AWS MCP Server Now GA: Unlocking Secure, Up-to-Date AWS Access for AI Agents

AI agents and coding assistants are powerful, but giving them real AWS access without compromising security has been a challenge. The newly generally available AWS MCP Server solves this by providing a managed, remote Model Context Protocol server that enables authenticated, granular access to all AWS services through a compact set of tools. Below, we answer the most pressing questions about this release.

What is the AWS MCP Server, and why was it created?

The AWS MCP Server is a managed remote Model Context Protocol (MCP) server that gives AI agents and coding assistants secure, authenticated access to AWS services. It was created to solve a critical problem: how to let agents interact with AWS without handing them overly broad permissions or exposing sensitive credentials. Prior to this, agents often relied on outdated training data, produced insecure IAM policies, and defaulted to the AWS CLI instead of best-practice tools like AWS CDK or CloudFormation. The MCP Server provides a fixed, small set of tools that enforce fine-grained access using existing IAM credentials, ensuring agents build production-ready infrastructure without security risks.

How does the MCP Server ensure agents always use current AWS documentation and APIs?

The server includes two key tools – search_documentation and read_documentation – that retrieve up-to-date AWS documentation and best practices at query time. This means the agent never works from stale training data. Additionally, the call_aws tool can execute any of the 15,000+ AWS API operations using your existing IAM credentials. When new APIs launch, they are supported within days because the server dynamically resolves the latest API definitions. This combination eliminates the risk of agents referencing obsolete information or missing newer services like Amazon S3 Vectors or Amazon Aurora DSQL.

What new capabilities come with the general availability release?

The GA release introduces several enhancements: IAM context keys allow you to express fine-grained access in standard IAM policies without needing a separate permission for the server itself. Documentation retrieval no longer requires any authentication, simplifying setup. The number of tokens consumed per interaction has been reduced, which is critical for complex, multi-step workflows. The most significant addition is the run_script tool (see below). Additionally, the server has transitioned from Agent SOPs to Skills, providing curated, task-specific guidance for common operations like deploying infrastructure or analyzing data.

How does the run_script tool work, and why is it a game-changer?

The run_script tool lets the agent write a short Python script that executes server-side in a sandboxed environment. The sandbox inherits your IAM permissions but has no network access, so the agent can process data without accessing your local file system or a shell. This is a game-changer because it enables the agent to chain multiple API calls, filter responses, and compute results in a single round-trip. Previously, calling multiple APIs one at a time was slow and consumed context tokens. With run_script, agents perform complex workflows faster and more efficiently, all while maintaining strict security boundaries.

What is the significance of moving from Agent SOPs to Skills?

Agent SOPs (standard operating procedures) were a good starting point, but Skills take it further. Skills provide curated guidance and best practices for specific tasks, such as building a serverless application or setting up a data pipeline. They are more structured, easier to maintain, and can be updated as best practices evolve. For developers, this means the agent receives precise, actionable instructions that lead to production-ready outcomes. The AWS MCP Server ships with a growing library of Skills, and users can create custom ones for their own workflows.

How does the AWS MCP Server ensure security and fine-grained access control?

Security is built in at multiple levels. First, the server uses your existing IAM credentials – no separate secret key is needed. IAM context keys enable administrators to write standard policies that restrict the server’s capabilities exactly as needed, down to specific resources and actions. The run_script tool runs in a sandbox with no network access, preventing data exfiltration. Documentation retrieval requires no authentication, but API operations always respect the caller’s IAM permission. Finally, the server is managed by AWS, so there is no infrastructure to maintain or risk of credential exposure.