Amazon EKS MCP Server: Setup for Claude, Cursor and Other Apps

• Lists Kubernetes resources in a cluster

  Lists resources of one kind, such as pods or deployments, in an EKS cluster. You can filter by namespace, labels and fields.

  Try: “List all pods in the production namespace of my cluster demo.”

  Network · list_k8s_resources

• Reads logs from a pod or container

  Retrieves pod logs and can limit them by time, line count and size, or read a single container. It only works when the sensitive-data option is on.

  Try: “Show the last 100 log lines from the api pod in the default namespace.”

  Network · get_pod_logs

• Shows Kubernetes events for a resource

  Returns events for a resource with time, count, message, reason and type. It only works when the sensitive-data option is on.

  Try: “Why is my checkout deployment failing? Show its recent events.”

  Network · get_k8s_events

• Shows EKS insights on misconfigurations and upgrade blockers

  Lists EKS insights for a cluster, split into misconfiguration and upgrade readiness, or details one insight with recommendations. It only works when the sensitive-data option is on.

  Try: “Is my cluster ready to upgrade? Check the EKS insights.”

  Network · get_eks_insights

• Searches the EKS troubleshooting guide

  Searches the EKS troubleshooting guide and returns symptoms and short and long-term fixes, including for EKS Auto Mode node and controller problems.

  Try: “Search the EKS troubleshooting guide for nodes stuck in NotReady.”

  Network · search_eks_troubleshoot_guide

• Pulls CloudWatch logs for a cluster resource

  Fetches logs for a pod, node, container or the cluster, with time range, filter pattern and entry limit. It only works when the sensitive-data option is on.

  Try: “Get control-plane logs from the last 30 minutes that mention "error".”

  Network · get_cloudwatch_logs

• Pulls CloudWatch metrics for cluster resources

  Fetches metrics by name and dimensions over a time range, with a chosen statistic and period.

  Try: “Show average node CPU utilization for my cluster over the last hour.”

  Network · get_cloudwatch_metrics

• Lists which metrics exist for each resource type

  Returns the Container Insights metrics available for clusters, nodes, pods, namespaces and services, so the assistant picks the right names and dimensions.

  Try: “Which metrics can I check for pods in an EKS cluster?”

  Read · get_eks_metrics_guidance

• Shows the VPC setup behind a cluster

  Returns CIDR blocks, route tables and subnets, covers hybrid node setups, checks subnet capacity and flags subnets in availability zones EKS cannot use. It only works when the sensitive-data option is on.

  Try: “Check the VPC and subnets for my cluster demo for problems.”

  Network · get_eks_vpc_config

• Lists the API versions a cluster supports

  Lists the core and grouped API versions available on the cluster, so the assistant uses the right apiVersion when it manages resources.

  Try: “Which API versions does my cluster support?”

  Network · list_api_versions

• Shows the policies attached to an IAM role

  Returns the assume-role policy plus the managed and inline policies of a role, with their documents.

  Try: “What policies are attached to the role my nodes use?”

  Network · get_policies_for_role

• Writes Kubernetes deployment and service files

  Generates a deployment and service YAML from your app name, image and settings such as port, replicas, CPU, memory and load balancer type, and saves it to a folder you choose. It needs write mode on.

  Try: “Create Kubernetes manifests for image my-app:1.2 with 3 replicas, saved to ./k8s.”

  Write · generate_app_manifest

• Applies Kubernetes YAML files to a cluster

  Applies a multi-document YAML file to a namespace in the cluster and can update resources that already exist when forced. It relies on Kubernetes to validate the YAML. It needs write mode on.

  Try: “Apply ./k8s/deployment.yaml to the staging namespace of my cluster.”

  Write · apply_yaml

• Creates, reads, patches or deletes one Kubernetes resource

  Runs one operation (create, replace, patch, delete or read) on a single resource, namespaced or not. Writes and deletes need write mode on. Reading Secrets needs the sensitive-data option.

  Try: “Scale the checkout deployment to 5 replicas.”

  Delete · manage_k8s_resource

• Creates or deletes EKS clusters through CloudFormation

  Generates a template, deploys, describes or deletes an EKS cluster and its VPC, subnets, NAT gateways, roles and node pools. It only changes stacks that it created. A new cluster takes about 15 to 20 minutes. Deploy and delete need write mode on.

  Try: “Generate a CloudFormation template for a new EKS cluster named demo.”

  Delete · manage_eks_stacks

• Adds a new inline policy to an IAM role

  Creates and attaches a new inline policy to a role. It refuses to change a policy that already exists. It needs write mode on.

  Try: “Add an inline policy so the node role can read from my S3 bucket.”

  Write · add_inline_policy

Watch out for

• Opt-in write mode can delete clusters and resources

  Write mode lets it delete CloudFormation stacks it created and any Kubernetes resource. Keep --allow-write off unless you need it, and use a separate role for writes. github.com

• Opt-in write mode asks for very broad AWS permissions

  The README suggests IAMFullAccess, VPC and CloudFormation full access, and eks:*. It also says to prefer narrower custom policies for production. github.com

• Opt-in write mode can add IAM policies to roles

  In write mode it can attach new inline policies to a role, although it never edits existing ones. Scope the role it runs as. github.com

• Opt-in sensitive-data mode exposes logs and Secrets

  It unlocks pod logs, events, CloudWatch logs and reading Kubernetes Secrets, and that content goes to your AI provider. Turn it on only when needed. github.com

• Keep secrets out of prompts and YAML

  The README says not to put secrets in prompts, YAML files or templates. Store them in AWS Secrets Manager or Parameter Store instead. github.com

Security advisories