Atlas / MCP servers / lokeswaran-aj / AWS

AWSSAFE

Name: AWS
Author: lokeswaran-aj

mcp/lokeswaran-aj/aws-4

MCP server by lokeswaran-aj · aws · aws sdk · mcp · Audited 2026-10-08

⚑ Report / re-scan Source ↗

An MCP(Model Context Protocol) Server for AWS services

Verdict

SAFE

Grade

Trust score

89 /100

Exposed tools

54 21r · 20w · 13d

Transport

—

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

🎬 Demo

See it in action! Here's how easy it is to spin up a full-blown EC2 setup — VPC, subnets, security groups, this works — all through natural language prompts to an AI Model Context Protocol (MCP) server.

✨ Features

Currently supports

RDS
S3
EC2
VPC
Subnet
Internet Gateway
Route Table
Security Group
Key Pair
Instance Tag
AMI

More AWS services (like Lambda, API Gateway, etc.) coming soon! Contributions welcome 🚀

📋 Prerequisites

For Development:

Node.js >= 18.0.0
pnpm >= 10.0.0

For Docker Deployment:

Docker and Docker Compose

For Both:

AWS Account with AWS credentials (Access Key ID and Secret Access Key)

⚙️ Developer Setup

1. Clone the repo

git clone https://github.com/lokeswaran-aj/aws-mcp.git
cd aws-mcp

❗️Currently, the server reads credentials from MCP configuration headers. In future versions, we'll support AWS Role ARN.

2. Install dependencies

pnpm install

💡 Make sure you have pnpm installed globally. If not: ``bash npm install -g pnpm ``

3. Run the dev server

pnpm dev

🐳 Docker Deployment

Quick Start with Docker

Option 1: Using Docker Compose (Recommended)

docker-compose up -d

Option 2: Using Docker directly

# Build the image
docker build -t aws-mcp .

# Run with port mapping
docker run -d --name aws-mcp-server -p 8080:8080 aws-mcp

The server will be available at:

MCP HTTP Stream: http://localhost:8080/mcp
MCP SSE: http://localhost:8080/sse

Managing Docker Containers

# View logs
docker-compose logs -f

# Stop container
docker-compose down

# Rebuild and restart
docker-compose build --no-cache

Read from source at commit 252a9af0df03OBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add aws-mcp -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "aws-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}

Exposed tools (54)

21 read · 20 write · 13 destructive. Blast radius: 13 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`associate-route-table`	read	Associate a route table with a subnet or internet gateway or virtual private gateway
`attach-internet-gateway`	read	Attach an internet gateway to a VPC
`authorize-security-group-egress`	read	Authorize a security group egress in the given region
`authorize-security-group-ingress`	read	Authorize a security group ingress in the given region
`create-ami`	write	Create an AMI
`create-bucket`	write	Create a new S3 bucket in the given region
`create-db-instance`	write	Create a new RDS DB instance in the given region
`create-instance-tag`	write	Create instance tag
`create-internet-gateway`	write	Create a new internet gateway in the given region
`create-key-pair`	write	Create a key pair in the given region
`create-route-table`	write	Create a route table in the given region
`create-security-group`	write	Create a security group in the given region
`create-subnet`	write	Create a subnet in the given region
`create-vpc`	write	Create a new VPC in the given region
`delete-ami`	destructive	Delete an AMI
`delete-bucket`	destructive	Delete an S3 bucket in the given region
`delete-db-instance`	destructive	Delete a given RDS DB instance in the given region
`delete-instance-tag`	destructive	Delete instance tag
`delete-internet-gateway`	destructive	Delete an internet gateway by ID in the given region
`delete-key-pair`	destructive	Delete a key pair in the given region
`delete-route-table`	destructive	Delete a route table in the given region
`delete-security-group`	destructive	Delete a security group in the given region
`delete-subnet`	destructive	Delete a subnet by subnet ID in the given region
`delete-vpc`	destructive	Delete a VPC by VPC ID in the given region
`detach-internet-gateway`	read	Detach an internet gateway from a VPC
`disassociate-route-table`	read	Disassociate a route table from a subnet or internet gateway or virtual private gateway
`import-key-pair`	write	Import a key pair in the given region
`launch-ec2-instance`	read	Launch an EC2 instance in a given region
`list-amis`	read	List AMIs
`list-buckets`	read	List all the S3 buckets in the given region
`list-db-instances`	read	List all the RDS DB instances in the given region
`list-ec2-instances`	read	List EC2 instances in a given region
`list-instance-tags`	read	List instance tags
`list-internet-gateways`	read	List all internet gateways in the given region
`list-key-pairs`	read	List key pairs in the given region
`list-route-tables`	read	List route tables in the given region
`list-security-group-rules`	read	List all security group rules in the given region
`list-security-groups`	read	List all security groups in the given region
`list-subnets`	read	List all the subnets in the given region
`list-vpcs`	read	List all the VPCs in the given region
`modify-security-group-rules`	write	Modify a security group rule in the given region
`reboot-ec2-instance`	read	Reboot an EC2 instance in a given region
`replace-route-table-association`	read	Replace the route table association for a subnet or internet gateway or virtual private gateway
`revoke-security-group-egress`	destructive	Revoke a security group egress in the given region
`revoke-security-group-ingress`	destructive	Revoke a security group ingress in the given region
`start-ec2-instance`	write	Start an EC2 instance in a given region
`stop-ec2-instance`	write	Stop an EC2 instance in a given region
`terminate-ec2-instance`	destructive	Terminate an EC2 instance in a given region
`update-db-instance`	write	Update a given RDS DB instance in the given region
`update-security-group-rule-descriptions-egress`	write	Update the description of a security group rule egress in the given region
`update-security-group-rule-descriptions-ingress`	write	Update the description of a security group rule ingress in the given region
`update-subnet-attribute`	write	Update a subnet attributes by subnet ID in the given region
`update-vpc-attribute`	write	Update a VPC attribute(EnableDnsHostnames, EnableDnsSupport, EnableNetworkAddressUsageMetrics) by VPC ID in the given region
`update-vpc-endpoint`	write	Update a VPC endpoint(Gateway endpoint, Interface endpoint) by VPC endpoint ID in the given region

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (2 observation(s))
Network: none-observed
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (5)

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

delete-ami, delete-bucket, delete-db-instance, delete-instance-tag, delete-internet-gateway, delete-key-pair, delete-route-table, delete-security-group, delete-subnet, delete-vpc, revoke-security-grou

Why it matters. 13 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.hidden_file · CWE-1104

.prettierignore

.prettierignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/tools/ec2/handler.ts:21

} from "../../schema/ec2";

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

package.json

@aws-sdk/client-ec2, @aws-sdk/client-rds, @aws-sdk/client-s3, @modelcontextprotocol/sdk, dotenv, fastmcp, zod, @eslint/js

Why it matters. 22 dependency range(s) float

Fix. pin exact versions or ship a lockfile

INFOInventory / provenance · inv.oversize · CWE-1104

assets/demo.gif

assets/demo.gif

Why it matters. 41468586 bytes not read

Gates applied: no_behavioural_pass.

Audited 2026-10-08 · audit v0.4.1 · source sha 252a9af0df03full audit observations/trust-audit/mcp-server/lokeswaran-aj__aws-4.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-08	`252a9af0df03`	SAFE	B	89	first audit

Questions

What is the AWS MCP server?

An MCP(Model Context Protocol) Server for AWS services

What tools does AWS expose?

54 in total: 21 read-only, 20 that write, and 13 that can delete or overwrite (delete-ami, delete-bucket, delete-db-instance, delete-instance-tag, delete-internet-gateway). Every one is listed on this page with its risk.

Is AWS safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 13 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does AWS need?

No credential environment variables were found in its source, so it appears to need none.

How current is this page?

The grade is for one exact copy of the source (252a9af0df03), read on 2026-10-08. The repository is watched and re-audited when it changes.

Source	lokeswaran-aj/aws-mcp
npm	`aws-mcp@0.0.2`
License	MIT
Activity	pushed 480d ago