MCP Server** first, and enforce read-only access with IAM/SCP guardrails.[12][18] If you need to expose additional organization-specific inventory or policy data that AWS\u2019s managed tools do not cover, then add a **custom self-hosted MCP server** alongside it rather than replacing it.[1][13]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 9, "phrasing": "Top open source MCP servers for AWS integration", "text": "If you want the **best open-source MCP servers for AWS integration**, the strongest starting point is **AWS Labs\u2019 `awslabs/mcp`** project, which is the official open-source collection of MCP servers for AWS services and resources.[1][3] It is also the most comprehensive AWS-specific option in the results, covering multiple AWS domains rather than just a single service.[8][11]\n\nThe top AWS-focused open-source options shown in the results are:\n\n- **`awslabs/mcp`** \u2014 Official AWS Labs collection of MCP servers for AWS; described as \u201cOpen source MCP Servers for AWS\u201d and includes multiple specialized servers such as IAM, DynamoDB, SageMaker AI, OpenSearch, Aurora, and Data Processing.[1][3][8]\n- **`alexei-led/aws-mcp-server` / `aws-mcp-server`** \u2014 A lightweight community MCP server that lets AI assistants execute AWS CLI commands, use Unix pipes, and apply prompt templates for AWS tasks.[4][7]\n- **AWS Serverless MCP Server** \u2014 An AWS open-source server aimed at serverless workflows and development for modern applications.[15]\n- **AWS Data Processing MCP Server** \u2014 An AWS open-source server for analytics and data-processing workflows across Glue, EMR-EC2, and Athena.[14]\n- **AWS API MCP Server** \u2014 An open-source server for natural-language interaction with AWS APIs.[17]\n\nIf you want the most practical choice by use case:\n\n| Use case | Best pick | Why |\n|---|---|---|\n| Broad AWS service integration | **`awslabs/mcp`** | Official AWS Labs suite with multiple specialized servers.[1][8] |\n| CLI-style automation | **`aws-mcp-server`** | Designed around AWS CLI execution and shell-like workflows.[4][7] |\n| Serverless development | **AWS Serverless MCP Server** | Focused on Lambda/serverless workflows.[15] |\n| Data/analytics workflows | **AWS Data Processing MCP Server** | Built for Glue, EMR, and Athena.[14] |\n| Direct API interaction | **AWS API MCP Server** | Open-source natural-language access to AWS APIs.[17] |\n\nA notable point is that AWS also offers a **managed remote AWS MCP Server** that is now generally available, but that is **not** open source; it is a hosted service, so it is different from the open-source servers you asked for.[12]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 10, "phrasing": "Which Model Context Protocol server works best for Amazon Bedrock LLMs?", "text": "For **Amazon Bedrock LLMs**, the best MCP server is usually **the one closest to your use case**, not a single universal winner. AWS\u2019s own guidance emphasizes selecting the appropriate MCP server for your data source or task, and Bedrock supports multiple MCP server patterns rather than one default server for all workloads.[5][3]\n\nIf you mean the **best AWS-supported options**, these are the strongest choices depending on the job:\n\n- **Amazon Bedrock Knowledge Bases Retrieval MCP Server** for enterprise document and knowledge-base Q&A with citations.[4][10]\n- **AWS Documentation / AWS Knowledge MCP servers** for AWS-product and infrastructure questions.[8][10]\n- **AWS Bedrock Data Automation MCP Server** for document, image, video, and audio analysis.[10]\n- **Amazon Bedrock Custom Model Import MCP Server** if your workflow is centered on managing custom models and on-demand inference.[4]\n- **A custom MCP server on AgentCore Runtime** if you need your own tools, APIs, or business systems exposed to Bedrock models.[7][14][19]\n\nIf your question is specifically about **deployment reliability and compatibility**, AWS Bedrock AgentCore Runtime is the most clearly documented hosting option for MCP servers because it supports MCP over **Streamable HTTP** and expects servers at `0.0.0.0:8000/mcp` with `stateless_http=True` for scalability.[14][19]\n\nSo the practical answer is:\n- **Best for enterprise knowledge:** Bedrock Knowledge Bases Retrieval MCP Server.[4][10]\n- **Best for AWS docs / AWS ops:** AWS Documentation / AWS Knowledge MCP server.[8][10]\n- **Best overall for custom Bedrock apps:** a **custom MCP server on AgentCore Runtime**.[7][14][19]\n\nIf you want, I can narrow this down to the **best MCP server for your exact Bedrock use case**\u2014for example, RAG, code assistants, AWS support, or tool automation.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 11, "phrasing": "How to connect an LLM assistant to AWS cloud resources using MCP?", "text": "To connect an **LLM assistant** to AWS cloud resources using **MCP (Model Context Protocol)**, you typically install an AWS MCP server, configure your AI client to load it, and provide AWS credentials with the right permissions so the server can call AWS APIs on your behalf.[1][3][5]\n\nA practical setup looks like this:\n\n- **Pick an MCP-compatible assistant** such as Claude for Desktop, Amazon Q CLI, Cursor, or Cline.[3][5]\n- **Choose an AWS MCP server** for the capability you need, for example:\n  - **AWS Cloud Control API MCP Server** for creating and managing many AWS resources through natural language.[2][8]\n  - **AWS Knowledge MCP Server** for AWS documentation and guidance.[1][17]\n  - **AWS Lambda Tool MCP Server** for invoking Lambda functions as tools.[7]\n- **Install the server** using the method documented for that server, often via `uvx`/Python packaging for AWS Labs servers or another package/runtime depending on the project.[3][6][7]\n- **Add the server to your client\u2019s MCP config**, usually in an `mcp.json` or client-specific config file, with the server command, args, and environment variables.[3][18]\n- **Set AWS credentials and permissions** so the MCP server can access the intended services securely.[3][6][12]\n- **Restart the assistant**, confirm the server loaded, and then ask a task-oriented prompt such as creating an S3 bucket or querying AWS docs.[2][12]\n\nOne common example from AWS Labs uses an MCP client config like this conceptually:\n\n```json\n{\n  \"mcpServers\": {\n    \"awslabs-core-mcp-server\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.core-mcp-server@latest\"],\n      \"env\": {\n        \"FASTMCP_LOG_LEVEL\": \"ERROR\",\n        \"MCP_SETTINGS_PATH\": \"path to your mcp server settings\"\n      }\n    }\n  }\n}\n```\n\nAWS then recommends starting the client, letting it initialize the MCP servers, and testing with a natural-language request such as: **\u201cCreate an S3 bucket with versioning and encrypt it using a new KMS key.\u201d**[2][3]\n\nIf you want, I can give you a **step-by-step setup for a specific assistant** like Claude Desktop, Amazon Q CLI, or Cursor.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 12, "phrasing": "What is the most reliable MCP server for inspecting AWS IAM roles and Security Groups?", "text": "For **inspecting AWS IAM roles and Security Groups**, the most reliable choice is the **AWS-managed MCP Server** family, using the dedicated **AWS IAM MCP Server** for IAM role inspection and the AWS-managed AWS API/MCP access for Security Group inspection through AWS APIs.[4][9][17]\n\nWhy this is the best fit:\n\n- The **AWS IAM MCP Server** is explicitly described by AWS Labs as a Model Context Protocol server for **comprehensive IAM operations**, including listing IAM roles and related IAM tasks.[4]\n- AWS\u2019s managed MCP approach is designed to inherit standard **IAM controls**, use existing AWS authorization, and support **CloudTrail auditing**, which makes it more reliable for security-sensitive inspection than ad hoc or community-hosted servers.[9][14][19]\n- AWS\u2019s security guidance emphasizes using **AWS-managed MCP** when possible because authorization can be enforced with AWS IAM conditions such as `aws:ViaAWSMCPService` and `aws:CalledViaAWSMCP`, reducing configuration drift and server-side trust issues.[2]\n\nIf you want the most practical answer by task:\n\n- **IAM roles:** use the **AWS IAM MCP Server**.[4]\n- **Security Groups:** use an **AWS-managed MCP Server** that can call AWS APIs for EC2/VPC inspection, since Security Groups are part of broader AWS resource metadata rather than IAM itself.[9][18]\n\nIf you meant **\u201cmost reliable\u201d** in the sense of **best audited and least operational risk**, AWS-managed is the strongest recommendation because it centralizes authn/authz in AWS rather than in a self-managed MCP host.[2][9][14]\n\nIf you want, I can also recommend the **exact MCP server setup** for:\n- **read-only inspection**\n- **Claude Code / Cursor**\n- **enterprise least-privilege AWS access**", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 13, "phrasing": "Best MCP server for querying CloudWatch logs with natural language", "text": "The **best choice** is the **AWS Labs CloudWatch MCP Server / Log Analyzer with MCP**, because it is the official AWS-backed option and is explicitly designed to let AI assistants query **CloudWatch Logs** for analysis, searching, correlation, and natural-language workflows.[2][7][11]\n\nIf your main goal is *natural-language querying of logs*, this server is the strongest fit because it can run **Logs Insights** queries across multiple log groups and regions in one call, while handling chunking, throttling, polling, retries, and large result sets automatically.[7] The AWS blog introducing the CloudWatch MCP servers also frames them as tools for AIOps and operational investigation, which matches the use case you described.[2]\n\nA quick comparison:\n\n| Option | Best for | Notes |\n|---|---|---|\n| **AWS Labs CloudWatch MCP Server** | **General best / production-oriented** | Official AWS source; built for CloudWatch Logs analysis and correlation.[2][7][11] |\n| **Log Analyzer with MCP** | **Natural-language log investigation** | AWS Labs project focused on letting AI assistants analyze CloudWatch logs.[11] |\n| **Community CloudWatch MCP servers** | Lightweight or custom needs | Useful, but less authoritative than AWS Labs.[4][15] |\n\nIf you want the safest default for \u201cquery CloudWatch logs with natural language,\u201d pick **AWS Labs CloudWatch MCP Server**.[7][11] If you want, I can also recommend the **best setup for Claude Code, Kiro, or Cursor** specifically.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 14, "phrasing": "We need an MCP server that lets developers ask an AI agent about active AWS EC2 instances. What options exist?", "text": "If your goal is **\u201cask an AI agent about active AWS EC2 instances\u201d**, there are a few MCP options, but the most direct ones are the **EC2-focused servers** that expose instance-listing and instance-detail tools.[2][3][7][10]\n\n| Option | What it does | Best fit |\n|---|---|---|\n| **AWS EC2 Instance MCP Server** | Returns running EC2 instance information for a specified region, including instance ID, type, IP address, and status.[2] | Simple \u201cwhat EC2 instances are active?\u201d use cases |\n| **AWS Instances MCP** | Lists running EC2 instances in a region via AWS SDK and exposes details like instance ID, type, public/private IPs, and state.[3] | General-purpose instance inventory for AI assistants |\n| **awslabs.ec2-mcp-server** | Open-source AWS Labs server with tools such as `list_instances` and `get_instance_details`, including filtering and security/networking details.[7][8] | More feature-rich EC2 inspection |\n| **aws-mcp-server (community)** | Includes an `aws_ec2_list_instances` tool with filters like `instance-state-name=running`.[10] | Lightweight, custom MCP integration |\n| **DataFaucet EC2 MCP** | Lets an AI agent check EC2 status, CPU/network metrics, running instances by tag, and security group config through MCP tools.[5] | If you also want monitoring/health context, not just inventory |\n\nA few broader AWS MCP options can also help, but they are less EC2-specific. The **AWS API MCP Server** lets agents interact with AWS services through AWS CLI commands, including instance management workflows, and can be run locally, on ECS/EKS, or via AWS Marketplace/AgentCore depending on the implementation path.[12][13][16] The managed **AWS MCP Server** from AWS is a general server that gives agents access to AWS through MCP, and AWS documents it as integrated with documentation/search and monitoring/CloudTrail capabilities.[18][11][1]\n\nIf you want the **fastest path for EC2 instance questions**, I\u2019d shortlist:\n- **AWS EC2 Instance MCP Server** for the simplest \u201clist running instances\u201d setup.[2]\n- **awslabs.ec2-mcp-server** if you want richer instance metadata and filtering.[7][8]\n- **AWS API MCP Server** if you want a broader AWS natural-language command surface beyond EC2.[12][16]\n\nIf you want, I can also narrow this down by **deployment style**:\n- **local MCP server**\n- **remote hosted MCP server**\n- **AWS-managed / AWS-native option**", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 15, "phrasing": "Which MCP server provides secure Amazon Web Services connector tools for AI models?", "text": "The **AWS MCP Server** provides secure Amazon Web Services connector tools for AI models.[1][10][16]\n\nIt is a managed remote Model Context Protocol server that gives AI agents and coding assistants **secure, authenticated access** to AWS services through a small set of tools, including `call_aws` for AWS API operations and `run_script` for sandboxed Python execution.[1][16]\n\nAWS also describes it as **secure, auditable** and notes that it uses **IAM-based guardrails** and **CloudTrail logging** for visibility and control.[3][10]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 16, "phrasing": "Best production-ready MCP server for AWS API interactions", "text": "For **production-ready AWS API interactions**, the best default choice is the **AWS API MCP Server** from AWS/awslabs, because AWS now publishes it as an official open-source MCP server and has also released a **v1.0.0** version of it. [2][16][9]\n\nIf your use case is broader than raw API calls, the right AWS MCP server depends on the task:\n\n| Use case | Best fit | Why |\n|---|---|---|\n| **Direct AWS API interactions** | **AWS API MCP Server** | Official AWS server for API-level assistant access, with a production release available. [16][9] |\n| **Infrastructure review/explanation** | **AWS Cloud Control API MCP Server** | Better aligned to infrastructure-oriented operations via Cloud Control API. [18] |\n| **General AWS developer workflow** | **awslabs/open source MCP servers for AWS** | AWS maintains a catalog of servers for different workflows. [2][5][6] |\n\nFor a **production deployment**, AWS\u2019s own guidance emphasizes that \u201cproduction-ready\u201d is not just the MCP server choice, but also the runtime and controls around it: use **AgentCore Gateway** for API management and access controls, **strip JWTs to least-privilege claims**, configure **stateless HTTP** for horizontal scaling, and deploy with **IaC** such as CDK or Terraform. [8]\n\nSo the practical recommendation is:\n\n- Choose **AWS API MCP Server** if you want the most directly production-ready option for AWS API interactions. [16][9]\n- Pair it with **AgentCore Gateway/Runtime** and production operations controls if you need an actual enterprise deployment. [8]\n- Use **Cloud Control API MCP Server** instead if your primary goal is natural-language infrastructure management rather than general AWS API usage. [18]\n\nIf you want, I can also give you a **short list of the exact AWS MCP server names and when to use each**.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 17, "phrasing": "We are an enterprise cloud platform team looking for a compliant AWS MCP server for internal AI tools. What should we evaluate?", "text": "For an **enterprise-compliant AWS MCP server**, evaluate it on **identity/authentication, authorization granularity, network isolation, auditability, and compliance scope**. AWS\u2019s managed MCP server uses **IAM** and **SigV4**, and AWS recommends checking whether the underlying AWS service is in scope for the compliance program you need, including third-party audit reports in AWS Artifact.[3][1][5]\n\nKey things to evaluate:\n\n- **Compliance scope of the service itself**  \n  Verify that the AWS service you plan to use is covered by the specific compliance program you care about, rather than assuming \u201cAWS-managed\u201d automatically means compliant for your use case.[1][5]\n\n- **Authentication model**  \n  Prefer a server that supports **strong, enterprise identity integration** such as AWS IAM/SigV4 or standards-based OAuth 2.0, depending on the deployment pattern.[3][7][15]\n\n- **Authorization granularity**  \n  Check whether you can enforce **least privilege** with fine-grained IAM policies, Service Control Policies, and context-aware conditions so AI agents are separated from human users.[3][16]\n\n- **Human-vs-agent separation**  \n  Make sure the platform can distinguish direct human actions from MCP-mediated actions using controls such as the AWS MCP context keys **`aws:ViaAWSMCPService`** and **`aws:CalledViaAWSMCP`**.[16]\n\n- **Network controls**  \n  Evaluate whether the server can run in a **private, hardened environment** such as VPCs, private subnets, containerized platforms, or sidecar patterns, with TLS enforced end to end.[2][16][9]\n\n- **Credential handling**  \n  Avoid designs that rely on **long-lived secrets**; prefer **short-lived credentials**, STS assume-role flows, or identity brokers so blast radius stays small.[2][18]\n\n- **Audit logging and monitoring**  \n  Confirm you can get **separate logs and metrics** for MCP-mediated calls, including CloudTrail visibility and CloudWatch metrics under the `AWS-MCP` namespace.[3][16]\n\n- **Transport and protocol support**  \n  If you are connecting third-party or remote MCP servers, verify support for the **Streamable HTTP transport protocol** and the required authentication method for your client ecosystem.[7]\n\n- **Data handling and tool scope**  \n  Review which tools are exposed, whether they are read-only or mutating, and whether input/output filtering or content controls are available before data access is granted.[3][2]\n\n- **Operational hardening**  \n  Prefer deployments on hardened runtimes such as **Amazon ECS** or equivalent container platforms, with centralized governance, immutable logs, and restricted egress.[2][9]\n\nA practical enterprise checklist is:\n\n- Can we prove the service is in-scope for our compliance program?[1][5]\n- Can we enforce least privilege per agent, tool, and environment?[3][16]\n- Can we isolate the server in our network and avoid static secrets?[2][18]\n- Can we audit every agent action separately from human activity?[3][16]\n- Can we limit the server to the minimal toolset required?[3][11]\n\nIf you want, I can turn this into a **vendor evaluation rubric** with columns for **security, compliance, operations, and cost**.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 18, "phrasing": "Which MCP server gives AI coding assistants real-time context on AWS cloud infrastructure?", "text": "The **AWS MCP Server** is the one that gives AI agents and coding assistants secure, authenticated, *real-time* access to AWS services through a managed remote Model Context Protocol server.[3][13]\n\nIf you mean a server focused specifically on infrastructure visibility, AWS also has specialized MCP servers such as:\n- **AWS Infrastructure as Code MCP Server** for CloudFormation and CDK workflows.[7]\n- **Amazon ECS MCP server** for real-time contextual knowledge of ECS workloads.[6]\n- **Amazon EKS MCP server** for up-to-date contextual information on EKS clusters.[14]\n\nIf you want, I can also tell you which AWS MCP server is best for **CDK/CloudFormation**, **containers**, or **general AWS service access**.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 19, "phrasing": "What MCP server should I use to let AI models run AWS CLI commands safely?", "text": "For **safe AWS CLI execution**, the best fit is **AWS API MCP Server** from AWS itself, because it is a managed MCP server with authenticated access, IAM-based controls, and explicit security guidance about least privilege and prompt-injection risk.[13][4]\n\nIf you specifically want a server that **wraps the AWS CLI** rather than calling AWS APIs more directly, the strongest open-source option in your results is **`aws-mcp-server`** by `alexei-led`, which validates AWS CLI syntax and includes security-focused command filtering for dangerous commands and pipe usage.[1]  \n\nA practical choice depends on your setup:\n\n- Use **AWS API MCP Server** if you want the most authoritative, AWS-supported, production-oriented option with managed access and IAM integration.[13][12]\n- Use **`aws-mcp-server`** if you want a local/open-source MCP server that explicitly filters and validates AWS CLI commands before execution.[1]\n- Use **`use_aws_mcp`** if you want a standalone MCP server that supports AWS CLI workflow and distinguishes read-only versus write operations, but it still requires careful IAM scoping and review.[3]\n\nIf your main requirement is *\u201clet AI models run AWS CLI commands safely\u201d*, I would choose **AWS API MCP Server** first, and **`aws-mcp-server`** as the best self-hosted fallback.[13][1][4]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 20, "phrasing": "Model Context Protocol server for querying AWS Cost Explorer and billing via AI", "text": "A practical way to build this is to use an **MCP server** that wraps the AWS **Cost Explorer API** and exposes a few AI-friendly tools such as `get_cost_and_usage`, `get_dimension_values`, and `get_tags`.[1][5] AWS explicitly supports programmatic querying of cost and usage data through Cost Explorer, including aggregated and granular views, and requires explicit IAM permission to use the API.[1][6]\n\nA solid design would look like this:\n\n- **MCP server layer**: translates natural-language requests into structured Cost Explorer API calls.\n- **AWS client layer**: uses the `ce` client (`boto3.client(\"ce\")` in Python or equivalent SDKs) to call `GetCostAndUsage` and related operations.[5][7]\n- **AI orchestration layer**: lets the model choose filters, time ranges, grouping dimensions, and metrics, then formats the response for the user.[5][7]\n\nUseful AWS Cost Explorer capabilities to expose as tools:\n- **GetCostAndUsage** for cost and usage by day or month, with filtering and grouping.[5][13]\n- **GetDimensionValues** to help the AI discover valid filter values like linked accounts, services, or usage types.[5][13]\n- **GetTags** to support tag-based chargeback or showback queries.[5][13]\n- **GetReservationUtilization** if you want reserved-instance utilization insights.[5][13]\n\nKey implementation details:\n- **Permissions**: the calling identity must have explicit access to query Cost Explorer.[1][6]\n- **Endpoint**: Cost Explorer uses the `ce.us-east-1.amazonaws.com` endpoint.[1][4]\n- **Query hygiene**: AWS recommends filtering queries to return only the data needed.[6]\n- **Cost**: AWS announced the API was priced at **$0.01 per call** when introduced.[5][13]\n\nIf you want, I can next provide either:\n- a **reference MCP server architecture**,\n- a **Python MCP server example** for AWS Cost Explorer,\n- or a **tool schema** for cost, budget, and billing questions.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 21, "phrasing": "What is the standard MCP server for Amazon Web Services integrations?", "text": "The **standard MCP server for AWS integrations** is the **AWS MCP Server**, a managed remote Model Context Protocol server that gives AI agents and coding assistants authenticated access to AWS services through a small, fixed set of tools.[9]\n\nAWS also publishes **open-source MCP servers for specific AWS use cases** under the *awslabs/mcp* project, but the general-purpose, official server referred to as the standard one is the **AWS MCP Server**.[2][9]\n\nIf you meant a server for a specific AWS product area, AWS has specialized MCP servers too, such as the **AWS Cloud Control API MCP Server** for infrastructure management and the **AWS Serverless MCP Server** for serverless development.[12][13]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 22, "phrasing": "Recommended MCP server for connecting AI agents to AWS Lambda and API Gateway", "text": "If you want the **most practical AWS-native MCP server setup** for connecting AI agents to **AWS Lambda and API Gateway**, the strongest recommendation is **AWS\u2019s Lambda Tool MCP Server** when you want agents to invoke existing Lambda functions without code changes, and **a remote MCP server on Lambda + API Gateway** when you want a custom MCP endpoint. AWS explicitly says the Lambda Tool MCP Server lets AI models directly interact with existing Lambda functions as MCP tools, while sample implementations from AWS and others show stateless MCP servers running natively on Lambda with API Gateway[8][17][18].\n\nIf your requirement is specifically **\u201cconnect AI agents to AWS Lambda and API Gateway\u201d**, the best fit depends on the use case:\n\n- **Use AWS Lambda Tool MCP Server** if you already have Lambda functions and want to expose them as tools quickly with minimal plumbing.[8]\n- **Use a custom remote MCP server on Lambda + API Gateway** if you need your own MCP server, custom routes, or a Streamable HTTP / remote MCP endpoint.[18][20][10]\n- **Use Lambda Function URL instead of API Gateway** if the MCP traffic needs **streaming** or progressive chunked responses, because API Gateway buffers Lambda responses and does not forward chunked transfer encoding for streaming MCP traffic.[5]\n- **Use API Gateway** if you need **OAuth, per-consumer rate limiting, WAF, or a custom domain** in front of the MCP server.[2]\n\nA concise rule from the AWS-focused guidance is:\n\n- **Inside a single AWS trust boundary:** Lambda Function URL with AWS_IAM is often the best default for stateless MCP servers.[2]\n- **Exposed externally or needing API management features:** Lambda + API Gateway is the better front door.[2]\n- **Need streaming:** prefer Lambda Function URL over API Gateway.[5]\n\nSo, if you want one recommendation: **start with AWS Lambda Tool MCP Server for direct Lambda access; if you need a full remote MCP server, deploy it on Lambda behind API Gateway, unless you require streaming, in which case use a Lambda Function URL instead.**[8][2][5]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 23, "phrasing": "Best MCP server for letting an LLM query Amazon RDS databases", "text": "The best **AWS-native** MCP server depends on what you mean by \u201cquery Amazon RDS,\u201d but for **natural-language querying of data in Amazon RDS PostgreSQL**, the strongest fit in the results is the **Amazon Aurora Postgres MCP Server** because it is explicitly designed for \u201cnatural language to Postgres SQL query\u201d and executing those queries against an Aurora Postgres database.[1]\n\nIf your RDS engine is different, AWS Labs also publishes engine-specific options on its MCP servers page, including **Amazon RDS SQL Server MCP Server** and **Amazon Aurora MySQL MCP Server** for SQL Server and MySQL workloads on RDS/Aurora respectively.[7][13] The AWS blog and AWS Labs pages indicate these are part of AWS\u2019s official MCP server offerings for database development and operations.[17][7]\n\nFor **database administration and monitoring** rather than just SQL querying, the **AWS RDS MCP Server / RDS Management MCP Server** is the more appropriate choice because it is described as enabling AI assistants to **manage and monitor Amazon RDS databases** through natural language.[3][10]\n\nA practical way to choose is:\n\n| Use case | Best fit |\n|---|---|\n| Ask questions and get SQL back from an **Aurora PostgreSQL** database | **Amazon Aurora Postgres MCP Server**[1] |\n| Query an **Aurora MySQL** or **RDS MySQL** database | **Amazon Aurora MySQL MCP Server**[7][13] |\n| Query an **RDS SQL Server** database | **Amazon RDS SQL Server MCP Server**[7] |\n| Manage, inspect, or monitor **RDS resources** | **AWS RDS MCP / RDS Management MCP Server**[3][10] |\n\nIf you want one recommendation without more constraints: **use the AWS Labs engine-specific database MCP server that matches your RDS engine, and use the RDS Management MCP server only for operational tasks**.[1][3][7]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 24, "phrasing": "We need an MCP server to let our AI assistant analyze AWS CloudTrail logs. What server works best?", "text": "For **AWS CloudTrail log analysis**, the best fit is the **AWS CloudTrail MCP Server** from **AWS Labs**.[2][5] It is purpose-built for **AWS API activity, user/resource analysis, security investigation, and compliance workflows** using CloudTrail logs.[2][5]\n\nWhy it\u2019s the best choice:\n- It gives direct access to **CloudTrail events** and **CloudTrail Lake analytics**.[2][6]\n- It supports searching **90 days of management event history** and running **Trino SQL queries** on CloudTrail Lake data spanning **up to 10 years**.[2][6]\n- AWS positions it specifically for **security and compliance analysis** through natural-language interactions with AI agents.[2][6]\n\nWhen you might choose something else:\n- If you want broader **security-service analytics** beyond CloudTrail, the **AWS Security MCP Server** can analyze CloudTrail plus other logs with **Athena**.[4]\n- If you mainly need **operations monitoring** and log analysis rather than audit trails, **Amazon CloudWatch MCP Server** is better suited.[17][19]\n\nSo, if your goal is to let an AI assistant **analyze CloudTrail logs**, start with the **AWS CloudTrail MCP Server**.[2][5]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 25, "phrasing": "Which MCP server bridges local AI clients with AWS cloud management APIs?", "text": "The **AWS API MCP Server** is the MCP server that bridges local AI clients with AWS cloud management APIs.[7][8]\n\nIf you mean the AWS server that lets MCP clients call AWS services and resources through AWS CLI/API operations, AWS describes the **AWS API MCP Server** as enabling AI assistants to interact with AWS services through AWS CLI commands and to bridge AI assistants with AWS services and resources.[7][8] The older **AWS Cloud Control API MCP Server** is more specific to infrastructure/resource CRUDL via the Cloud Control API, but AWS now labels it deprecated in favor of the newer AWS IAC MCP Server.[2]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 26, "phrasing": "Most active open source MCP server project for Amazon Web Services", "text": "The **most active open source MCP server project for AWS** appears to be **`awslabs/mcp`** from AWS Labs, which is the umbrella repository for \u201cOpen source MCP Servers for AWS.\u201d It is the central project AWS points to for its MCP server suite, and AWS\u2019s own open-source page describes this as a suite of specialized MCP servers for AWS use cases.[1][6][8]\n\nIf you mean *activity* in the sense of **ongoing AWS-led development across multiple servers**, `awslabs/mcp` is the best-supported answer from the sources provided because it is the main repository and documentation hub for the AWS MCP server family.[1][8][10]\n\nIf you mean **most popular by community usage or stars**, the provided results do **not** show a definitive, up-to-date ranking across all AWS MCP server projects, so I can\u2019t verify a single winner from these sources alone.[13][15][20]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 27, "phrasing": "What MCP server allows AI agents to inspect and modify AWS S3 bucket policies?", "text": "The MCP server most directly matching your query is **AWS S3 MCP Server** by `gangadharrr`, which exposes **`get_bucket_policy`** and **`set_bucket_policy`** tools so AI agents can inspect and modify S3 bucket policies.[4][6]\n\nA second matching option is **AWS S3 | Awesome MCP Servers** by `ashgw`, which also supports **get**, **set**, and **delete bucket policy** operations.[5]\n\nIf you mean the AWS-provided MCP offering for S3 data access rather than a community server, the **AWS MCP Server** permission model can let agents inspect resources while blocking destructive actions, but the search results here specifically show that for S3 bucket policies, the community S3 MCP servers above provide the direct policy-management tools.[2][4][5]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 28, "phrasing": "Best lightweight MCP server for AWS developer tooling", "text": "For **lightweight AWS developer tooling**, the best fit in AWS\u2019s own MCP catalog is usually the **AWS Knowledge MCP Server** if you want fast, low-overhead access to AWS docs and guidance, or the **AWS Cloud Control API MCP Server** if you need lightweight infrastructure operations through a small, focused tool surface.[16][18]\n\nAWS\u2019s MCP servers are explicitly described as **lightweight programs** that expose specific capabilities via Model Context Protocol, which makes them a good match when you want narrower scope and less operational complexity than a broad agent or monolithic integration.[6]\n\nA practical ranking for \u201clightweight\u201d AWS developer tooling is:\n\n- **AWS Knowledge MCP Server** \u2014 best for answering AWS service questions, surfacing documentation, and reducing context-switching while coding.[16]\n- **AWS Cloud Control API MCP Server** \u2014 best for natural-language infrastructure management with a focused API-backed capability set.[18]\n- **Broader AWS MCP Server set** \u2014 best when you want multiple AWS capabilities, but it is less lightweight than picking a single purpose-built server.[1][7][20]\n\nIf your goal is *developer assistance inside an IDE or coding assistant*, the **AWS Knowledge MCP Server** is the lightest useful starting point because it is documentation-centric rather than infrastructure-centric.[16] If your goal is *actually changing AWS resources*, the **Cloud Control API MCP Server** is the lighter choice compared with building custom tooling around multiple AWS service integrations.[18]\n\nIf you want, I can also recommend the **best AWS MCP server by use case**:\n- docs/Q&A\n- CLI replacement\n- infra changes\n- cost/security inspection", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 29, "phrasing": "We want our AI workflow to fetch metrics from Amazon CloudWatch via MCP. Which server implementation should we deploy?", "text": "You should deploy the **AWS Labs CloudWatch MCP Server**: `awslabs.cloudwatch-mcp-server`. AWS\u2019s own guidance says it is the MCP server for CloudWatch metrics, logs, alarm-based incident response, metric/log analysis, and log pattern detection.[1][2]\n\nFor a typical AI workflow, the recommended deployment path is **`uvx`** with the package `awslabs.cloudwatch-mcp-server@latest`, configured in your MCP client with `stdio` transport and your AWS profile/region in environment variables.[1][2]\n\nIf you need an alternative runtime, the same server can also be built and run with **Docker** from the AWS Labs MCP repo.[2][13]\n\nIf your workflow specifically needs **CloudWatch Logs only**, AWS Labs also maintains a separate **`awslabs.cloudwatch-logs-mcp-server`** implementation.[12][13]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 30, "phrasing": "Which Model Context Protocol server is best for connecting desktop AI assistants to AWS account resources?", "text": "The best choice is the **AWS MCP Server** from AWS, because it provides **secure, authenticated access to AWS services** for AI agents and coding assistants through a managed remote MCP server.[1][9]\n\nIf you want a more specific answer for *desktop AI assistants*:\n\n- **Claude Desktop / local desktop assistants:** the **AWS MCP Server** ecosystem\u2019s local `stdio` setup is typically the most practical fit, and AWS\u2019s MCP docs/blogs describe it as working with AI assistants and coding assistants via MCP.[1][10]\n- **AWS resource management and service access:** the **AWS API MCP Server** is the most directly relevant AWS-specific server for interacting with AWS services and resources through AWS CLI-style operations.[7][16]\n- **Documentation and learning:** the **AWS Documentation MCP Server** is useful if the assistant needs AWS docs rather than live account actions.[4][19]\n\nIf your goal is specifically \u201cconnect a desktop AI assistant to my AWS account resources,\u201d the **AWS MCP Server / AWS API MCP Server** pair is the strongest AWS-native option, with the AWS MCP Server being the official managed offering.[1][9][16]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 31, "phrasing": "Top MCP servers for Amazon Web Services cloud automation and DevOps", "text": "For **AWS cloud automation and DevOps**, the strongest starting point is the **AWS MCP Server** plus the **AWS API MCP Server**, because AWS positions them as the general-purpose way to give agents secure access to AWS services and execute multi-step workflows through MCP.[11][15][19] If you want a broader DevOps stack, the most useful adjacent servers are **AWS CloudWatch Logs**, **AWS Cost Explorer**, **AWS Pricing**, **AWS Lambda Tool**, **AWS EKS**, and **AWS CDK** from the AWS MCP catalog.[3][9]\n\nA practical \u201ctop servers\u201d shortlist for AWS automation is:\n\n- **AWS MCP Server** \u2014 the managed, generally available AWS-hosted MCP server for secure, authenticated access to AWS services through a small fixed set of tools; AWS says it can make API calls to any Region.[11][15]\n- **AWS API MCP Server** \u2014 the general AWS interaction server with comprehensive AWS API support, command validation, and security controls; AWS describes it as the place to start for managing infrastructure and executing AWS operations with natural language.[9][19]\n- **Core MCP Server** \u2014 orchestrates and plans across MCP servers, which is useful when your workflow spans infrastructure, docs, and operations tools.[9]\n- **AWS Knowledge MCP Server** \u2014 useful for DevOps because it provides current AWS docs, API references, blog posts, architectural references, and Well-Architected guidance.[9]\n- **AWS CloudWatch Logs MCP Server** \u2014 helps discover log groups and run Log Insights queries, which is directly relevant for incident response and troubleshooting.[4]\n- **AWS Cost Explorer MCP Server** \u2014 gives detailed cost analysis and spend reporting for FinOps and workload optimization.[4][9]\n- **AWS Pricing MCP Server** \u2014 useful for estimating cost before deployment and comparing architectures.[9]\n- **AWS Lambda Tool MCP Server** \u2014 supports selecting and running Lambda functions as MCP tools, which is handy for serverless automation.[4][7]\n- **AWS EKS MCP Server** \u2014 relevant if your DevOps workflows include Kubernetes cluster and deployment management on AWS EKS.[4]\n- **AWS CDK MCP Server** \u2014 helps with CDK best practices, IaC patterns, and security/compliance checks such as CDK Nag.[4]\n\nIf you want the most useful **DevOps-first combo**, use:\n- **AWS API MCP Server** for control-plane operations,\n- **AWS Knowledge MCP Server** for up-to-date guidance,\n- **CloudWatch Logs MCP Server** for troubleshooting,\n- **Cost Explorer** and **Pricing** for governance,\n- **CDK** or **Terraform**-oriented servers for infrastructure automation.[9][4]\n\nAWS also states that its MCP catalog includes **over 60 official MCP servers** spanning infrastructure, deployment, containers, Lambda, AI/ML, data, messaging, and cost analysis, so the \u201cbest\u201d server depends on whether your main job is provisioning, observability, CI/CD, or cost control.[8][1][3]\n\nIf you want, I can turn this into a **ranked list by use case** such as *IaC, observability, serverless, EKS, and FinOps*.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 32, "phrasing": "How to expose AWS infrastructure context to LLMs using an MCP server?", "text": "Use an **MCP server as the context bridge** between your AWS environment and the LLM: the client connects to the MCP server, the server exposes AWS-specific tools/context, and the model uses that context to reason about your infrastructure and take actions when allowed.[2][5][11]\n\nA practical AWS setup usually looks like this:\n\n- **Choose the AWS context you want to expose**: documentation, best practices, account/profile/region metadata, resource inventories, cost data, or direct management actions.[2][19]\n- **Run or connect to an AWS MCP server**: AWS provides open-source MCP servers for services and workflows, and also a managed **AWS MCP Server** that gives authenticated access to AWS services through a small set of tools.[1][3][4]\n- **Configure your MCP client**: add the server in your AI tool\u2019s MCP config so the client can maintain a 1:1 connection to the server.[2][4][5]\n- **Pass AWS credentials and region context**: many AWS MCP servers use `AWS_PROFILE` and `AWS_REGION`, while the managed AWS MCP Server can be accessed through an OAuth 2.1-compatible proxy for local credential workflows.[3][4]\n- **Let the server supply tools/resources**: the LLM retrieves relevant AWS context through MCP, then uses those tools to inspect or manage infrastructure.[2][8][11]\n\nFor infrastructure-specific context, the most relevant AWS MCP options are:\n\n- **AWS Cloud Control API MCP Server**: designed to let LLMs create and manage over 1,100 AWS resources using the Cloud Control API and Infrastructure-as-Code-oriented workflows.[1]\n- **AWS Labs MCP servers**: a collection of servers that expose AWS docs, guidance, and service-specific capabilities for tasks like CDK, cost analysis, and Bedrock knowledge retrieval.[4][17]\n- **Custom MCP server**: if you need organization-specific context, you can build your own server with the MCP SDK and expose your own inventory, tagging, architecture metadata, or guardrails.[8][14]\n\nA minimal client-side pattern is:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-mcp\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.core-mcp-server@latest\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"your-aws-profile\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\nIf you want the LLM to \u201cunderstand\u201d your AWS infrastructure, the best practice is to expose **read-only discovery tools first**\u2014for example listing accounts, regions, stacks, ECS services, Lambda functions, VPCs, and cost data\u2014then add controlled write tools only if needed.[2][12][16]\n\nIf you want, I can give you:\n- a **reference architecture** for an AWS MCP setup,\n- a **sample MCP server design** for AWS inventory/metadata,\n- or a **step-by-step Claude/Cursor configuration**.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 33, "phrasing": "What MCP server enables natural language querying of AWS infrastructure status?", "text": "The MCP server that enables natural language querying of **AWS infrastructure status** is the **AWS Cloud Control API MCP Server**.[3][13]\n\nIt is designed for natural language infrastructure management on AWS and supports creating, reading, updating, deleting, and listing resources, which includes checking resource and deployment status through the AWS Cloud Control API.[3][13]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 34, "phrasing": "Best enterprise-grade MCP server with role-based access control for AWS cloud resources", "text": "For **enterprise-grade AWS resource access with RBAC**, the strongest default choice is the **AWS MCP Server** when you want AWS-native IAM enforcement and a clean separation between human and agent permissions.[13][17] If your main requirement is **managing IAM itself**, the **AWS IAM MCP Server** is the better fit because it is purpose-built for IAM user, role, group, and policy operations.[3][19]\n\nA practical way to choose is:\n\n- **AWS MCP Server**: best for broader AWS API access with access control enforced by IAM policies attached to the calling user or role; AWS says it forwards requests using your credentials, so downstream IAM determines what it can do.[17]\n- **AWS IAM MCP Server**: best for enterprise IAM administration and policy management, with AWS documenting it specifically as the IAM-focused MCP server.[3][19]\n- **AWS API MCP Server**: useful when you want a broader AWS API surface in an MCP package, but the security model still depends on IAM and least-privilege policy design.[5][14]\n\nFor **role-based access control**, AWS recommends using IAM roles and policies, plus **permission boundaries** for agent-specific roles to cap maximum permissions, and in AWS-managed MCP scenarios using condition keys like **`aws:ViaAWSMCPService`** and **`aws:CalledViaAWSMCP`** to distinguish MCP-mediated calls.[2][9] AWS also notes that for enterprise customers, the AWS MCP Server can provide **clear separation between human and agent permissions**, which is a key RBAC requirement.[13]\n\nIf you need the most enterprise-ready architecture, the best pattern is usually:\n\n- **AWS MCP Server** for AWS API access\n- **Dedicated agent IAM roles**\n- **Permission boundaries**\n- **Service Control Policies** for org-wide guardrails\n- **Read-only by default** unless a specific tool or role needs write access[2][5][13]\n\nIf you want, I can turn this into a **short shortlist by use case** or a **recommended reference architecture** for RBAC on AWS MCP.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 35, "phrasing": "Which AWS MCP server supports fine-grained IAM permission scoping for AI tools?", "text": "The AWS-managed MCP servers that support **fine-grained IAM permission scoping for AI tools** are the **AWS MCP Server**, **Amazon EKS MCP Server**, and **Amazon ECS MCP Server**.[1][2][16]\n\nAWS says these managed MCP servers support the standardized IAM context keys **`aws:ViaAWSMCPService`** and **`aws:CalledViaAWSMCP`**, which let you distinguish AI-initiated calls from human actions and scope access at the service level.[1][16] For example, the EKS MCP Server also exposes separate permissions for read-only versus privileged tools, such as **`eks-mcp:CallReadOnlyTool`** and **`eks-mcp:CallPrivilegedTool`**.[14]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 36, "phrasing": "We need an MCP server so our developer assistant can create and check AWS SQS queues. What should we use?", "text": "Use **AWS\u2019s official Amazon SNS / SQS MCP Server** from the `awslabs/mcp` project. It explicitly supports **creating, listing, and managing Amazon SQS queues** and is designed as a bridge between MCP clients and AWS messaging resources.[1][4][6]\n\nIf your developer assistant only needs SQS queue operations, this is the most direct fit. If you also want broader AWS service access, AWS now offers a separate **managed AWS MCP Server** for access to AWS services through a fixed tool set, but for queue creation/checking the SNS/SQS server is the targeted choice.[12]\n\nFor a lightweight alternative, there are community-built SQS MCP servers, but the AWS Labs server is the authoritative option for AWS-integrated queue management.[7][8]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 37, "phrasing": "What Model Context Protocol server offers the broadest coverage of AWS service APIs?", "text": "The **AWS MCP Server** offers the broadest AWS service API coverage. AWS says it consolidates the earlier AWS API MCP and AWS Knowledge servers into one interface and can generate and execute calls to **over 15,000 AWS APIs**, including newly released services.[3]\n\nIf you mean the option with the widest general AWS API access, the AWS open-source repo also describes the **AWS API MCP Server** as the place to start for \u201cgeneral AWS interactions\u201d with \u201ccomprehensive AWS API support\u201d and access to all AWS services.[14] The managed **AWS MCP Server** appears to be the broader, newer unified offering, while the **AWS API MCP Server** is its underlying API-focused component.[3][14]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 38, "phrasing": "Best MCP server for connecting LLM context windows to Amazon Web Services documentation and architecture", "text": "For **AWS documentation and architecture lookup**, the best fit is the **AWS Knowledge MCP Server** because AWS says it provides access to AWS documentation, API references, best practices, and knowledge bases, and it does **not require AWS credentials**, which makes it ideal for documentation-focused LLM workflows.[2][12]\n\nIf you want the most current official AWS options, AWS also lists the **AWS Documentation MCP Server** and the broader **AWS MCP Server** in its open-source MCP catalog.[1][9] The **AWS MCP Server** is better when you want not just docs, but also **authenticated access to AWS services**, real-time documentation retrieval, API calls, and multi-step workflows via Agent SOPs.[4][7]\n\n**Practical recommendation:**\n- **Best for docs-first context windows:** **AWS Knowledge MCP Server**.[2][12]\n- **Best for docs + live AWS actions:** **AWS MCP Server**.[4][7]\n- **Best for a lightweight, \u201cjust give me the docs\u201d setup:** **AWS Knowledge MCP Server** again, because it avoids credential management.[2]\n\nIf you want, I can also compare the **AWS Knowledge MCP Server vs AWS Documentation MCP Server vs AWS MCP Server** in a compact table.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 39, "phrasing": "Which MCP server allows AI chatbots to interact with AWS ECS and EKS clusters?", "text": "The MCP servers are the **Amazon ECS MCP Server** and the **Amazon EKS MCP Server**. AWS says these are specialized Model Context Protocol servers that let AI assistants interact with ECS clusters and EKS clusters, respectively.[1][2]\n\nIf you mean the one for **both** services, AWS has separate hosted MCP servers with separate endpoints for **ECS** and **EKS** rather than a single combined server.[1][5]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 40, "phrasing": "What is the most secure MCP server implementation for Amazon Web Services APIs?", "text": "There is **no single universally \u201cmost secure\u201d MCP server implementation** for AWS APIs; the most secure option in practice is the **AWS-managed AWS MCP Server** or **AWS API MCP Server deployed through AWS-managed infrastructure with OAuth 2.0/OIDC, least-privilege IAM, and read-only defaults**.[2][15][17]\n\nIf you mean the **best security posture for remote access to AWS APIs**, AWS\u2019s own guidance points to a setup that uses **Amazon Cognito OAuth 2.0 authorization code flow**, **Protected Resource Metadata (RFC 9728)**, and **audience-bound tokens**, with additional controls like **token isolation**, **separate read/write authorization**, and **least privilege**.[4][5][7][15]\n\nFor a practical choice, the security ranking is roughly:\n\n| Option | Security posture | Why |\n|---|---|---|\n| **AWS-managed AWS MCP Server** | Strongest overall | Managed by AWS, authenticated access to AWS services, and AWS says it is built for secure, authenticated access through a fixed set of tools.[2][17] |\n| **AWS API MCP Server on AWS with OAuth 2.0 + Cognito + IAM least privilege** | Very strong | Open-source, but AWS documents and samples emphasize secure file-system controls, input validation, and standards-based auth flows.[3][7][18] |\n| **AWS Serverless MCP Server in read-only mode** | Strong for safety, especially for exploration | Default read-only behavior and restricted CloudWatch Logs access reduce mutation and data-exposure risk.[14] |\n| **DIY/self-managed MCP server** | Depends on implementation | Secure only if you correctly implement OAuth, token isolation, validation, IAM scoping, logging, and network controls.[4][12][15] |\n\nThe **key security features** to require are:\n- **OAuth 2.0 / OAuth 2.1** authentication instead of static API keys.[5][12]\n- **Least-privilege IAM** with separate roles or session policies for read vs. write actions.[4][15]\n- **Read-only default mode** whenever possible.[14][19]\n- **Strong input validation** and syntactic restriction of tool calls.[3][18]\n- **CloudTrail auditing** and tight credential/session isolation.[17][19]\n\nIf you want the **single safest recommendation**, use the **AWS-managed AWS MCP Server** when it meets your use case; if you need self-hosting, use the **AWS API MCP Server with Cognito/OAuth 2.0, IAM least privilege, and read-only-by-default controls**.[2][7][15][17]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 41, "phrasing": "Recommended MCP server for AI agents doing automated cloud auditing on AWS", "text": "For **automated cloud auditing on AWS**, the best default choice is the **AWS MCP Server** from AWS/Agent Toolkit, because it is the current recommended replacement for older AWS API/Knowledge MCP servers and is designed for **secure, auditable AWS operations** with **CloudTrail logging**.[11][10][2]\n\nIf your audits are specifically **security-focused**\u2014for example, scanning configurations, reviewing code, or simulating penetration-testing workflows\u2014then the **AWS Security Agent MCP Server** is the more targeted option.[6][2]\n\nA practical recommendation is:\n\n- **General AWS cloud auditing:** **AWS MCP Server**[11][10]\n- **Security-centric auditing:** **AWS Security Agent MCP Server**[6][2]\n- **Enterprise-managed AWS environments:** consider **Amazon Bedrock AgentCore** as a broader managed agent platform if you need more than just MCP tooling.[1]\n\nWhy the **AWS MCP Server** is the best starting point:\n- AWS says it is the recommended server if you are currently using the older AWS API MCP Server or AWS Knowledge MCP Server.[11]\n- AWS positions its MCP servers around **secure, auditable operations** and **CloudTrail logging**, which fits audit workflows well.[2]\n- AWS documents secure access patterns for MCP on AWS, including IAM controls and CloudTrail-based monitoring, which matters for automated auditing agents.[5]\n\nIf you want, I can also give you a **recommended AWS MCP server stack for auditing** by use case: *read-only inventory, security posture checks, IAM review, or incident-response validation*.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 42, "phrasing": "Which Model Context Protocol tool provides seamless integration with AWS account management?", "text": "The tool is the **AWS MCP Server** (also referred to as the **Model Context Protocol (MCP) Server for AWS**), which provides secure, authenticated access to AWS services and supports AWS account management workflows.[10][7]\n\nIf you mean a tool for integrating MCP into an AI client rather than the server itself, AWS also offers the **MCP Proxy for AWS**, which connects MCP clients to AWS-hosted MCP servers using AWS SigV4 authentication.[2]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 43, "phrasing": "What MCP server should DevOps teams install to give AI assistants access to AWS diagnostics?", "text": "DevOps teams should install the **AWS MCP Server** if they want AI assistants to access AWS diagnostics, because AWS describes it as a managed remote MCP server that gives AI agents secure, authenticated access to AWS services and explicitly says it can be used to **troubleshoot AWS issues** by analyzing **CloudWatch logs**, **CloudTrail events**, permission problems, and performance failures.[1][10]\n\nIf the goal is specifically **AWS diagnostics for DevOps investigations**, AWS also provides MCP integration patterns for the **AWS DevOps Agent**, which can connect to MCP servers to extend its investigation capabilities with external observability and operational data sources.[2][3]", "error": null}