AWS MCP Server: Setup for Claude, Cursor and Other Apps
Lets your assistant search AWS documentation and work with your AWS account, through a server that AWS hosts.
This is the managed AWS MCP Server, run by AWS at a regional web address, so there is nothing to host. You can sign in with your AWS account in the browser (OAuth), or sign requests with your AWS CLI credentials through the MCP Proxy for AWS. Pick the second option if you use several accounts, need a read-only mode or work from a terminal. The server can act in your account with your permissions, so use a role that allows only what you want the assistant to do.
Good for
- Developers who want accurate AWS documentation inside their coding assistant
- Engineers who want the assistant to inspect or manage AWS resources
- Teams working across several AWS accounts through named profiles
Works in
14 should work
Tap an app to see how to set it up and any known problems.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports hosted MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports hosted MCP servers.
Install AWS MCP
Claude Code
- 1
Copy this prompt.
Add the AWS MCP server to Claude Code. Run this command: claude mcp add --transport http aws https://aws-mcp.us-east-1.api.aws/mcp Then check that it loaded and tell me if I need to sign in or restart.
- 2
Paste it into Claude Code. It shows the change and asks before running it.
Requires Sign-in with the vendor account (OAuth).
Read-only mode: Add --read-only to the proxy arguments (SigV4 option only).
Two ways to connect. The hosted OAuth entry signs you in with your AWS account and needs the AWSMCPSignInOAuthAccessPolicy policy on your role. The uvx entry uses your AWS CLI credentials (SigV4), and needs uv and the AWS CLI. If sign-in does not start, the address ends in ?oauth=initialize for the apps AWS lists.
Built from the package data we hold. Not yet tested by us.
Tools
Searches AWS documentation
Searches AWS documentation so the assistant can answer from current docs. The AWS guide names this tool as one you should see after connecting, and says the server also offers API calls and step-by-step workflows.
Try: “Search the AWS docs for how to set up an S3 lifecycle rule.”
Network ·
aws___search_documentationFetches a guided AWS workflow for the assistant to follow
Retrieves a skill, a packaged set of guidance for an AWS task. The AWS guide lists it next to the documentation search tool, and the server is described as offering workflows.
Try: “Get the AWS guidance for deploying a container to ECS.”
Network ·
aws___retrieve_skill
Read from the source code
Permissions
high risk · 4 things to watch
High risk
The server calls AWS with your permissions, so it can change or delete resources your role can reach. Use a limited role, and pick the SigV4 option with the read-only flag if you only want answers.
What it can do
- Read your data
- Create and change things
- Delete things
- Read-only modeHow to turn it on
Watch out for
It can act in your AWS account
The server makes AWS API calls with your permissions, so it can change or delete resources if your role allows. Use a limited role and the read-only option. docs.aws.amazon.com
OAuth has no read-only mode or multi-account switching
AWS says read-only mode and profile switching need the SigV4 option. Choose SigV4 if you need either. docs.aws.amazon.com
Your IAM role needs an extra policy for OAuth
Attach the AWSMCPSignInOAuthAccessPolicy managed policy or the browser sign-in ends in a 400 error. docs.aws.amazon.com
Remove the older AWS servers first
AWS says to remove the AWS API and Knowledge MCP servers to avoid tool conflicts. docs.aws.amazon.com
Security advisories
No published security advisories as of Nov 1, 2026.
Technical details
| Turning on read-only | Use the SigV4 option through the MCP Proxy for AWS and pass its --read-only flag to hide write-capable tools. |
|---|---|
| Talks to | aws-mcp.<region>.api.aws, the AWS-hosted server |
| Sign-in and keys | OAuth: you sign in with your AWS account and the client keeps the token (valid 1 hour, refreshed up to 12 hours). SigV4: your local AWS CLI credentials are used and not stored by the server. |
| Scopes |
|
Questions
What is the AWS MCP Server URL?
The us-east-1 address is https://aws-mcp.us-east-1.api.aws/mcp. AWS also runs it in us-west-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, eu-central-1, eu-west-1 and eu-west-2. Swap the region in the address.
Is the AWS MCP Server official?
Yes. AWS runs and documents it as part of the Agent Toolkit for AWS.
OAuth or SigV4: which should I choose?
OAuth is simpler: sign in with your browser, nothing to install, and it works with web clients like Claude.ai and ChatGPT.com. SigV4 needs the AWS CLI and uv, but it supports several accounts, a read-only mode and a default region.
Why does sign-in fail with a 400 error?
Your IAM user or role is missing the OAuth permissions. Attach the AWSMCPSignInOAuthAccessPolicy managed policy and sign in again.
My app does not start the sign-in. What now?
Add ?oauth=initialize to the end of the server address. AWS lists this for Claude Desktop, Cursor, VS Code, Codex, Gemini CLI, Copilot CLI and Kiro IDE.
Can I use it read-only?
Yes, with the SigV4 option. Run it through the MCP Proxy for AWS with its read-only flag and write-capable tools are hidden.
How is it different from the MCP Proxy for AWS?
The AWS MCP Server is the hosted service. The proxy is a small local program that signs your requests so assistants can reach it, and other IAM-secured MCP servers on AWS, using your AWS CLI credentials.
Is the tool list complete?
No. The AWS guide names two tools you should see after connecting. The server also offers AWS API calls and workflows that this page does not list.
Information
updated Nov 2, 2026
- Publisher
- Amazon Web Services (official)
- Package
mcp-proxy-for-aws-cli- Registry
- PyPI
- Transport
- Streamable HTTP
- Auth
- OAuth
- Last commit
- Oct 30, 2026
- Listed in
- Official MCP registry
Other AWS MCP servers
Sources
Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.
Show all 2Hide
- docs.aws.amazon.com · docs.aws.amazon.com
- github.com · github.com