AWS ships an official MCP toolkit for AI coding agents

What it does

The Agent Toolkit for AWS packages a managed MCP server, curated skills, and IDE plugins so AI coding assistants can interact with AWS services. It exposes the full AWS API surface—more than 300 services—through a single authenticated endpoint, and bundles task-specific guidance for everything from CDK deployments to Bedrock agent building to Glue ETL workflows. The plugins drop into Claude Code, Codex, and Cursor; other agents can wire up the MCP server directly.

The interesting bit

The managed AWS MCP Server sandboxes Python script execution for multi-step operations and serves live documentation without requiring credentials. More importantly, it emits CloudTrail logs and CloudWatch metrics with IAM condition keys that distinguish agent actions from human ones, so you can lock an agent to read-only even if the developer’s underlying IAM role has broader access.

Key highlights

• Four plugin bundles: aws-core (the baseline), aws-agents (Bedrock/AgentCore), aws-data-analytics (Glue, Athena, S3 Tables), and aws-agents-for-devsecops (security scanning, incident response).
• Skills are loaded on demand—agents fetch only the instructions and reference materials relevant to the current task.
• The AWS MCP Server offers sandboxed Python execution and real-time AWS documentation search.
• Enterprise controls include IAM context keys for agent-specific policies, plus CloudTrail audit logging and CloudWatch metrics on every request.
• It supersedes the earlier AWS Labs MCP tools, with skills that have undergone end-to-end evaluations.

Caveats

• Native plugins are only available for Claude Code, Codex, and Cursor; other agents must configure the MCP Server and install skills manually.
• The README is heavy on quickstart commands and light on architectural detail about how the script sandbox actually isolates execution.

Verdict

Worth a look if you want an AI assistant to actually provision and manage AWS infrastructure rather than just suggest templates. Skip it if you aren’t already using a supported coding agent or don’t want to route production API access through AWS’s managed MCP middleman.