trackmcp
Back to directory

The aws-mcp project is a Python-based application designed to interact with AWS services using the Model Context Protocol (MCP).

3 stars PythonAI & Machine Learning Updated Oct 3, 2025

Documentation

AWS Sage

Version
License
Python
Tests

A production-grade Model Context Protocol (MCP) server for AWS. Connect AI assistants to your AWS infrastructure and manage it through natural conversation.

๐Ÿš€ Works with any MCP-compatible client - just install and configure.

Compatible Clients

ClientStatusNotes
Claude Desktopโœ… Full SupportRecommended
Claude Codeโœ… Full SupportCLI & IDE
Cursorโœ… Full SupportMCP enabled
Clineโœ… Full SupportVS Code extension
Windsurfโœ… Full SupportMCP enabled
Zedโœ… Full SupportMCP enabled
VS Code + Copilotโณ PlannedVia MCP extension

Why AWS Sage?

AWS Labs offers 15 separate MCP servers for different services. AWS Sage takes a different approach:

FeatureAWS Labs MCPAWS Sage
Architecture15 separate servers1 unified server
Tools~45 tools across servers30 intelligent tools
Cross-Service QueriesNoYes - discover resources across all services
Dependency MappingNoYes - "what depends on this resource?"
Impact AnalysisNoYes - "what breaks if I delete this?"
Incident InvestigationNoYes - automated troubleshooting workflows
Cost AnalysisSeparate serverBuilt-in - idle resources, rightsizing, projections
LocalStack SupportNoYes - seamless local development
Multi-AccountNoYes - cross-account via AssumeRole
Docker SupportSeparateBuilt-in with docker-compose
Safety SystemBasic3-tier with 70+ blocked operations
Natural LanguageLimitedFull NLP with intent classification

Features

Core Capabilities

  • Natural Language Queries: "Show me EC2 instances tagged production"
  • Multi-Profile Support: Switch between AWS profiles with SSO support
  • Auto-Pagination: Never miss resources due to pagination limits
  • Smart Formatting: Tabular output for lists, detailed JSON for single resources

Safety System

Three safety modes protect your infrastructure:

ModeDescriptionOperations Allowed
`READ_ONLY`Default - exploration onlylist, describe, get
`STANDARD`Normal operationsread + write (with confirmation)
`UNRESTRICTED`Full accessall except denylist

Always Blocked (70+ operations):

  • `cloudtrail.delete_trail` / `stop_logging`
  • `iam.delete_account_password_policy`
  • `organizations.leave_organization`
  • `guardduty.delete_detector`
  • `kms.schedule_key_deletion`
  • And 65+ more critical operations

Unique Differentiators

Cross-Service Resource Discovery

Find resources across your entire AWS account:

code
"Find all resources tagged Environment=production"
"Discover resources with Name containing api"

Dependency Mapping

Understand resource relationships:

code
"What resources does my Lambda function depend on?"
"Map dependencies for my ECS service"

Impact Analysis

Know what breaks before you delete:

code
"What will break if I delete this security group?"
"Show impact of removing this IAM role"

Incident Investigation

Automated troubleshooting workflows:

code
"Investigate why my Lambda is failing"
"Debug high latency on my ALB"
"Analyze this security alert"

Cost Analysis

Find savings and optimize spending:

code
"Find idle resources in my account"
"Get rightsizing recommendations for EC2"
"Project costs for 3 t3.large instances"

LocalStack Integration

Develop locally without touching production:

code
"Switch to LocalStack environment"
"Compare S3 buckets between localstack and production"

Multi-Account Support

Work across AWS accounts:

code
"Assume role in account 123456789012"
"Switch to production account"

Quick Start

bash
# 1. Clone and install
git clone https://github.com/arunsanna/aws-sage
cd aws-sage
pip install .

# 2. Add to Claude Desktop config (see Configuration below)
# 3. Restart Claude Desktop
# 4. Start chatting: "List my S3 buckets"

That's it! Claude Desktop automatically runs AWS Sage when needed.

Installation

Prerequisites

  • Python 3.11+
  • AWS credentials configured (`~/.aws/credentials` or `~/.aws/config`)
  • Any MCP-compatible client (see Compatible Clients above)

Option 1: From Source

bash
git clone https://github.com/arunsanna/aws-sage
cd aws-sage
pip install .

Option 2: Direct from GitHub

bash
pip install git+https://github.com/arunsanna/aws-sage.git

Client Configuration

First, find your Python path:

bash
which python  # or: which python3

Claude Desktop

Config file location:

OSPath
macOS`~/Library/Application Support/Claude/claude_desktop_config.json`
Windows`%APPDATA%\Claude\claude_desktop_config.json`
Linux`~/.config/Claude/claude_desktop_config.json`
json
{
  "mcpServers": {
    "aws-sage": {
      "command": "/path/to/python3",
      "args": ["-m", "aws_sage.server"],
      "env": {
        "AWS_PROFILE": "default"
      }
    }
  }
}

Claude Code

Option 1: CLI command

bash
claude mcp add aws-sage -s user -- python -m aws_sage.server

Option 2: Project config (`.mcp.json` in project root)

json
{
  "mcpServers": {
    "aws-sage": {
      "command": "python",
      "args": ["-m", "aws_sage.server"],
      "env": {
        "AWS_PROFILE": "default"
      }
    }
  }
}

Option 3: Global config (`~/.claude.json`)

json
{
  "mcpServers": {
    "aws-sage": {
      "command": "python",
      "args": ["-m", "aws_sage.server"],
      "env": {
        "AWS_PROFILE": "default"
      }
    }
  }
}

Cursor

Config file: `~/.cursor/mcp.json` (global) or `.cursor/mcp.json` (project)

json
{
  "mcpServers": {
    "aws-sage": {
      "command": "python",
      "args": ["-m", "aws_sage.server"],
      "env": {
        "AWS_PROFILE": "default"
      }
    }
  }
}

Cline (VS Code Extension)

Config file: Access via Cline settings โ†’ "Configure MCP Servers" โ†’ `cline_mcp_settings.json`

json
{
  "mcpServers": {
    "aws-sage": {
      "command": "python",
      "args": ["-m", "aws_sage.server"],
      "env": {
        "AWS_PROFILE": "default"
      },
      "disabled": false
    }
  }
}

Windsurf

Config file:

OSPath
macOS`~/.codeium/windsurf/mcp_config.json`
Windows`%USERPROFILE%\.codeium\windsurf\mcp_config.json`
json
{
  "mcpServers": {
    "aws-sage": {
      "command": "python",
      "args": ["-m", "aws_sage.server"],
      "env": {
        "AWS_PROFILE": "default"
      }
    }
  }
}

Zed

Config file: Zed Settings (`settings.json`)

json
{
  "context_servers": {
    "aws-sage": {
      "command": "python",
      "args": ["-m", "aws_sage.server"],
      "env": {
        "AWS_PROFILE": "default"
      }
    }
  }
}

VS Code (Native MCP)

Config file: `.vscode/mcp.json` (project)

json
{
  "servers": {
    "aws-sage": {
      "command": "python",
      "args": ["-m", "aws_sage.server"],
      "env": {
        "AWS_PROFILE": "default"
      }
    }
  }
}

Docker Installation (All Clients)

For enhanced security with container isolation:

bash
git clone https://github.com/arunsanna/aws-sage
cd aws-sage
docker compose build aws-sage

Docker config (use in any client above):

macOS/Linux:

json
{
  "command": "docker",
  "args": [
    "run", "-i", "--rm",
    "-v", "${HOME}/.aws:/home/appuser/.aws:ro",
    "-e", "AWS_PROFILE=default",
    "aws-sage:latest"
  ]
}

Windows:

json
{
  "command": "docker",
  "args": [
    "run", "-i", "--rm",
    "-v", "%USERPROFILE%\\.aws:/home/appuser/.aws:ro",
    "-e", "AWS_PROFILE=default",
    "aws-sage:latest"
  ]
}

Tools Reference (30 Tools)

Credential Management

ToolDescription
`list_profiles`List available AWS profiles
`select_profile`Select and authenticate with a profile
`get_account_info`Show current account ID, region, identity

Safety Controls

ToolDescription
`set_safety_mode`Switch between READ_ONLY, STANDARD, UNRESTRICTED

Query Operations (Read-Only)

ToolDescription
`aws_query`Natural language AWS queries
`validate_operation`Check if an operation is valid without executing

Execute Operations (Require Confirmation)

ToolDescription
`aws_execute`Execute validated AWS operations

Context & Memory

ToolDescription
`get_context`View conversation context and recent resources
`set_alias`Create shortcuts for resources (e.g., "prod-db")
`list_aliases`View all defined aliases

Cross-Service Intelligence

ToolDescription
`discover_resources`Find resources by tags across all services
`map_dependencies`Show what a resource depends on
`impact_analysis`Predict what breaks if you modify/delete something
`investigate_incident`Automated incident investigation workflows

AWS Knowledge (Composition)

ToolDescription
`search_docs`Search AWS documentation
`get_aws_knowledge`Query built-in AWS knowledge base
`get_best_practices`Get service-specific best practices
`get_service_limits`Show default service quotas

Cost Analysis

ToolDescription
`find_idle_resources`Find unused EC2/RDS/EBS/EIP resources
`get_rightsizing_recommendations`Get EC2 right-sizing suggestions
`get_cost_breakdown`Spending analysis by service/tag
`project_costs`Estimate costs before deployment

Environment Management

ToolDescription
`list_environments`List configured environments (production/localstack)
`switch_environment`Switch between LocalStack and production
`get_environment_info`Current environment details
`check_localstack`Verify LocalStack connectivity
`compare_environments`Diff resources between environments

Multi-Account Management

ToolDescription
`assume_role`Assume role in another account via STS
`list_accounts`Show configured accounts
`switch_account`Change active account context

Usage Examples

Basic Queries

code
"List all S3 buckets"
"Show EC2 instances in us-west-2"
"Describe Lambda function payment-processor"
"Get IAM users with console access"

Cost Analysis

code
"Find idle resources in us-east-1"
"Get rightsizing recommendations for EC2"
"Show cost breakdown by service for last 30 days"
"Project costs for 2 t3.large and 100GB gp3 EBS"

LocalStack Development

code
"Switch to localstack"
"Create an S3 bucket in localstack"
"Compare DynamoDB tables between localstack and production"
"Check localstack connectivity"

Multi-Account Operations

code
"Assume role arn:aws:iam::123456789012:role/AdminRole"
"List all configured accounts"
"Switch to production account"

Cross-Service Discovery

code
"Find all resources tagged with Environment=production"
"Discover resources owned by team-platform"
"Show all resources in the payment-service stack"

Dependency Analysis

code
"What does my api-gateway Lambda depend on?"
"Map all dependencies for the checkout-service ECS task"
"Show resources connected to vpc-abc123"

Impact Analysis

code
"What breaks if I delete sg-abc123?"
"Impact of terminating this RDS instance"
"What depends on this KMS key?"

Incident Investigation

code
"Investigate Lambda failures for order-processor"
"Debug high latency: ALB arn:aws:elasticloadbalancing:..."
"Analyze security alert for instance i-abc123"

Architecture

code
aws-sage/
โ”œโ”€โ”€ Dockerfile                  # Container support
โ”œโ”€โ”€ docker-compose.yml          # LocalStack + MCP server
โ”‚
โ”œโ”€โ”€ src/aws_sage/
โ”‚   โ”œโ”€โ”€ server.py              # FastMCP server (30 tools)
โ”‚   โ”œโ”€โ”€ config.py              # Configuration & safety modes
โ”‚   โ”‚
โ”‚   โ”œโ”€โ”€ core/
โ”‚   โ”‚   โ”œโ”€โ”€ session.py         # AWS session management
โ”‚   โ”‚   โ”œโ”€โ”€ context.py         # Conversation memory
โ”‚   โ”‚   โ”œโ”€โ”€ environment.py     # Environment configuration
โ”‚   โ”‚   โ”œโ”€โ”€ environment_manager.py  # LocalStack/production switching
โ”‚   โ”‚   โ”œโ”€โ”€ multi_account.py   # Cross-account management
โ”‚   โ”‚   โ””โ”€โ”€ exceptions.py      # Custom exceptions
โ”‚   โ”‚
โ”‚   โ”œโ”€โ”€ safety/
โ”‚   โ”‚   โ”œโ”€โ”€ classifier.py      # Operation classification
โ”‚   โ”‚   โ”œโ”€โ”€ validator.py       # Pre-execution validation
โ”‚   โ”‚   โ””โ”€โ”€ denylist.py        # Blocked operations (70+)
โ”‚   โ”‚
โ”‚   โ”œโ”€โ”€ parser/
โ”‚   โ”‚   โ”œโ”€โ”€ intent.py          # NLP intent classification
โ”‚   โ”‚   โ””โ”€โ”€ service_models.py  # Botocore integration
โ”‚   โ”‚
โ”‚   โ”œโ”€โ”€ execution/
โ”‚   โ”‚   โ”œโ”€โ”€ engine.py          # Execution orchestrator
โ”‚   โ”‚   โ””โ”€โ”€ pagination.py      # Auto-pagination
โ”‚   โ”‚
โ”‚   โ”œโ”€โ”€ composition/
โ”‚   โ”‚   โ”œโ”€โ”€ docs_proxy.py      # AWS documentation
โ”‚   โ”‚   โ””โ”€โ”€ knowledge_proxy.py # AWS knowledge base + live query
โ”‚   โ”‚
โ”‚   โ””โ”€โ”€ differentiators/
โ”‚       โ”œโ”€โ”€ discovery.py       # Cross-service discovery
โ”‚       โ”œโ”€โ”€ dependencies.py    # Dependency mapping
โ”‚       โ”œโ”€โ”€ workflows.py       # Incident investigation
โ”‚       โ”œโ”€โ”€ cost.py            # Cost analysis
โ”‚       โ””โ”€โ”€ compare.py         # Environment comparison
โ”‚
โ””โ”€โ”€ tests/
    โ”œโ”€โ”€ unit/                  # Unit tests (145 tests)
    โ””โ”€โ”€ integration/           # Integration tests

Development (For Contributors)

Setup

bash
git clone https://github.com/arunsanna/aws-sage
cd aws-sage
pip install -e ".[dev]"

Run Tests

bash
pytest                          # All tests
pytest --cov=aws_sage           # With coverage
pytest tests/unit/test_cost.py  # Specific module

Local Testing with LocalStack

Test against LocalStack without touching real AWS:

bash
# Start LocalStack
docker compose up -d localstack

# In Claude Desktop, say:
# "Switch to localstack environment"
# "Create test bucket my-test-bucket"

Debug Server Directly

For development/debugging (not needed for normal use):

bash
fastmcp dev src/aws_sage/server.py  # Interactive mode
python -m aws_sage.server           # Direct run

Environment Variables

VariableDescriptionDefault
`AWS_PROFILE`AWS profile to use`default`
`AWS_DEFAULT_REGION`Default AWS region`us-east-1`
`AWS_SAGE_SAFETY_MODE`Safety mode (read_only/standard/unrestricted)`read_only`
`AWS_SAGE_LOCALSTACK_ENABLED`Enable LocalStack by default`false`
`AWS_SAGE_LOCALSTACK_HOST`LocalStack host`localhost`
`AWS_SAGE_LOCALSTACK_PORT`LocalStack port`4566`

Troubleshooting

View Logs

bash
# Claude Desktop logs
tail -f ~/Library/Logs/Claude/mcp-server-aws-sage.log
tail -f ~/Library/Logs/Claude/mcp.log

Common Issues

"Profile not found"

  • Ensure AWS credentials are configured in `~/.aws/credentials` or `~/.aws/config`
  • For SSO profiles, run `aws sso login --profile ` first

"Operation blocked"

  • Check current safety mode with `get_account_info`
  • Use `set_safety_mode` to change if needed
  • Some operations are always blocked (see denylist)

"Validation failed"

  • The parser validates operations against botocore models
  • Check spelling of service/operation names
  • Use `validate_operation` to test before executing

"LocalStack not reachable"

  • Ensure LocalStack is running: `docker compose up -d localstack`
  • Check endpoint: `curl http://localhost:4566/_localstack/health`
  • Use `check_localstack` tool to diagnose

Roadmap

v1.0.0 (Current)

  • [x] 30 intelligent tools across 10 categories
  • [x] Cross-service discovery, dependency mapping, impact analysis
  • [x] Cost optimization analyzer
  • [x] LocalStack integration
  • [x] Multi-account support
  • [x] Docker containerization
  • [x] 3-tier safety system with 70+ blocked operations

Future

  • [ ] CloudFormation drift detection
  • [ ] Custom workflow definitions
  • [ ] Terraform state integration
  • [ ] Compliance scanning (CIS benchmarks)

References

Contributing

See CONTRIBUTING.md for guidelines.

License

MIT License - see LICENSE for details.

Contact

Frequently asked questions

What is aws-sage?

aws-sage is The aws-mcp project is a Python-based application designed to interact with AWS services using the Model Context Protocol (MCP).

How do I install aws-sage?

Open the GitHub repository and follow its README. Most MCP servers are added to your client's MCP config, then called by your agent.

Is aws-sage open source?

Yes โ€” it is hosted on GitHub at https://github.com/arunsanna/aws-sage and has 3 stars.

Related MCP tools

All-Hands-AIopenhands

๐Ÿ™Œ OpenHands: Code Less, Make More for the Model Context Protocol. Enhance AI assistants with powerful integrations. Python-based implementation.

64,677 Python
agentartificial-intelligencechatgpt+6
mem0aimem0

Universal memory layer for AI Agents; Announcing OpenMemory MCP - local and secure memory management. Python-based implementation.

42,646 Python
agentsaiai-agents+12
zhayujiechatgpt-on-wechat

ๅŸบไบŽๅคงๆจกๅž‹ๆญๅปบ็š„่Šๅคฉๆœบๅ™จไบบ๏ผŒๅŒๆ—ถๆ”ฏๆŒ ๅพฎไฟกๅ…ฌไผ—ๅทใ€ไผไธšๅพฎไฟกๅบ”็”จใ€้ฃžไนฆใ€้’‰้’‰ ็ญ‰ๆŽฅๅ…ฅ๏ผŒๅฏ้€‰ๆ‹ฉChatGPT/Claude/DeepSeek/ๆ–‡ๅฟƒไธ€่จ€/่ฎฏ้ฃžๆ˜Ÿ็ซ/้€šไน‰ๅƒ้—ฎ/ Gemini/GLM-4/Kimi/LinkAI๏ผŒ่ƒฝๅค„็†ๆ–‡ๆœฌใ€่ฏญ้Ÿณๅ’Œๅ›พ็‰‡๏ผŒ่ฎฟ้—ฎๆ“ไฝœ็ณป็ปŸๅ’Œไบ’่”็ฝ‘๏ผŒๆ”ฏๆŒๅŸบไบŽ่‡ชๆœ‰็Ÿฅ่ฏ†ๅบ“่ฟ›่กŒๅฎšๅˆถไผไธšๆ™บ่ƒฝๅฎขๆœใ€‚

39,573 Python
aiai-agentchatgpt+17
assafelovicgpt-researcher

An LLM agent that conducts deep research (local and web) on any given topic and generates a long report with citations. Built for the Model Context Protocol to

24,026 Python
agentaiautomation+8
jlowinfastmcp

๐Ÿš€ The fast, Pythonic way to build MCP servers and clients Trusted by 19900+ developers. Trusted by 19900+ developers. Trusted by 19900+ developers.

19,927 Python
agentsfastmcpllms+6
1Panel-devmaxkb

๐Ÿ”ฅ MaxKB is an open-source platform for building enterprise-grade agents. MaxKB ๆ˜ฏๅผบๅคงๆ˜“็”จ็š„ๅผ€ๆบไผไธš็บงๆ™บ่ƒฝไฝ“ๅนณๅฐใ€‚ for the Model Context Protocol. Enhance AI assistants with po

19,062 Python
agentagentic-aichatbot+11

Run your own MCP server? See who uses it and what to fix.

Measure it with TrackMCP