This is a catalog, and AWS has named its successor
awslabs/mcp gathers specialized servers for AWS documentation, infrastructure as code, containers, serverless systems, databases, analytics, cost, observability, security, and messaging. Each server exposes a smaller tool set to an MCP client rather than handing an agent one universal AWS interface. That separation can make permissions and context easier to reason about. It also means this repository is dozens of products with different credentials and failure modes, not one package you can approve after a single smoke test.
The README now puts an important decision at the top. Agent Toolkit for AWS is the successor to these servers, plugins, and skills, and AWS recommends it for production software and agents built for customers. The toolkit adds IAM condition keys that distinguish agent actions from human actions, plus CloudWatch and CloudTrail visibility. This repository still accepts contributions, but its most useful work is expected to move over time. New production buyers should treat that as direction, not a footnote.
The focused servers are useful for trials and local development
The documentation server can retrieve current AWS references, while the pricing server supports cost questions. Other packages cover CDK, Terraform, ECS, serverless applications, CloudWatch, databases, and queues. Most examples use uvx and include configurations for Claude Code, Kiro, Cursor, Windsurf, VS Code, and Cline.
The local setup generally needs uv, Python 3.10, and AWS credentials for the selected service. Some servers are read-oriented, while others can deploy resources, invoke functions, alter databases, or operate queues. Several expose explicit write and sensitive-data switches. Keep those switches off until a reviewed task requires them, and use a dedicated AWS profile whose IAM policy matches the individual server. MCP auto-approval should never substitute for an AWS permission boundary.
What happened when we ran it
Our sandbox detected the npm project under docusaurus/, not the Python packages under src/. Installation completed in 30 seconds with 1,114 packages and 283 MB on disk. The documentation site built successfully in 59 seconds. At commit 100b55b, the repository contained 3,708 files, roughly 854,561 lines of source, and occupied 71 MB after checkout.
There was no test script or target in that detected project, so our harness skipped tests. This distinction matters: a green documentation build does not prove that an EKS, Redshift, ECS, or database MCP server starts, authenticates, or enforces its flags. The repository has 23 CI workflow files, but our run did not execute the server suites. Any adoption decision needs a server-specific boot test with the same credentials, transport, and client policy intended for use.
npm audit reported 31 known vulnerabilities in the Docusaurus dependency tree: 21 high and 10 moderate, with no critical or low findings. Those advisories concern the documentation project we installed. They should not be projected onto every published Python server, and they should not be ignored if a team builds or hosts the docs. Our measured result is narrow, which is more useful than pretending one monorepo command evaluated the whole catalog.
stdio keeps local setup simple but limits shared operation
The open-source servers in this repository are designed for stdio. SSE support was removed from their latest major versions in May 2025, and the README says Streamable HTTP work is underway. A local MCP client can start a stdio process and inherit a constrained environment. A shared remote service needs a different design or one of AWS's managed offerings. Teams looking for an always-available HTTP endpoint should not infer that capability from the MCP label alone.
The @latest examples trade repeatability for freshness. The README warns that uvx checks and may download the newest package whenever the client starts. Removing the suffix uses the local cache, while explicit refresh commands let an operator choose the update moment. For infrastructure tools, that is the safer default: pin a reviewed release, run a small acceptance set, and promote updates after checking tool schemas and permission behavior.
Container images are available in public ECR. The examples pass credentials through an environment file or mount the host AWS directory. Both methods put identity handling inside the deployment design. Temporary credentials and a purpose-built profile are preferable to copying a long-lived general profile into a container that an agent can call. The process boundary does not reduce what IAM permits.
The EKS Secret report shows why flags need verification
Open issue 2942 reports that the EKS server's list_k8s_resources path can enumerate Kubernetes Secret names, namespaces, labels, and annotations without checking allow_sensitive_data_access. The report also says documented redaction is absent when sensitive access is enabled. This is a specific, code-level claim about one server, not evidence that every package mishandles secrets. It is still a useful warning against trusting similarly named safety flags without testing the exact tool path.
The repository was pushed on August 26, 2026, and its latest GitHub release was published on August 14. The open count of 263 combines issues and pull requests, while recent activity covers billing, Redshift, dependencies, docs, and new server work. Maintenance is plainly active. Active development can also change tools and flags quickly, which strengthens the case for version pins and regression checks.
Use the catalog to learn, then choose the production boundary
For experimentation, awslabs/mcp is a deep menu of AWS-specific MCP designs. A developer can connect documentation, pricing, infrastructure guidance, or a narrow service operation without inventing the protocol layer. Apache 2.0 licensing makes the behavior inspectable.
For a production buying decision, the repository has already answered the larger question: Agent Toolkit for AWS is the preferred destination. Teams that stay with an individual server should do so deliberately because its narrow behavior fits, not because the catalog looks official. Test that server, pin it, deny writes by default, and record its AWS calls. The useful unit of evaluation is one server with one role and one client policy, never the 71 MB repository as a whole.