AWS CloudWatch MCP Server: Setup for Claude, Cursor and Other Apps

• Lists the CloudWatch alarms that are firing now

  Finds the alarms currently in the ALARM state across your account and says which region was checked.

  Try: “Which CloudWatch alarms are firing right now in us-east-1?”

  Network · get_active_alarms

• Shows how an alarm changed state over time

  Returns past state changes for one alarm, so the assistant can spot patterns such as flapping or a repeat time of day.

  Try: “Show the history of the HighCPU alarm for the last 3 days.”

  Network · get_alarm_history

• Finds CloudWatch log groups and their settings

  Lists log groups and their metadata, optionally filtered by name, so the assistant can pick the right group to look into.

  Try: “Find the log groups that belong to my checkout service.”

  Network · describe_log_groups

• Looks for anomalies and error patterns in a log group

  Analyzes one log group over a time window and reports anomalies, common message patterns and error patterns.

  Try: “Analyze /aws/lambda/orders for errors in the last hour.”

  Network · analyze_log_group

• Starts a Logs Insights query

  Starts a Logs Insights query on one or more log groups for a time range. It returns a query ID that you use to fetch the results.

  Try: “Query the checkout log group for the 20 slowest requests today.”

  Network · execute_log_insights_query

• Fetches the results of a Logs Insights query

  Returns the rows of a query started earlier, using its query ID.

  Try: “Get the results of the query I just started.”

  Network · get_logs_insight_query_results

• Stops a Logs Insights query that is still running

  Cancels a query in progress. It only stops the query and does not touch your logs.

  Try: “Cancel that log query, it is taking too long.”

  Network · cancel_logs_insight_query

• Runs one Logs Insights query across many log groups and regions

  Runs a single query over many log groups and regions, splits the work, retries failures and merges the rows into one result with warnings.

  Try: “Search all my production log groups in us-east-1 and eu-west-1 for ERROR in the last hour.”

  Network · execute_cwl_insights_batch

• Suggests field indexes for one log group

  Looks at how a log group is queried and recommends fields to index so queries run faster.

  Try: “Which fields should I index on the payments log group?”

  Network · recommend_indexes_loggroup

• Finds the log groups that would gain most from indexing

  Triage across your account: ranks which log groups would benefit from field indexing.

  Try: “Which of my log groups should I add indexes to first?”

  Network · recommend_indexes_account

• Fetches CloudWatch metric values over time

  Retrieves data points for any metric by namespace, dimension and statistic. It can also compute percentiles, math expressions and several metrics in one call.

  Try: “Show p99 latency for my API Gateway over the last 6 hours.”

  Network · get_metric_data

• Explains what a CloudWatch metric measures

  Returns a description of a metric, how it is calculated and which statistics suit it.

  Try: “What does the CPUCreditBalance metric mean?”

  Network · get_metric_metadata

• Reports trend and seasonality of a metric

  Analyzes metric data to find its trend, seasonality and basic statistics.

  Try: “Does my Lambda error count show a daily pattern?”

  Network · analyze_metric

• Suggests alarm settings for a metric

  Proposes alarm thresholds and evaluation periods for a metric from best practice and its own history. It only suggests and creates no alarm.

  Try: “Recommend an alarm for the RDS FreeStorageSpace metric.”

  Network · get_recommended_metric_alarms

• Runs a PromQL query at a single point in time

  Runs an instant PromQL query against CloudWatch, for metrics sent through OpenTelemetry and enriched AWS metrics.

  Try: “Run a PromQL query for the current request rate of service checkout.”

  Network · execute_promql_query

• Runs a PromQL query over a time window

  Runs a PromQL range query and returns a time series, for trend analysis.

  Try: “Graph the request rate of service checkout over the last day with PromQL.”

  Network · execute_promql_range_query

• Lists the values of a PromQL label

  Returns values of one label, such as metric names or service names, to help you discover what is there.

  Try: “List the service names available in PromQL.”

  Network · get_promql_label_values

• Finds series that match PromQL label filters

  Returns the full label set of every series that matches the selectors you give.

  Try: “Find the series for service checkout in PromQL.”

  Network · get_promql_series

• Lists all PromQL label names

  Returns the label names available, so the assistant learns the structure of your OpenTelemetry metrics.

  Try: “Which PromQL labels exist in my account?”

  Network · get_promql_labels

Watch out for

• Log lines can contain secrets and personal data

  Query results go to your assistant and its provider. Scope the AWS profile to the log groups you are happy to share. github.com

• Big queries can be slow and costly

  Logs Insights bills by data scanned. Ask for a short time range and a limit, and cancel queries that run long. github.com

Security advisories