{"engine": "chatgpt", "model": "gpt-5.5", "index": 0, "phrasing": "What is the best MCP server for connecting AI assistants to AWS infrastructure?", "text": "The best choice is **AWS Labs\u2019 official MCP servers**, especially the **AWS API MCP Server** from the `awslabs/mcp` collection.\n\nUse it if you want an AI assistant to interact with AWS infrastructure through real AWS APIs, with your normal AWS credentials/IAM controls.\n\nGood options depending on your use case:\n\n- **AWS API MCP Server** \u2014 best general-purpose option for querying and managing AWS resources.\n- **AWS Documentation MCP Server** \u2014 best for getting accurate AWS docs and service guidance.\n- **AWS CDK MCP Server** \u2014 best if your infrastructure is managed with AWS CDK.\n- **Terraform MCP Server / IaC-focused server** \u2014 better if your AWS infra is Terraform-managed.\n\nMy recommendation:\n\n> Use the **official AWS Labs MCP servers**, start with the **AWS API MCP Server**, and run it with a tightly scoped IAM role, ideally read-only at first.\n\nAvoid giving an MCP server broad admin credentials unless you are running it in a controlled environment with logging, approvals, and least-privilege IAM policies.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 1, "phrasing": "Best Model Context Protocol server for Amazon Web Services", "text": "There isn\u2019t one \u201cbest\u201d MCP server for AWS\u2014it depends on what you want the AI to do. The safest recommendation is to start with the **AWS Labs MCP servers**.\n\n## Best overall choice\n\n**AWS Labs MCP Servers**  \nGitHub: `awslabs/mcp`\n\nThese are AWS-maintained/open-source MCP servers covering common AWS workflows.\n\n## Recommended picks by use case\n\n| Use case | Recommended MCP server |\n|---|---|\n| Read AWS docs and get service guidance | **AWS Documentation MCP Server** |\n| Build AWS infrastructure with CDK | **AWS CDK MCP Server** |\n| Terraform-based AWS infra | **Terraform MCP Server** |\n| Cost analysis and pricing | **AWS Cost / Pricing MCP Servers** |\n| Kubernetes on AWS | **EKS MCP Server** |\n| General AWS API access | **AWS API MCP Server**, if available/appropriate for your setup |\n\n## My recommendation\n\nIf you are just getting started, use:\n\n1. **AWS Documentation MCP Server** \u2014 low risk, very useful for accurate AWS guidance.\n2. **AWS CDK MCP Server** \u2014 best if you want the assistant to help create AWS infrastructure.\n3. **Cost/Pricing MCP Server** \u2014 useful for architecture and cost estimates.\n\nFor production AWS account access, be careful with any MCP server that can call AWS APIs. Use:\n\n- Least-privilege IAM roles\n- Read-only access by default\n- Separate dev/sandbox AWS account\n- CloudTrail logging\n- Explicit approval before write/delete operations\n\nIf you want one practical starting point, I\u2019d choose the **AWS Documentation MCP Server** plus the **AWS CDK MCP Server** from `awslabs/mcp`.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 2, "phrasing": "We want our local AI coding assistant to query AWS S3 buckets and CloudWatch logs via MCP. What server should we use?", "text": "Use the **AWS API MCP Server** from AWS Labs.\n\nIt is the best fit if your local AI coding assistant needs to query multiple AWS services, including:\n\n- **Amazon S3** buckets and objects\n- **Amazon CloudWatch Logs**\n- Other AWS APIs via the same MCP interface\n\nRepo/package: **`awslabs/aws-api-mcp-server`**\n\nWhy this one:\n\n- It exposes AWS service APIs through MCP\n- Works with your normal AWS credentials/profile\n- Avoids needing separate MCP servers for S3 and CloudWatch\n- Can be run locally alongside tools like Claude Desktop, Cursor, Continue, etc.\n\nYou should configure it with least-privilege AWS credentials, for example permissions such as:\n\n```json\n{\n  \"Effect\": \"Allow\",\n  \"Action\": [\n    \"s3:ListBucket\",\n    \"s3:GetObject\",\n    \"logs:DescribeLogGroups\",\n    \"logs:DescribeLogStreams\",\n    \"logs:GetLogEvents\",\n    \"logs:StartQuery\",\n    \"logs:GetQueryResults\"\n  ],\n  \"Resource\": \"*\"\n}\n```\n\nSo the short answer is: **use the AWS Labs AWS API MCP Server**.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 3, "phrasing": "Recommend an AWS MCP server for a team managing multi-region cloud resources.", "text": "I\u2019d recommend the **AWS API MCP Server** (`awslabs/aws-api-mcp-server`) for a team managing **multi-region AWS resources**.\n\nWhy it fits:\n\n- Provides broad access to AWS service APIs through MCP\n- Useful for querying and managing resources across accounts and regions\n- Works with normal AWS credentials, IAM roles, and profiles\n- Good for operations teams that need visibility into EC2, IAM, CloudWatch, S3, RDS, Lambda, etc.\n- Can be paired with assistants like Claude Desktop or other MCP-compatible clients\n\nTypical use cases:\n\n- \u201cList EC2 instances in us-east-1 and eu-west-1\u201d\n- \u201cFind unattached EBS volumes across regions\u201d\n- \u201cCheck CloudWatch alarms in all production regions\u201d\n- \u201cDescribe IAM roles used by Lambda functions\u201d\n- \u201cCompare RDS configurations between regions\u201d\n\nRecommended repo:\n\n```text\nawslabs/aws-api-mcp-server\n```\n\nIf your team mostly manages infrastructure as code, also consider pairing it with:\n\n```text\nawslabs/cdk-mcp-server\n```\n\nor a Terraform-focused MCP server, depending on your IaC stack.\n\nFor a multi-region cloud ops team, though, the **AWS API MCP Server** is the best general-purpose starting point.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 4, "phrasing": "affordable and secure MCP server for AWS resource management", "text": "For an **affordable and secure MCP server for AWS resource management**, the best starting point is usually the **official AWS Labs MCP servers**.\n\n### Recommended option\n\n**AWS Labs MCP Servers**\n- GitHub: `awslabs/mcp`\n- Good for: AWS resource discovery, automation, infrastructure workflows, cost tools, CDK/Terraform assistance\n- Cost: Free/open source; you only pay normal AWS usage\n- Security: Can run locally or inside your own AWS account; uses your IAM permissions\n\n### Best fit for AWS resource management\n\nLook at:\n\n1. **AWS API MCP Server**\n   - General AWS service interaction\n   - Useful for querying and managing resources\n   - Best if you want broad AWS coverage\n\n2. **AWS CDK MCP Server**\n   - Best for infrastructure-as-code workflows\n   - Helps create and update CDK projects safely\n\n3. **AWS Terraform MCP Server**\n   - Good if you manage AWS through Terraform\n\n4. **AWS Cost Explorer MCP Server**\n   - Useful for cost visibility and optimization\n\n---\n\n## Secure deployment recommendation\n\nFor most teams, the safest and cheapest setup is:\n\n### Run MCP locally or in a private environment\n\nAvoid exposing the MCP server publicly.\n\nUse:\n\n- Local machine\n- Private EC2 instance\n- ECS/Fargate in private subnets\n- Internal developer workstation\n\n### Use least-privilege IAM\n\nCreate a dedicated IAM role/user for MCP with only the permissions it needs.\n\nExample starting point:\n\n```json\n{\n  \"Effect\": \"Allow\",\n  \"Action\": [\n    \"ec2:Describe*\",\n    \"s3:List*\",\n    \"s3:Get*\",\n    \"rds:Describe*\",\n    \"lambda:List*\",\n    \"lambda:Get*\",\n    \"cloudwatch:Get*\",\n    \"cloudwatch:List*\",\n    \"ce:Get*\"\n  ],\n  \"Resource\": \"*\"\n}\n```\n\nStart read-only, then add write permissions only where needed.\n\n---\n\n## Avoid if security matters\n\nBe cautious with:\n\n- Publicly hosted MCP servers\n- MCP servers requiring broad `AdministratorAccess`\n- Unknown third-party MCP servers with access to AWS credentials\n- Long-lived static AWS keys\n\n---\n\n## My recommendation\n\nUse the **AWS Labs AWS API MCP Server**, run it locally or inside your VPC, and connect it to AWS using a **least-privilege IAM role**.\n\nIf your goal is infrastructure changes, use it together with either:\n\n- **AWS CDK MCP Server**, or\n- **Terraform MCP Server**\n\ndepending on your IaC tool.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 5, "phrasing": "What MCP server do cloud engineers actually use to let LLMs read AWS configuration?", "text": "Cloud engineers usually use one of these:\n\n1. **AWS Labs AWS API MCP Server** \u2014 for direct live AWS API access  \n   - Repo: `awslabs/mcp`\n   - Server: `aws-api-mcp-server`\n   - Lets an LLM call AWS APIs to inspect resources, configs, IAM, networking, etc.\n   - Best used with **read-only IAM credentials** or a tightly scoped role.\n\n2. **Steampipe MCP Server** \u2014 for safer SQL-style cloud inventory queries  \n   - Good if you want the LLM to query AWS configuration without giving it broad API freedom.\n   - Uses Steampipe\u2019s AWS plugin to expose AWS resources as SQL tables.\n   - Popular with cloud/security engineers because it feels like:  \n     ```sql\n     select * from aws_ec2_instance;\n     select * from aws_iam_role;\n     select * from aws_vpc;\n     ```\n\n3. **CloudQuery MCP Server** \u2014 for inventory-first setups  \n   - Syncs AWS configuration into a database first.\n   - The LLM queries the inventory instead of live AWS APIs.\n   - Better for larger environments, auditability, and multi-cloud asset inventory.\n\nIf you want the most direct answer: **use the AWS Labs `aws-api-mcp-server` for live AWS config reads**, but run it with a **read-only, least-privilege IAM role**.\n\nIf you want the safer cloud-engineering pattern: **use Steampipe or CloudQuery**, because the LLM queries an inventory layer instead of having broad access to AWS APIs.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 6, "phrasing": "Best MCP server to connect AI agents to Amazon Web Services data stores", "text": "Best overall choice: **AWS Labs `aws-api-mcp-server`**.\n\nIt\u2019s the most flexible MCP server for connecting AI agents to AWS data stores because it can call AWS APIs using your normal AWS credentials/IAM controls. It can work with services such as:\n\n- **S3**\n- **DynamoDB**\n- **RDS / Aurora via Data API**\n- **Redshift Data API**\n- **OpenSearch**\n- **Bedrock Knowledge Bases**\n- **Glue / Athena**\n\nExample MCP config:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-api\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-api-mcp-server@latest\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"my-profile\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\nRecommended setup:\n\n1. Use **read-only IAM permissions** by default.\n2. Restrict access to only the needed services/tables/buckets.\n3. Prefer service-specific MCP servers when available, e.g.:\n   - **DynamoDB MCP server** for DynamoDB-heavy agents\n   - **PostgreSQL/MySQL MCP server** for RDS/Aurora SQL access\n   - **Bedrock Knowledge Bases Retrieval MCP server** for RAG over AWS-managed knowledge bases\n   - **Redshift MCP/Data API access** for analytics agents\n\nMy recommendation:\n\n- For broad AWS data-store access: **AWS Labs `aws-api-mcp-server`**\n- For production database querying: use a **dedicated DB MCP server** with least-privilege credentials\n- For AI retrieval/RAG: use **Amazon Bedrock Knowledge Bases Retrieval MCP server**", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 7, "phrasing": "Which MCP server allows LLMs to query AWS DynamoDB and S3 safely?", "text": "The **AWS MCP Server** (often listed as `mcp-server-aws`) allows LLMs to safely query AWS services such as **DynamoDB** and **S3**.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 8, "phrasing": "We are building an AI dev tool that needs read-only access to AWS architecture via MCP. What MCP server implementation is best?", "text": "Best default: **AWS Labs\u2019 official `aws-api-mcp-server`**, run with a **strict read-only IAM role**.\n\nWhy it\u2019s the best fit:\n\n- It is the most general MCP interface for live AWS accounts.\n- It can inspect real deployed infrastructure across services using AWS APIs.\n- You can constrain it to `List*`, `Describe*`, and safe `Get*` calls.\n- It works well for multi-account/multi-region architecture discovery via `AssumeRole`.\n- It is maintained under the AWS Labs MCP ecosystem rather than being an unofficial scraper.\n\nRecommended setup:\n\n1. **Use `awslabs/aws-api-mcp-server`**\n   - Best for querying VPCs, subnets, EC2, ECS, EKS, RDS, Lambda, IAM, ELB, CloudFormation, etc.\n\n2. **Attach a custom read-only IAM policy**\n   - Prefer a custom policy over broad `ReadOnlyAccess`.\n   - Allow architecture metadata:\n     - `ec2:Describe*`\n     - `elasticloadbalancing:Describe*`\n     - `rds:Describe*`\n     - `ecs:Describe*`\n     - `eks:Describe*`\n     - `lambda:GetFunctionConfiguration`\n     - `cloudformation:Describe*`\n     - `cloudformation:List*`\n     - `iam:Get*`\n     - `iam:List*`\n   - Avoid data/secret reads:\n     - `secretsmanager:GetSecretValue`\n     - `ssm:GetParameter*`\n     - `s3:GetObject`\n     - `dynamodb:GetItem`\n     - `rds-data:*`\n\n3. **Use cross-account `AssumeRole`**\n   - One read-only role per AWS account.\n   - External ID if this is a hosted dev tool.\n   - Enable CloudTrail logging.\n\n4. **Optionally pair with AWS Resource Explorer**\n   - If you mainly need \u201cwhat resources exist?\u201d discovery, AWS Resource Explorer is useful.\n   - For deeper topology and relationships, use the AWS API MCP server.\n\n5. **Optionally pair with AWS Diagram MCP**\n   - Use it only for rendering diagrams after you collect the inventory.\n   - It does not replace live AWS architecture discovery.\n\nShort answer: **Use the official AWS Labs `aws-api-mcp-server` with a tightly scoped read-only IAM role.** For production, enforce read-only at IAM level, not just in the MCP prompt or server configuration.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 9, "phrasing": "Top open source MCP servers for AWS integration", "text": "Here are the best open-source MCP servers to consider for AWS integration:\n\n| MCP server | Best for | Notes |\n|---|---|---|\n| **AWS Labs MCP Servers** | General AWS integration | Official AWS Labs collection of MCP servers. Best starting point. GitHub: `awslabs/mcp` |\n| **AWS Documentation MCP Server** | AWS docs lookup | Lets an AI assistant search and retrieve AWS documentation accurately. Good for architecture, CLI, SDK, and service questions. |\n| **AWS CDK MCP Server** | Infrastructure as Code with CDK | Helpful for generating, reviewing, and explaining AWS CDK constructs and patterns. |\n| **Terraform MCP Server for AWS** | Terraform-based AWS IaC | Useful if your AWS infrastructure is managed with Terraform. Can help with provider docs, modules, and IaC workflows. |\n| **CloudFormation MCP Server** | CloudFormation templates | Good for generating, validating, or explaining CloudFormation/SAM-style infrastructure. |\n| **AWS API MCP Server** | Direct AWS service operations | Provides tools for interacting with AWS APIs. Use carefully with least-privilege IAM credentials. |\n| **Amazon CloudWatch MCP Server** | Logs and observability | Useful for querying logs, troubleshooting workloads, and summarizing operational issues. |\n| **AWS Cost Analysis / Cost Explorer MCP Server** | Cost optimization | Helps analyze AWS spend, usage patterns, and potential savings. |\n| **Amazon Bedrock Knowledge Base Retrieval MCP Server** | RAG with Bedrock KBs | Connects MCP clients to Amazon Bedrock Knowledge Bases for retrieval-augmented generation. |\n| **Amazon EKS / ECS MCP Servers** | Container workloads | Useful for Kubernetes or ECS cluster inspection, troubleshooting, and operational queries. |\n| **AWS Lambda / Serverless MCP Server** | Serverless apps | Helps inspect, manage, or reason about Lambda and serverless architectures. |\n\nMy recommendation:\n\n1. **Start with `awslabs/mcp`**  \n   This is the main official open-source AWS MCP collection.\n\n2. Add servers based on your workflow:\n   - CDK \u2192 **AWS CDK MCP Server**\n   - Terraform \u2192 **Terraform MCP Server**\n   - Ops/debugging \u2192 **CloudWatch MCP Server**\n   - Cost \u2192 **Cost Analysis MCP Server**\n   - RAG/search \u2192 **Bedrock KB Retrieval MCP Server**\n   - Runtime management \u2192 **AWS API MCP Server**\n\nUse AWS IAM least-privilege roles or profiles when connecting these servers, especially anything that can call live AWS APIs.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 10, "phrasing": "Which Model Context Protocol server works best for Amazon Bedrock LLMs?", "text": "There isn\u2019t a single MCP server that \u201cworks best\u201d for Amazon Bedrock LLMs, because MCP servers are generally **model-agnostic**. Bedrock-hosted models use MCP through an MCP-compatible client/agent, and the server you choose depends on what tools or data you want to expose.\n\nGood choices:\n\n| Use case | Recommended MCP server |\n|---|---|\n| RAG with Amazon Bedrock Knowledge Bases | **AWS Labs Bedrock Knowledge Base Retrieval MCP Server** |\n| AWS documentation lookup | **AWS Labs AWS Documentation MCP Server** |\n| AWS service/API operations | **AWS Labs AWS MCP servers** relevant to the service |\n| Custom app/database/tools | Build a custom MCP server |\n\nIf you specifically want to connect Bedrock LLMs to Bedrock Knowledge Bases, the best fit is:\n\n**`awslabs/bedrock-kb-retrieval-mcp-server`**\n\nBut if your goal is simply to use Claude, Llama, Mistral, etc. on Amazon Bedrock with MCP tools, then any standards-compliant MCP server can work\u2014the important part is using a client or agent framework that supports both **Amazon Bedrock** and **MCP**.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 11, "phrasing": "How to connect an LLM assistant to AWS cloud resources using MCP?", "text": "You connect an LLM assistant to AWS resources with MCP by running an **MCP server** that exposes AWS operations as tools, then configuring your LLM client to use that MCP server.\n\n## High-level architecture\n\n```text\nLLM assistant / MCP client\n        \u2193 MCP\nAWS MCP server\n        \u2193 AWS SDK / AWS CLI\nAWS resources: S3, EC2, Lambda, CloudWatch, IAM, etc.\n```\n\nThe LLM does not connect directly to AWS. It asks the MCP server to call approved AWS tools.\n\n---\n\n## Option 1: Use an existing AWS MCP server\n\nAWS and the community provide MCP servers for AWS services, such as documentation, CloudWatch, Lambda, CDK, Terraform, cost analysis, and AWS API access.\n\nExample MCP client config:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-api-mcp-server@latest\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"dev\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\nThe exact package name depends on the AWS MCP server you choose, so check the server\u2019s README.\n\nCommon clients that support MCP include:\n\n- Claude Desktop\n- Cursor\n- Cline\n- Continue\n- Windsurf\n- Custom MCP clients\n\n---\n\n## Option 2: Build your own AWS MCP server\n\nIf you want strict control, write a small MCP server that exposes only specific AWS actions.\n\nExample using Python and `boto3`:\n\n```python\nfrom mcp.server.fastmcp import FastMCP\nimport boto3\n\nmcp = FastMCP(\"aws-assistant\")\n\n@mcp.tool()\ndef list_s3_buckets():\n    \"\"\"List S3 buckets in the current AWS account.\"\"\"\n    s3 = boto3.client(\"s3\")\n    response = s3.list_buckets()\n    return [bucket[\"Name\"] for bucket in response[\"Buckets\"]]\n\n@mcp.tool()\ndef list_ec2_instances(region: str = \"us-east-1\"):\n    \"\"\"List EC2 instances in a region.\"\"\"\n    ec2 = boto3.client(\"ec2\", region_name=region)\n    response = ec2.describe_instances()\n\n    instances = []\n    for reservation in response[\"Reservations\"]:\n        for instance in reservation[\"Instances\"]:\n            instances.append({\n                \"InstanceId\": instance[\"InstanceId\"],\n                \"State\": instance[\"State\"][\"Name\"],\n                \"Type\": instance[\"InstanceType\"]\n            })\n\n    return instances\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\nInstall dependencies:\n\n```bash\npip install mcp boto3\n```\n\nConfigure your MCP client:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-local\": {\n      \"command\": \"python\",\n      \"args\": [\"/path/to/aws_mcp_server.py\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"dev\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\n---\n\n## AWS authentication\n\nUse normal AWS credentials:\n\n```bash\naws configure sso\n```\n\nor:\n\n```bash\naws configure --profile dev\n```\n\nThen verify:\n\n```bash\naws sts get-caller-identity --profile dev\n```\n\nYour MCP server can use:\n\n```bash\nAWS_PROFILE=dev\nAWS_REGION=us-east-1\n```\n\nor IAM roles if running on EC2, ECS, Lambda, or EKS.\n\n---\n\n## Recommended IAM setup\n\nCreate a dedicated IAM role or user for the MCP server.\n\nStart with read-only access:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"s3:ListAllMyBuckets\",\n        \"ec2:DescribeInstances\",\n        \"cloudwatch:GetMetricData\",\n        \"logs:DescribeLogGroups\",\n        \"logs:FilterLogEvents\"\n      ],\n      \"Resource\": \"*\"\n    }\n  ]\n}\n```\n\nAvoid giving the assistant broad permissions like:\n\n```text\nAdministratorAccess\n```\n\nunless you are in a sandbox account.\n\n---\n\n## Best practices\n\n- Use least-privilege IAM permissions.\n- Start with read-only tools.\n- Require human approval before destructive actions.\n- Log all MCP tool calls.\n- Separate dev, staging, and production profiles.\n- Never expose long-lived AWS keys to the LLM directly.\n- Prefer AWS SSO, IAM roles, or temporary credentials.\n- Limit tools to specific AWS services and regions.\n\n---\n\n## Example use cases\n\nOnce connected, you can ask the assistant:\n\n```text\nList my EC2 instances in us-east-1.\n```\n\n```text\nShow recent CloudWatch logs for this Lambda function.\n```\n\n```text\nFind S3 buckets without encryption enabled.\n```\n\n```text\nCheck the current AWS bill trend.\n```\n\n```text\nGenerate a CDK stack for this architecture.\n```\n\n---\n\nIn short: run an MCP server with AWS SDK/CLI access, authenticate it with a limited IAM role or profile, then register that server in your LLM client\u2019s MCP configuration.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 12, "phrasing": "What is the most reliable MCP server for inspecting AWS IAM roles and Security Groups?", "text": "The most reliable choice is the **official AWS Labs AWS API MCP Server** \u2014 usually referred to as:\n\n**`awslabs.aws-api-mcp-server`**\n\nIt is the best fit for inspecting:\n\n- **IAM roles**\n  - `iam:ListRoles`\n  - `iam:GetRole`\n  - `iam:ListAttachedRolePolicies`\n  - `iam:GetPolicy`\n  - `iam:GetPolicyVersion`\n  - `iam:ListRolePolicies`\n  - `iam:GetRolePolicy`\n\n- **Security Groups**\n  - `ec2:DescribeSecurityGroups`\n  - `ec2:DescribeSecurityGroupRules`\n  - `ec2:DescribeNetworkInterfaces`\n  - `ec2:DescribeVpcs`\n\nWhy it is the safest/reliable option:\n\n- Maintained under **AWS Labs**\n- Uses real AWS APIs rather than scraping or unofficial data\n- Works with normal AWS credentials, profiles, and assumed roles\n- Can be restricted with a read-only IAM policy\n- Better suited for live account inspection than documentation-only MCP servers\n\nRecommended setup: run it with a **read-only audit role**, not admin credentials.\n\nFor production-grade security review, pair it with AWS-native tools such as:\n\n- **IAM Access Analyzer**\n- **AWS Config**\n- **Security Hub**\n- **Prowler** or **Steampipe** for deeper auditing\n\nBut for an MCP server specifically, I\u2019d choose **AWS Labs AWS API MCP Server**.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 13, "phrasing": "Best MCP server for querying CloudWatch logs with natural language", "text": "The best choice is **AWS Labs\u2019 CloudWatch MCP Server**:\n\n> **`awslabs.cloudwatch-mcp-server`**\n\nIt is purpose-built for Amazon CloudWatch and lets an MCP-capable client like Claude Desktop, Cursor, Cline, or Continue translate natural language into CloudWatch Logs Insights queries.\n\nExample use cases:\n\n- \u201cShow me errors in `/aws/lambda/my-api` from the last 30 minutes.\u201d\n- \u201cFind the top 10 exception messages in this log group today.\u201d\n- \u201cSummarize recent 5xx errors for my ECS service.\u201d\n- \u201cQuery CloudWatch Logs Insights for timeout errors grouped by function name.\u201d\n\nTypical config:\n\n```json\n{\n  \"mcpServers\": {\n    \"cloudwatch\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.cloudwatch-mcp-server@latest\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"default\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\nRecommended IAM permissions, read-only:\n\n```json\n{\n  \"Effect\": \"Allow\",\n  \"Action\": [\n    \"logs:DescribeLogGroups\",\n    \"logs:DescribeLogStreams\",\n    \"logs:StartQuery\",\n    \"logs:GetQueryResults\",\n    \"logs:StopQuery\",\n    \"cloudwatch:GetMetricData\",\n    \"cloudwatch:ListMetrics\",\n    \"cloudwatch:DescribeAlarms\"\n  ],\n  \"Resource\": \"*\"\n}\n```\n\nA key point: the MCP server exposes CloudWatch tools; the **natural-language experience comes from your MCP client\u2019s LLM**, which decides how to call those tools.\n\nIf your main goal is **natural language over CloudWatch Logs**, use **AWS Labs CloudWatch MCP Server** rather than a generic AWS CLI MCP server.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 14, "phrasing": "We need an MCP server that lets developers ask an AI agent about active AWS EC2 instances. What options exist?", "text": "Options for an MCP server that lets developers ask an AI agent about active AWS EC2 instances:\n\n| Option | Description | Best for |\n|---|---|---|\n| **AWS Labs AWS API MCP Server** | Generic MCP server that can call AWS APIs. The agent could use `ec2:DescribeInstances` to answer questions about running instances. | Fastest way to expose AWS APIs through MCP |\n| **Custom EC2-only MCP server** | Build a small MCP server using `boto3`, AWS SDK for JS, or Go SDK with tools like `list_running_instances`, `get_instance_details`, `find_instances_by_tag`. | Best production/security option |\n| **AWS CLI via a shell/command MCP server** | Let the agent run restricted AWS CLI commands such as `aws ec2 describe-instances`. | Quick prototype, internal demos |\n| **AWS Config / Resource Explorer / Systems Manager Inventory MCP wrapper** | Query inventory data instead of live EC2 APIs. Useful for broader asset visibility or historical state. | Multi-account inventory, audit, compliance |\n| **Cloud Control API MCP server** | Use AWS Cloud Control APIs to inspect AWS resources. May work for EC2 resources but is less ideal for live instance state queries. | Generic AWS resource inspection |\n| **Third-party hosted MCP servers** | Some MCP marketplaces/catalogs have AWS-related servers. Quality and security posture vary. | Convenience if vendor-approved |\n\nRecommended approach: **build a narrow custom EC2 MCP server** unless you only need a prototype.\n\nExpose only read-only tools, for example:\n\n```text\nlist_active_instances(region?, account?, tags?)\nget_instance(instance_id, region)\nsummarize_instances_by_tag(tag_key, tag_value?)\n```\n\nUse a minimal IAM policy such as:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"ec2:DescribeInstances\",\n        \"ec2:DescribeTags\",\n        \"ec2:DescribeRegions\"\n      ],\n      \"Resource\": \"*\"\n    },\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"sts:GetCallerIdentity\",\n      \"Resource\": \"*\"\n    }\n  ]\n}\n```\n\nFor querying active/running instances, the underlying AWS API call is:\n\n```bash\naws ec2 describe-instances \\\n  --filters \"Name=instance-state-name,Values=running\"\n```\n\nIf you want broad AWS API access, use the **AWS API MCP Server**. If you want something safe for developers, use a **purpose-built EC2 read-only MCP server** with tight IAM and limited tools.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 15, "phrasing": "Which MCP server provides secure Amazon Web Services connector tools for AI models?", "text": "The **AWS MCP Server** (often listed as **mcp-server-aws**) provides secure Amazon Web Services connector tools for AI models.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 16, "phrasing": "Best production-ready MCP server for AWS API interactions", "text": "For **production AWS API interactions**, the best default choice is:\n\n## AWS Labs **AWS API MCP Server**\n\n**Repo:** `awslabs/mcp`  \n**Server:** `aws-api-mcp-server`\n\nIt is the most credible option because it is AWS-maintained, supports broad AWS API access, and uses normal AWS credential resolution such as profiles, environment variables, IAM roles, and SSO-backed credentials.\n\nTypical MCP config:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-api\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-api-mcp-server@latest\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"prod-readonly\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\n## My recommendation\n\nUse it for:\n\n- Inspecting AWS resources\n- Querying CloudWatch, ECS, EKS, EC2, S3, IAM, etc.\n- Operational troubleshooting\n- Read-only or tightly scoped automation\n\nFor **production write actions**, I would not give an LLM broad AWS API access directly. Instead:\n\n1. Use a dedicated IAM role with least privilege.\n2. Prefer read-only access by default.\n3. Require human approval for destructive or mutating actions.\n4. Run it in a controlled environment, not on a developer laptop with admin creds.\n5. Enable CloudTrail and monitor all MCP-triggered API calls.\n6. Consider building a small custom MCP server that exposes only approved operations.\n\n## Alternatives depending on use case\n\n| Use case | Better MCP choice |\n|---|---|\n| General AWS API calls | **AWS Labs AWS API MCP Server** |\n| AWS docs / guidance | AWS Documentation MCP Server |\n| Infrastructure as Code workflows | Terraform MCP Server or CDK-related MCP tools |\n| Safer resource management | AWS Cloud Control API / CCAPI-focused MCP server |\n| Company-specific production ops | Custom internal MCP server with restricted tools |\n\n## Bottom line\n\nUse **AWS Labs `aws-api-mcp-server`** if you want the best general-purpose AWS MCP server today. For real production operations, pair it with **least-privilege IAM, read-only defaults, approval gates, and CloudTrail auditing**.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 17, "phrasing": "We are an enterprise cloud platform team looking for a compliant AWS MCP server for internal AI tools. What should we evaluate?", "text": "A \u201ccompliant AWS MCP server\u201d should be evaluated less as a generic connector and more as a privileged cloud control-plane component. Key areas to assess:\n\n## 1. Deployment and trust model\n\nPrefer an MCP server that can be:\n\n- Self-hosted in your AWS environment\n- Deployed inside your VPC or private network\n- Run with no public ingress\n- Integrated with your existing IAM, network, logging, and monitoring controls\n- Isolated per environment, account group, or tenant if needed\n\nBe cautious with SaaS-hosted MCP servers that require long-lived AWS credentials or broad cross-account roles.\n\n## 2. Authentication and identity propagation\n\nEvaluate whether it supports:\n\n- IAM roles, STS, and short-lived credentials\n- IAM Identity Center / SSO integration\n- OIDC or workload identity federation\n- Per-user attribution, not just a shared service role\n- Clear mapping between AI user, MCP session, AWS role, and performed action\n\nYou should be able to answer: \u201cWhich human or service caused this AWS API call?\u201d\n\n## 3. Authorization and least privilege\n\nLook for:\n\n- Read-only mode by default\n- Fine-grained tool-level permissions\n- Account, region, and resource allowlists\n- IAM permission boundaries\n- Support for SCPs and organizational guardrails\n- Explicit deny controls for destructive actions\n- Role assumption policies scoped by environment or team\n\nAvoid MCP servers that require broad permissions such as `AdministratorAccess`.\n\n## 4. Change control and human approval\n\nFor enterprise use, distinguish between:\n\n- Read-only discovery tools\n- Safe diagnostics\n- Mutating operations\n- Destructive operations\n\nThe server should support approval workflows for actions like:\n\n- Deleting resources\n- Modifying IAM\n- Changing security groups\n- Updating production infrastructure\n- Creating access keys or secrets\n- Modifying networking, KMS, or logging configurations\n\nUseful features include dry-run mode, plan/apply separation, and integration with Jira, ServiceNow, Slack approvals, or internal change systems.\n\n## 5. Auditability\n\nYou should get full audit trails across:\n\n- MCP requests\n- Tool invocations\n- Prompt/session identifiers\n- User identity\n- Target AWS account and region\n- AWS API calls made\n- Parameters used\n- Results returned\n- Approval records, if applicable\n\nIntegrations to expect:\n\n- AWS CloudTrail\n- CloudWatch Logs\n- Security Lake or SIEM\n- OpenTelemetry\n- Internal audit log pipelines\n\nAudit logs should be tamper-resistant and retained according to your policy.\n\n## 6. Security controls against AI-specific risks\n\nMCP servers introduce risks beyond normal automation tooling. Evaluate protections against:\n\n- Prompt injection\n- Tool misuse\n- Data exfiltration through model responses\n- Confused deputy issues\n- Over-broad autonomous actions\n- Untrusted content influencing AWS operations\n\nImportant controls:\n\n- Tool allowlisting\n- Strict input validation\n- Output filtering/redaction\n- Context boundaries between users and tenants\n- No automatic execution of high-risk actions\n- Policy-based runtime enforcement\n- Rate limits and anomaly detection\n\n## 7. Secrets and credential handling\n\nThe MCP server should:\n\n- Never require static AWS access keys\n- Use STS or workload identity\n- Store secrets only in approved systems such as AWS Secrets Manager or HashiCorp Vault\n- Encrypt data in transit and at rest\n- Support KMS customer-managed keys\n- Avoid logging secrets, tokens, ARNs with sensitive context, or resource payloads unnecessarily\n\nCheck whether it redacts:\n\n- Secrets Manager values\n- SSM Parameter Store secure strings\n- Access keys\n- Session tokens\n- Database credentials\n- Private key material\n- Sensitive environment variables\n\n## 8. Network architecture\n\nEvaluate whether it supports:\n\n- PrivateLink or VPC endpoints\n- No outbound internet, or tightly controlled egress\n- TLS/mTLS\n- Proxy support\n- Private DNS\n- Deployment in isolated subnets\n- Egress filtering by AWS service endpoint\n\nFor regulated environments, the MCP server should not require arbitrary external callbacks.\n\n## 9. Data handling and compliance posture\n\nAsk:\n\n- What data is sent to the LLM?\n- Are AWS resource names, tags, logs, metrics, or configuration details exposed?\n- Are prompts and responses stored?\n- Can logging be disabled or routed internally?\n- Is customer data ever transmitted to third parties?\n- Does it support data residency requirements?\n- Can sensitive fields be redacted before reaching the model?\n\nIf using external LLM providers, evaluate whether MCP outputs can contain regulated data such as PII, PHI, PCI, secrets, or proprietary system details.\n\n## 10. Supported AWS services and tool design\n\nAssess which AWS capabilities are exposed.\n\nCommon read-only tools:\n\n- EC2 inventory\n- IAM analysis\n- CloudWatch metrics\n- CloudTrail lookup\n- Config rules\n- Cost Explorer\n- EKS/ECS status\n- S3 bucket configuration\n- RDS status\n- Lambda diagnostics\n\nHigher-risk mutating tools:\n\n- IAM policy changes\n- Security group updates\n- Resource deletion\n- KMS changes\n- Route table or VPC changes\n- EKS cluster modifications\n- Production deployments\n\nPrefer modular servers where you can enable only the tools you need.\n\n## 11. Multi-account and multi-region support\n\nEnterprise AWS environments usually need:\n\n- AWS Organizations support\n- Cross-account role assumption\n- Account allowlists and denylists\n- OU-aware scoping\n- Region restrictions\n- Environment labels such as dev, test, staging, prod\n- Integration with Control Tower or Landing Zone patterns\n\nThe server should not treat all accounts as equally accessible.\n\n## 12. Policy-as-code integration\n\nStrong candidates should integrate with or respect:\n\n- IAM policies\n- SCPs\n- AWS Config\n- OPA/Rego\n- Cedar / Amazon Verified Permissions\n- Terraform policy checks\n- Checkov, tfsec, cfn-guard, or similar tools\n- Internal cloud governance rules\n\nThis is especially important if AI tools can propose or execute infrastructure changes.\n\n## 13. Operational readiness\n\nEvaluate:\n\n- High availability\n- Horizontal scaling\n- Health checks\n- Metrics\n- Tracing\n- Backups, if stateful\n- Disaster recovery\n- Version pinning\n- Safe upgrades\n- Rollback support\n- SLOs and support model\n\nFor internal platform use, treat it like production infrastructure.\n\n## 14. Supply chain security\n\nCheck for:\n\n- Open-source license compatibility\n- SBOM availability\n- Signed containers or artifacts\n- Dependency scanning\n- Vulnerability management\n- SLSA provenance\n- Minimal base images\n- Regular patching\n- Active maintainership\n- Security disclosure process\n\nIf using community MCP servers, perform internal review before production use.\n\n## 15. Compatibility with your AI stack\n\nConfirm support for:\n\n- MCP protocol version used by your clients\n- Your chosen AI tools and agents\n- Streaming responses\n- Tool schemas\n- Authentication between client and MCP server\n- Session isolation\n- Concurrency limits\n- Error handling\n- Pagination for large AWS responses\n\nAlso test how well the server handles partial failures, throttling, and large AWS estates.\n\n## 16. Guardrails for production environments\n\nFor production accounts, require:\n\n- Read-only by default\n- Explicit break-glass process for write access\n- Human approval for high-risk actions\n- MFA-backed identity\n- Full audit logging\n- Region and resource scoping\n- Change-ticket linkage\n- Automated rollback or remediation where practical\n\nDo not let an AI agent directly administer production AWS with broad permissions.\n\n## 17. Recommended evaluation approach\n\nA practical evaluation plan:\n\n1. Start with read-only AWS inventory and diagnostics.\n2. Deploy the MCP server in a sandbox account.\n3. Use short-lived IAM roles only.\n4. Enable CloudTrail and MCP-level audit logs.\n5. Test prompt-injection scenarios.\n6. Verify sensitive data redaction.\n7. Validate least-privilege IAM policies.\n8. Connect to your SIEM.\n9. Run internal security review.\n10. Expand to non-prod accounts.\n11. Add approval workflows before enabling write actions.\n12. Only then consider limited production access.\n\n## 18. Key questions to ask vendors or project maintainers\n\nAsk:\n\n- Can we self-host it fully inside our AWS environment?\n- Does it require static credentials?\n- Can actions be attributed to individual users?\n- What AWS permissions are required?\n- Can we disable specific tools?\n- Does it support read-only mode?\n- How are logs, prompts, and tool outputs stored?\n- Can sensitive values be redacted?\n- Does it integrate with CloudTrail, CloudWatch, SIEM, or OpenTelemetry?\n- Does it support approval workflows?\n- How does it prevent prompt-injection-driven tool misuse?\n- Is there an SBOM?\n- Are images signed?\n- What compliance certifications apply, if any?\n- How are vulnerabilities disclosed and patched?\n\n## Bottom line\n\nFor an enterprise AWS MCP server, prioritize:\n\n1. Self-hosting and private networking  \n2. Short-lived IAM credentials  \n3. Per-user attribution  \n4. Least-privilege tool access  \n5. Strong audit logging  \n6. Read-only default posture  \n7. Approval workflows for mutations  \n8. Sensitive data redaction  \n9. Supply chain security  \n10. Integration with existing AWS governance controls  \n\nThe safest initial pattern is a self-hosted, read-only MCP server for AWS diagnostics and inventory, with tightly scoped account access and full audit logging. Only add write capabilities after you have approval gates, policy enforcement, and production-grade observability in place.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 18, "phrasing": "Which MCP server gives AI coding assistants real-time context on AWS cloud infrastructure?", "text": "The **AWS API MCP Server** gives AI coding assistants real-time context on AWS cloud infrastructure by allowing them to query and interact with AWS services through AWS APIs/CLI.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 19, "phrasing": "What MCP server should I use to let AI models run AWS CLI commands safely?", "text": "Use the **AWS Labs AWS CLI MCP Server** \u2014 typically named:\n\n**`awslabs.aws-cli-mcp-server`**\n\nIt is designed specifically to let AI assistants execute **AWS CLI** commands through MCP with safer controls than giving the model arbitrary shell access.\n\nExample MCP config:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-cli\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-cli-mcp-server\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"your-profile\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\nSafety tips:\n\n- Use **least-privilege IAM credentials**\n- Prefer a **read-only role** unless writes are required\n- Avoid production credentials by default\n- Require human approval for destructive or mutating commands\n- Do not expose a generic shell MCP server for AWS access\n\nSo the short answer is: **use the AWS Labs `aws-cli-mcp-server` MCP server, with tightly scoped AWS credentials.**", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 20, "phrasing": "Model Context Protocol server for querying AWS Cost Explorer and billing via AI", "text": "Below is a simple **Model Context Protocol (MCP) server** that lets an AI assistant query **AWS Cost Explorer, Budgets, and billing-related data**.\n\n## 1. Install dependencies\n\n```bash\npip install mcp boto3\n```\n\n## 2. Create `aws_cost_mcp_server.py`\n\n```python\nimport os\nimport json\nfrom typing import Optional\n\nimport boto3\nfrom mcp.server.fastmcp import FastMCP\n\nmcp = FastMCP(\"aws-cost-explorer\")\n\nAWS_REGION = os.getenv(\"AWS_REGION\", \"us-east-1\")\n\nce = boto3.client(\"ce\", region_name=AWS_REGION)\nbudgets = boto3.client(\"budgets\", region_name=AWS_REGION)\nsts = boto3.client(\"sts\", region_name=AWS_REGION)\n\n\ndef _json_or_none(value: Optional[str]):\n    if not value:\n        return None\n    return json.loads(value)\n\n\n@mcp.tool()\ndef get_cost_and_usage(\n    start: str,\n    end: str,\n    granularity: str = \"MONTHLY\",\n    metrics: str = \"UnblendedCost\",\n    group_by_dimension: Optional[str] = None,\n    filter_json: Optional[str] = None,\n):\n    \"\"\"\n    Query AWS Cost Explorer cost and usage.\n\n    Args:\n        start: Start date, YYYY-MM-DD.\n        end: End date, YYYY-MM-DD. Exclusive.\n        granularity: DAILY, MONTHLY, or HOURLY.\n        metrics: Comma-separated metrics, e.g. UnblendedCost,UsageQuantity.\n        group_by_dimension: Optional AWS dimension, e.g. SERVICE, LINKED_ACCOUNT, REGION.\n        filter_json: Optional Cost Explorer Filter JSON string.\n    \"\"\"\n\n    request = {\n        \"TimePeriod\": {\n            \"Start\": start,\n            \"End\": end,\n        },\n        \"Granularity\": granularity,\n        \"Metrics\": [m.strip() for m in metrics.split(\",\")],\n    }\n\n    if group_by_dimension:\n        request[\"GroupBy\"] = [\n            {\n                \"Type\": \"DIMENSION\",\n                \"Key\": group_by_dimension,\n            }\n        ]\n\n    parsed_filter = _json_or_none(filter_json)\n    if parsed_filter:\n        request[\"Filter\"] = parsed_filter\n\n    return ce.get_cost_and_usage(**request)\n\n\n@mcp.tool()\ndef get_cost_forecast(\n    start: str,\n    end: str,\n    metric: str = \"UNBLENDED_COST\",\n    granularity: str = \"MONTHLY\",\n    filter_json: Optional[str] = None,\n):\n    \"\"\"\n    Get AWS Cost Explorer cost forecast.\n\n    Args:\n        start: Forecast start date, YYYY-MM-DD.\n        end: Forecast end date, YYYY-MM-DD.\n        metric: BLENDED_COST, UNBLENDED_COST, AMORTIZED_COST, NET_UNBLENDED_COST, etc.\n        granularity: DAILY or MONTHLY.\n        filter_json: Optional Cost Explorer Filter JSON string.\n    \"\"\"\n\n    request = {\n        \"TimePeriod\": {\n            \"Start\": start,\n            \"End\": end,\n        },\n        \"Metric\": metric,\n        \"Granularity\": granularity,\n    }\n\n    parsed_filter = _json_or_none(filter_json)\n    if parsed_filter:\n        request[\"Filter\"] = parsed_filter\n\n    return ce.get_cost_forecast(**request)\n\n\n@mcp.tool()\ndef get_dimension_values(\n    start: str,\n    end: str,\n    dimension: str = \"SERVICE\",\n    search_string: Optional[str] = None,\n):\n    \"\"\"\n    List available Cost Explorer dimension values.\n\n    Args:\n        start: Start date, YYYY-MM-DD.\n        end: End date, YYYY-MM-DD.\n        dimension: SERVICE, LINKED_ACCOUNT, REGION, USAGE_TYPE, INSTANCE_TYPE, etc.\n        search_string: Optional search string.\n    \"\"\"\n\n    request = {\n        \"TimePeriod\": {\n            \"Start\": start,\n            \"End\": end,\n        },\n        \"Dimension\": dimension,\n    }\n\n    if search_string:\n        request[\"SearchString\"] = search_string\n\n    return ce.get_dimension_values(**request)\n\n\n@mcp.tool()\ndef get_anomalies(\n    start: str,\n    end: str,\n    monitor_arn: Optional[str] = None,\n):\n    \"\"\"\n    Get AWS Cost Anomaly Detection anomalies.\n\n    Args:\n        start: Start date, YYYY-MM-DD.\n        end: End date, YYYY-MM-DD.\n        monitor_arn: Optional Cost Anomaly Monitor ARN.\n    \"\"\"\n\n    request = {\n        \"DateInterval\": {\n            \"StartDate\": start,\n            \"EndDate\": end,\n        }\n    }\n\n    if monitor_arn:\n        request[\"MonitorArn\"] = monitor_arn\n\n    return ce.get_anomalies(**request)\n\n\n@mcp.tool()\ndef list_budgets():\n    \"\"\"\n    List AWS Budgets for the current AWS account.\n    \"\"\"\n\n    account_id = sts.get_caller_identity()[\"Account\"]\n    return budgets.describe_budgets(AccountId=account_id)\n\n\n@mcp.tool()\ndef get_budget_performance_data(\n    budget_name: str,\n    start: str,\n    end: str,\n    granularity: str = \"MONTHLY\",\n):\n    \"\"\"\n    Get AWS Budget performance data.\n\n    Args:\n        budget_name: Name of the AWS Budget.\n        start: Start date, YYYY-MM-DD.\n        end: End date, YYYY-MM-DD.\n        granularity: DAILY, MONTHLY, or QUARTERLY.\n    \"\"\"\n\n    account_id = sts.get_caller_identity()[\"Account\"]\n\n    return budgets.describe_budget_performance_history(\n        AccountId=account_id,\n        BudgetName=budget_name,\n        TimePeriod={\n            \"Start\": start,\n            \"End\": end,\n        },\n        Granularity=granularity,\n    )\n\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\n## 3. Example IAM policy\n\nAttach this to the IAM role/user used by the MCP server:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"ce:GetCostAndUsage\",\n        \"ce:GetCostForecast\",\n        \"ce:GetDimensionValues\",\n        \"ce:GetAnomalies\",\n        \"budgets:DescribeBudgets\",\n        \"budgets:DescribeBudgetPerformanceHistory\",\n        \"sts:GetCallerIdentity\"\n      ],\n      \"Resource\": \"*\"\n    }\n  ]\n}\n```\n\n## 4. Claude Desktop MCP config example\n\nAdd this to your MCP config:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-cost-explorer\": {\n      \"command\": \"python\",\n      \"args\": [\n        \"/absolute/path/to/aws_cost_mcp_server.py\"\n      ],\n      \"env\": {\n        \"AWS_PROFILE\": \"default\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\n## 5. Example AI prompts\n\nOnce connected, you can ask:\n\n```text\nWhat did we spend on AWS last month, grouped by service?\n```\n\n```text\nShow daily AWS costs for the last 30 days.\n```\n\n```text\nForecast this month's AWS bill.\n```\n\n```text\nWhich AWS services had the biggest cost increase this month?\n```\n\n```text\nList my AWS budgets and tell me which ones are close to being exceeded.\n```\n\nCost Explorer must be enabled in the AWS account before these APIs return useful data.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 21, "phrasing": "What is the standard MCP server for Amazon Web Services integrations?", "text": "The standard/general-purpose MCP server for Amazon Web Services integrations is the **AWS API MCP Server** from **AWS Labs**.\n\nIt is commonly referenced as:\n\n**`awslabs/aws-api-mcp-server`**\n\nIt lets MCP clients interact with AWS services through AWS APIs using your configured AWS credentials and IAM permissions.\n\nAWS also provides more specialized MCP servers, such as AWS Documentation, CDK, CloudFormation, Lambda, ECS/EKS, and Cost Explorer MCP servers, but the general AWS integration server is the **AWS API MCP Server**.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 22, "phrasing": "Recommended MCP server for connecting AI agents to AWS Lambda and API Gateway", "text": "Recommended choice: **AWS Labs Lambda Tool MCP Server** if your goal is to let AI agents call AWS Lambda functions as tools.\n\nUse it when:\n\n- You already have business logic in **AWS Lambda**\n- You want the agent to invoke specific Lambda functions safely\n- You want IAM-based access control instead of exposing everything through public HTTP APIs\n\nGitHub/org to look for: **`awslabs/mcp`** / **AWS Labs MCP servers**, specifically the **Lambda Tool MCP Server**.\n\nAlso consider:\n\n| Use case | Recommended MCP server |\n|---|---|\n| Invoke Lambda functions from an AI agent | **AWS Labs Lambda Tool MCP Server** |\n| Manage AWS resources including Lambda/API Gateway | **AWS Labs AWS API MCP Server** |\n| Let an agent call API Gateway REST/HTTP APIs | **OpenAPI MCP server** using your API Gateway OpenAPI spec |\n| Help agent understand AWS docs/configs | **AWS Documentation MCP Server** |\n\nMy recommendation:\n\n- For **agent \u2192 Lambda**: use **AWS Labs Lambda Tool MCP Server**\n- For **agent \u2192 API Gateway endpoint**: export your API Gateway as **OpenAPI** and connect it through an **OpenAPI MCP server**\n- For **agent managing AWS infra**: use **AWS API MCP Server**, but restrict IAM permissions carefully\n\nFor production, give the MCP server a tightly scoped IAM role, for example only:\n\n```json\n{\n  \"Effect\": \"Allow\",\n  \"Action\": [\n    \"lambda:InvokeFunction\"\n  ],\n  \"Resource\": [\n    \"arn:aws:lambda:REGION:ACCOUNT_ID:function:YOUR_FUNCTION_NAME\"\n  ]\n}\n```", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 23, "phrasing": "Best MCP server for letting an LLM query Amazon RDS databases", "text": "The \u201cbest\u201d MCP server depends on which RDS engine you use.\n\n## Best choice for RDS PostgreSQL / Aurora PostgreSQL\n\nUse the official PostgreSQL MCP server:\n\n```bash\nnpx -y @modelcontextprotocol/server-postgres postgresql://user:pass@rds-endpoint:5432/dbname?sslmode=require\n```\n\nExample Claude Desktop config:\n\n```json\n{\n  \"mcpServers\": {\n    \"rds-postgres\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"@modelcontextprotocol/server-postgres\",\n        \"postgresql://readonly_user:password@mydb.abc123.us-east-1.rds.amazonaws.com:5432/mydb?sslmode=require\"\n      ]\n    }\n  }\n}\n```\n\nWhy this is usually the best option:\n\n- Works with Amazon RDS PostgreSQL because RDS exposes standard Postgres\n- Lets the LLM inspect schemas and run SQL\n- Simple to deploy locally or in a private network\n- Can be secured with a read-only database user\n\n## Best choice for RDS MySQL / MariaDB\n\nUse a MySQL MCP server, for example one of the community `mcp-server-mysql` implementations.\n\nTypical config looks like:\n\n```json\n{\n  \"mcpServers\": {\n    \"rds-mysql\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"mcp-server-mysql\",\n        \"--host\", \"mydb.abc123.us-east-1.rds.amazonaws.com\",\n        \"--port\", \"3306\",\n        \"--user\", \"readonly_user\",\n        \"--password\", \"password\",\n        \"--database\", \"mydb\"\n      ]\n    }\n  }\n}\n```\n\nBecause MySQL MCP servers are mostly community-maintained, review the code and permissions before using one in production.\n\n## If using Aurora Serverless with Data API\n\nIf your Aurora cluster supports the RDS Data API, a custom MCP server wrapping:\n\n```text\nrds-data:ExecuteStatement\n```\n\ncan be safer than exposing a direct DB connection. This is useful when you want IAM-based access instead of long-lived DB credentials.\n\n## My recommendation\n\nFor most RDS use cases:\n\n1. **RDS PostgreSQL / Aurora PostgreSQL**: use `@modelcontextprotocol/server-postgres`\n2. **RDS MySQL / MariaDB**: use a vetted MySQL MCP server\n3. **Production / sensitive data**: put the MCP server inside your VPC and use a read-only DB role\n4. **Aurora Data API available**: consider a custom Data API MCP server with IAM controls\n\nAlso strongly recommended:\n\n- Create a dedicated read-only database user\n- Restrict access to specific schemas/tables\n- Enforce row limits\n- Disable writes unless explicitly needed\n- Use SSL/TLS with RDS\n- Avoid exposing the RDS endpoint publicly\n- Log all queries issued by the MCP server", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 24, "phrasing": "We need an MCP server to let our AI assistant analyze AWS CloudTrail logs. What server works best?", "text": "Best choice: **AWS Labs CloudWatch Logs MCP Server** \u2014 if your CloudTrail events are delivered to **CloudWatch Logs**.\n\nWhy it fits best:\n- Lets the assistant run **CloudWatch Logs Insights** queries.\n- Works well for investigation-style questions like:\n  - \u201cWho disabled MFA?\u201d\n  - \u201cShow failed console logins from unusual IPs.\u201d\n  - \u201cFind IAM policy changes in the last 24 hours.\u201d\n- Avoids giving the assistant broad AWS CLI access.\n- Easy to scope with read-only IAM permissions.\n\nRecommended setup:\n\n1. Configure CloudTrail to send events to a CloudWatch Logs log group.\n2. Connect your AI assistant to the **CloudWatch Logs MCP server**.\n3. Grant minimal IAM permissions such as:\n\n```json\n{\n  \"Effect\": \"Allow\",\n  \"Action\": [\n    \"logs:DescribeLogGroups\",\n    \"logs:DescribeLogStreams\",\n    \"logs:StartQuery\",\n    \"logs:GetQueryResults\",\n    \"logs:StopQuery\",\n    \"logs:FilterLogEvents\"\n  ],\n  \"Resource\": \"*\"\n}\n```\n\nRestrict `Resource` to your CloudTrail log group ARNs if possible.\n\nExample CloudWatch Logs Insights query the assistant could run:\n\n```sql\nfields @timestamp, eventName, userIdentity.arn, sourceIPAddress, errorCode\n| filter eventSource = \"iam.amazonaws.com\"\n| sort @timestamp desc\n| limit 50\n```\n\nIf your CloudTrail logs are stored mainly in **S3**, then the better option is an **Athena MCP server** querying CloudTrail logs through Athena.\n\nSo the short answer:\n\n- **CloudTrail \u2192 CloudWatch Logs:** use **AWS Labs CloudWatch Logs MCP Server**.\n- **CloudTrail \u2192 S3/data lake:** use an **Athena MCP server**.\n- **CloudTrail Lake:** use or build an MCP server around CloudTrail Lake query APIs.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 25, "phrasing": "Which MCP server bridges local AI clients with AWS cloud management APIs?", "text": "The **AWS Cloud Control MCP Server** bridges local MCP-compatible AI clients with AWS cloud management APIs, enabling AI tools to manage AWS resources through the AWS Cloud Control API.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 26, "phrasing": "Most active open source MCP server project for Amazon Web Services", "text": "The most active and credible open-source MCP project for Amazon Web Services is:\n\n**AWS Labs MCP Servers**  \nGitHub: https://github.com/awslabs/mcp\n\nIt is an official AWS Labs open-source monorepo containing multiple MCP servers for AWS, including support for things like:\n\n- AWS documentation\n- AWS CDK\n- CloudWatch Logs\n- Cost analysis\n- Bedrock / Knowledge Bases\n- Terraform on AWS\n- General AWS API interactions\n\nIf you want a general AWS-focused MCP server, start with **`awslabs/mcp`**.  \nIf you specifically want MCP access to AWS APIs, look for the **AWS API MCP Server** inside that repo.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 27, "phrasing": "What MCP server allows AI agents to inspect and modify AWS S3 bucket policies?", "text": "The **AWS S3 Bucket Policy MCP Server** allows AI agents to inspect and modify AWS S3 bucket policies.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 28, "phrasing": "Best lightweight MCP server for AWS developer tooling", "text": "The best lightweight choice is **AWS Labs\u2019 AWS Documentation MCP Server**:\n\n**`awslabs.aws-documentation-mcp-server`**\n\nWhy it\u2019s a good default:\n\n- Official AWS Labs MCP server\n- Lightweight and read-only\n- No AWS credentials required\n- Great for SDK, CLI, CDK, CloudFormation, IAM, service docs, and architecture guidance\n- Low-risk compared with MCP servers that can call live AWS APIs\n\nExample config:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-docs\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-documentation-mcp-server@latest\"],\n      \"env\": {\n        \"FASTMCP_LOG_LEVEL\": \"ERROR\"\n      }\n    }\n  }\n}\n```\n\nIf you use CDK heavily, add:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-cdk\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.cdk-mcp-server@latest\"],\n      \"env\": {\n        \"FASTMCP_LOG_LEVEL\": \"ERROR\"\n      }\n    }\n  }\n}\n```\n\nMy recommendation:\n\n- **General AWS development:** `aws-documentation-mcp-server`\n- **CDK projects:** add `cdk-mcp-server`\n- **Live AWS account operations:** only use an AWS API/CLI-style MCP server with tightly scoped IAM permissions and a sandbox account.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 29, "phrasing": "We want our AI workflow to fetch metrics from Amazon CloudWatch via MCP. Which server implementation should we deploy?", "text": "Deploy the **AWS Labs CloudWatch MCP Server** \u2014 i.e. the `awslabs/cloudwatch-mcp-server` implementation.\n\nIt is the appropriate MCP server for letting an AI workflow query Amazon CloudWatch data such as metrics and related observability information.\n\nYou\u2019ll need to configure it with AWS credentials/role permissions such as:\n\n- `cloudwatch:GetMetricData`\n- `cloudwatch:GetMetricStatistics`\n- `cloudwatch:ListMetrics`\n- Relevant regional access to the CloudWatch namespaces you want to query.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 30, "phrasing": "Which Model Context Protocol server is best for connecting desktop AI assistants to AWS account resources?", "text": "The best fit is the **AWS API MCP Server** (from **AWS Labs / awslabs**).\n\nIt\u2019s designed to let MCP-compatible desktop AI assistants, such as Claude Desktop, connect to and operate on resources in your AWS account using your configured AWS credentials.\n\nUse it if you want the assistant to inspect or manage AWS resources. If you only need AWS documentation lookup, use the **AWS Documentation MCP Server** instead.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 31, "phrasing": "Top MCP servers for Amazon Web Services cloud automation and DevOps", "text": "Here are the top MCP servers to consider for AWS cloud automation and DevOps workflows.\n\n| MCP server | Best for | Why it matters |\n|---|---|---|\n| **AWS API MCP Server** | General AWS automation | Lets an AI agent call AWS APIs through your configured AWS credentials. Useful for inspecting and managing EC2, IAM, S3, Lambda, ECS, EKS, RDS, CloudFormation, etc. |\n| **AWS Documentation MCP Server** | AWS research, troubleshooting, architecture guidance | Gives the agent access to current AWS documentation instead of relying only on model memory. Very useful for IaC, service limits, CLI syntax, and best practices. |\n| **AWS CDK MCP Server** | Infrastructure as Code with AWS CDK | Helps generate, review, and explain CDK constructs, stacks, and patterns. Good for teams using TypeScript, Python, Java, or .NET CDK. |\n| **AWS Terraform MCP Server** | Terraform-based AWS provisioning | Useful for Terraform module generation, provider docs lookup, resource explanations, and IaC review. Good fit for DevOps and platform engineering teams. |\n| **AWS CloudFormation / Cloud Control API MCP tooling** | CloudFormation and native AWS IaC | Useful if your org standardizes on CloudFormation, SAM, or StackSets. Helps inspect stacks, resources, drift, and templates. |\n| **AWS Cost Analysis MCP Server** | FinOps and cost optimization | Helps query cost data, identify expensive services, analyze trends, and suggest optimization opportunities. |\n| **AWS Pricing MCP Server** | Cost estimation and architecture planning | Useful when comparing instance types, storage classes, managed services, or estimating cost before deployment. |\n| **AWS Diagram MCP Server** | Architecture diagrams | Generates AWS architecture diagrams from descriptions or existing infrastructure context. Helpful for documentation and design reviews. |\n| **Kubernetes MCP Server** | EKS operations | Not AWS-specific, but very useful for EKS clusters. Can inspect pods, deployments, services, namespaces, logs, and cluster state. |\n| **GitHub or GitLab MCP Server** | CI/CD and DevOps workflows | Pairs well with AWS automation for pull requests, deployment pipelines, Terraform/CDK reviews, GitHub Actions, and release workflows. |\n| **Docker MCP Server** | Container workflows | Useful for ECS, EKS, and CodeBuild workflows involving Dockerfiles, image builds, and container debugging. |\n| **Prometheus / Grafana MCP Servers** | Observability | Helpful for querying metrics, dashboards, alerts, and incident context in AWS-hosted workloads. |\n\n### Recommended AWS DevOps MCP stack\n\nFor most AWS automation teams, I\u2019d start with:\n\n1. **AWS Documentation MCP Server**\n2. **AWS API MCP Server**\n3. **AWS CDK MCP Server** or **AWS Terraform MCP Server**\n4. **AWS Cost Analysis MCP Server**\n5. **Kubernetes MCP Server** if using EKS\n6. **GitHub/GitLab MCP Server** for CI/CD workflows\n\n### Practical security advice\n\nUse separate AWS profiles or roles for MCP access:\n\n- `aws-readonly` for discovery, docs, audits, and analysis\n- `aws-devops-limited` for controlled changes\n- Avoid giving MCP agents full `AdministratorAccess`\n- Require human approval for destructive actions such as deleting stacks, modifying IAM, terminating EC2, or changing production infrastructure\n\nIf you want the safest setup, run AWS MCP servers first with read-only IAM permissions and add write access only for specific services and environments.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 32, "phrasing": "How to expose AWS infrastructure context to LLMs using an MCP server?", "text": "Use an MCP server as a controlled bridge between your LLM client and AWS APIs. The LLM does not get raw AWS credentials; it gets access to specific MCP tools/resources that you define.\n\n## 1. What to expose\n\nTypical AWS infrastructure context:\n\n- Accounts and regions\n- VPCs, subnets, route tables, NAT gateways\n- EC2 instances, ASGs, load balancers\n- ECS/EKS clusters\n- RDS, DynamoDB, ElastiCache\n- IAM roles and policies\n- CloudFormation stacks / Terraform state\n- CloudWatch metrics and logs\n- AWS Config relationships\n- Cost Explorer summaries\n- Resource Explorer search results\n\n## 2. High-level architecture\n\n```text\nLLM Client\n  \u2514\u2500\u2500 MCP Client\n        \u2514\u2500\u2500 Your AWS MCP Server\n              \u251c\u2500\u2500 AWS SDK / boto3\n              \u251c\u2500\u2500 AWS Resource Explorer\n              \u251c\u2500\u2500 AWS Config\n              \u251c\u2500\u2500 CloudFormation / Terraform state\n              \u251c\u2500\u2500 CloudWatch\n              \u2514\u2500\u2500 IAM read-only role\n```\n\nThe MCP server exposes AWS context through:\n\n- **Tools**: callable actions, e.g. `list_ec2_instances`, `get_vpc_topology`\n- **Resources**: read-only documents, e.g. `aws://account/123456789012/vpcs`\n- **Prompts**: reusable templates, e.g. \u201cExplain this VPC architecture\u201d\n\n## 3. Example MCP server using Python\n\nInstall dependencies:\n\n```bash\npip install mcp boto3\n```\n\nCreate `aws_mcp_server.py`:\n\n```python\nfrom mcp.server.fastmcp import FastMCP\nimport boto3\n\nmcp = FastMCP(\"aws-infrastructure-context\")\n\nsession = boto3.Session(profile_name=\"readonly\")\nec2 = session.client(\"ec2\")\nsts = session.client(\"sts\")\n\n\n@mcp.tool()\ndef get_current_account() -> dict:\n    \"\"\"\n    Return the AWS account identity used by this MCP server.\n    \"\"\"\n    return sts.get_caller_identity()\n\n\n@mcp.tool()\ndef list_vpcs(region: str = \"us-east-1\") -> list:\n    \"\"\"\n    List VPCs in a region.\n    \"\"\"\n    client = session.client(\"ec2\", region_name=region)\n    response = client.describe_vpcs()\n\n    return [\n        {\n            \"VpcId\": vpc[\"VpcId\"],\n            \"CidrBlock\": vpc.get(\"CidrBlock\"),\n            \"IsDefault\": vpc.get(\"IsDefault\"),\n            \"Tags\": vpc.get(\"Tags\", []),\n        }\n        for vpc in response[\"Vpcs\"]\n    ]\n\n\n@mcp.tool()\ndef list_ec2_instances(region: str = \"us-east-1\") -> list:\n    \"\"\"\n    List EC2 instances with basic metadata.\n    \"\"\"\n    client = session.client(\"ec2\", region_name=region)\n    response = client.describe_instances()\n\n    instances = []\n\n    for reservation in response[\"Reservations\"]:\n        for instance in reservation[\"Instances\"]:\n            instances.append(\n                {\n                    \"InstanceId\": instance[\"InstanceId\"],\n                    \"InstanceType\": instance[\"InstanceType\"],\n                    \"State\": instance[\"State\"][\"Name\"],\n                    \"VpcId\": instance.get(\"VpcId\"),\n                    \"SubnetId\": instance.get(\"SubnetId\"),\n                    \"PrivateIpAddress\": instance.get(\"PrivateIpAddress\"),\n                    \"Tags\": instance.get(\"Tags\", []),\n                }\n            )\n\n    return instances\n\n\n@mcp.tool()\ndef get_security_groups(region: str = \"us-east-1\") -> list:\n    \"\"\"\n    Return security groups and ingress/egress rules.\n    \"\"\"\n    client = session.client(\"ec2\", region_name=region)\n    response = client.describe_security_groups()\n\n    return [\n        {\n            \"GroupId\": sg[\"GroupId\"],\n            \"GroupName\": sg[\"GroupName\"],\n            \"VpcId\": sg.get(\"VpcId\"),\n            \"IngressRules\": sg.get(\"IpPermissions\", []),\n            \"EgressRules\": sg.get(\"IpPermissionsEgress\", []),\n            \"Tags\": sg.get(\"Tags\", []),\n        }\n        for sg in response[\"SecurityGroups\"]\n    ]\n\n\n@mcp.resource(\"aws://vpcs/{region}\")\ndef vpcs_resource(region: str) -> str:\n    \"\"\"\n    Expose VPC inventory as an MCP resource.\n    \"\"\"\n    vpcs = list_vpcs(region)\n    return str(vpcs)\n\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\nRun it:\n\n```bash\npython aws_mcp_server.py\n```\n\n## 4. Configure your MCP client\n\nFor example, in a local MCP-compatible client config:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-infra\": {\n      \"command\": \"python\",\n      \"args\": [\"/path/to/aws_mcp_server.py\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"readonly\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\nThen the LLM can ask questions like:\n\n> What EC2 instances are running in us-east-1?\n\nor:\n\n> Summarize the network architecture for my default VPC.\n\nThe model will call your MCP tools to retrieve live AWS context.\n\n## 5. Recommended AWS data sources\n\nFor richer infrastructure context, combine multiple AWS APIs.\n\n### AWS Resource Explorer\n\nGood for broad inventory search.\n\n```python\nresource_explorer = session.client(\"resource-explorer-2\")\n\n@mcp.tool()\ndef search_resources(query: str, region: str = \"us-east-1\") -> dict:\n    client = session.client(\"resource-explorer-2\", region_name=region)\n    return client.search(QueryString=query)\n```\n\nExample query:\n\n```text\nservice:ec2 region:us-east-1\n```\n\n### AWS Config\n\nGood for relationships and historical configuration.\n\n```python\nconfig = session.client(\"config\")\n\n@mcp.tool()\ndef get_resource_config(\n    resource_type: str,\n    resource_id: str,\n    region: str = \"us-east-1\"\n) -> dict:\n    client = session.client(\"config\", region_name=region)\n    return client.get_resource_config_history(\n        resourceType=resource_type,\n        resourceId=resource_id,\n        limit=1\n    )\n```\n\n### CloudFormation\n\nGood for stack-based infrastructure context.\n\n```python\n@mcp.tool()\ndef list_cloudformation_stacks(region: str = \"us-east-1\") -> list:\n    client = session.client(\"cloudformation\", region_name=region)\n    response = client.describe_stacks()\n\n    return [\n        {\n            \"StackName\": stack[\"StackName\"],\n            \"StackStatus\": stack[\"StackStatus\"],\n            \"CreationTime\": str(stack[\"CreationTime\"]),\n            \"Outputs\": stack.get(\"Outputs\", []),\n            \"Tags\": stack.get(\"Tags\", []),\n        }\n        for stack in response[\"Stacks\"]\n    ]\n```\n\n## 6. Security best practices\n\nUse a dedicated IAM role for the MCP server.\n\nExample permissions:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"ec2:Describe*\",\n        \"elasticloadbalancing:Describe*\",\n        \"autoscaling:Describe*\",\n        \"ecs:Describe*\",\n        \"ecs:List*\",\n        \"eks:Describe*\",\n        \"eks:List*\",\n        \"rds:Describe*\",\n        \"cloudformation:Describe*\",\n        \"cloudformation:List*\",\n        \"config:Get*\",\n        \"config:List*\",\n        \"config:Describe*\",\n        \"resource-explorer-2:Search\",\n        \"cloudwatch:GetMetricData\",\n        \"cloudwatch:ListMetrics\",\n        \"logs:DescribeLogGroups\",\n        \"logs:DescribeLogStreams\"\n      ],\n      \"Resource\": \"*\"\n    }\n  ]\n}\n```\n\nRecommendations:\n\n- Start with **read-only** permissions.\n- Do not expose destructive tools like `delete_instance` unless heavily guarded.\n- Add allowlists for accounts and regions.\n- Redact secrets, tokens, user data, and sensitive tags.\n- Log all MCP tool calls.\n- Use STS assume-role instead of long-lived credentials.\n- Consider approval workflows for write actions.\n\n## 7. Useful MCP tools to implement\n\n```text\nget_current_account()\nlist_regions()\nsearch_resources(query, region)\nlist_vpcs(region)\nget_vpc_topology(vpc_id, region)\nlist_ec2_instances(region)\nget_instance_details(instance_id, region)\nlist_security_groups(region)\nanalyze_security_group(group_id, region)\nlist_load_balancers(region)\nlist_rds_instances(region)\nlist_cloudformation_stacks(region)\nget_cloudwatch_metrics(resource_id, region)\nget_recent_logs(log_group, filter_pattern)\nsummarize_costs(service, start_date, end_date)\n```\n\n## 8. Example user questions enabled by this\n\nOnce connected, you can ask the LLM:\n\n- \u201cShow me all public-facing load balancers.\u201d\n- \u201cWhich EC2 instances are in private subnets?\u201d\n- \u201cExplain the topology of VPC `vpc-1234`.\u201d\n- \u201cFind overly permissive security groups.\u201d\n- \u201cSummarize recent RDS CPU metrics.\u201d\n- \u201cWhat changed in this CloudFormation stack?\u201d\n- \u201cWhich resources appear unused?\u201d\n- \u201cEstimate which services are driving AWS cost.\u201d\n\nIn short: create an MCP server that wraps read-only AWS SDK calls, expose those calls as MCP tools/resources, connect it to your LLM client, and secure it with tightly scoped IAM permissions.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 33, "phrasing": "What MCP server enables natural language querying of AWS infrastructure status?", "text": "The **AWS MCP Server** (`mcp-server-aws`) enables natural language querying of AWS infrastructure status.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 34, "phrasing": "Best enterprise-grade MCP server with role-based access control for AWS cloud resources", "text": "For **enterprise-grade MCP access to AWS resources with role-based access control**, the best choice is usually:\n\n## Best option: **Amazon Bedrock AgentCore Gateway + AWS IAM**\n\nIf you are building for production on AWS, use **Amazon Bedrock AgentCore Gateway** or a similar AWS-native MCP gateway pattern rather than exposing a generic MCP server with broad AWS credentials.\n\n### Why this is the best fit\n\n- **Native AWS security model**\n  - Use **IAM roles**, **IAM Identity Center**, STS, permission boundaries, SCPs, and CloudTrail.\n- **Role-based access control**\n  - Map users, groups, or agents to specific AWS IAM roles.\n  - Example: `ReadOnlyOpsRole`, `DevDeployRole`, `SecurityAuditRole`.\n- **Enterprise auditability**\n  - AWS CloudTrail logs API activity.\n  - You can add CloudWatch, GuardDuty, Security Hub, and AWS Config.\n- **Least-privilege design**\n  - Expose only approved actions as MCP tools.\n  - Avoid giving an LLM direct unrestricted AWS API access.\n- **Better production posture**\n  - Works well with private networking, IAM, Lambda, API Gateway, and existing AWS controls.\n\n---\n\n## Recommended architecture\n\n```text\nAI Client / Agent\n      \u2193\nMCP Gateway / AgentCore Gateway\n      \u2193\nAuth layer: IAM Identity Center / OIDC / SSO\n      \u2193\nRole mapping\n      \u2193\nAWS Lambda or controlled AWS SDK tools\n      \u2193\nAWS services: EC2, S3, ECS, EKS, RDS, CloudWatch, IAM, etc.\n```\n\nEach MCP tool should call a narrowly scoped backend function.\n\nExample tools:\n\n```text\nlist_ec2_instances\nget_cloudwatch_logs\ndescribe_rds_instances\nrestart_ecs_service\ncreate_s3_presigned_url\n```\n\nAvoid exposing a generic tool like:\n\n```text\naws_api_call(service, action, parameters)\n```\n\nunless it is heavily policy-controlled.\n\n---\n\n## Good supporting option: **AWS Labs MCP Servers**\n\nAWS provides open-source MCP servers under AWS Labs, including ones for:\n\n- AWS documentation\n- CDK\n- Terraform\n- AWS APIs\n- CloudWatch\n- Cost analysis\n- Bedrock-related workflows\n\nThese are useful, but for enterprise use I would put them behind:\n\n- IAM-based authentication\n- network isolation\n- an MCP gateway\n- audit logging\n- explicit allowlists\n- least-privilege roles\n\nThe generic AWS API MCP server is powerful but should be used very carefully in production.\n\n---\n\n## My recommendation\n\nIf your priority is **enterprise security and RBAC**, use:\n\n> **Amazon Bedrock AgentCore Gateway backed by least-privilege AWS IAM roles and controlled Lambda/API tools.**\n\nIf you want open-source building blocks, use:\n\n> **AWS Labs MCP Servers**, but deploy them behind your own auth gateway with IAM role mapping and strict tool-level permissions.\n\n---\n\n## Avoid\n\nDo not run an MCP server with:\n\n- long-lived AWS access keys\n- administrator credentials\n- unrestricted AWS SDK access\n- no per-user authorization\n- no audit logs\n- no tool allowlist\n\nThat is not enterprise-grade.\n\n---\n\n### Short answer\n\nThe best enterprise-grade MCP approach for AWS RBAC is **Amazon Bedrock AgentCore Gateway with AWS IAM role mapping**, optionally using **AWS Labs MCP servers** as backend tools where appropriate.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 35, "phrasing": "Which AWS MCP server supports fine-grained IAM permission scoping for AI tools?", "text": "The **AWS API MCP Server** supports fine-grained IAM permission scoping for AI tools. It lets AI assistants call AWS APIs while relying on AWS IAM policies to tightly control which services, actions, and resources the tools can access.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 36, "phrasing": "We need an MCP server so our developer assistant can create and check AWS SQS queues. What should we use?", "text": "Use the **AWS Labs AWS API MCP Server**.\n\nIt lets your developer assistant call AWS APIs directly, including SQS operations like:\n\n- `sqs:CreateQueue`\n- `sqs:GetQueueUrl`\n- `sqs:GetQueueAttributes`\n- `sqs:ListQueues`\n- `sqs:TagQueue`\n- `sqs:SetQueueAttributes`\n\nExample MCP config:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-api\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-api-mcp-server@latest\"],\n      \"env\": {\n        \"AWS_REGION\": \"us-east-1\",\n        \"AWS_PROFILE\": \"dev\"\n      }\n    }\n  }\n}\n```\n\nUse an AWS IAM role/profile with least-privilege SQS permissions, for example:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"sqs:CreateQueue\",\n        \"sqs:GetQueueUrl\",\n        \"sqs:GetQueueAttributes\",\n        \"sqs:ListQueues\",\n        \"sqs:TagQueue\",\n        \"sqs:SetQueueAttributes\"\n      ],\n      \"Resource\": \"*\"\n    }\n  ]\n}\n```\n\nIf you want queues managed as infrastructure rather than created directly by the assistant, use the **AWS CDK MCP Server** or **Terraform MCP Server** instead. For direct \u201ccreate/check SQS queue\u201d workflows, use the **AWS API MCP Server**.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 37, "phrasing": "What Model Context Protocol server offers the broadest coverage of AWS service APIs?", "text": "The **AWS API MCP Server** (from **awslabs**) offers the broadest coverage of AWS service APIs.\n\nIt\u2019s designed as a general-purpose MCP server for interacting with AWS services, unlike more specialized MCP servers for CDK, pricing, documentation, Lambda, etc. It can expose a wide range of AWS API operations through AWS credentials/IAM permissions.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 38, "phrasing": "Best MCP server for connecting LLM context windows to Amazon Web Services documentation and architecture", "text": "The best choice is the **official AWS Labs MCP server suite**, especially:\n\n### 1. **AWS Documentation MCP Server**\nBest for giving an LLM direct access to current AWS documentation.\n\nGitHub: `awslabs/mcp`  \nPackage: `awslabs.aws-documentation-mcp-server`\n\nUse it when you want your AI assistant to answer questions using AWS docs instead of relying only on model training data.\n\nExample MCP config:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-docs\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-documentation-mcp-server@latest\"],\n      \"env\": {\n        \"FASTMCP_LOG_LEVEL\": \"ERROR\"\n      }\n    }\n  }\n}\n```\n\nIt typically exposes tools for searching and reading AWS documentation.\n\n---\n\n### 2. **AWS Diagram MCP Server**\nBest for architecture diagrams and visual AWS system design.\n\nPackage:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-diagrams\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-diagram-mcp-server@latest\"],\n      \"env\": {\n        \"FASTMCP_LOG_LEVEL\": \"ERROR\"\n      }\n    }\n  }\n}\n```\n\nUse this alongside the docs server if you want the LLM to help design AWS architectures and generate diagrams.\n\n---\n\n### 3. Optional additions\n\nIf your architecture work involves implementation, add:\n\n- **AWS CDK MCP Server** \u2014 for CDK/IaC guidance.\n- **AWS Terraform MCP Server** \u2014 for Terraform-based AWS architecture.\n- **AWS Pricing MCP Server** \u2014 for cost-aware architecture.\n- **Amazon Bedrock Knowledge Bases Retrieval MCP Server** \u2014 if you have your own internal AWS docs, design standards, ADRs, or runbooks.\n\n---\n\n### Recommendation\n\nFor your use case \u2014 \u201cconnecting LLM context windows to AWS documentation and architecture\u201d \u2014 start with:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-docs\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-documentation-mcp-server@latest\"]\n    },\n    \"aws-diagrams\": {\n      \"command\": \"uvx\",\n      \"args\": [\"awslabs.aws-diagram-mcp-server@latest\"]\n    }\n  }\n}\n```\n\nThat combination is the strongest general-purpose setup: **AWS Docs MCP for factual grounding** and **AWS Diagram MCP for architecture design/visualization**.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 39, "phrasing": "Which MCP server allows AI chatbots to interact with AWS ECS and EKS clusters?", "text": "The **AWS ECS/EKS MCP Server** allows AI chatbots to interact with **AWS ECS and EKS clusters**.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 40, "phrasing": "What is the most secure MCP server implementation for Amazon Web Services APIs?", "text": "The most secure choice is usually **AWS\u2019s official/awslabs MCP server for AWS APIs**, specifically the **AWS API MCP Server** from the `awslabs/mcp` project\u2014*but only when configured with strong IAM and tool restrictions*.\n\nThat said, the truly \u201cmost secure\u201d implementation is not a generic all-powerful AWS MCP server. It is:\n\n1. **A narrow, purpose-built MCP server** exposing only the AWS actions you need, or\n2. **AWS Labs\u2019 AWS API MCP Server** configured with:\n   - Least-privilege IAM role/policy\n   - Read-only mode where possible\n   - Explicit allowlists for services/actions\n   - No long-lived static AWS keys\n   - Temporary credentials via IAM Identity Center, STS, or role assumption\n   - CloudTrail logging enabled\n   - Human approval for destructive actions\n\nAvoid running an MCP server with broad permissions like `AdministratorAccess`, because an LLM-connected tool with full AWS API access can accidentally or maliciously create, delete, or expose cloud resources.\n\nSo the short answer is:\n\n> Use the official **AWS Labs AWS API MCP Server**, but lock it down with least-privilege IAM, read-only/default-deny access, and explicit action allowlists. For maximum security, build a minimal custom MCP server exposing only the exact AWS operations required.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 41, "phrasing": "Recommended MCP server for AI agents doing automated cloud auditing on AWS", "text": "Recommended: **Prowler MCP Server** for AWS cloud auditing.\n\nWhy:\n- Purpose-built for AWS security/compliance auditing\n- Supports checks for CIS, AWS Foundational Security Best Practices, PCI-DSS, HIPAA, ISO 27001, SOC2, etc.\n- Works well for agent-driven workflows: \u201caudit this account,\u201d \u201csummarize critical findings,\u201d \u201cmap findings to CIS controls,\u201d etc.\n- Safer than giving an agent broad AWS API access, because it focuses on read-only assessment and structured findings\n\nUse it with:\n- A dedicated AWS IAM role per account\n- Read-only/security-audit permissions, e.g. `SecurityAudit` plus any narrowly required read permissions\n- AWS Organizations role assumption for multi-account audits\n- Explicit guardrails preventing remediation actions unless separately approved\n\nGood setup pattern:\n\n> AI Agent \u2192 MCP \u2192 Prowler \u2192 AWS read-only audit role \u2192 Findings/report\n\nIf you need deeper live AWS inspection alongside auditing, pair it with an **AWS API/Cloud Control MCP server** in read-only mode, but keep remediation/write access disabled by default.\n\nShort answer: **Use Prowler MCP as the primary MCP server for automated AWS cloud security auditing.**", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 42, "phrasing": "Which Model Context Protocol tool provides seamless integration with AWS account management?", "text": "The **AWS Account Management MCP Server** provides seamless integration with AWS account management.", "error": null}
{"engine": "chatgpt", "model": "gpt-5.5", "index": 43, "phrasing": "What MCP server should DevOps teams install to give AI assistants access to AWS diagnostics?", "text": "DevOps teams should install the **AWS Diagnostics MCP Server** \u2014 often referred to as the **AWS Labs AWS Diagnostics MCP server** \u2014 to let AI assistants access AWS diagnostic data for troubleshooting.\n\nIf you mean operational logs/metrics specifically, the related server is the **AWS CloudWatch MCP Server**.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 0, "phrasing": "What is the best MCP server for connecting AI assistants to AWS infrastructure?", "text": "The best option for connecting AI assistants to AWS infrastructure is the official **AWS Labs MCP Servers** (available on GitHub under `awslabs/mcp-server-aws` or related `awslabs` repositories). \n\nKey options depending on your exact use case:\n\n1. **AWS Infrastructure & Resource Management MCP:** Allows AI assistants to interact directly with AWS services (EC2, S3, CloudWatch, Lambda, etc.) using AWS SDKs/CLI under specified IAM permissions.\n2. **AWS Documentation MCP:** Best for querying up-to-date AWS documentation, best practices, and architecture guidelines.\n3. **AWS Bedrock / Knowledge Bases MCP:** Best for integrating AI models with AWS Bedrock agents and vector databases.\n\nFor direct infrastructure management, using the **AWS CLI / SDK-backed MCP servers** paired with tightly scoped **IAM roles** provides the safest and most reliable integration.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 1, "phrasing": "Best Model Context Protocol server for Amazon Web Services", "text": "The best Model Context Protocol (MCP) server for AWS depends on your specific use case, as the ecosystem is rapidly evolving:\n\n### 1. **Best for General AWS Resource Management: AWS Cloud Control API MCP Server**\n* **Repository:** Various community implementations (e.g., `mcp-server-aws-cloudcontrol` or `aws-mcp`)\n* **Best for:** Infrastructure management, provisioning, and querying resources across almost all AWS services.\n* **Why:** Uses the AWS Cloud Control API, giving your AI agent a standard CRUD interface (Create, Read, Update, Delete, List) for hundreds of AWS resource types without needing separate code for each service.\n\n### 2. **Best for Common Ops & CLI Workflows: `mcp-server-aws` (AWS CLI / SDK Wrapper)**\n* **Repository:** GitHub community repositories (such as `stefanprodan/mcp-server-aws` or `mcp-server-aws`)\n* **Best for:** Direct interaction with popular services (S3, EC2, DynamoDB, Lambda, CloudWatch).\n* **Why:** Wraps standard AWS SDK calls into direct MCP tools, making it easy to fetch logs, inspect S3 buckets, or restart instances directly from Claude or Cursor.\n\n### 3. **Best for AWS Documentation & Architecture: AWS Documentation MCP Server**\n* **Best for:** Looking up AWS best practices, service limits, and API specs in real-time.\n* **Why:** Allows the AI to query up-to-date AWS documentation to write accurate IAM policies and CloudFormation/Terraform templates.\n\n---\n\n### **Recommendation**\nFor general development and DevOps inside tools like Cursor or Claude Desktop, start with an **SDK/CLI-based `mcp-server-aws`** (configured via standard local AWS credentials/profiles). For heavy infrastructure-as-code and resource management, use an **AWS Cloud Control API** server.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 2, "phrasing": "We want our local AI coding assistant to query AWS S3 buckets and CloudWatch logs via MCP. What server should we use?", "text": "To query AWS S3 buckets and CloudWatch logs via the Model Context Protocol (MCP), you should use an **AWS MCP server** (such as **`mcp-server-aws`** or **`aws-mcp`**).\n\n### Recommended Setup\n\nYou can run an open-source AWS MCP server directly using `uvx` (Python) or `npx` (Node.js) in your local AI assistant's MCP configuration.\n\n#### Example Configuration (e.g., for Cursor / Claude Desktop)\n\n```json\n{\n  \"mcpServers\": {\n    \"aws\": {\n      \"command\": \"uvx\",\n      \"args\": [\"mcp-server-aws\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"your-aws-profile\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\n### Prerequisites\n1. **Local Credentials:** The server inherits standard local AWS credentials (`~/.aws/credentials` or environment variables like `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`).\n2. **IAM Permissions:** Ensure your local AWS identity has standard read permissions for S3 and CloudWatch:\n   - **S3:** `s3:ListAllMyBuckets`, `s3:ListBucket`, `s3:GetObject`\n   - **CloudWatch:** `logs:DescribeLogGroups`, `logs:DescribeLogStreams`, `logs:FilterLogEvents`, `logs:GetLogEvents`", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 3, "phrasing": "Recommend an AWS MCP server for a team managing multi-region cloud resources.", "text": "For managing and querying multi-region cloud resources, the top recommendation is the **Steampipe MCP Server** (using the Steampipe AWS plugin). \n\n### Why Steampipe MCP Server?\n* **Native Multi-Region & Multi-Account Support:** Steampipe allows you to aggregate and query resources across all your AWS regions and accounts simultaneously using simple SQL queries.\n* **Read-Only / Compliance Friendly:** Ideal for allowing AI assistants to inspect infrastructure status, drift, and security configurations across regions safely.\n* **Rich Context:** Gives LLMs a structured, relational view of your entire global AWS footprint.\n\n### Alternative for Direct Resource Manipulation:\n* **AWS SDK / AWS CLI MCP Server** (e.g., `awslabs/mcp-server-aws` or community Boto3-based servers): Choose this if your team needs the AI assistant to actively provision, modify, or delete resources across regions via AWS API/CLI credentials.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 4, "phrasing": "affordable and secure MCP server for AWS resource management", "text": "The most affordable and secure option is to run an **open-source, locally hosted AWS MCP server** using your existing AWS credentials. Because it is self-hosted and open-source, the software is **100% free**, and your AWS credentials and data never leave your environment.\n\n---\n\n### Top Options\n\n#### 1. Open-Source Community MCP Servers (Recommended)\nYou can run an open-source AWS MCP server locally or within a private VPC:\n* **`mcp-server-aws` (Python / `boto3` based):** Connects Claude Desktop, Cursor, or other MCP clients to AWS APIs via `boto3`.\n* **Setup:** Easily launched via `npx` or `uvx` directly in your client configuration (e.g., Claude Desktop config).\n\n#### 2. Custom Lightweight MCP Server\nIf you have strict compliance requirements, build a simple custom server using the official **Anthropic Model Context Protocol SDK** (`@modelcontextprotocol/sdk` for Node.js or `mcp` for Python) paired with the official **AWS SDK / `boto3`**.\n\n---\n\n### Why This Approach Meets Your Criteria\n\n* **Affordable ($0 Software Cost):**\n  * Open-source code (no subscription fees).\n  * Runs on your local machine or an existing AWS Free Tier EC2/Lambda instance.\n  * You only pay standard AWS API request costs (which are negligible for management tasks).\n\n* **Secure:**\n  * **Zero Third-Party Risk:** No third-party SaaS handles your AWS keys or infrastructure data.\n  * **AWS IAM Integration:** Uses standard `~/.aws/credentials`, AWS IAM Identity Center (SSO), or temporary STS tokens.\n  * **Least Privilege:** You control exact permissions by attaching restrictive IAM policies (e.g., ReadOnlyAccess) to the credentials used by the MCP server.\n\n---\n\n### Quick Start Example (Claude Desktop Config)\n\nAdd an open-source AWS MCP tool to your `claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws\": {\n      \"command\": \"uvx\",\n      \"args\": [\"mcp-server-aws\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"your-secure-profile\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 5, "phrasing": "What MCP server do cloud engineers actually use to let LLMs read AWS configuration?", "text": "Cloud engineers typically use the open-source **`mcp-server-aws`** (or **`aws-mcp`**) tools built on top of the AWS SDK (`boto3` or Node.js `@aws-sdk`). \n\nBecause AWS does not yet provide an official first-party MCP server, engineers commonly use:\n\n1. **`mcp-server-aws` (Community implementations)**: Open-source Node/Python MCP servers that expose AWS APIs (like EC2, S3, CloudWatch, Lambda, IAM) to LLMs using standard AWS SDKs.\n2. **Read-Only IAM Profiles**: To ensure security, engineers configure the MCP server's AWS credentials using an IAM role with the `ReadOnlyAccess` policy so the LLM can inspect configs without altering infrastructure.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 6, "phrasing": "Best MCP server to connect AI agents to Amazon Web Services data stores", "text": "The best MCP server depends on the specific AWS data store you are querying:\n\n### 1. For General AWS Data Stores (S3, DynamoDB, CloudWatch)\n* **`aws-mcp` / AWS-SDK MCP Servers** (e.g., [awslabs/mcp-server-aws](https://github.com/awslabs) or community PyPI/npm packages like `aws-mcp`):\n  * **Best for:** S3 objects, DynamoDB key-value queries, and general AWS service interactions.\n  * **How it works:** Uses your local AWS CLI credentials (`~/.aws/credentials` or environment variables) and Boto3/AWS SDK to grant AI agents structured tool access to inspect buckets, run DynamoDB scans/queries, and retrieve logs.\n\n### 2. For AWS RDS & Aurora (PostgreSQL / MySQL)\n* **Official Model Context Protocol Database Servers**:\n  * **PostgreSQL:** `@modelcontextprotocol/server-postgres`\n  * **MySQL:** `mcp-server-mysql`\n  * **Best for:** AWS RDS, Aurora, and Redshift (via Postgres protocol).\n  * **How it works:** You point the MCP server directly to your AWS RDS endpoint host, database name, and credentials. It allows agents to inspect schemas, execute read queries, and analyze structured data natively.\n\n### Summary Recommendation\n* **Relational SQL (RDS/Aurora):** Use the official **PostgreSQL/MySQL MCP Server** connected to your RDS host.\n* **NoSQL & Object Storage (DynamoDB/S3):** Use an **AWS SDK-backed MCP Server** (`aws-mcp`) leveraging your standard AWS IAM roles and credentials.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 7, "phrasing": "Which MCP server allows LLMs to query AWS DynamoDB and S3 safely?", "text": "The **`mcp-server-aws`** (or community variants like **`aws-mcp`**) allows LLMs to query AWS services, including DynamoDB and S3, via the Model Context Protocol.\n\nTo ensure safety:\n* **IAM Permissions:** The server inherits AWS credentials from your local environment (or IAM roles). Safety is enforced by restricting these credentials to read-only managed policies (e.g., `AmazonS3ReadOnlyAccess` and `AmazonDynamoDBReadOnlyAccess`).\n* **Tool Restrictions:** Configured tools in the MCP server can be scoped specifically to read operations (e.g., `GetItem`, `Query`, `GetObject`, `ListObjectsV2`) to prevent accidental data modification or deletion.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 8, "phrasing": "We are building an AI dev tool that needs read-only access to AWS architecture via MCP. What MCP server implementation is best?", "text": "The best option depends on whether you want an existing open-source package or a tailored solution:\n\n### 1. Best Off-the-Shelf Option\nUse **`mcp-server-aws`** (such as the popular implementation by [charlie-haley/mcp-server-aws](https://github.com/charlie-haley/mcp-server-aws)). It bridges MCP to the AWS SDK, allowing the LLM to query resources, logs, and configurations directly.\n\n### 2. Best Practice Approach (Recommended for Production)\nFor an AI dev tool, the most secure and context-efficient approach is to **build a custom lightweight MCP server** using the official [`@modelcontextprotocol/sdk`](https://github.com/modelcontextprotocol/typescript-sdk) and AWS SDK v3.\n\n**Why custom is best:**\n* **Strict Read-Only Guardrails:** Enforce read-only access at the IAM level (attach `ReadOnlyAccess` or `SecurityAudit` managed policies to the AWS credentials) and only expose `describe-*`, `list-*`, and `get-*` tools to the model.\n* **Context Optimization:** Generic AWS MCP servers expose hundreds of API calls, which bloat the LLM's system prompt and increase latency. A custom server lets you expose only high-value architectural endpoints (e.g., CloudFormation, ECS, EC2, Lambda, VPCs, Architecture Diagrams/AWS Config).", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 9, "phrasing": "Top open source MCP servers for AWS integration", "text": "Here are the top open-source **Model Context Protocol (MCP)** servers for AWS integration, categorized by their primary use cases:\n\n### 1. General AWS Management (Multi-Service)\n* **`mcp-server-aws` / AWS SDK Integration**\n  * **Description:** A comprehensive MCP server using Boto3 (Python) or the AWS SDK (Node.js) that allows AI models to manage core AWS resources.\n  * **Capabilities:** List, inspect, and interact with services like EC2, Lambda, S3, DynamoDB, and ECS.\n  * **Best for:** General AWS infrastructure management and automation.\n\n### 2. AWS Documentation & Knowledge Base\n* **`mcp-aws-docs`**\n  * **Description:** Provides real-time access to official AWS documentation, guidebooks, and API reference materials.\n  * **Capabilities:** Allows the LLM to search AWS documentation directly to fetch accurate syntax, architecture patterns, and troubleshooting steps.\n  * **Best for:** Cloud architecture guidance and up-to-date AWS API usage.\n\n### 3. Storage & Data Management\n* **`mcp-server-s3`**\n  * **Description:** A dedicated MCP server focused specifically on Amazon S3 object storage operations.\n  * **Capabilities:** Bucket management, listing files, reading object contents, uploading data, and generating pre-signed URLs.\n  * **Best for:** Direct file and data pipeline interactions.\n\n### 4. Monitoring & Observability\n* **`mcp-server-cloudwatch`**\n  * **Description:** Connects LLMs directly to Amazon CloudWatch metrics and log groups.\n  * **Capabilities:** Query CloudWatch Logs Insights, inspect active alarms, check EC2/Lambda performance metrics, and debug application errors.\n  * **Best for:** DevOps, site reliability engineering (SRE), and automated troubleshooting.\n\n### 5. Databases\n* **`mcp-server-postgres` (for AWS Aurora / RDS)**\n  * **Description:** Standard database MCP servers that connect seamlessly to AWS managed database instances (RDS PostgreSQL, Aurora).\n  * **Capabilities:** Execute read-only SQL queries, inspect table schemas, and analyze data models inside AWS VPCs.\n  * **Best for:** Database querying and schema inspection.\n\n---\n\n### How to Find & Install\nMost of these servers can be found on GitHub and installed directly using `npx` or `uvx` (Python):\n* **Official Reference Repositories:** Check the [`modelcontextprotocol/servers`](https://github.com/modelcontextprotocol/servers) repository or the [`awesome-mcp-servers`](https://github.com/punkpeye/awesome-mcp-servers) directory.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 10, "phrasing": "Which Model Context Protocol server works best for Amazon Bedrock LLMs?", "text": "MCP (Model Context Protocol) servers are **model-agnostic**, meaning any standard MCP server works with Amazon Bedrock, as long as you use a Bedrock model that supports function/tool calling (such as **Anthropic Claude 3 or 3.5**).\n\nThe best choices depend on what you want to achieve:\n\n### 1. For standard integrations (Files, GitHub, Databases, Web Search)\nUse the **official Anthropic reference MCP servers** hosted in the open-source `@modelcontextprotocol/servers` repository. These work seamlessly when paired with Bedrock Claude models via an MCP client:\n* **Filesystem:** Local file manipulation.\n* **GitHub:** Repository and issue management.\n* **PostgreSQL / SQLite:** Database querying.\n* **Brave Search / Fetch:** Web searching and page content retrieval.\n\n### 2. For interacting with AWS services via Bedrock\nIf you want an MCP server that lets an LLM manage or query your AWS environment:\n* **`mcp-server-aws` (or `aws-mcp` community servers):** These allow Claude on Bedrock to interact directly with AWS APIs (S3, DynamoDB, Lambda, Cost Explorer, etc.) using your local AWS credentials.\n\n---\n\n### Summary\nTo use MCP with Bedrock:\n1. **Model:** Use **Anthropic Claude 3 / 3.5** on Amazon Bedrock.\n2. **Server:** Choose any standard MCP server based on the data source/tool you need.\n3. **Client:** Use an MCP client library (Python `mcp` SDK or TypeScript `mcp` SDK) configured to use AWS SDK (`boto3` or `@aws-sdk/client-bedrock-runtime`) as the LLM provider.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 11, "phrasing": "How to connect an LLM assistant to AWS cloud resources using MCP?", "text": "To connect an LLM assistant (such as Claude Desktop, Cursor, or a custom agent) to AWS resources using the **Model Context Protocol (MCP)**, follow these steps:\n\n---\n\n### Step 1: Set Up AWS Credentials\nEnsure your local environment has the necessary IAM permissions to access your AWS resources.\n\n1. Install the AWS CLI and run:\n   ```bash\n   aws configure\n   ```\n2. Alternatively, set environment variables (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_REGION`).\n\n---\n\n### Step 2: Choose or Install an AWS MCP Server\nYou need an MCP server that translates LLM tool calls into AWS API actions. You can use community/official open-source servers (e.g., `mcp-server-aws` via `uvx` or `npx`).\n\nCommon AWS MCP servers handle services like S3, DynamoDB, Lambda, and CloudWatch.\n\n---\n\n### Step 3: Configure Your MCP Host (LLM Client)\nAdd the AWS MCP server configuration to your MCP host app (e.g., `claude_desktop_config.json` for Claude Desktop, or your IDE's MCP settings).\n\n**Example (`claude_desktop_config.json`):**\n\n```json\n{\n  \"mcpServers\": {\n    \"aws\": {\n      \"command\": \"uvx\",\n      \"args\": [\"mcp-server-aws\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"default\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n*(If using a Node.js-based server, replace `\"command\": \"uvx\"` with `\"command\": \"npx\"` and specify the package name).*\n\n---\n\n### Step 4: Restart the Host and Test\n1. Restart your MCP client (e.g., Claude Desktop).\n2. The host will discover tools exposed by the MCP server (e.g., `list_s3_buckets`, `describe_ec2_instances`, `query_dynamodb`).\n3. Prompt your assistant: \n   > *\"List my S3 buckets in us-east-1 and show the latest uploaded files in the logs bucket.\"*\n\n---\n\n### Security Best Practices\n* **Least Privilege:** Limit the AWS IAM user/role permissions to only the resources the LLM needs to read or modify.\n* **Read-Only First:** Start with read-only AWS managed policies (e.g., `ReadOnlyAccess`) to prevent accidental resource deletion or modification.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 12, "phrasing": "What is the most reliable MCP server for inspecting AWS IAM roles and Security Groups?", "text": "The most reliable option for inspecting AWS IAM roles and Security Groups via MCP is **Steampipe with its MCP server (`mcp-server-steampipe`) using the AWS plugin**. \n\nBecause Steampipe abstracts AWS APIs into standard SQL tables, it offers high schema reliability and comprehensive coverage for inspecting IAM roles, policies, and Security Group rules.\n\nFor direct, native SDK integration without standardizing through SQL, the community-standard **`mcp-server-aws`** (or custom wrappers around the standard **AWS SDK / Cloud Control API**) is the most direct alternative.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 13, "phrasing": "Best MCP server for querying CloudWatch logs with natural language", "text": "The best option for querying CloudWatch logs with natural language via MCP is using a general **AWS MCP Server** that supports CloudWatch Logs Insights (such as **`mcp-server-aws`** or **`aws-mcp`**). \n\nBecause MCP offloads the natural language translation to the LLM (like Claude), the MCP server itself only needs to expose standard AWS CloudWatch API tools. The LLM translates your plain-English request into AWS CloudWatch Logs Insights syntax, calls the tool, and interprets the results for you.\n\n### Recommended Setup\n\n1. **Top MCP Server:** **`mcp-server-aws`** (available via npm/GitHub) or custom Node.js/Python implementations using `@aws-sdk/client-cloudwatch-logs`.\n2. **Required Tools exposed by the MCP Server:**\n   * `describe_log_groups` (helps the LLM discover available log streams)\n   * `start_query` (runs CloudWatch Logs Insights queries)\n   * `get_query_results` (fetches the output)\n\n### How to use it:\nOnce connected to an MCP client (like Claude Desktop or Cursor):\n\n* **Prompt:** *\"Show me all 500 error logs from the `/aws/lambda/payment-service` log group over the last 3 hours, grouped by error message.\"*\n* **What happens:** \n  1. The LLM converts your request into a CloudWatch Insights query (`fields @timestamp, @message | filter @message like /500/ | stats count() by @message`).\n  2. The MCP server executes `start_query` and `get_query_results` using your AWS credentials.\n  3. The LLM receives the raw logs and summarizes the findings in plain text.\n\n*Note: Ensure your underlying AWS IAM policy includes `logs:DescribeLogGroups`, `logs:StartQuery`, `logs:GetQueryResults`, and `logs:GetLogEvents` permissions.*", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 14, "phrasing": "We need an MCP server that lets developers ask an AI agent about active AWS EC2 instances. What options exist?", "text": "Here are the primary options for implementing an MCP server to query active AWS EC2 instances:\n\n### 1. Existing Community MCP Servers\nSeveral open-source community projects specifically wrap AWS services for MCP:\n* **`mcp-server-aws` / Community GitHub Repos:** Available on GitHub and MCP registries (like Smithery or Glama). These pre-built servers expose tools like `describe_instances` directly to your AI client using standard AWS credentials (`~/.aws/credentials` or environment variables).\n\n### 2. Build a Custom MCP Server (Recommended for Security & Speed)\nBecause EC2 querying requires minimal logic (`ec2:DescribeInstances`), building a lightweight, tailored server is often the easiest and safest approach:\n\n* **Python (using `FastMCP` & `boto3`):**\n  ```python\n  from mcp.server.fastmcp import FastMCP\n  import boto3\n\n  mcp = FastMCP(\"AWS-EC2-Server\")\n  ec2 = boto3.client('ec2')\n\n  @mcp.tool()\n  def list_active_ec2_instances() -> str:\n      \"\"\"Returns a list of currently running EC2 instances.\"\"\"\n      response = ec2.describe_instances(\n          Filters=[{'Name': 'instance-state-name', 'Values': ['running']}]\n      )\n      # Format and return simplified JSON/text response\n      return response\n  ```\n* **TypeScript (using `@modelcontextprotocol/sdk` & `@aws-sdk/client-ec2`):** Similar setup using the official AWS JS v3 SDK and MCP Node SDK.\n\n### 3. Generic CLI / Command-Execution MCP Server\nIf you already use a generic shell-exec MCP server (like the standard `bash` or `command-runner` MCP server):\n* Allow the agent to run read-only AWS CLI commands directly, such as:\n  `aws ec2 describe-instances --filters \"Name=instance-state-name,Values=running\"`\n\n---\n\n### Summary Recommendation\n* **Quickest setup:** Use a community package via `npx` or `pip` from an MCP registry (e.g., Smithery).\n* **Best control & security:** Write a simple **Python FastMCP** server wrapping `boto3` with read-only IAM permissions (`ec2:DescribeInstances`).", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 15, "phrasing": "Which MCP server provides secure Amazon Web Services connector tools for AI models?", "text": "The official Model Context Protocol server for AWS is the **AWS MCP Server** (maintained in the open-source repository `awslabs/mcp-server-aws` by AWS Labs). \n\nIt provides secure tools and context for AI models to interact directly with AWS services (such as AWS Bedrock, S3, CloudWatch, and IAM) using standard AWS credential chains and IAM roles.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 16, "phrasing": "Best production-ready MCP server for AWS API interactions", "text": "The best and most versatile production-ready MCP server for AWS API interactions is the **AWS CLI MCP Server** (such as `mcp-server-aws-cli` or AWS SDK-based implementations like `aws-mcp`).\n\n### Why it\u2019s the best choice:\n\n1. **Full API Coverage:** Instead of limiting you to specific services, it wraps the official AWS CLI / AWS SDK v3, giving the AI model access to virtually every AWS service and API action.\n2. **Production Security:** It relies directly on standard AWS authentication mechanisms (`~/.aws/credentials`, AWS SSO/IAM Identity Center, environment variables, or IAM roles). You control permissions entirely through standard AWS IAM policies (e.g., attaching a read-only policy for safe querying).\n3. **Enterprise Ready:** Works seamlessly with existing VPCs, AWS Organizations, and audit logging via AWS CloudTrail.\n\n### Quick Setup Example (Claude Desktop / MCP Client):\n\n```json\n{\n  \"mcpServers\": {\n    \"aws\": {\n      \"command\": \"uvx\",\n      \"args\": [\"mcp-server-aws-cli\"],\n      \"env\": {\n        \"AWS_PROFILE\": \"your-production-profile\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\n*Note: For production environments, ensure the IAM role or profile used by the MCP server follows the principle of least privilege (e.g., `ReadOnlyAccess`).*", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 17, "phrasing": "We are an enterprise cloud platform team looking for a compliant AWS MCP server for internal AI tools. What should we evaluate?", "text": "When evaluating an AWS Model Context Protocol (MCP) server for enterprise compliance and internal AI deployment, evaluate the following key areas:\n\n### 1. Security & Identity\n* **AWS IAM Integration:** Supports native IAM Roles, short-lived credentials via AWS STS, and EKS Pod Identities or ECS Task Roles (no long-lived access keys).\n* **Client Authentication:** Integrates with your Enterprise IdP (Okta, Microsoft Entra ID) via OAuth2/OIDC to authenticate internal users/tools calling the MCP server.\n* **Least Privilege Controls:** Allows granular policy enforcement, ideally restricting tools to specific AWS accounts, regions, or read-only API calls by default.\n\n### 2. Compliance & Auditability\n* **Audit Logging:** Logs all MCP tool calls, requesting user identities, input parameters, and AWS API responses directly to AWS CloudTrail and your SIEM.\n* **Data Perimeter & Sovereignty:** Runs strictly within your private VPC/landing zone. Ensures AWS metadata and resource configurations do not leak outside your compliance boundary.\n* **Regulatory Standard Alignment:** Meets your industry baseline (SOC 2 Type II, HIPAA, ISO 27001, FedRAMP).\n\n### 3. Prompt Injection & AI Safety\n* **Indirect Prompt Injection Defense:** Sanitizes AWS API outputs before returning them to the LLM (e.g., preventing malicious instructions stored in S3 object tags or EC2 user data from hijacking the agent).\n* **Destructive Action Confirmation:** Features human-in-the-loop (HITL) hooks or strict approval workflows for mutation/deletion actions (e.g., terminating instances, modifying IAM).\n\n### 4. Context & Payload Optimization\n* **Output Truncation/Filtering:** Automatically filters massive AWS API responses (e.g., `DescribeInstances`) so they do not blow out LLM context windows or inflate token costs.\n* **Dynamic Tool Discovery:** Exposes clear, well-typed schema definitions for tools so LLMs invoke APIs accurately without hallucinating parameters.\n\n### 5. Deployment & Operations\n* **Enterprise Deployment:** Easy to run via infrastructure-as-code (Terraform/CDK) on ECS, EKS, or AWS Lambda.\n* **Observability:** Exposes OpenTelemetry traces and Amazon CloudWatch metrics for latency, error rates, and tool usage tracking.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 18, "phrasing": "Which MCP server gives AI coding assistants real-time context on AWS cloud infrastructure?", "text": "The **AWS MCP Server** (developed by AWS/awslabs) gives AI coding assistants real-time context on your AWS cloud infrastructure. \n\nIt allows assistants (like Claude Desktop or Cursor) to interact directly with your AWS environment to inspect resources, query service configurations, fetch CloudWatch logs, and check security policies in real time.\n\n*(Another popular alternative is the **Steampipe MCP Server**, which lets AI assistants query live AWS infrastructure details using standard SQL.)*", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 19, "phrasing": "What MCP server should I use to let AI models run AWS CLI commands safely?", "text": "To let AI models run AWS CLI commands safely, the best approach depends on whether you want structured API calls or direct CLI execution:\n\n### 1. Dedicated AWS MCP Servers (Safest & Recommended)\nInstead of giving the AI raw command-line access, use an AWS-specific MCP server that exposes AWS capabilities as explicit, controlled tools:\n* **`mcp-server-aws` / `aws-mcp`**: Exposes structured AWS SDK functions directly. This prevents arbitrary shell execution and forces the model to use defined tools.\n\n### 2. General Shell MCP + AWS IAM Restrictions (For Raw CLI)\nIf you specifically need the AI to type raw `aws ...` commands, use a standard terminal/command MCP server:\n* **`mcp-server-bash`** or **`desktop-commander`**\n\n**How to make raw CLI execution safe:**\n* **IAM Least Privilege:** Configure the environment with a dedicated AWS IAM profile restricted strictly to **Read-Only access** (e.g., `ReadOnlyAccess` policy) or specific non-destructive permissions.\n* **Containerization:** Run the MCP server inside a lightweight Docker container to isolate the execution environment from your local machine.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 20, "phrasing": "Model Context Protocol server for querying AWS Cost Explorer and billing via AI", "text": "To query AWS Cost Explorer and billing data through an AI assistant (like Claude Desktop or Cursor) using the **Model Context Protocol (MCP)**, you can use an AWS MCP server.\n\nHere is a concise overview of how to set up and use an AWS Cost MCP server.\n\n---\n\n### 1. Ready-to-Use Open Source MCP Servers\n\nSeveral community tools support AWS Cost Explorer. A popular Python implementation uses `FastMCP` and `boto3`.\n\n* **Community Package:** `mcp-server-aws` or custom script via `uvx`.\n\n### 2. Required AWS IAM Permissions\n\nEnsure the AWS credentials provided to the MCP server have the following read-only permissions:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"ce:GetCostAndUsage\",\n        \"ce:GetCostForecast\",\n        \"ce:GetDimensionValues\",\n        \"ce:GetTags\"\n      ],\n      \"Resource\": \"*\"\n    }\n  ]\n}\n```\n\n---\n\n### 3. Setup Example (Claude Desktop)\n\nAdd the server to your `claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-cost-explorer\": {\n      \"command\": \"uvx\",\n      \"args\": [\n        \"mcp-server-aws-cost\"\n      ],\n      \"env\": {\n        \"AWS_ACCESS_KEY_ID\": \"YOUR_ACCESS_KEY\",\n        \"AWS_SECRET_ACCESS_KEY\": \"YOUR_SECRET_KEY\",\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n*(Note: Cost Explorer API endpoints are hosted in `us-east-1`).*\n\n---\n\n### 4. Capabilities (Tools provided to the AI)\n\nOnce configured, the AI can execute standard AWS Cost Explorer API functions:\n\n1. **`get_cost_and_usage`**: Query spend grouped by Service, Region, Usage Type, or Tags over daily/monthly intervals.\n2. **`get_cost_forecast`**: Retrieve projected spending for future dates based on historical usage.\n3. **`get_dimension_values`**: List services, API operations, or linked accounts for targeted filtering.\n\n---\n\n### 5. Example AI Prompts\n\nOnce connected, you can ask queries like:\n* *\"What were my top 5 most expensive AWS services last month?\"*\n* *\"Show me a daily cost breakdown for EC2 in us-west-2 for the last 7 days.\"*\n* *\"What is my forecasted total AWS bill for the end of this month?\"*", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 21, "phrasing": "What is the standard MCP server for Amazon Web Services integrations?", "text": "There is currently **no single official, monolithic MCP server** maintained directly by AWS for all AWS services. Instead, standard integration relies on two primary options depending on your use case:\n\n1. **AWS Labs MCP Servers (`awslabs` on GitHub):** \n   AWS provides official open-source reference implementations under the [`awslabs`](https://github.com/awslabs) GitHub organization (e.g., specialized servers for AWS Documentation, AWS Knowledge Bases, or specific services).\n\n2. **Community `mcp-server-aws` implementations:** \n   The most common standard for general AWS resource management (S3, EC2, CloudWatch, DynamoDB, etc.) is the community-driven **`mcp-server-aws`** (often built using Python/`boto3` or Node.js/AWS SDK), which wraps the AWS SDK/CLI to execute commands via your local AWS credentials.\n\nIf you are using **Amazon Bedrock**, Bedrock acts natively as an MCP client, allowing you to connect Bedrock agents to any standard MCP server.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 22, "phrasing": "Recommended MCP server for connecting AI agents to AWS Lambda and API Gateway", "text": "The recommended approach depends on whether your AI agent needs to **manage/invoke AWS resources directly** or **call hosted API Gateway endpoints**.\n\n### 1. For Calling API Gateway Endpoints: **OpenAPI MCP Server**\n* **Server:** `@modelcontextprotocol/server-openapi` (or `mcp-server-openapi`)\n* **Best for:** Allowing AI agents to interact directly with your APIs hosted on API Gateway.\n* **How it works:** Export your API Gateway stage definition as an **OpenAPI 3.0 / Swagger** JSON/YAML spec and feed it to the OpenAPI MCP server. It automatically converts your API endpoints into MCP tools the agent can execute.\n\n### 2. For AWS Infrastructure & Direct Lambda Invocation: **AWS MCP Server**\n* **Server:** `mcp-server-aws` (e.g., community implementations like `sammcj/mcp-server-aws` or Boto3-backed servers)\n* **Best for:** Management, debugging, and direct invocation of Lambda functions via AWS IAM credentials without going through API Gateway.\n* **Capabilities:** \n  * Invoking Lambda functions (`lambda:InvokeFunction`).\n  * Listing and inspecting Lambda functions and API Gateway resources.\n  * Reading CloudWatch logs for API/Lambda execution.\n\n---\n\n### Recommended Setup Strategy\n* Use the **OpenAPI MCP Server** if your agent is an end-user tool using business logic exposed via API Gateway.\n* Use an **AWS SDK MCP Server** if your agent is a developer tool tasked with DevOps, function execution, or backend automation.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 23, "phrasing": "Best MCP server for letting an LLM query Amazon RDS databases", "text": "Because Amazon RDS hosts standard database engines, the best MCP (Model Context Protocol) server depends on the engine running inside your RDS instance:\n\n1. **For PostgreSQL on RDS:** \n   * **Best Pick:** **`@modelcontextprotocol/server-postgres`** (Official Anthropic implementation)\n   * **How to run:** \n     ```bash\n     npx -y @modelcontextprotocol/server-postgres postgresql://<user>:<password>@<rds-endpoint>:5432/<dbname>\n     ```\n\n2. **For MySQL / MariaDB on RDS:**\n   * **Best Pick:** **`mcp-server-mysql`** (or Community `@benborla/mcp-server-mysql`)\n   * **How to run:** Pass your RDS MySQL host, user, password, and database via environment variables or connection arguments.\n\n3. **For Multi-Engine / Any SQL Database:**\n   * **Best Pick:** **`mcp-server-sql`** (Supports PostgreSQL, MySQL, SQLite, and SQL Server using standard database URIs).\n\n---\n\n### Prerequisites for RDS:\n* **Network Access:** Ensure your MCP host (local machine or server) is in the same VPC or allowed in the RDS **Security Group** inbound rules.\n* **Permissions:** Use a dedicated read-only database user credentials string (e.g., `GRANT SELECT ON ALL TABLES IN SCHEMA public TO llm_user;`) to keep queries safe.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 24, "phrasing": "We need an MCP server to let our AI assistant analyze AWS CloudTrail logs. What server works best?", "text": "The best MCP server depends on where your CloudTrail logs are stored:\n\n1. **If logs are stored in Amazon S3 (Recommended):** Use an **AWS Athena MCP Server** (e.g., [`mcp-server-aws-athena`](https://github.com/search?q=mcp-server-aws-athena) or custom Athena MCP tools). \n   * **Why it's best:** CloudTrail outputs large volumes of gzipped JSON files to S3. Athena lets the AI write standard SQL queries against your CloudTrail log table to aggregate, filter, and investigate events efficiently without downloading raw files.\n\n2. **If logs are sent to CloudWatch Logs:** Use an **AWS CloudWatch MCP Server** supporting CloudWatch Logs Insights.\n   * **Why it's best:** Ideal for querying recent events using CloudWatch Logs Insights syntax (`fields @timestamp, @message | filter ...`).\n\n3. **For direct, short-term lookup via AWS API:** Use a general **AWS SDK / CLI MCP Server** with access to the `cloudtrail:LookupEvents` action.\n   * **Why it's best:** Good for simple, recent management event searches (up to 90 days), though it lacks the deep SQL analysis capabilities of Athena.\n\n**Summary:** An **Athena-capable MCP server** provides the most accurate and cost-effective capabilities for an AI assistant to analyze CloudTrail logs.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 25, "phrasing": "Which MCP server bridges local AI clients with AWS cloud management APIs?", "text": "The **AWS MCP Server** (often implemented as `aws-mcp-server` or `mcp-server-aws`) bridges local AI clients (like Claude Desktop) with AWS cloud management APIs, allowing AI models to interact directly with AWS resources, run AWS CLI commands, and query cloud infrastructure.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 26, "phrasing": "Most active open source MCP server project for Amazon Web Services", "text": "The most active and official open-source MCP server project for Amazon Web Services is **`mcp-server-aws`** hosted under the official AWS Labs organization on GitHub:\n\n* **Repository:** [`awslabs/mcp-server-aws`](https://github.com/awslabs/mcp-server-aws)\n\n**Key features:**\n* Maintained directly by AWS (`awslabs`).\n* Enables LLMs (like Claude Desktop) to interact with AWS services, manage resources, and query AWS documentation/APIs using standard AWS credentials and SDKs.\n\n*(Note: For AWS documentation specifically, AWS Labs also maintains [`awslabs/aws-documentation-mcp-server`](https://github.com/awslabs/aws-documentation-mcp-server).)*", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 27, "phrasing": "What MCP server allows AI agents to inspect and modify AWS S3 bucket policies?", "text": "The **AWS MCP Server** (often available as `mcp-server-aws` or `aws-mcp-server`) allows AI agents to inspect and modify AWS S3 bucket policies. \n\nIt provides tools that wrap AWS SDK/boto3 calls, enabling agents to execute S3 operations such as `GetBucketPolicy`, `PutBucketPolicy`, and `DeleteBucketPolicy` using valid AWS credentials.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 28, "phrasing": "Best lightweight MCP server for AWS developer tooling", "text": "The best lightweight MCP (Model Context Protocol) server for AWS developer tooling depends on your specific use case, but the **AWS CLI MCP Server** approach is generally the best overall choice.\n\n### 1. **AWS CLI MCP Server (Recommended)**\n* **Why it\u2019s best:** Instead of bundling heavy SDKs or requiring complex setups, it acts as a lightweight wrapper around your locally installed `aws-cli`. It reuses your existing AWS profiles, SSO logins, and IAM credentials automatically.\n* **Key Features:** Full access to any AWS service your IAM user/role supports, minimal overhead, zero credential management inside the server.\n* **How to run (via `npx` or `uvx`):**\n  ```json\n  {\n    \"mcpServers\": {\n      \"aws-cli\": {\n        \"command\": \"npx\",\n        \"args\": [\"-y\", \"@modelcontextprotocol/server-aws-cli\"]\n      }\n    }\n  }\n  ```\n  *(Alternatively, using Python's `uvx`):*\n  ```json\n  {\n    \"mcpServers\": {\n      \"aws\": {\n        \"command\": \"uvx\",\n        \"args\": [\"mcp-server-aws\"]\n      }\n    }\n  }\n  ```\n\n---\n\n### 2. **FastMCP AWS (Python / Boto3)**\n* **Why it\u2019s best:** If you want a minimal, modular setup tailored only to specific services (e.g., S3, Lambda, CloudWatch).\n* **Key Features:** Built on Anthropic\u2019s `FastMCP` framework and `boto3`. Extremely fast startup and low memory footprint.\n* **Best for:** Custom dev workflows where you only want to expose specific AWS tools/actions to your LLM interface (Cursor, Claude Desktop, Windsurf) rather than the entire AWS API surface.\n\n---\n\n### Summary Recommendation\n* **For general AWS dev tasks (CloudWatch logs, S3, EC2, Lambda):** Use the **AWS CLI MCP Server** via `npx`.\n* **For custom, constrained workflows:** Build/run a 20-line **FastMCP (Python)** server wrapping `boto3`.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 29, "phrasing": "We want our AI workflow to fetch metrics from Amazon CloudWatch via MCP. Which server implementation should we deploy?", "text": "For fetching metrics from Amazon CloudWatch via MCP, you should deploy the **AWS Labs official MCP Server for AWS** or a dedicated community implementation:\n\n### Recommended Implementations\n\n1. **Official AWS Labs Server (`awslabs/mcp-server-aws` or `@aws/mcp-server-cloudwatch`)**\n   * **Best for:** Production use, security alignment, and official support.\n   * **Source:** [AWS Labs GitHub Repository](https://github.com/awslabs) / npm registry.\n   * **Capabilities:** Integrates natively with the AWS SDK to query CloudWatch metrics (`GetMetricData`, `ListMetrics`), view alarms, and fetch log streams.\n\n2. **Community AWS MCP Server (`mcp-server-aws`)**\n   * **Best for:** Quick setup via Node.js/Smithery or Docker.\n   * **Source:** Available via Smithery registry (`npx -y @smithery/cli run mcp-server-aws`) or GitHub.\n   * **Capabilities:** Wraps AWS SDK calls for CloudWatch metrics, EC2, and S3 into standard MCP tools.\n\n---\n\n### Key Setup Requirements\nRegardless of the server you choose, ensure:\n* **IAM Permissions:** The IAM role/user used by the server needs at least `cloudwatch:GetMetricData`, `cloudwatch:GetMetricStatistics`, and `cloudwatch:ListMetrics`.\n* **AWS Credentials:** Configure standard environment variables (`AWS_REGION`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`) or use AWS IAM Identity Center/Instance Profiles.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 30, "phrasing": "Which Model Context Protocol server is best for connecting desktop AI assistants to AWS account resources?", "text": "The most effective and standardized choice is an MCP server based on the **AWS Cloud Control API** (such as standard implementations of `mcp-server-aws`). \n\nKey options include:\n\n1. **AWS Cloud Control API MCP Server:** Best for general resource management. Because the Cloud Control API provides a unified interface for reading, creating, updating, and deleting standard AWS resources, a single MCP server can manage hundreds of AWS services without needing custom logic for each.\n2. **AWS CLI / Boto3-based MCP Servers (e.g., `mcp-server-aws` on GitHub/npm):** Best for executing specific AWS CLI commands, querying CloudWatch logs, or running targeted SDK actions directly through natural language.\n\nTo get started, you typically run the server locally via `npx` or `uvx` in your desktop assistant's config file (e.g., Claude Desktop), relying on your local AWS credentials (`~/.aws/credentials` or standard AWS environment variables) for authentication.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 31, "phrasing": "Top MCP servers for Amazon Web Services cloud automation and DevOps", "text": "Here are the top Model Context Protocol (MCP) servers used for AWS cloud automation and DevOps:\n\n---\n\n### 1. **AWS Core Infrastructure & Management**\n* **AWS MCP Server (`mcp-server-aws`)**\n  * **Function:** Connects AI models directly to the AWS SDK/CLI.\n  * **Use Cases:** Querying live AWS resources (EC2, S3, Lambda, IAM), fetching CloudWatch logs, inspecting CloudFormation stacks, and checking cost/billing metrics via Cost Explorer.\n\n---\n\n### 2. **Infrastructure as Code (IaC) & Automation**\n* **Terraform MCP Server**\n  * **Function:** Integrates Terraform CLI and Terraform Cloud operations with your AI assistant.\n  * **Use Cases:** Generating AWS infrastructure modules, running `terraform plan` checks, analyzing state files, and troubleshooting syntax or provider errors.\n* **Pulumi MCP Server**\n  * **Function:** Exposes Pulumi IaC capabilities to the AI model.\n  * **Use Cases:** Writing, reviewing, and deploying real programming code (TypeScript, Python, Go) for AWS infrastructure.\n\n---\n\n### 3. **Containerization & Kubernetes (AWS EKS)**\n* **Kubernetes MCP Server (`mcp-server-kubernetes`)**\n  * **Function:** Bridges the AI client to `kubectl` and Helm on AWS EKS clusters.\n  * **Use Cases:** Inspecting pod logs, debugging failing deployments, generating Kubernetes manifests, and managing cluster configurations.\n\n---\n\n### 4. **DevOps Pipeline & CI/CD Integration**\n* **GitHub / GitLab MCP Servers**\n  * **Function:** Connects the AI client directly to your version control and CI/CD pipelines.\n  * **Use Cases:** Triggering GitHub Actions or GitLab CI pipelines for AWS deployments, inspecting build logs, creating PRs for infrastructure updates, and managing release tags.\n\n---\n\n### 5. **Observability & Monitoring**\n* **Datadog / Prometheus / Grafana MCP Servers**\n  * **Function:** Connects observability platforms monitoring AWS workloads to your AI workflow.\n  * **Use Cases:** Fetching real-time system metrics, querying active alerts, analyzing log traces, and correlating AWS infrastructure incidents.\n\n---\n\n### **How to Get Started**\nYou can run these MCP servers locally via `npx` or Docker and connect them to MCP-compatible clients like **Claude Desktop**, **Cursor**, or **Continue.dev** by configuring your `mcpServers` JSON settings file with your AWS credentials/profiles.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 32, "phrasing": "How to expose AWS infrastructure context to LLMs using an MCP server?", "text": "To expose AWS infrastructure context to an LLM using the Model Context Protocol (MCP), you set up an **MCP Server** that uses the AWS SDK (e.g., `boto3` for Python or `@aws-sdk` for Node.js) to query your AWS environment and serve that data to an MCP-compliant client (like Claude Desktop or Cursor).\n\nHere is the step-by-step process:\n\n---\n\n### 1. Set Up AWS Authentication\nEnsure the environment running your MCP server has valid AWS credentials configured (via AWS CLI `~/.aws/credentials`, environment variables, or an IAM Role). \n*Best practice: Use an IAM policy with **read-only permissions** (e.g., `ReadOnlyAccess`).*\n\n---\n\n### 2. Build the MCP Server (Python Example)\n\nInstall the official Python MCP SDK and AWS SDK:\n```bash\npip install mcp boto3\n```\n\nCreate a server file (`aws_mcp_server.py`) that exposes AWS infrastructure context as **Resources** (read-only state) or **Tools** (callable functions):\n\n```python\nimport boto3\nfrom mcp.server.fastmcp import FastMCP\n\n# Initialize FastMCP server\nmcp = FastMCP(\"AWS Infrastructure Context\")\n\n# Initialize AWS clients\nec2 = boto3.client(\"ec2\")\ns3 = boto3.client(\"s3\")\n\n@mcp.tool()\ndef list_ec2_instances() -> str:\n    \"\"\"Gets a list of all EC2 instances, their states, and public IP addresses.\"\"\"\n    response = ec2.describe_instances()\n    instances = []\n    for reservation in response[\"Reservations\"]:\n        for inst in reservation[\"Instances\"]:\n            instances.append(f\"ID: {inst['InstanceId']}, State: {inst['State']['Name']}, Type: {inst['InstanceType']}\")\n    return \"\\n\".join(instances) if instances else \"No instances found.\"\n\n@mcp.tool()\ndef get_cloudwatch_logs(log_group: str, limit: int = 10) -> str:\n    \"\"\"Fetch the recent log events from a specified CloudWatch log group.\"\"\"\n    logs = boto3.client(\"logs\")\n    streams = logs.describe_log_streams(logGroupName=log_group, orderBy=\"LastEventTime\", descending=True, limit=1)\n    if not streams[\"logStreams\"]:\n        return \"No streams found.\"\n    \n    stream_name = streams[\"logStreams\"][0][\"logStreamName\"]\n    events = logs.get_log_events(logGroupName=log_group, logStreamName=stream_name, limit=limit)\n    return \"\\n\".join([e[\"message\"] for e in events[\"events\"]])\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\n---\n\n### 3. Register the MCP Server with Your Client\n\nAdd your custom MCP server to your client's configuration file (e.g., `claude_desktop_config.json`):\n\n```json\n{\n  \"mcpServers\": {\n    \"aws-context\": {\n      \"command\": \"python\",\n      \"args\": [\"/path/to/aws_mcp_server.py\"],\n      \"env\": {\n        \"AWS_REGION\": \"us-east-1\"\n      }\n    }\n  }\n}\n```\n\n---\n\n### 4. Use Existing Open-Source Options\nIf you prefer not to build your own from scratch, you can use existing open-source AWS MCP servers via `npx` or `pipx`:\n\n* **Community AWS MCP Servers:** Search GitHub for pre-built community servers (e.g., `mcp-server-aws`) that already expose APIs for EC2, CloudWatch, S3, IAM, and Cost Explorer out of the box.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 33, "phrasing": "What MCP server enables natural language querying of AWS infrastructure status?", "text": "The **Steampipe MCP Server** (used with the Steampipe AWS plugin) is the most popular MCP server for enabling natural language querying of AWS infrastructure status. It translates natural language prompts into SQL queries against live AWS APIs to report on infrastructure state, resources, and configurations.\n\nOther notable options include:\n* **CloudQuery MCP Server**: Similar to Steampipe, it extracts AWS infrastructure data into a queryable format via MCP.\n* **`mcp-server-aws`** (Community open-source): Direct MCP wrapper around the AWS SDK/CLI for querying services directly.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 34, "phrasing": "Best enterprise-grade MCP server with role-based access control for AWS cloud resources", "text": "For enterprise-grade management of AWS cloud resources using the Model Context Protocol (MCP), the best approach is using the **Official AWS MCP Server integrated with AWS IAM Identity Center (SSO)**. \n\n### Why this is the best solution:\n* **Native AWS RBAC:** MCP itself delegates authentication. By pairing the standard AWS MCP server with **AWS IAM Identity Center** and **AWS STS (Security Token Service)**, role-based access control is strictly enforced at the AWS API level using temporary, least-privilege credentials based on the user's assigned IAM role.\n* **Auditability:** Every action taken by the MCP server is logged in **AWS CloudTrail**, giving enterprise security teams full visibility into LLM-driven actions mapped to specific identity roles.\n\n---\n\n### Key Alternatives Based on Use Case:\n\n1. **For Infrastructure-as-Code (IaC) Workflows:**\n   * **Pulumi MCP Server:** Best if you manage AWS via IaC. It provides built-in enterprise RBAC, policy-as-code enforcement, and team permissions through Pulumi Cloud.\n\n2. **For Zero-Trust / Proxy-Level Governance:**\n   * **AWS MCP + Teleport / Identity-Aware Proxy:** If you require fine-grained access control before requests reach AWS, route the MCP server traffic through an enterprise access proxy (like Teleport or Cloudflare Zero Trust) mapped to your IdP (Okta, Entra ID).", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 35, "phrasing": "Which AWS MCP server supports fine-grained IAM permission scoping for AI tools?", "text": "The **AWS MCP Server** (specifically the open-source server hosted under `awslabs/mcp-server-aws` and built on the AWS Cloud Control API) supports fine-grained IAM permission scoping. \n\nIt achieves this by binding AI tools directly to standard AWS IAM credentials and execution roles, allowing administrators to restrict the AI's capabilities to specific AWS resources, actions, and condition keys using standard, least-privilege IAM policies.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 36, "phrasing": "We need an MCP server so our developer assistant can create and check AWS SQS queues. What should we use?", "text": "You have two practical options depending on whether you want a quick off-the-shelf tool or tight control over IAM permissions:\n\n### 1. Ready-Made Solution: Community AWS MCP Servers\nYou can use pre-built community servers like **`mcp-server-aws`** or **`aws-mcp`**.\n\n* **How to run:** Configure it in your assistant's MCP config using `uvx` or `npx`:\n  ```json\n  {\n    \"mcpServers\": {\n      \"aws\": {\n        \"command\": \"uvx\",\n        \"args\": [\"mcp-server-aws\"],\n        \"env\": {\n          \"AWS_PROFILE\": \"your-dev-profile\",\n          \"AWS_REGION\": \"us-east-1\"\n        }\n      }\n    }\n  }\n  ```\n* **Pros:** Ready to go instantly.\n* **Cons:** Gives the assistant broad AWS capabilities unless restricted at the IAM level.\n\n---\n\n### 2. Recommended: Custom Lightweight MCP Server\nBecause SQS operations are simple, building a dedicated, secure MCP server using Python (`fastmcp` + `boto3`) is often the best approach. It limits the LLM strictly to SQS actions.\n\n**Minimal Python Example (`sqs_mcp.py`):**\n\n```python\nimport boto3\nfrom mcp.server.fastmcp import FastMCP\n\nmcp = FastMCP(\"AWS-SQS\")\nsqs = boto3.client(\"sqs\")\n\n@mcp.tool()\ndef create_queue(queue_name: str) -> str:\n    \"\"\"Create an AWS SQS queue and return its URL.\"\"\"\n    response = sqs.create_queue(QueueName=queue_name)\n    return response[\"QueueUrl\"]\n\n@mcp.tool()\ndef get_queue_url(queue_name: str) -> str:\n    \"\"\"Get the URL of an existing SQS queue.\"\"\"\n    response = sqs.get_queue_url(QueueName=queue_name)\n    return response[\"QueueUrl\"]\n\n@mcp.tool()\ndef list_queues(prefix: str = \"\") -> list:\n    \"\"\"List SQS queue URLs matching a prefix.\"\"\"\n    response = sqs.list_queues(QueueNamePrefix=prefix)\n    return response.get(\"QueueUrls\", [])\n\nif __name__ == \"__main__\":\n    mcp.run()\n```\n\n### Summary Recommendation\n* **Use Option 1** if you want no maintenance and already manage permissions strictly via AWS IAM profiles.\n* **Use Option 2** if you want a lightweight, dedicated, and secure interface specifically for SQS.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 37, "phrasing": "What Model Context Protocol server offers the broadest coverage of AWS service APIs?", "text": "The **Boto3/AWS SDK-based MCP servers** (such as [`mcp-server-aws`](https://github.com/mcp-so/mcp-server-aws) or dynamic Boto3 wrappers) offer the broadest coverage. \n\nBecause they dynamically wrap the official AWS Python SDK (`boto3`), they provide access to virtually **all AWS service APIs** out of the box, rather than limiting functionality to a manually implemented subset of services.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 38, "phrasing": "Best MCP server for connecting LLM context windows to Amazon Web Services documentation and architecture", "text": "The standard and most effective option for this workflow is the **AWS Documentation MCP Server** (such as community-maintained servers like `aws-doc-mcp` or implementations under the `awslabs` / open-source GitHub repositories).\n\nHere are the top choices depending on your specific use case:\n\n### 1. **AWS Documentation MCP Server (Best for Docs & Architecture)**\n* **Repository:** Search GitHub for `aws-doc-mcp` or `mcp-server-aws-docs`.\n* **What it does:** Indexes official AWS documentation, the AWS Well-Architected Framework, and AWS Architecture Center patterns. It allows the LLM to search, retrieve, and reference specific AWS services, API references, and architecture best practices directly inside your prompt context.\n* **Best for:** Design patterns, infrastructure-as-code (CDK/Terraform) syntax, and service limits/quotas.\n\n### 2. **AWS CLI / Resource MCP Server (Best for Live Infrastructure Context)**\n* **Repository:** `mcp-server-aws` (or AWS Labs implementations)\n* **What it does:** Connects your LLM context to your active AWS environment (via AWS SDK/CLI credentials) to read current configurations, CloudFormation templates, or deployed resources alongside docs.\n* **Best for:** Auditing live architecture against AWS documentation and troubleshooting active deployments.\n\n---\n\n### Alternative / General-Purpose Recommendation\nIf you don't want to run a dedicated AWS-only server, the **Context7** or **Puppeteer/Fetch MCP Server** paired with a targeted query strategy (pointing the LLM to `docs.aws.amazon.com` and `aws.amazon.com/architecture`) works seamlessly for fetching live, up-to-date AWS documentation.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 39, "phrasing": "Which MCP server allows AI chatbots to interact with AWS ECS and EKS clusters?", "text": "The **AWS MCP Server** (e.g., `awslabs/mcp-server-aws` or open-source variants like `mcp-server-aws`) allows AI chatbots to manage and interact with AWS resources, including **ECS** and **EKS**, via the AWS SDK.\n\nFor deeper, Kubernetes-native management of **EKS** clusters specifically, chatbots typically use the **Kubernetes MCP Server** (`mcp-server-kubernetes`) configured with AWS IAM credentials.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 40, "phrasing": "What is the most secure MCP server implementation for Amazon Web Services APIs?", "text": "The most secure approach to using Model Context Protocol (MCP) with AWS APIs relies on using a **locally executed `stdio`-based MCP server** paired with **AWS IAM best practices**, rather than relying solely on a specific third-party implementation.\n\nTo achieve maximum security for an AWS MCP server, follow this standard security architecture:\n\n### 1. Implementation Choice\nUse an open-source MCP server built on official AWS SDKs (such as Node.js `@aws-sdk` or Python `boto3`) that executes locally over `stdio` rather than exposing HTTP/SSE network endpoints.\n\n### 2. Core Security Practices\n\n* **Temporary Credentials (AWS SSO / IAM Identity Center):** Never pass static AWS access keys (`AKIA...`) as environment variables or configuration files. Configure the MCP server to rely on the default AWS credential provider chain using short-lived tokens generated via `aws sso login`.\n* **Least-Privilege IAM Roles:** Attach strict, scoped IAM policies to the active session. If the goal is querying resources, assign a policy with read-only access (e.g., `AWSReadOnlyAccess`) or restrict permissions to specific services and resources.\n* **Human-in-the-Loop (HITL) Gatekeeping:** Ensure your MCP client (such as Claude Desktop) is configured to require manual user approval before executing any tool call, especially state-changing operations (Create, Update, Delete).\n* **Local Isolation:** Run the MCP server in a restricted local environment or container (like Docker) if you need to prevent the server from accessing local file systems or host network interfaces beyond what AWS requires.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 41, "phrasing": "Recommended MCP server for AI agents doing automated cloud auditing on AWS", "text": "The recommended MCP server for automated AWS cloud auditing is the **Steampipe MCP Server** (using the Steampipe AWS plugin).\n\n### Why it's the best choice for auditing:\n* **SQL-based Auditing:** Allows AI agents to query AWS infrastructure using standard SQL across 100+ AWS services (e.g., checking for unencrypted S3 buckets, overly permissive IAM policies, or open Security Groups).\n* **Built-in Compliance Frameworks:** Easily integrates with Steampipe compliance mods (CIS Benchmarks, PCI-DSS, NIST, HIPAA) so the AI can run pre-built audit suites natively.\n* **Token Efficiency:** Instead of fetching massive, unstructured AWS API payloads, SQL queries return precise, structured JSON, saving LLM context window space.\n\n---\n\n### Alternative Option:\n* **AWS CLI / Boto3 MCP Server** (e.g., community packages like `mcp-server-aws`): Best if your AI agent needs direct, raw access to AWS APIs (`aws ec2 describe-*`, `aws iam list-*`) rather than high-level security/compliance queries.\n\n### Key Setup Requirement:\nEnsure the IAM role attached to the MCP server has strictly **Read-Only / Auditor access** (e.g., AWS managed policy `SecurityAudit` or `ReadOnlyAccess`) to maintain a safe blast radius.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 42, "phrasing": "Which Model Context Protocol tool provides seamless integration with AWS account management?", "text": "The **AWS MCP Server** (often available as `mcp-server-aws` or through community integrations like the `aws-mcp` tools) provides seamless integration with AWS account management and services.", "error": null}
{"engine": "gemini", "model": "gemini-flash-latest", "index": 43, "phrasing": "What MCP server should DevOps teams install to give AI assistants access to AWS diagnostics?", "text": "DevOps teams should install an **AWS MCP Server** (such as the open-source `mcp-server-aws` or community tools like `aws-mcp`). \n\nThese servers integrate with the AWS SDK/CLI to provide AI assistants with read-only access to diagnostic services, including:\n\n* **AWS CloudWatch:** For querying logs, alarms, and performance metrics.\n* **AWS CloudTrail:** For reviewing API activity and audit logs.\n* **AWS Health & Config:** For monitoring resource status, compliance, and infrastructure changes.\n* **EC2 / EKS / ECS:** For checking service, container, and instance health.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 0, "phrasing": "What is the best MCP server for connecting AI assistants to AWS infrastructure?", "text": "There is **no single best** MCP server for AWS infrastructure; the best choice depends on what you want the AI assistant to do. For **general AWS service access**, the strongest default is the **AWS MCP Server / AWS API MCP Server** from AWS, while for **infrastructure authoring and review** the **AWS Infrastructure as Code MCP Server** is the more targeted choice.[1][10][15][16]\n\nIf you want a practical recommendation:\n\n- **Best overall for broad AWS access:** **AWS MCP Server** / **AWS API MCP Server** because it is AWS-backed and designed for general interaction with AWS services.[15][16]\n- **Best for CDK / CloudFormation help:** **AWS Infrastructure as Code MCP Server** because AWS explicitly positions it for AI-powered IaC assistance.[10][18]\n- **Best if you want a curated AWS-focused ecosystem:** the **awslabs/mcp** collection, which AWS documents as open-source MCP servers for AWS use cases.[5][11][13]\n- **Best for a narrow operational use case:** a service-specific server such as CloudWatch, S3, EC2, or Bedrock, which can be easier to scope and safer to adopt than a broad SDK wrapper.[1]\n\nFor most teams, the safest starting point is:\n\n1. Use the **AWS Infrastructure as Code MCP Server** if your main goal is building, explaining, or reviewing AWS infrastructure code.[10][18]\n2. Use the **AWS MCP Server** if your assistant needs broader AWS operational access across services.[15][16]\n3. Prefer a **narrow server** over a broad wrapper when you only need one domain, because that is the recommendation in current MCP server guidance for AWS teams.[1]\n\nIf you want, I can also give you a **ranked shortlist by use case** such as *Terraform/CDK, SRE operations, security review, or cost analysis*.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 1, "phrasing": "Best Model Context Protocol server for Amazon Web Services", "text": "If you mean the **best official AWS MCP server** for working with AWS services, the strongest default choice is the **AWS MCP Server** from AWS, which is now generally available and specifically positioned for AWS-related code assistants and workflows.[1][7]\n\nIf you mean the **best way to run MCP servers on AWS**, AWS recommends a few deployment patterns depending on your needs: **Amazon ECS** for containerized servers, **AWS Lambda + API Gateway** for lightweight/serverless use cases, and **Bedrock AgentCore Runtime** for deploying MCP servers as part of AgentCore-based agents.[2][3][15][17][18]\n\nA practical way to choose is:\n\n- **Use AWS MCP Server** if you want broad, first-party access to AWS services and tooling.[1][7]\n- **Use awslabs open-source MCP servers** if you want task-specific servers for particular AWS services or examples to customize.[6][8]\n- **Use the AWS guidance for deploying MCP servers on AWS** if your main goal is hosting your own MCP server reliably on AWS infrastructure.[2][3][10]\n\nIf you want, I can also give you a **best MCP server by use case** breakdown, such as for **S3, Lambda, ECS, Bedrock, or infrastructure review**.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 2, "phrasing": "We want our local AI coding assistant to query AWS S3 buckets and CloudWatch logs via MCP. What server should we use?", "text": "Use **two MCP servers**, because AWS currently publishes separate servers for these needs: **`awslabs.cloudwatch-mcp-server`** for CloudWatch logs/alarms/metrics and a separate **S3 MCP server** for S3 buckets and objects.[1][2][10]\n\nIf you want the **AWS-maintained/open-source** options, the most directly supported pairing is:\n\n- **CloudWatch:** `awslabs.cloudwatch-mcp-server`[1][2]\n- **S3:** an **AWS S3 MCP server** such as `aws-s3-mcp`/`aws-s3-mcp-server`-style implementations for bucket/object operations[10][11]\n\nIf your goal is **one server that can access many AWS services**, AWS also has a managed **AWS MCP Server** that provides authenticated access to **all AWS services** through a fixed set of tools, but that is a broader service rather than a dedicated S3+CloudWatch local server pair.[3][7]\n\nFor a **local coding assistant**, the practical answer is usually:\n\n- use **`awslabs.cloudwatch-mcp-server`** for CloudWatch access[1][2]\n- use a separate **S3 MCP server** for S3 access[10][11]\n\nIf you want, I can also recommend the **best exact S3 MCP server** based on your client (Claude Desktop, Cursor, Amazon Q, Cline, etc.).", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 3, "phrasing": "Recommend an AWS MCP server for a team managing multi-region cloud resources.", "text": "For a team managing **multi-region AWS resources**, the best default choice is the **AWS MCP Server** because it provides secure, authenticated access to **all AWS services**, can make API calls to **any Region**, and is designed for real-world multi-step tasks like provisioning, troubleshooting, and resource management.[2][3][6]\n\nIf your team also needs strong **region-awareness** for planning or expansion work, pair it with the **AWS Knowledge MCP Server**. AWS says it includes authoritative documentation plus **regional availability of AWS APIs and CloudFormation resources**, which makes it especially useful when evaluating what is available in each Region before deploying.[1][5]\n\nA practical recommendation would be:\n\n- **Primary server:** **AWS MCP Server** for day-to-day operational work across Regions.[2][6]\n- **Add-on server:** **AWS Knowledge MCP Server** for documentation, best practices, and regional availability checks.[1][5]\n\nWhy this combo works well for multi-region teams:\n\n- The AWS MCP Server is **managed**, **authenticated through IAM**, and provides **CloudTrail audit logging**, which is useful for shared team operations.[3][6]\n- It supports **multi-service workflows** and pre-built **Agent SOPs**, which can reduce mistakes during cross-region changes.[3][6]\n- The AWS Knowledge MCP Server is **free**, **globally available**, and does not require an AWS account, so it is easy to use as a trusted reference layer.[5]\n\nIf you want, I can also recommend a setup by use case, such as **operations**, **architecture review**, or **incident response**.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 4, "phrasing": "affordable and secure MCP server for AWS resource management", "text": "The **best affordable and secure choice** is the **managed AWS MCP Server** from AWS, because it has **no additional charge for the server itself** and is designed for **secure, authenticated, auditable access** to AWS services.[3][5][16][20]\n\nIf you want a **more specialized** option for resource management, AWS also offers open-source MCP servers under `awslabs/mcp`, including the **AWS API MCP Server** for broad AWS operations and the **Cloud Control API MCP Server** for CRUDL resource management.[1][6][10][12] The Cloud Control API MCP Server is explicitly recommended with **least-privilege IAM**, **CloudTrail auditing**, and an optional **read-only mode** for safer use.[6]\n\nA practical recommendation:\n\n| Option | Cost | Security posture | Best for |\n|---|---:|---|---|\n| **AWS MCP Server** | **Free server; pay only for AWS resources used** | Strong: managed by AWS, authenticated access, audit logging, IAM condition keys | General AWS resource management with minimal setup[3][5][16][20] |\n| **Cloud Control API MCP Server** | Open-source server; AWS usage costs apply | Strong if you follow least privilege, CloudTrail, and read-only mode | CRUDL-style infrastructure management[6][10] |\n| **AWS API MCP Server** | Free product listing; AWS usage costs apply | Secure when deployed with built-in authentication/session isolation on AgentCore | Broad AWS CLI-style management[7] |\n\nIf your priority is **lowest cost + security**, start with the **managed AWS MCP Server**.[3][5][16] If you need **more control** or a **self-hosted** setup, use the **Cloud Control API MCP Server** with IAM least privilege and read-only mode where possible.[6]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 5, "phrasing": "What MCP server do cloud engineers actually use to let LLMs read AWS configuration?", "text": "Cloud engineers typically use the **AWS MCP Server** for this now, especially the managed remote version that Amazon recommends if you want an LLM to read AWS configuration and other AWS service data.[6][10] AWS says that if you are currently using the older **AWS API MCP Server** or **AWS Knowledge MCP Server**, you should switch to the **AWS MCP Server**.[10]\n\nIf the goal is specifically to let an LLM inspect AWS config through your local AWS credentials, AWS documents a setup that uses the **AWS MCP Server** together with the **MCP Proxy for AWS**, which bridges IAM-based local credentials to the OAuth flow the remote MCP server expects.[6]  \n\nFor engineers working with source-managed, local tooling, AWS also publishes the **open-source AWS MCP Servers** suite, including the **core** server that coordinates with other AWS MCP servers in the stack.[1][8][15]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 6, "phrasing": "Best MCP server to connect AI agents to Amazon Web Services data stores", "text": "For **Amazon Web Services data stores**, the strongest default choice is the **AWS MCP Servers** suite from **AWS Labs**, because it is the official, open-source set of MCP servers for AWS and includes server support for **Bedrock knowledge bases, cost analysis, documentation, CDK, Lambda, ECS, and more**.[1][7][8][9]\n\nIf your goal is specifically to work with **AWS databases / data stores**, AWS also publishes a **database-focused MCP server** and a separate **AWS Data Processing MCP Server** for data workflows, so the \u201cbest\u201d option depends on which datastore you mean and what you want the agent to do.[5][12][18]\n\n**Practical recommendation:**\n- **General AWS data-store access and broad AWS tooling:** use **AWS MCP Servers** from AWS Labs.[1][7][9]\n- **Database development and database-oriented agent tasks:** use the AWS **database-focused MCP server** referenced in AWS\u2019s database blog.[5]\n- **Data engineering / processing pipelines:** use the **AWS Data Processing MCP Server**.[12][18]\n\nIf you want the most broadly useful answer in one line: **AWS MCP Servers (AWS Labs) is the best overall starting point for connecting AI agents to AWS data stores** because it is official and covers the widest AWS surface area.[1][7][9]\n\nIf you want, I can also recommend the **best AWS MCP server by datastore type** \u2014 for example **Aurora, DynamoDB, S3, Redshift, or OpenSearch**.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 7, "phrasing": "Which MCP server allows LLMs to query AWS DynamoDB and S3 safely?", "text": "The **AWS MCP Server** is the managed MCP server that lets LLMs query AWS services, including **Amazon DynamoDB** and **Amazon S3**, through a fixed set of tools and existing IAM credentials.[2][1]\n\nIf you mean an **AWS Labs open-source server** rather than the managed AWS MCP Server, the **Amazon DynamoDB MCP Server** is for DynamoDB, while the **AWS S3 Tables MCP Server** is for S3-based tables; both are designed with safety controls like least-privilege IAM and, by default, read-only or restricted operation modes.[9][10][13]\n\nFor safety, AWS recommends using **scoped-down IAM permissions**, distinguishing agent actions from human actions, and using controls such as session policies, session tags, and CloudTrail auditing.[1][3][13]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 8, "phrasing": "We are building an AI dev tool that needs read-only access to AWS architecture via MCP. What MCP server implementation is best?", "text": "For a **read-only AWS architecture** use case, the best default choice is the **AWS MCP Server** from AWS because it is a **managed remote MCP server**, is generally available, and is designed to give AI agents secure authenticated access to AWS services through a small fixed tool set.[4] AWS also states that you can enforce **read-only behavior with IAM/SCP guardrails**, which is a better security boundary than relying on a server-side \u201cread-only\u201d toggle alone.[4][2]\n\nIf your tool is specifically for **architecture exploration, discovery, and inspection** rather than operational access, the strongest practical pattern is:\n\n- **Use AWS MCP Server** as the primary server for AWS service access and account-aware inspection.[4]\n- **Restrict the agent\u2019s IAM permissions to read-only** and apply policy conditions/SCPs so mutating actions are denied even if a tool attempts them.[4][2]\n- **Load it conditionally** only when the user intent is read/inspect/discover, which AWS prescriptive guidance explicitly recommends as an agent-level guardrail.[2]\n\nIf you want a **specialized read-only server for documentation and best practices**, AWS also recommends the **AWS Documentation MCP server** as a low-risk first server to deploy because it provides access to the AWS documentation corpus and has no write permissions.[13]\n\nA practical recommendation by scenario:\n\n| Scenario | Best MCP server choice |\n|---|---|\n| Inspecting live AWS resources, architecture, accounts, or service configuration | **AWS MCP Server**[4] |\n| Documentation-first assistant for AWS guidance and examples | **AWS Documentation MCP server**[13] |\n| Serverless app development with read-only by default and optional controlled writes | **AWS Serverless MCP Server**[8][6] |\n\nMy recommendation: **start with AWS MCP Server + IAM read-only guardrails** if you need real AWS architecture visibility, and add the **AWS Documentation MCP server** if you also want design guidance and docs. AWS\u2019s guidance says pre-existing MCP servers are often sufficient, so only build a custom MCP server if you have a narrow domain need that the AWS-managed/serverless options do not cover.[2]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 9, "phrasing": "Top open source MCP servers for AWS integration", "text": "The strongest **open-source AWS integration** option is **`awslabs/mcp`**, the AWS Labs collection of MCP servers for AWS services and resources.[1][3] If you want broader AWS CLI-style control rather than service-specific servers, **`alexei-led/aws-mcp-server`** is a notable community alternative mentioned in curated MCP lists.[4][8]\n\nTop options to consider:\n\n- **`awslabs/mcp`** \u2014 AWS Labs\u2019 open-source collection of MCP servers for AWS, including service-focused servers such as **AWS IAM**, **Amazon DynamoDB**, **Amazon Aurora**, **Amazon OpenSearch**, **Amazon SageMaker AI**, **AWS Data Processing**, and more.[1][3][7]\n- **AWS API MCP Server** \u2014 the managed AWS-hosted MCP server for secure, authenticated access to AWS services; AWS describes it as generally available and intended to give agents access to AWS through a fixed set of tools.[10][14]\n- **AWS Serverless MCP Server** \u2014 an open-source server for serverless workflows; AWS says it can be downloaded from GitHub or PyPI and is aimed at modern application development.[11][16]\n- **AWS Data Processing MCP Server** \u2014 an open-source server for analytics and data engineering workflows across AWS Glue, Amazon EMR, and Amazon Athena.[12]\n- **`alexei-led/aws-mcp-server`** \u2014 a lightweight community server that lets AI assistants execute AWS CLI commands and use Unix pipes, which can be useful if you prefer CLI-driven automation.[4][8]\n\nIf you want the most practical shortlist:\n\n| Best for | Server |\n|---|---|\n| Broad AWS service integration | `awslabs/mcp`[1][3] |\n| Managed, secure AWS access | AWS API MCP Server[10][14] |\n| Serverless app workflows | AWS Serverless MCP Server[11][16] |\n| Data/analytics pipelines | AWS Data Processing MCP Server[12] |\n| CLI-based automation | `alexei-led/aws-mcp-server`[4][8] |\n\nFor most users, start with **`awslabs/mcp`** if you want a maintained AWS-native ecosystem, and choose a specialized server from that collection based on your workload.[1][7] If you tell me your use case\u2014Lambda, IAM, DynamoDB, Bedrock, data engineering, or general AWS ops\u2014I can narrow this to the best 2\u20133 servers.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 10, "phrasing": "Which Model Context Protocol server works best for Amazon Bedrock LLMs?", "text": "For **Amazon Bedrock LLMs**, the best MCP server is usually **not one single server** but the **AWS-managed MCP option that matches your use case**\u2014most often the **Amazon Bedrock Knowledge Bases Retrieval MCP Server** for enterprise RAG, or the **Amazon Bedrock AgentCore MCP Server** if you want a purpose-built, managed path for Bedrock AgentCore integrations.[7][8][9][4]\n\nIf you mean \u201cbest\u201d in terms of **official AWS support and easiest Bedrock integration**, the strongest candidates are:\n\n- **Amazon Bedrock Knowledge Bases Retrieval MCP Server** \u2014 best for asking Bedrock models over your internal documents with citation support.[7][9]\n- **Amazon Bedrock AgentCore MCP Server** \u2014 best when you are building Bedrock AgentCore-based agents and want runtime, gateway integration, identity management, and memory built in.[4]\n- **AWS open-source MCP servers** \u2014 best when you need broader AWS-tool access and want to compose multiple servers rather than rely on one.[2][7][9]\n\nA practical rule is:\n\n- Use **Knowledge Bases Retrieval** for retrieval-augmented generation over company knowledge.[7][9]\n- Use **AgentCore MCP Server** for managed agent runtimes and production agent workflows.[4][10][19]\n- Use **multiple MCP servers** if you need reliability and want to avoid a single point of failure.[1][8]\n\nAWS\u2019s own guidance emphasizes selecting the **appropriate MCP servers for your data sources** rather than treating MCP as a single all-purpose server.[5]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 11, "phrasing": "How to connect an LLM assistant to AWS cloud resources using MCP?", "text": "To connect an LLM assistant to AWS cloud resources using **MCP (Model Context Protocol)**, you typically **install an AWS MCP server, configure AWS credentials, and register that server in your MCP-capable client** such as Claude Desktop, Amazon Q CLI, Cursor, or Cline.[1][2][5]\n\nA practical setup looks like this:\n\n- **Choose the AWS MCP server** you need, such as the AWS Cloud Control API MCP Server for managing many AWS resources, the AWS Knowledge MCP Server for documentation, or a service-specific server like OpenSearch or Lambda Tool MCP.[8][13][17]\n- **Install prerequisites** such as `uv`, Python, and valid AWS credentials with the permissions required for the resources you want the assistant to access.[1][6][18]\n- **Add the server to your MCP client config** so the assistant can discover and call its tools. AWS examples show `mcpServers` entries that launch the server with `uvx` or another command, depending on the package.[1][10]\n- **Restart the client and verify the server loads**; for example, Amazon Q CLI lets you check server status with `/mcp` after startup.[3][18]\n- **Prompt the assistant naturally** and let it use the MCP tools for AWS actions, such as creating resources or querying service information.[3][8][11]\n\nThe key idea is that MCP acts as a **standard bridge** between the LLM client and AWS tools/services, so the model can request actions through the server instead of calling AWS APIs directly.[2][5][11]\n\nIf you want, I can give you a **step-by-step setup for a specific client** like Claude Desktop, Amazon Q CLI, or Cursor.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 12, "phrasing": "What is the most reliable MCP server for inspecting AWS IAM roles and Security Groups?", "text": "If your goal is **inspecting AWS IAM roles and Security Groups**, the most reliable choice is usually the **AWS-managed MCP Server** for AWS, because it uses AWS-native IAM authorization, reduces self-hosting drift, and is the option AWS positions for secure agent access with standard IAM controls and CloudTrail auditability.[7][8][15]\n\nFor the specific task of **IAM roles**, AWS also provides an **AWS IAM MCP Server** in the `awslabs/mcp` project, which is described as a \u201cModel Context Protocol (MCP) server for comprehensive AWS Identity and Access Management (IAM) operations\u201d and includes tools such as listing IAM roles.[3][14] For **Security Groups**, the broader AWS MCP Server is the more relevant fit because Security Groups are part of EC2/networking rather than IAM, and the managed AWS MCP Server exposes a large set of AWS API operations across services.[13][15]\n\n**Practical recommendation:**\n- Use **AWS-managed MCP Server** if you want the most reliable, lowest-maintenance option for inspecting both IAM-related and networking-related AWS resources.[7][8][15]\n- Use **AWS IAM MCP Server** if your workflow is narrowly focused on IAM-only inspection and role analysis.[3][14]\n- Avoid relying on community-hosted or third-party MCP wrappers when reliability and security matter, because AWS-managed access keeps authorization and audit in the AWS control plane.[5][7][8]\n\nIf you want, I can also compare the **best MCP setup for IAM roles vs Security Groups** in a small table.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 13, "phrasing": "Best MCP server for querying CloudWatch logs with natural language", "text": "For **natural-language querying of CloudWatch Logs**, the strongest choice in these results is the **AWS Labs CloudWatch Logs MCP server / Log-Analyzer-with-MCP**, because it is purpose-built for CloudWatch Logs analysis and explicitly supports AI assistants for searching, analysis, and correlation.[10][11]\n\nIf your priority is *turning a question into a logs query and getting structured analysis back*, AWS\u2019s own ecosystem is also the most credible option because AWS documents a CloudWatch Logs Insights **Query Assist** feature that can generate and update queries from natural language.[7]\n\nA practical ranking from the results would be:\n\n| Option | Best for | Why it stands out |\n|---|---|---|\n| **AWS Labs Log-Analyzer-with-MCP / CloudWatch Logs MCP** | Natural-language log analysis | Built specifically for CloudWatch Logs analysis, searching, and correlation.[10][11] |\n| **AWS CloudWatch Logs Insights Query Assist** | Native AWS natural-language query help | AWS-supported natural-language generation and editing of Logs Insights queries.[7] |\n| **CloudWatch Logs MCP Server (community)** | Lightweight MCP integration | Described as querying logs with natural language and identifying patterns.[2] |\n\nIf you want the **best overall** answer, I\u2019d pick **AWS Labs Log-Analyzer-with-MCP** for an MCP-based workflow, and **CloudWatch Logs Insights Query Assist** if you prefer staying entirely inside AWS tooling.[7][10][11]\n\nIf you want, I can also compare these by **setup difficulty, permissions, and compatibility with Claude/Kiro**.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 14, "phrasing": "We need an MCP server that lets developers ask an AI agent about active AWS EC2 instances. What options exist?", "text": "Several **MCP server options** can help developers ask an AI agent about **active AWS EC2 instances**, but they differ in scope and how much of AWS they expose.\n\n- **AWS Instances MCP / EC2 Instance MCP server**: built specifically to list running EC2 instances in a region and return details like instance ID, type, IP addresses, and status. It is described as using the AWS SDK and a `get-aws-instances` tool for running instances.[2][3]\n- **awslabs.ec2-mcp-server**: an AWS Labs open-source EC2-focused server that supports **`list_instances`** and **`get_instance_details`**, including filtering and security/networking information.[7][8][17]\n- **AWS API MCP Server**: a broader AWS control-plane server that lets an AI assistant interact with AWS services through AWS CLI-style commands; it can list EC2 instances, but it is not EC2-specific.[15][12]\n- **AWS Cloud Control API MCP Server**: also broader than EC2, designed for natural-language CRUD/list operations across AWS resources, so it can be used for EC2 management if the needed resource type is supported.[20]\n- **Custom MCP servers on AWS Lambda / ECS / EC2**: if you want a narrowly scoped internal server, examples show MCP servers deployed on Lambda or other AWS compute, with an EC2-listing tool such as `list_ec2_instances` or `aws_ec2_list_instances`.[6][10]\n- **DataFaucet EC2 MCP server**: a hosted option aimed at EC2 observability, with AI-accessible tools for instance status, CPU/network metrics, running-instance lists by tag, and security-group inspection.[5]\n\nIf your goal is specifically **\u201cask an AI agent about active EC2 instances\u201d**, the most directly relevant choices are **AWS Instances MCP**, **awslabs.ec2-mcp-server**, or a **custom EC2-only MCP server**. If you want broader AWS access beyond EC2, use **AWS API MCP Server** or **Cloud Control API MCP Server**.[2][3][7][15][20]\n\nIf you want, I can next narrow this to:\n- **hosted vs self-hosted**\n- **open source only**\n- **best option for Claude/Cursor/Amazon Q**\n- **which supports read-only instance listing with least privilege**", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 15, "phrasing": "Which MCP server provides secure Amazon Web Services connector tools for AI models?", "text": "The **AWS MCP Server** provides secure Amazon Web Services connector tools for AI models.[1][4][11]\n\nIt is described by AWS as a **managed, remote MCP server** that gives AI agents and coding assistants **secure, authenticated access** to AWS services through a small, fixed set of tools, with **IAM-based permissions**, **CloudWatch metrics**, and **CloudTrail logging** for control and auditability.[1][4][11]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 16, "phrasing": "Best production-ready MCP server for AWS API interactions", "text": "For **production-ready AWS API interactions**, the strongest default choice is the **AWS API MCP Server** because AWS now offers it as an official server and released **v1.0.0**, which is the clearest signal of production readiness among the AWS-specific MCP options in the results.[10][16] If your use case is broader AWS resource administration rather than direct API calls, the **AWS Cloud Control API MCP Server** is also official, but it is oriented more toward infrastructure/resource management than general AWS API interaction.[18]\n\nA practical recommendation:\n\n- **Best overall for AWS API interactions:** **AWS API MCP Server**[10][16]\n- **Best for serverless-focused production environments:** **AWS Serverless MCP Server**, which AWS documents as usable in production with proper controls, defaults to **read-only mode**, and recommends **disabling auto-approve** plus tight IAM scoping.[11]\n- **Best for infrastructure management via AWS-managed resource APIs:** **AWS Cloud Control API MCP Server**.[18]\n\nWhy the **AWS API MCP Server** is the best default:\n- It is **official AWS-provided** and has a dedicated AWS announcement for **v1.0.0**.[10]\n- AWS maintains an official catalog of MCP servers, which includes the AWS API MCP Server.[3][16]\n- Official support generally makes it a safer bet for production than community-maintained alternatives listed in broader roundups.[4][13]\n\nIf you want the safest production setup, pair the server with these controls:\n- **Least-privilege IAM roles**.[11]\n- **Separate roles** for read-only and write actions.[11]\n- **CloudTrail auditing** for API calls.[11]\n- **Resource tagging** and regular permission reviews.[11]\n- If using the server in an agentic workflow, prefer **manual approval for writes** and keep **read-only mode** as the default.[11]\n\nIf you mean \u201cbest\u201d in a narrower sense\u2014such as *the most mature deployment pattern on AWS*\u2014AWS\u2019s own production guidance around MCP servers emphasizes **AgentCore Gateway** for API management and **stateless HTTP** server design for scalable deployments.[9]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 17, "phrasing": "We are an enterprise cloud platform team looking for a compliant AWS MCP server for internal AI tools. What should we evaluate?", "text": "For an **enterprise-compliant AWS MCP server**, evaluate it on three layers: **AWS compliance scope**, **security architecture**, and **operational controls**. The key question is not just whether the server is \u201csecure,\u201d but whether its underlying AWS services, authentication model, and logging/governance features fit your regulatory and internal controls requirements.[1][3][4][5][17]\n\n- **Compliance scope of the AWS services involved**: AWS says to verify whether each underlying service is in scope for the compliance program you care about by checking *AWS services in Scope by Compliance Program*, and it points to AWS Artifact for third-party audit reports.[1][5]\n- **Authentication and authorization model**: AWS MCP Server uses **IAM** and **SigV4** authentication, and AWS recommends fine-grained IAM policies plus new IAM context keys such as `aws:ViaAWSMCPService` and `aws:CalledViaAWSMCP` to distinguish MCP-originated actions from direct human actions.[3][17]\n- **Least privilege**: Confirm you can enforce **read-only** vs **mutating** separation, scope permissions per tool, and start with restrictive policies that you can tighten or relax over time as usage becomes clear.[3][17]\n- **Credential handling**: Prefer **short-lived credentials** and assume-role style flows rather than long-lived secrets; AWS security guidance for MCP patterns emphasizes ephemeral credentials and scoped tokens.[2]\n- **Transport security**: Require **TLS 1.2+** end-to-end, with certificate validation; AWS documentation explicitly requires TLS 1.2 and recommends TLS 1.3.[5]\n- **Supported integration protocol**: If you plan to connect it to AWS-managed agents such as DevOps Agent, verify the server supports **Streamable HTTP transport** and one of the supported auth methods: **OAuth 2.0**, **API key/token**, or **SigV4**.[7]\n- **Network isolation**: Prefer deployment patterns that keep the server in hardened environments such as **ECS**, private subnets, sidecars, or similarly isolated container runtimes, with strict network controls.[2][9][16]\n- **Logging and auditability**: Confirm the server produces detailed, immutable audit logs for model calls, authorization decisions, and tool invocations so you can support compliance reviews and incident investigations.[2][12][17]\n- **MFA and identity governance**: AWS recommends **MFA** and strong account/role governance for secure data access patterns.[5]\n- **Data access minimization**: Evaluate whether the server exposes only the AWS APIs and operations your internal AI tools truly need, with explicit controls for sensitive services and environments.[3][17]\n- **Compliance automation**: Check whether the server can be paired with automated validation/compliance tooling where appropriate; some AWS MCP-related tooling is designed to run validation locally without AWS permissions, which can reduce blast radius for certain workflows.[11]\n\nA practical enterprise evaluation checklist would be:\n\n- **Compliance evidence**: AWS Artifact reports, service-in-scope status, region/data residency fit.[1][5]\n- **Identity**: IAM/SigV4, SSO integration, MFA, short-lived credentials.[3][5][17]\n- **Authorization**: least-privilege policies, SCP support, read/write separation, MCP-specific context keys.[3][17]\n- **Deployment**: hardened container/runtime, private networking, TLS enforcement.[2][5][9][16]\n- **Observability**: request logs, audit trails, traceability for every tool call.[2][12][17]\n- **Supported protocols**: Streamable HTTP and compatible auth mechanisms for your client stack.[7]\n- **Operational fit**: whether it is a managed AWS MCP server or a self-hosted MCP deployment, since managed and self-hosted models have different compliance and control implications.[3][16][18][19]\n\nIf you want, I can turn this into a **vendor evaluation matrix** with columns for *control objective, question to ask, evidence to request, and pass/fail criteria*.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 18, "phrasing": "Which MCP server gives AI coding assistants real-time context on AWS cloud infrastructure?", "text": "The **AWS MCP Server** is the one that gives AI coding assistants real-time context on AWS cloud infrastructure through secure, authenticated access to AWS services and documentation.[1][11][12]\n\nIf you mean a **service-specific** server, AWS also offers MCP servers for **ECS**, **EKS**, **Lambda**, and **Serverless** development that provide real-time, contextual knowledge of those workloads and services to coding assistants.[2][6][9][13]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 19, "phrasing": "What MCP server should I use to let AI models run AWS CLI commands safely?", "text": "Use the **AWS MCP Server** from AWS, not a generic terminal MCP, if your goal is to let models run AWS CLI\u2013style operations with the best built-in security posture. AWS now offers a managed, remote **AWS MCP Server** with authenticated access, a small fixed tool set, and sandboxed execution options; AWS says it is the appropriate choice for secure agent access to AWS services[16][12].\n\nIf you specifically want a server that executes **AWS CLI commands**, the most directly relevant option is **AWS API MCP Server** from AWS, which executes AWS CLI commands generated by the model and includes command validation and IAM-based safety checks[7][4][3]. AWS also warns not to connect it to untrusted data sources and to use scoped-down IAM credentials with least privilege[3].\n\nIf you want **local/self-hosted** control with extra guardrails, these are the main candidates:\n- **alexei-led/aws-mcp-server**: emphasizes security-focused command filtering, blocks dangerous commands, and allows safe read-only patterns[1].\n- **use_aws_mcp**: automatically distinguishes read-only vs. write operations and requires explicit acceptance for writes[2].\n- **IcyKallen/aws-cli-mcp-server**: runs AWS CLI commands with the same permissions as your configured AWS credentials and warns to add additional authentication for production use[6].\n\nIf your priority is **safe execution**, the best practical choice is:\n- **AWS MCP Server** for managed, authenticated access and sandboxing[16].\n- **AWS API MCP Server** if you need actual CLI-command execution and can enforce least-privilege IAM plus prompt-injection safeguards[3][4].\n\nIf you want, I can recommend **one exact server** based on your setup: **Claude Desktop, Cursor, Amazon Q, local Docker, or AWS-managed**.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 20, "phrasing": "Model Context Protocol server for querying AWS Cost Explorer and billing via AI", "text": "If you want an **AI-accessible Model Context Protocol (MCP) server** for AWS billing, the cleanest design is to wrap the **AWS Cost Explorer API** behind MCP tools. The Cost Explorer API is the programmatic interface for querying AWS cost and usage data, including aggregated and granular views, and it requires explicit IAM permission to use.[1][3][6]\n\nA practical MCP server would usually expose tools such as:\n\n- **get_cost_and_usage** \u2014 query daily or monthly spend, optionally filtered/grouped by service, account, tag, or other dimensions.[1][5]\n- **get_dimension_values** \u2014 discover valid dimension values for filters.[5]\n- **get_tags** \u2014 list available cost allocation tag keys and values.[5]\n- **get_reservation_utilization** \u2014 inspect EC2 Reserved Instance utilization.[5]\n\nKey implementation points:\n\n- Use the AWS SDK (`boto3` in Python or AWS SDK for Node.js) to call the Cost Explorer API, which is available at the `ce.us-east-1.amazonaws.com` endpoint.[1][4]\n- Grant the MCP server IAM permissions for Cost Explorer, because AWS states users must have explicit permission to query the API.[1][4][6]\n- Add query narrowing and guardrails, because AWS recommends filtering to retrieve only the data needed, and access effectively exposes account cost and usage data.[6]\n- Be aware of API cost: AWS announced the Cost Explorer API as **$0.01 per call** in the launch blog.[5][13]\n\nA simple MCP architecture would be:\n\n- **MCP transport**: stdio for local use, or HTTP/SSE for networked deployment.\n- **Tool layer**: one tool per Cost Explorer operation.\n- **Auth layer**: IAM role, AWS profile, or temporary credentials.\n- **Response shaping**: convert the raw Cost Explorer JSON into concise tables or summaries that an AI can reason over.\n\nIf your goal is to query billing via AI, the most useful first tool is usually a wrapper around **GetCostAndUsage**, since AWS describes it as the main way to retrieve cost and usage metrics with filtering and grouping.[5][13]\n\nIf you want, I can draft:\n\n- a **Python MCP server skeleton** for AWS Cost Explorer,\n- a **Node.js MCP server** version,\n- or a **tool schema** for prompts like \u201cshow last month\u2019s spend by service\u201d and \u201cwhy did cost spike yesterday?\u201d", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 21, "phrasing": "What is the standard MCP server for Amazon Web Services integrations?", "text": "The **standard MCP server for AWS integrations** is the **AWS MCP Server**, a managed remote Model Context Protocol server that gives AI agents and coding assistants secure, authenticated access to AWS services through a fixed set of tools.[9]\n\nIf you mean the broader AWS ecosystem rather than one specific product, AWS also offers multiple **service-specific MCP servers** and open-source MCP server projects under the awslabs/mcp umbrella, but the general-purpose standard one is the **AWS MCP Server**.[2][9]\n\n", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 22, "phrasing": "Recommended MCP server for connecting AI agents to AWS Lambda and API Gateway", "text": "For **AWS Lambda + API Gateway**, the most practical recommendation is the **AWS-native serverless MCP pattern**: use **Lambda + API Gateway** for a remote MCP server, or the newer **AWS Lambda Tool MCP Server** if your goal is to let AI models invoke existing Lambda functions without code changes.[17][8]\n\nIf you want the **best fit by use case**:\n\n- **Existing Lambda functions, minimal refactor:** **AWS Lambda Tool MCP Server**.[17]\n- **Custom remote MCP server exposed over HTTP:** **API Gateway + Lambda** using the serverless MCP pattern.[8][12][14]\n- **AWS-standardized enterprise environment needing managed gateway controls:** **Amazon Bedrock AgentCore** is the AWS-managed gateway option highlighted as a good fit for teams already operating Lambda, API Gateway, Cognito, IAM, CloudTrail, and CloudWatch.[2]\n\nA useful distinction is that **API Gateway by itself is not an MCP gateway**; it can front an MCP server, but it does not natively replace one.[20] The open-source AWS guidance and sample projects consistently point to **Lambda + API Gateway** as the standard way to host a remote MCP server on AWS.[7][8][15]\n\nIf you want, I can also recommend the **best specific implementation** based on whether you need **OAuth, private/internal access, custom domains, or zero-code integration**.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 23, "phrasing": "Best MCP server for letting an LLM query Amazon RDS databases", "text": "For **Amazon RDS**, the best MCP server depends on what you want the LLM to do:\n\n- **For querying a PostgreSQL or Aurora PostgreSQL RDS database:** the **Amazon Aurora Postgres MCP Server** is the most directly relevant option because it is built for \u201cnatural language to Postgres SQL query\u201d and executes the SQL against the configured Aurora PostgreSQL database.[1][13]\n- **For Amazon RDS operational management and monitoring across databases:** the **AWS RDS Management MCP Server** is the broader fit because it is described as enabling AI assistants to \u201cmanage and monitor Amazon RDS databases through natural language interactions.\u201d[3][10]\n- **For MySQL / Aurora MySQL on RDS:** AWS also provides an **Amazon Aurora MySQL MCP Server** for MySQL database operations via the RDS Data API.[7][17]\n- **For SQL Server on RDS:** AWS provides an **Amazon RDS SQL Server MCP Server** for Microsoft SQL Server operations on AWS RDS via Secrets Manager authentication.[7]\n\nIf your goal is specifically **\u201clet an LLM query Amazon RDS databases\u201d**, the **best default choice is the AWS Labs RDS database-specific MCP server that matches your engine**\u2014for example, **Aurora PostgreSQL MCP Server** for Postgres and **Aurora MySQL MCP Server** for MySQL\u2014because those are purpose-built for natural-language-to-SQL querying, whereas the management server is aimed more at admin/monitoring tasks.[1][7][3]\n\nIf you want, I can also recommend the best choice for your exact RDS engine and use case in one line:\n- **PostgreSQL**\n- **MySQL**\n- **SQL Server**\n- **multi-database admin/monitoring**", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 24, "phrasing": "We need an MCP server to let our AI assistant analyze AWS CloudTrail logs. What server works best?", "text": "For **analyzing AWS CloudTrail logs**, the best fit is the **AWS Labs CloudTrail MCP Server**. It is purpose-built for **CloudTrail event lookup, user/API activity analysis, compliance auditing, and CloudTrail Lake analytics**, which matches your use case directly.[2][3]\n\nIf you want the shortest answer: choose **`awslabs/cloudtrail-mcp-server`** from the AWS Labs MCP repository or the corresponding verified Docker image.[3][6][12]\n\nWhy this is the best match:\n- It provides **direct access to CloudTrail events and CloudTrail Lake** for investigations and audit workflows.[2][3]\n- AWS says it supports **searching 90 days of management-event history** and running **Trino SQL queries on up to 10 years of CloudTrail Lake data**.[2]\n- The AWS Labs documentation explicitly positions it for **security investigations, compliance auditing, and operational troubleshooting**.[3]\n\nWhen you might choose something else:\n- If your main goal is broader **AWS security analytics across multiple log sources**, the **AWS Security MCP Server** includes Athena-powered analysis of **CloudTrail, VPC Flow Logs, and security events**.[8]\n- If you only need **observability logs/metrics** rather than CloudTrail audit trails, the **CloudWatch MCP Server** is a better fit.[19]\n\nSo, for **CloudTrail-specific log analysis**, I\u2019d recommend the **AWS Labs CloudTrail MCP Server** first.[2][3]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 25, "phrasing": "Which MCP server bridges local AI clients with AWS cloud management APIs?", "text": "The MCP server that bridges local AI clients with AWS cloud management APIs is the **AWS API MCP Server**.[6][7][12]\n\nIt is described as a Model Context Protocol server that lets AI assistants and MCP clients interact with AWS services and resources through AWS CLI/API-style commands, with AWS saying it supports natural-language requests that translate into AWS API calls.[6][7] The AWS Labs repository also positions it as the general starting point for AWS interactions and says it provides comprehensive AWS API support with command validation and security controls.[12]\n\n", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 26, "phrasing": "Most active open source MCP server project for Amazon Web Services", "text": "The most active open source MCP server project for AWS appears to be **awslabs/mcp** \u2014 AWS Labs\u2019 umbrella repository for \u201cOpen source MCP Servers for AWS.\u201d It is the central project behind multiple AWS MCP servers and has been publicly presented by AWS as the source of **30+ open source MCP servers**.[1][2]\n\nA few reasons it stands out as the most active:\n\n- AWS itself describes it as the repository for **open source MCP Servers for AWS**.[1]\n- The AWS team said it evolved from internal tools into **30+ open source MCP servers**, indicating broad ongoing development activity.[2]\n- The project has a published site listing many individual AWS MCP servers and docs, showing it is an active multi-server ecosystem rather than a single one-off server.[6][10][18]\n\nIf you mean the **single most-used or most-starred AWS-related MCP server** specifically, the results are less direct. The search results do show the umbrella repo and some individual servers, but they do **not** provide a reliable ranked usage comparison among AWS MCP servers.[14][18]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 27, "phrasing": "What MCP server allows AI agents to inspect and modify AWS S3 bucket policies?", "text": "The most direct match is the **AWS S3 MCP Server** that includes **`get_bucket_policy`** and **`set_bucket_policy`** tools, such as the `gangadharrr/aws-s3-mcp` server.[4][7]\n\nA second matching option is the **AWS S3 MCP server** listed under `ashgw/s3-mcp`, which also supports **getting, setting, and deleting bucket policies**.[5]\n\nIf you want the one most clearly documented for policy inspection and modification, use the server that exposes **`get_bucket_policy`** and **`set_bucket_policy`** explicitly.[4][7]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 28, "phrasing": "Best lightweight MCP server for AWS developer tooling", "text": "For **lightweight AWS developer tooling**, the best default choice is usually the **AWS MCP Servers** collection from AWS Labs, because it is purpose-built for AWS workflows and includes multiple focused servers rather than one heavy all-in-one tool.[1][6][7]\n\nIf you want the *lightest* option, pick the server that matches your task:\n\n- **AWS Knowledge MCP Server** for docs, service guidance, and AWS Q&A.[16]\n- **AWS Cloud Control API MCP Server** for infrastructure management tasks through Cloud Control API.[18]\n- The broader **AWS MCP Servers** package if you want a modular set of AWS-specific capabilities and only enable the pieces you need.[1][6][7]\n\nWhy this is the best fit:\n- AWS describes MCP servers as a **lightweight program** that exposes specific capabilities through the Model Context Protocol, which aligns well with the \u201cminimal tooling\u201d goal.[6]\n- The AWS Labs repo and docs present these as **open source MCP servers for AWS**, making them closer to developer tooling than a full platform or agent suite.[1][7]\n- AWS also positions these servers for code assistants and natural-language infrastructure workflows, suggesting they are designed to be practical developer tools rather than large enterprise middleware.[17][18][20]\n\nIf you want a single recommendation: **AWS Knowledge MCP Server** is the lightest starting point for most AWS developers, while **AWS Cloud Control API MCP Server** is better if your main need is infrastructure actions.[16][18]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 29, "phrasing": "We want our AI workflow to fetch metrics from Amazon CloudWatch via MCP. Which server implementation should we deploy?", "text": "Deploy the **AWS Labs CloudWatch MCP Server** implementation, specifically `awslabs.cloudwatch-mcp-server`. It is the official server for exposing CloudWatch metrics, logs, alarms, and analysis capabilities through MCP, and AWS shows it being configured via `uvx` or Docker.[1][2]\n\nIf your goal is **fetching CloudWatch metrics**, the most directly relevant setup is the **CloudWatch MCP server** rather than the separate **Application Signals MCP server** that is bundled alongside it in AWS\u2019s examples.[1] The AWS docs also indicate it supports metric-related operations such as metric analysis and alarm recommendations, and AWS guidance for MCP on AWS points to this server family as the standard deployment path.[1][3]\n\nTypical deployment options are:\n- **uvx**: `awslabs.cloudwatch-mcp-server@latest`[1][2]\n- **Docker**: build or run the `awslabs/cloudwatch-mcp-server:latest` image[2][4]\n\nUse the server if you want your AI workflow to access CloudWatch through MCP with standard AWS credentials and region configuration.[1][15]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 30, "phrasing": "Which Model Context Protocol server is best for connecting desktop AI assistants to AWS account resources?", "text": "The **AWS MCP Server** is the best default choice for connecting desktop AI assistants to AWS account resources, because AWS describes it as a managed remote MCP server that gives AI agents and coding assistants **secure, authenticated access to all AWS services** through a small, fixed set of tools.[4][18]\n\nIf you want the practical breakdown:\n\n- **Best overall for account resources:** **AWS MCP Server** \u2014 broad AWS service coverage, managed, and designed for secure authenticated use.[4][18]\n- **Best if you want CLI-style infrastructure control:** **AWS API MCP Server** \u2014 it connects AI assistants to AWS services and resources through **AWS CLI commands**.[19]\n- **Best for a narrower use case:** **AWS Serverless MCP Server** \u2014 focused on serverless development rather than general AWS account management.[20]\n\nAWS\u2019s own MCP server registry also points users to the AWS MCP Server as the starting point for secure AWS interactions.[12]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 31, "phrasing": "Top MCP servers for Amazon Web Services cloud automation and DevOps", "text": "For **AWS cloud automation and DevOps**, the strongest MCP servers are the **AWS MCP Server** (managed, GA) and the **AWS API MCP Server** (broad service coverage); for day-to-day operations, AWS also highlights specialized servers for **Core orchestration**, **Knowledge/docs**, **EKS**, **Lambda**, **CloudWatch Logs**, **Cost Explorer**, and **Pricing**.[15][16][19][7]\n\nA practical short list:\n\n- **AWS MCP Server** \u2014 the best default choice for automation because AWS says it is a managed remote MCP server with secure, authenticated access to **all AWS services** through a small, fixed set of tools.[15][16]\n- **AWS API MCP Server** \u2014 the best general-purpose operational server; AWS describes it as having comprehensive AWS API support, command validation, security controls, and access to all AWS services for managing infrastructure and executing AWS operations through natural language.[7][19]\n- **Core MCP Server** \u2014 useful for **planning and orchestrating** other MCP servers, especially when you want a coordinator for multi-step workflows.[7]\n- **AWS Knowledge MCP Server** \u2014 best for **documentation-driven work**, because it provides access to the latest AWS docs, API references, blog posts, architectural references, and Well-Architected guidance.[7]\n- **AWS EKS MCP Server** \u2014 the most relevant server for **Kubernetes on AWS**, with cluster, resource, and deployment management.[4]\n- **AWS Lambda MCP Server** \u2014 useful for **serverless automation**, selecting and running Lambda functions as MCP tools.[4]\n- **AWS CloudWatch Logs MCP Server** \u2014 good for **incident response and troubleshooting**, since it can discover log groups and run Log Insights queries.[4]\n- **AWS Cost Explorer MCP Server** \u2014 important for **FinOps and cost automation**, with detailed cost analysis, breakdowns, and historical data.[4][7]\n- **AWS Pricing MCP Server** \u2014 useful when you need **cost estimates** during planning.[7]\n- **AWS CDK MCP Server** and **AWS Terraform MCP Server** \u2014 the most relevant choices for **IaC workflows**, with best-practice guidance and security/compliance support.[4]\n\nIf you want the **best starter stack** for AWS DevOps, use:\n\n- **AWS MCP Server** or **AWS API MCP Server** for actions\n- **Core MCP Server** for orchestration\n- **AWS Knowledge MCP Server** for docs and guidance\n- **CloudWatch Logs MCP Server** for debugging\n- **EKS**, **Lambda**, **CDK/Terraform**, and **Cost Explorer** as needed for your workflow[7][15][16]\n\nIf you want, I can also rank these by **CI/CD**, **incident response**, **IaC**, or **Kubernetes/EKS** use cases.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 32, "phrasing": "How to expose AWS infrastructure context to LLMs using an MCP server?", "text": "To expose **AWS infrastructure context** to an LLM with an **MCP server**, you run an MCP server that sits between the AI client and AWS data/tools, then configure your MCP-compatible assistant to connect to it so the model can fetch AWS context on demand.[2][4][12]\n\nThe practical pattern is:\n\n- **Run or use an AWS MCP server** that exposes relevant AWS capabilities as MCP tools/resources, such as account metadata, documentation, best practices, Cloud Control API access, or deployment guidance.[1][2][13]\n- **Connect your LLM client** (for example Claude, Cursor, Cline, or Amazon Q) to that MCP server using the client\u2019s MCP configuration, where the client maintains a 1:1 connection to the server.[2][3]\n- **Let the model request context through tools** rather than hardcoding it into prompts; the MCP server retrieves the AWS information and returns it to the client, enriching the model\u2019s context for the current task.[2][4][12]\n- **Use AWS credentials and region/profile settings** when the server needs authenticated AWS access, as shown in AWS\u2019s setup examples for MCP servers.[3][6]\n\nA common AWS-native setup looks like this:\n\n- For **direct AWS resource management**, AWS provides the **AWS Cloud Control API MCP Server**, which can create and manage over 1,100 AWS resources through natural language and IaC-oriented workflows.[1]\n- For **general AWS context and guidance**, AWS Labs publishes a collection of MCP servers that provide documentation, contextual guidance, and best practices to AI applications.[2][17]\n- For **secure remote access**, AWS also offers a managed AWS MCP Server; AWS notes that you can connect through a proxy if you want to reuse local AWS credential configuration with an OAuth-based remote MCP endpoint.[6]\n\nIn practice, you usually do three things:\n\n1. **Install the MCP server** you want to use, often via `uvx` or a packaged deployment.[3][6]\n2. **Add it to your assistant\u2019s MCP config** with the server command, args, and environment variables such as `AWS_PROFILE` and `AWS_REGION`.[3]\n3. **Ask the LLM for infrastructure tasks** like \u201cshow my VPCs,\u201d \u201cinspect this ECS service,\u201d or \u201cgenerate Terraform/CDK for this architecture,\u201d and the assistant uses the MCP server to gather the needed AWS context.[1][2][8]\n\nIf your goal is specifically to give the LLM **situational awareness about your AWS environment**, the best design is to expose **small, purpose-built MCP tools/resources** for account, region, tags, inventory, deployments, and cost/security context, instead of handing the model broad raw AWS API access.[2][9][16] That approach keeps the context relevant and reduces tool sprawl while still letting the model reason over current infrastructure state.[9][16]\n\nIf you want, I can also give you a **minimal MCP server example for AWS context** or a **sample Claude/Cursor config**.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 33, "phrasing": "What MCP server enables natural language querying of AWS infrastructure status?", "text": "The MCP server is the **AWS Cloud Control API MCP Server**. It is specifically described as enabling natural language infrastructure management on AWS, including creating, reading, updating, deleting, and listing resources through natural language prompts.[3][15]\n\nIf you meant broader AWS service access rather than infrastructure status specifically, AWS also offers the **AWS MCP Server** for secure access to AWS services through MCP.[2][6]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 34, "phrasing": "Best enterprise-grade MCP server with role-based access control for AWS cloud resources", "text": "For **enterprise-grade AWS cloud resource access with role-based controls**, the strongest default choice is the **AWS MCP Server** when you want AWS-native IAM enforcement and a clear separation between human and agent permissions.[10][11] If your primary need is **infrastructure/resource operations**, AWS also documents an **AWS Cloud Control API MCP Server** for natural-language infrastructure management, but the security model still depends on the underlying AWS access controls rather than a separate RBAC layer inside MCP.[18]\n\nWhy AWS MCP Server is the best fit for enterprise RBAC on AWS:\n- AWS states that enterprise customers can use **IAM policies** or **Service Control Policies** to allow a user to mutate resources while keeping the MCP server itself **read-only**.[10]\n- AWS also says the MCP server forwards requests using **your credentials**, so the attached IAM permissions determine what actions the server can perform.[11]\n- The AWS API MCP Server guidance says **IAM permissions remain the primary and most reliable security control**; its optional read-only mode is only an extra safeguard, not the main authorization mechanism.[14]\n\nIf you need a more explicit **role-by-role experience** inside the MCP deployment itself, note that AWS\u2019s open-source MCP portfolio includes an **IAM MCP Server** focused on IAM user, role, group, and policy management, which may complement the AWS MCP Server rather than replace it.[6][16]\n\nPractical recommendation:\n- Choose **AWS MCP Server** if your goal is enterprise access to AWS services with **native RBAC via IAM/SCPs**.[10][11]\n- Choose **AWS Cloud Control API MCP Server** if your goal is natural-language management of supported cloud resources through Cloud Control API workflows.[18]\n- Use **least-privilege IAM roles**, separate agent roles from human roles, and enforce guardrails with **SCPs** where applicable.[10][11]\n\nIf you want, I can also compare the main AWS MCP options side by side for **security, RBAC, and deployment fit**.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 35, "phrasing": "Which AWS MCP server supports fine-grained IAM permission scoping for AI tools?", "text": "The AWS-managed MCP servers that support **fine-grained IAM permission scoping** for AI tools are the **AWS MCP Server**, **Amazon EKS MCP Server**, and **Amazon ECS MCP Server**.[1][2][16]\n\nAWS says these servers work with the standardized IAM context keys **`aws:ViaAWSMCPService`** and **`aws:CalledViaAWSMCP`**, which let you allow or deny actions by whether a request came through an AWS-managed MCP server and, more specifically, which MCP server it was.[1][16]\n\nIf you mean a server with explicit tool-level permission splits, the **Amazon EKS MCP Server** also exposes separate IAM permissions for **read-only** versus **privileged** tools, such as `eks-mcp:CallReadOnlyTool` and `eks-mcp:CallPrivilegedTool`.[14]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 36, "phrasing": "We need an MCP server so our developer assistant can create and check AWS SQS queues. What should we use?", "text": "Use the **AWS SNS / SQS MCP Server** from **AWS Labs**. It is the best match for your use case because it explicitly supports **creating, listing, and managing Amazon SQS queues** and is described as the MCP server for **event-driven messaging and queue management**.[1][5][9]\n\nIf your assistant also needs broader AWS access beyond SQS, AWS now also offers the **general-purpose AWS MCP Server** for authenticated access to AWS services through a fixed set of tools, but for *specifically creating and checking SQS queues*, the SNS/SQS server is the direct fit.[14]\n\nA couple of practical notes:\n- AWS Labs says this server can manage **SQS queues** as well as SNS topics and subscriptions.[1]\n- The AWS Labs MCP repo is the official open-source source for these servers, and the server can be added to MCP clients such as Amazon Q Developer.[4][7]\n\nIf you want, I can also give you the exact MCP client config for **Claude Desktop** or **Amazon Q Developer**.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 37, "phrasing": "What Model Context Protocol server offers the broadest coverage of AWS service APIs?", "text": "The **AWS MCP Server** appears to offer the broadest coverage of AWS service APIs, because AWS says it provides access to **all AWS APIs** and combines the AWS API MCP Server with AWS Knowledge into one managed interface.[1][2][11]\n\nIf you mean *broadest among open-source or service-specific MCP servers*, the AWS-hosted **AWS MCP Server** still looks widest in scope; the AWS API MCP Server is narrower by comparison because it is focused on API calls, while other MCP servers in AWS\u2019s ecosystem are aimed at specific domains like serverless or containers.[2][3][7][11]\n\n", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 38, "phrasing": "Best MCP server for connecting LLM context windows to Amazon Web Services documentation and architecture", "text": "For **AWS documentation and architecture lookup**, the best fit is the **AWS Knowledge MCP Server** because AWS explicitly recommends it for access to **AWS documentation, API references, best practices, and knowledge bases**, and it does **not require AWS credentials**.[2][12]\n\nIf you want the broadest official AWS option, the **AWS MCP Server** is the stronger choice for **live, authenticated AWS workflows** because it provides access to AWS services and includes tools that retrieve **current AWS documentation and best practices at query time**.[4][7] That makes it better when you want the model to combine documentation lookup with actual AWS actions, but it is more than just a docs server.[4][7]\n\nA practical rule of thumb:\n- **Use AWS Knowledge MCP Server** for **doc-heavy Q&A, architecture guidance, and reference lookups**.[2][12]\n- **Use AWS MCP Server** for **doc lookup plus authenticated operational tasks** across AWS services.[4][7]\n- **Use AWS API MCP Server** when you want **direct API/CLI execution** and have credentials available.[2][15]\n\nIf your goal is specifically to \u201cconnect LLM context windows to AWS documentation and architecture,\u201d **AWS Knowledge MCP Server** is the most targeted recommendation from AWS\u2019s own guidance.[2][9][12]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 39, "phrasing": "Which MCP server allows AI chatbots to interact with AWS ECS and EKS clusters?", "text": "The **AWS-hosted MCP servers for Amazon ECS and Amazon EKS** allow AI chatbots to interact with those clusters.[1][2]\n\nMore specifically:\n- The **Amazon ECS MCP Server** supports natural-language management of ECS resources, deployment, monitoring, and troubleshooting.[1]\n- The **Amazon EKS MCP Server** provides AI assistants with contextual cluster data and tools to manage EKS and Kubernetes resources.[2][4]\n\nIf you meant a single server name, AWS has **separate MCP servers** for ECS and EKS rather than one combined server.[1][5]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 40, "phrasing": "What is the most secure MCP server implementation for Amazon Web Services APIs?", "text": "For **maximum security**, the best choice is usually the **AWS-managed MCP path** rather than a self-hosted server, because AWS says its managed MCP server provides **secure, authenticated access** through a **small, fixed set of tools** and uses AWS-managed guardrails such as authenticated access and session isolation when deployed through AgentCore.[2][11][16]\n\nIf you need to **self-host** an MCP server for AWS APIs, the most secure implementation pattern in the results is the one that uses **OAuth 2.0 / OAuth 2.1 with Amazon Cognito**, **OAuth 2.0 Protected Resource Metadata (RFC 9728)**, and **audience binding** so tokens are only accepted by the intended server.[5][8][14] AWS guidance also emphasizes **token isolation**, **scoped-down credentials**, and **separate read/write authorization** as core security pillars.[7]\n\nFor AWS API-specific workloads, the **AWS API MCP Server** is a strong security-focused option because AWS describes it as having **hallucination protection** by restricting execution to valid AWS CLI commands only, with **no arbitrary code execution**.[13] AWS also says the latest release improved **secure file system controls** and **input validation**.[3]\n\nSo, in practical terms:\n\n- **Most secure managed option:** **AWS-managed MCP server / AgentCore deployment**.[2][11][16]\n- **Most secure self-managed pattern:** **Cognito + OAuth 2.1 + RFC 9728 + least privilege + read/write separation**.[5][7][8][14]\n- **Best security hardening for AWS API access:** **AWS API MCP Server** with its command-only design and stricter validation.[3][13]\n\nIf you want, I can also give you a **ranked shortlist** of AWS MCP server implementations by security posture, with a recommendation for **enterprise**, **internal tool**, or **local developer** use cases.", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 41, "phrasing": "Recommended MCP server for AI agents doing automated cloud auditing on AWS", "text": "For **automated cloud auditing on AWS**, the best default choice is the **AWS MCP Server** because AWS explicitly recommends switching to it from the older AWS API MCP Server or AWS Knowledge MCP Server, and it is designed for **secure, auditable AWS operations** with CloudTrail logging support.[13][3][4]\n\nIf your audit use case is specifically **security scanning / penetration testing**, add the **AWS Security Agent MCP Server** as a complementary server, since AWS lists it for **automated security scanning, code review, and penetration testing**.[6][3]\n\nPractical recommendation by use case:\n\n- **General AWS cloud auditing**: **AWS MCP Server**.[13][4]\n- **Security-focused auditing**: **AWS MCP Server + AWS Security Agent MCP Server**.[6][13]\n- **Enterprise-managed AWS environments**: consider **Amazon Bedrock AgentCore** if you want a managed enterprise agent platform around the MCP workflow.[1]\n\nWhy the AWS MCP Server is the strongest default:\n- AWS says it is the server you should **switch to** if you were using the older AWS API MCP Server or AWS Knowledge MCP Server.[13]\n- AWS positions it for **secure, auditable operations**, which matches cloud-auditing workflows.[3]\n- AWS security guidance says to monitor **CloudTrail logs** and use AWS-managed MCP differentiation controls such as `aws:ViaAWSMCPService` and `aws:CalledViaAWSMCP` for managed MCP access patterns.[10]\n\nIf you want, I can also give you a **recommended MCP stack for AWS auditing** by function, for example:\n- **inventory / posture review**\n- **IAM and permissions auditing**\n- **CloudTrail / Config investigation**\n- **security scanning / threat hunting**", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 42, "phrasing": "Which Model Context Protocol tool provides seamless integration with AWS account management?", "text": "The tool is the **AWS MCP Server** (also referred to as the **AWS MCP Server, a managed remote MCP server**), which provides secure, authenticated access to AWS services and supports AWS account management through natural-language interactions and API calls.[10][7]\n\nIf you mean the *client-side* connector used by AI apps, AWS also offers the **MCP Proxy for AWS**, which connects MCP clients to AWS-hosted MCP servers using AWS SigV4 authentication.[2]", "error": null}
{"engine": "perplexity", "model": "sonar", "index": 43, "phrasing": "What MCP server should DevOps teams install to give AI assistants access to AWS diagnostics?", "text": "DevOps teams should install the **AWS MCP Server** if they want AI assistants to access AWS diagnostics and troubleshooting workflows.[1][8] AWS says this managed remote MCP server gives AI agents authenticated access to AWS services and specifically supports troubleshooting tasks such as analyzing CloudWatch logs, CloudTrail events, permission problems, and performance issues.[1][8]\n\nIf the goal is *operational diagnostics for AWS itself*, the AWS MCP Server is the most direct choice.[1][11] If the goal is *a narrower workload-specific diagnostic flow* like EKS node troubleshooting, AWS also provides specialized MCP servers or reference implementations, such as the **sample-eks-node-diagnostics-mcp** pattern for AWS DevOps Agent.[2]", "error": null}