AWS CLI MCP Server

Overview

AWS CLI MCP Server enables AI assistants to execute AWS CLI commands securely through the Model Context Protocol (MCP). This integration allows AI tools like Claude and Cursor to help you manage AWS infrastructure by running commands in a safe, containerized environment.

Installation

Prerequisites

• Docker installed on your system
• AWS credentials configured (access key, secret key, and optionally session token)

Using Docker

The simplest way to run AWS CLI MCP Server is using Docker:

docker run -p 8080:8080 \
  -e AWS_ACCESS_KEY_ID=your_access_key \
  -e AWS_SECRET_ACCESS_KEY=your_secret_key \
  -e AWS_SESSION_TOKEN=your_session_token \
  -e AWS_REGION=us-west-2 \
  ghcr.io/alexei-led/aws-mcp-server:latest

Using Smithery

For a more streamlined experience, you can use Smithery:

1. Install Smithery:

pip install smithery

2. Run AWS CLI MCP Server with Smithery:

smithery run alexei-led/aws-mcp-server

Configuration

AWS CLI MCP Server supports various configuration options through environment variables:

AWS Credentials

• AWS_ACCESS_KEY_ID: Your AWS access key
• AWS_SECRET_ACCESS_KEY: Your AWS secret key
• AWS_SESSION_TOKEN: Your AWS session token (if using temporary credentials)
• AWS_REGION: Default AWS region (e.g., us-west-2)

Security Configuration

The server implements a comprehensive security system with three configurable modes:

• AWS_MCP_SECURITY_MODE: Set to one of:

  • strict (default): Blocks all potentially dangerous commands
  • moderate: Allows more commands but still blocks high-risk operations
  • permissive: Minimal restrictions, use with caution
  • custom: Use a custom security configuration file

• AWS_MCP_SECURITY_CONFIG: Path to a custom security configuration YAML file (when using custom mode)

Server Configuration

• AWS_MCP_SERVER_HOST: Host address (default: 0.0.0.0)
• AWS_MCP_SERVER_PORT: Port number (default: 8080)
• AWS_MCP_LOG_LEVEL: Logging level (default: INFO)

Usage with AI Assistants

Claude

To use AWS CLI MCP Server with Claude, add the following to your prompt:

I'd like to use the AWS CLI to manage my AWS resources. Please use the AWS CLI MCP Server to execute commands.

Cursor

To configure Cursor to use AWS CLI MCP Server, add the following to your MCP configuration:

"mcpServers": {
  "aws-cli": {
    "url": "http://localhost:8080"
  }
}

Security Best Practices

1. Use the strictest security mode possible for your use case. The default strict mode is recommended for most users.

2. Create dedicated IAM credentials with minimal permissions for the server to use.

3. Run in a private network or behind a secure proxy if possible.

4. Review the logs regularly to monitor command execution.

5. Consider using AWS Organizations SCPs as an additional layer of protection.

Troubleshooting

• If commands fail, check the server logs for detailed error messages
• Verify your AWS credentials are correctly configured
• Ensure the security mode allows the commands you're trying to run
• Check network connectivity between your AI assistant and the server

For more detailed information, refer to the GitHub repository.