AWS CLI MCP Server

io.github.musaddiq-devPublished by GitHub account musaddiq-devv0.1.2Updated Oct 24, 2026

Python MCP server for AWS CLI inspection and operations

VerifiedSTDIODesktop onlyCloud & InfrastructureDeveloper Tools

Overview

AI-generated overview

A local MCP server that lets an assistant run AWS CLI commands, suggest commands, list regions and check the caller identity.

What you can do
Execute AWS CLI commands with shell-style argument parsing and no shell expansion, so quoted arguments are preserved and shell operators are blocked. Suggest common AWS CLI commands from a natural-language request. List available AWS regions and return the current caller identity. Validate configuration and write logs to stderr and a local log file.
When to use it
Useful when you want an assistant to inspect or operate AWS accounts through the AWS CLI from a desktop MCP client, for example to look up regions, confirm which identity is active, or run scoped commands with review. Prefer it for non-production or least-privilege profiles where command execution is acceptable.
Requirements
Local process run with uvx from the PyPI package mdev-aws-mcp-server. Needs Python 3.12+, AWS CLI v2 on PATH, and AWS credentials configured through a profile, SSO, environment variables or an IAM role. Optional settings include AWS_PROFILE, AWS_REGION, AWS_MCP_WORKING_DIR, AWS_MCP_REQUIRE_CONFIRMATION and AWS_MCP_LOG_LEVEL.
Before you install
The server executes AWS CLI commands with the credentials available to the process, so it can modify or delete AWS resources. Blocking shell operators and flagging destructive commands does not replace IAM least privilege or human review. Use scoped profiles, avoid long-term access keys, keep call_aws on manual approval, and do not expose the server over a network.

Installation

In SourceWeft

  1. Open AWS CLI MCP Server in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

AWS MCP Server

A Python Model Context Protocol (MCP) server that lets MCP-compatible clients inspect and operate AWS through the AWS CLI. It supports command execution with validation, command suggestions, AWS region lookup, and caller identity checks.

Features

  • Execute AWS CLI commands without shell expansion, preserving quoted arguments with shell-style parsing
  • Suggest common AWS CLI commands from natural language requests
  • Return available AWS regions
  • Return the current caller identity
  • Support stdio transport for local MCP clients
  • Validate configuration and write logs to stderr plus a local log file

Safety Model

This server can execute AWS CLI commands using the credentials available to the process. It blocks shell operators by using subprocess.run(..., shell=False) and flags destructive-looking commands, but it cannot replace IAM least privilege or human review. Use scoped AWS profiles or roles, prefer non-production accounts for testing, and keep destructive commands on manual approval in your MCP client.

Requirements

Installation

When published to PyPI, install or run the server like a standard Python MCP package:

bash
uvx mdev-aws-mcp-server

For local development from source:

bash
git clone https://github.com/musaddiq-dev/aws-cli-mcp-server.gitcd aws-cli-mcp-serverpython -m venv .venvsource .venv/bin/activatepip install -e .

Configuration

Before running this server, install the AWS CLI using the official AWS CLI install guide, then configure credentials using the official AWS CLI sign-in guide and AWS CLI configuration guide. AWS recommends short-term credentials where possible; avoid long-term IAM user keys unless your use case requires them.

Copy the example environment file and adjust values as needed.

bash
cp .env.example .env
VariableDescriptionDefault
AWS_REGIONDefault AWS regionus-east-1
AWS_PROFILEAWS credentials profiledefault
AWS_MCP_WORKING_DIRWorking directory for file operations/tmp/aws-mcp-work
AWS_MCP_REQUIRE_CONFIRMATIONEmit warnings for destructive-looking operationstrue
AWS_MCP_LOG_LEVELApplication log levelINFO

Running

bash
mdev-aws-mcp-server

From a local checkout before PyPI publication, run:

bash
python -m aws_mcp_server.server

MCP Client Configuration

For published installs, prefer uvx. MCP servers using stdio must write protocol messages only to stdout; this server writes logs to stderr and a local file under ~/.aws-mcp-server/logs.

Claude Desktop / Cursor / Windsurf / Cline

Most MCP clients accept this mcpServers JSON shape:

json
{  "mcpServers": {    "aws": {      "command": "uvx",      "args": ["mdev-aws-mcp-server"],      "env": {        "AWS_PROFILE": "default",        "AWS_REGION": "us-east-1"      }    }  }}

For local development from this repository, use the installed console script path instead:

json
{  "mcpServers": {    "aws": {      "command": "/absolute/path/to/aws-cli-mcp-server/.venv/bin/mdev-aws-mcp-server",      "args": [],      "env": {        "AWS_PROFILE": "default",        "AWS_REGION": "us-east-1"      }    }  }}

Claude Code CLI

bash
claude mcp add aws --env AWS_PROFILE=default --env AWS_REGION=us-east-1 -- uvx mdev-aws-mcp-server

VS Code MCP

VS Code uses the same command/args/env model in its MCP configuration:

json
{  "servers": {    "aws": {      "type": "stdio",      "command": "uvx",      "args": ["mdev-aws-mcp-server"],      "env": {        "AWS_PROFILE": "default",        "AWS_REGION": "us-east-1"      }    }  }}

Tools

ToolPurposeSafety
call_awsExecute an AWS CLI commandCan modify AWS resources
suggest_aws_commandsSuggest common AWS CLI commandsRead-only
get_aws_regionsList AWS regionsRead-only
get_caller_identityReturn current AWS identityRead-only

Development

bash
pip install -e .pip install -e '.[dev]'pytestruff check .ruff format .pyright

Smoke Check

bash
python -m py_compile src/aws_mcp_server/server.py src/aws_mcp_server/config.py src/aws_mcp_server/aws/executor.pypython -m pytest

Manual AWS check, if credentials are configured:

bash
aws sts get-caller-identity

Distribution

This server is published through the standard Python MCP distribution path:

  • PyPI package: mdev-aws-mcp-server
  • MCP Registry name: io.github.musaddiq-dev/aws-cli-mcp-server
  • Runtime hint: uvx
  • Transport: stdio

The mcp-name marker at the top of this README is required for MCP Registry ownership verification. Users should prefer uvx mdev-aws-mcp-server in local MCP client configurations.

Security Notes

  • Do not commit .env, AWS credentials, profiles, access keys, or account-specific outputs.
  • Use least-privilege IAM permissions for the profile or role running this server.
  • Keep call_aws on explicit manual approval in your MCP client.
  • Do not expose this server over a network without adding authentication, TLS, and network controls.
  • Review generated command suggestions before executing them.

License

MIT

Source: README.md at commit 989a081

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.2LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts