AWS Sso MCP Server
AWS IAM Identity Center resources managed via natural language commands.
Data last scanned today · Reviewed today
Overview
This TypeScript-based server bridges the gap between AI assistants and your AWS environment. By integrating with AWS IAM Identity Center, it allows you to query account lists, describe VPCs, and monitor EC2 instance status using conversational prompts. It also supports executing AWS CLI commands and running shell operations through SSM. The server facilitates navigation across multi-account setups and permission sets. Users can authenticate through their SSO start URL and region configuration, enabling streamlined interactions with cloud infrastructure directly from within compatible AI development environments.
Our verdict
With a security score of 21/100, this tool is categorized as high risk. The lack of a defined software license and the absence of a restrictive read-only mode mean users cannot verify legal terms or limit the scope of operations. Given these factors and the community-maintained, unreviewed nature of the project, it should be used with extreme caution in production or environments containing sensitive data.
- Supports multi-account AWS environment navigation
- Enables remote shell execution via SSM
- Contains only 13 direct dependencies
- No license detected, creating legal ambiguity
- Lacks a read-only mode for restricted operations
- Community-maintained project with no formal editorial review
Setup
{
"mcpServers": {
"mcp-server-aws-sso": {
"args": [
"-y",
"@aashari/mcp-server-aws-sso"
],
"command": "npx"
}
}
}Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No read-only mode — running this grants full read/write access.
- No built-in authentication — anyone with access to this config can invoke every tool it exposes.
Tools
| Tool | Description | Risk |
|---|---|---|
| aws_sso_login | Initiates AWS SSO device authorization flow | medium |
| aws_sso_status | Checks current authentication status | low |
| aws_sso_ls_accounts | Lists all accessible AWS accounts and roles | low |
| aws_sso_exec_command | Executes AWS CLI commands with SSO credentials | high |
| aws_sso_ec2_exec_command | Executes shell commands on EC2 instances via SSM | high |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf | ||||
| ChatGPT |
Frequently asked questions
›What are the prerequisites for using this MCP server?
You must have AWS IAM Identity Center enabled, an identity source configured, and permission sets assigned to users for your AWS accounts.
›How can I configure the server for use with my AI assistant?
You can add it to your Claude Desktop configuration file, install it globally via npm for other assistants, or create a system-wide configuration file at ~/.mcp/configs.json.
›Does the server require specific environment variables?
Yes, you generally need to provide the AWS_SSO_START_URL and AWS_REGION to define your connection and target environment.
›Can I perform operations on EC2 instances using this server?
Yes, the server supports executing shell commands on EC2 instances via AWS Systems Manager and can retrieve information like disk usage or instance status.
›How do I troubleshoot or check my current authentication status?
You can use the aws_sso_status tool or ask your AI assistant to check your authentication status to confirm if you are still logged in.
›Can the server handle multi-account environments?
Yes, you can list accessible accounts and roles, and execute commands by specifying the account ID and role name for specific operations.
Badge
Maintain this server? Add the live badge to your README.