# io.github.YawLabs/aws-mcp (npm · @yawlabs/aws-mcp) AWS MCP server — call any AWS API from AI assistants, with first-class SSO re-login - Trust score: 67/100 (medium) - Change this week: −5 - Registry status: active - Liveness: live - Owner verified: no - Last scored: 2026-08-06 ## Components - npm · `@yawlabs/aws-mcp`: 67/100 (this document), [markdown](https://verifymcp.io/servers/yawlabs-aws-mcp/yawlabs-aws-mcp.md), [page](https://verifymcp.io/servers/yawlabs-aws-mcp/yawlabs-aws-mcp) ## Channel facts - Registry: `npm` - Package: `@yawlabs/aws-mcp` - Version: `1.5.4` - Transport: `stdio` ## Trust breakdown How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog) Scored 2026-08-06. - **Supply Chain Security**: 100/100 - No malware found by supply-chain analysis. - No known CVEs affecting this package version or its production dependencies. - No install/post-install scripts declared. - No production dependencies, so there is no dependency health to assess. - **Provenance & Transparency**: 19/100 - Repository check failed: no source repository is declared. - Provenance check failed: no build-provenance attestation is published. - Clear OSI-approved license (MIT). - Actively maintained (last published 15 days ago). - Disclosure check failed: no security disclosure policy was found in the source repository. - **Schema Quality & AI Usability**: 64/100 - AI-judged instruction clarity (excellent). - Context-footprint check failed: tool/resource definitions use about 6428 tokens (~257/item across 25 items; 25 tools + 0 resources), over budget; trim descriptions and params. - Usage-examples check failed: none of the tools include examples. - **Stability & Change Management**: 33/100 - Stability observed for 10 of 30 days with no destabilising changes; credit accrues until the full window elapses. - **Tool Coverage**: 100/100 - 100% of tools have a non-trivial description (not blank, and not just the tool's name). - 100% of tool parameters carry a description. - **Capabilities**: 100/100 - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28. ## Install ### Claude ```bash claude mcp add yawlabs-aws-mcp -- npx -y @yawlabs/aws-mcp ``` ### Codex ```bash codex mcp add yawlabs-aws-mcp -- npx -y @yawlabs/aws-mcp ``` ### opencode ```json { "$schema": "https://opencode.ai/config.json", "mcp": { "yawlabs-aws-mcp": { "type": "local", "command": [ "npx", "-y", "@yawlabs/aws-mcp" ], "enabled": true } } } ``` ### OpenClaw ```bash openclaw mcp add yawlabs-aws-mcp --command npx --arg -y --arg @yawlabs/aws-mcp ``` ### Hermes ```yaml mcp_servers: yawlabs-aws-mcp: command: "npx" args: ["-y", "@yawlabs/aws-mcp"] ``` ### Other ```json { "mcpServers": { "yawlabs-aws-mcp": { "command": "npx", "args": [ "-y", "@yawlabs/aws-mcp" ] } } } ``` ## Changelog Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims. ### 2026-08-06 (score 67, +1) No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-08-04 (score 66, +1) No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-08-03 (score 65, +3) - [functional improvement] Stability: unverified → 0.23 ### 2026-08-02 (score 62, +15) - [security improvement] Malware scan: unverified → pass ### 2026-08-01 (score 47, −7) - [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server ### 2026-07-31 (score 54, −18) - [security regression] Malware scan: pass → unverified ### 2026-07-27 (score 72, +31) - [functional improvement] Tool coverage: unverified → 100 - [functional] First check of Tool coverage: 100 - [functional] First check of Schema quality: fail - [functional] First check of Schema quality: excellent - [functional] First check of Schema quality: fail ### 2026-07-26 (score 41) First indexed and scored. - [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server ## MCP tools (25) ### `aws_whoami` (~96 tokens) Show the current AWS identity (account, role ARN, user ID) plus SSO token status and time remaining. Use this first to verify auth before running other AWS operations. Returns a structured fix-it message if SSO is expired. Input parameters: - `profile` (string): AWS profile name. Defaults to $AWS_PROFILE or 'default'. - `region` (string): AWS region. Defaults to $AWS_REGION or us-east-1. ### `aws_login_start` (~95 tokens) Start an AWS SSO login via the device-code flow (no browser spawned from this process). Returns a verification URL and short code -- surface these to the user so they can open the URL in their own browser and paste the code. After they auth, call aws_login_complete with the returned sessionId to confirm completion. Input parameters: - `profile` (string): AWS profile configured for SSO. Defaults to $AWS_PROFILE or 'default'. ### `aws_login_complete` (~99 tokens) Block until the SSO login started by aws_login_start finishes (user completed auth in browser, or subprocess exited with error). Returns the new identity on success, or a structured error. Input parameters: - `profile` (string): Profile to verify identity against after login. Defaults to $AWS_PROFILE or 'default'. - `region` (string): Region for the post-login identity check. - `sessionId` (string, required): The sessionId returned by aws_login_start. ### `aws_refresh_if_expiring_soon` (~136 tokens) Proactive SSO token check. If the cached token has fewer than `thresholdMinutes` left (default 10), this kicks off aws_login_start and returns the verification URL + code in one round-trip. If plenty of time remains, returns `status: 'ok'` with the minutes left. Use at the start of a multi-step AWS workflow to avoid mid-session expiry. Input parameters: - `profile` (string): AWS profile configured for SSO. Defaults to $AWS_PROFILE or 'default'. - `thresholdMinutes` (integer): Trigger refresh when the token has fewer than this many minutes left. Default 10. ### `aws_session_set` (~140 tokens) Set the default AWS profile and/or region for the rest of this MCP session. Subsequent calls to aws_whoami, aws_login_*, and other AWS tools will use these values unless they override explicitly. Use when the user says 'switch to prod', 'use us-west-2', 'look at the staging account', etc. Both params are optional; pass whichever changed. Returns the resulting session state. Input parameters: - `profile` (string): AWS profile name to use as default. Omit to leave unchanged. - `region` (string): AWS region to use as default (e.g. 'us-west-2'). Omit to leave unchanged. ### `aws_session_get` (~73 tokens) Show the current session's default AWS profile and region, and where each value came from ('session' = set by aws_session_set, 'env' = AWS_PROFILE/AWS_REGION env var, 'default' = built-in fallback). Useful for confirming state before running operations or debugging why a call hit the wrong account. ### `aws_session_clear` (~109 tokens) Remove session-set profile and/or region overrides so subsequent calls fall back to env vars / defaults. No args clears both. Pass `profile: true` or `region: true` to clear just one. Use when the user says 'go back to the default profile,' 'unset the region,' or 'reset session.' Input parameters: - `profile` (boolean): If true, clear the session profile override. Default false. - `region` (boolean): If true, clear the session region override. Default false. ### `aws_call` (~401 tokens) Run an arbitrary AWS API operation via the aws CLI. Use kebab-case service and operation names as in `aws help` (service='s3api', operation='list-buckets'). Pass params as a JSON object using the AWS API's PascalCase keys (e.g. {Bucket: 'foo'}); they go through --cli-input-json. Session profile/region (from aws_session_set) are used by default; override per-call when needed. For high-level wrappers like 'aws s3 cp' or 'aws ec2 wait', use your shell — this tool targets the low-level API. Returns parsed JSON output by default, plus the literal command that was run. Input parameters: - `operation` (string, required): Operation name in kebab-case: 'list-buckets', 'describe-instances', 'get-caller-identity', 'put-object'. - `outputFormat` (string): Output format. Default 'json' (parsed into structured data when possible). - `params` (object): Operation parameters as a JSON object (AWS API schema, PascalCase keys). E.g. {Bucket: 'foo', Key: 'bar'}. - `profile` (string): Override session profile for this call. - `query` (string): JMESPath expression to extract a subset of the response (passed as --query). E.g. 'Buckets[].Name', 'Reservations[].Instances[].{Id:InstanceId,State:State.Name}'. Dramatically reduces output size; re… - `region` (string): Override session region for this call. - `service` (string, required): AWS service name in kebab-case: 's3api', 'ec2', 'iam', 'lambda', 'dynamodb', 'logs', 'sts', 'cloudformation', etc. - `timeoutMs` (integer): Timeout in milliseconds. Default 60000 (60s). Raise for slow ops; lower to fail fast. ### `aws_list_profiles` (~80 tokens) List AWS profiles configured in ~/.aws/config. Returns profile name, region, and SSO metadata (start URL, region, session name) where set, plus an `isSso` flag. Use when the user hasn't named a profile, when they ask to switch profiles, or when an SSO-expired error mentions a profile you haven't seen. ### `aws_paginate` (~401 tokens) Fetch one page of a paginated AWS list/describe operation. Identical to aws_call plus `maxItems` (page size) and `startingToken` (resume cursor). When `query` is supplied it is wrapped server-side as {NextToken, items: } so pagination survives a projection that would otherwise drop NextToken; the handler unwraps `items` before returning. Returns the parsed response, a `nextToken` (null when the list is exhausted), and `hasMore`. Call again with the returned nextToken as startingToken until hasMore is false. Use this instead of aws_call for operations that might exceed the 5 MB stdout cap: list-objects-v2, describe-instances, describe-log-streams, list-roles, etc. Input parameters: - `maxItems` (integer): Items per page (1-10000). Default 100. Lower this if hitting the 5 MB output cap. - `operation` (string, required): Paginated operation: 'list-objects-v2', 'describe-instances', 'list-roles', etc. - `params` (object): Operation parameters (PascalCase keys) passed via --cli-input-json. - `profile` (string): Override session profile for this call. - `query` (string): JMESPath expression to extract fields from each page (--query). The query is wrapped server-side as {NextToken, items: } so pagination still works even when the projection drops NextToken; the… - `region` (string): Override session region for this call. - `service` (string, required): AWS service in kebab-case: 's3api', 'ec2', 'iam', 'logs', etc. - `startingToken` (string): Resume cursor from the previous call's `nextToken`. Omit for the first page. - `timeoutMs` (integer): Timeout in milliseconds. Default 60000. ### `aws_assume_role` (~379 tokens) Call STS AssumeRole and stash the returned temporary credentials as a named profile in ~/.aws/credentials. Subsequent calls to aws_call / aws_whoami / aws_paginate can use profile='mcp-' (or your overridden targetProfile name). The raw secret key / session token are NOT returned to the caller — only the profile name, expiration, and assumed identity. Use for cross-account access: a source profile (your SSO identity) assumes a role in another account. Default timeout is 120s (raise via timeoutMs for slow SAML / credential_process setups on cold start). Input parameters: - `durationSeconds` (integer): Session duration in seconds (900-43200). Default 3600. - `externalId` (string): External ID (only required if the role's trust policy demands it). - `region` (string): Region for the STS call. Defaults to session region / $AWS_REGION. - `roleArn` (string, required): Target role ARN, e.g. 'arn:aws:iam::123456789012:role/CrossAccountAdmin'. - `sessionName` (string, required): Role session name (shows up in CloudTrail). Alphanumeric + +=,.@- only. - `sourceProfile` (string): Profile to use as the assuming identity. Defaults to session profile / $AWS_PROFILE / 'default'. - `targetProfile` (string): Profile name to write the temp creds under. Default 'mcp-'. Auto-prefixed with 'mcp-' if missing. - `timeoutMs` (integer): Timeout in milliseconds for the underlying STS AssumeRole CLI call. Default 120000 (120s) -- gives cold-start SAML / credential_process setups headroom over runAwsCall's 60s default. Raise further fo… ### `aws_logs_tail` (~312 tokens) Tail CloudWatch Logs for a log group. Wraps 'aws logs tail' (not the raw FilterLogEvents API) so you get the same server-side time parsing and event-grouping the CLI uses. Returns recent events as JSON. Does NOT stream -- run once to fetch the window, then call again with a later `since`. For long windows (> a few hundred events), narrow via `filterPattern` or lower `since`. Input parameters: - `filterPattern` (string): CloudWatch Logs filter pattern. E.g. 'ERROR', '"stack trace"', '[timestamp, request_id, level = ERROR, ...]'. - `logGroupName` (string, required): Log group name, e.g. '/aws/lambda/my-fn' or '/aws/ecs/my-service'. No leading 'logs/'. - `logStreamNamePrefix` (string): Restrict to streams with this prefix. Mutually exclusive with logStreamNames. - `logStreamNames` (array): Restrict to specific stream names. Overrides the default (all streams in the group). - `profile` (string): Override session profile for this call. - `region` (string): Override session region for this call. - `since` (string): Window to tail: ''. Default '10m'. Example: '30m', '1h', '3d'. - `timeoutMs` (integer): Timeout in milliseconds. Default 60000 (60s). Raise for large windows. ### `aws_metrics_query` (~661 tokens) Query CloudWatch metrics via GetMetricData (the modern multi-metric / expression-capable API, not the legacy get-metric-statistics). Pass `queries` as a flat array of {id, namespace, metricName, dimensions?, statistic?, period?, expression?, label?}; the tool shapes them into MetricDataQueries for you. `startTime`/`endTime` accept ISO 8601 or relative shorthand ('15m', '1h', '1d', '1w'); endTime defaults to 'now'. Period is auto-picked from the time range when omitted (60s for <=3h, 300s for <=24h, 900s for <=15d, 3600s otherwise) to stay under CloudWatch's ~100,800-datapoint response cap. Returns {series: [{id, label?, timestamps, values, period?, statusCode?}], messages?, periodSeconds, profile, region, nextToken, hasMore}. Each series' `period` is the effective granularity for that query (its explicit period, or the auto-pick it inherited); it is omitted for an expression query that didn't set one. The top-level `periodSeconds` is always the auto-pick. When CloudWatch truncates a large response, `hasMore` is true and `nextToken` carries the resume cursor -- call again with `nextToken` set to fetch the next page (rare for typical agent queries that stay within the per-request cap). Use for 'show me the CPU on this instance for the last hour', 'sum lambda invocations across these 3 functions', or expression-based 'p99 latency divided by average latency' lookups. Input parameters: - `endTime` (string): ISO 8601 timestamp or relative shorthand. Default 'now'. - `maxDataPoints` (integer): Target datapoint count. CloudWatch does not truncate to the first N points -- it widens (coarsens) the period server-side so the series aggregates down to fit this many points. CloudWatch's own ceili… - `nextToken` (string): Resume cursor from a previous call's `nextToken`. Omit for the first page. Forwarded as CloudWatch's NextToken; only meaningful when a prior call returned `hasMore: true`. - `profile` (string): Override session profile for this call. - `queries` (array, required): 1-100 queries. Each is either a metric-stat (namespace + metricName) or an expression. - `region` (string): Override session region for this call. - `scanBy` (string): Sort order for returned datapoints. Default 'TimestampDescending' (matches CloudWatch's default). - `startTime` (string): ISO 8601 timestamp or relative shorthand ('15m', '1h', '1d', '1w'). Default '1h' (one hour ago). - `timeoutMs` (integer): Timeout in milliseconds. Default 60000 (60s). ### `aws_resource_get` (~206 tokens) Read a single AWS resource via Cloud Control API. Covers hundreds of resource types with a CloudFormation schema. `typeName` is '::::' (e.g. 'AWS::Lambda::Function'); `identifier` is the primary key for that type (function name, bucket name, IAM role name, ARN, or composite id). Returns parsed Properties. For resources not covered by CCAPI or for data-plane operations, use aws_call. Input parameters: - `identifier` (string, required): Primary identifier for the resource (function name, bucket name, ARN, or composite id). - `profile` (string): Override session profile for this call. - `region` (string): Override session region for this call. - `timeoutMs` (integer): Timeout in milliseconds. Default 60000. - `typeName` (string, required): CloudFormation type name, e.g. 'AWS::Lambda::Function', 'AWS::S3::Bucket', 'AWS::IAM::Role'. ### `aws_resource_list` (~201 tokens) List resources of a given type via Cloud Control API, paginated. Returns an array of {identifier, properties}, a `nextToken` (null when exhausted), and `hasMore`. Some types need parent identifiers (e.g. nested resources under a cluster); pass those as `resourceModel`. Input parameters: - `maxResults` (integer): Page size (1-100). Default 100. - `nextToken` (string): Resume cursor from the previous call's `nextToken`. Omit for the first page. - `profile` (string): Override session profile for this call. - `region` (string): Override session region for this call. - `resourceModel` (object): Parent identifier properties for nested types, e.g. {ClusterArn: '...'}. - `timeoutMs` (integer): Timeout in milliseconds. Default 60000. - `typeName` (string, required): CloudFormation type name, e.g. 'AWS::Lambda::Function'. ### `aws_resource_create` (~363 tokens) Create an AWS resource via Cloud Control API. Async by default: returns a ProgressEvent with OperationStatus=IN_PROGRESS and a `requestToken` (top-level) -- poll aws_resource_status with that token, or pass `awaitCompletion: true` to have the server poll for you and return the terminal event. `desiredState` is the resource properties JSON matching the CloudFormation schema for `typeName`. Input parameters: - `awaitCompletion` (boolean): If true, poll get-resource-request-status until the operation reaches SUCCESS / FAILED / CANCEL_COMPLETE and return the final ProgressEvent. Default false (returns immediately with IN_PROGRESS, calle… - `clientToken` (string): Idempotency token (max 128 chars). Prevents duplicate creation on retry. - `desiredState` (object, required): Resource properties matching the CFN schema. E.g. for AWS::SSM::Parameter: {Name: '/my/param', Type: 'String', Value: 'hello'}. - `maxWaitMs` (integer): Maximum total wait in ms when awaitCompletion is true (range 1000-1800000). Default 300000. On timeout, returns the last seen status with a hint to keep polling. - `pollIntervalMs` (integer): Poll interval in ms when awaitCompletion is true (range 500-30000). Default 2000. ProgressEvent.RetryAfter overrides when CCAPI returns one. - `profile` (string): Override session profile for this call. - `region` (string): Override session region for this call. - `timeoutMs` (integer): Timeout in milliseconds. Default 60000. - `typeName` (string, required): CloudFormation type name, e.g. 'AWS::SSM::Parameter'. ### `aws_resource_update` (~328 tokens) Update an AWS resource via Cloud Control API using RFC 6902 JSON Patch. Async by default: returns a ProgressEvent with OperationStatus=IN_PROGRESS and a top-level `requestToken`. Pass `awaitCompletion: true` to have the server poll until terminal. Typical patch: [{op: 'replace', path: '/MemorySize', value: 512}]. Input parameters: - `awaitCompletion` (boolean): If true, poll get-resource-request-status until the operation reaches SUCCESS / FAILED / CANCEL_COMPLETE and return the final ProgressEvent. Default false (returns immediately with IN_PROGRESS, calle… - `clientToken` (string): Idempotency token (max 128 chars). - `identifier` (string, required): Primary identifier for the resource. - `maxWaitMs` (integer): Maximum total wait in ms when awaitCompletion is true (range 1000-1800000). Default 300000. On timeout, returns the last seen status with a hint to keep polling. - `patchDocument` (array, required): RFC 6902 JSON Patch document (array of operations). At least one entry. - `pollIntervalMs` (integer): Poll interval in ms when awaitCompletion is true (range 500-30000). Default 2000. ProgressEvent.RetryAfter overrides when CCAPI returns one. - `profile` (string): Override session profile for this call. - `region` (string): Override session region for this call. - `timeoutMs` (integer): Timeout in milliseconds. Default 60000. - `typeName` (string, required): CloudFormation type name. ### `aws_resource_delete` (~287 tokens) Delete an AWS resource via Cloud Control API. Async by default: returns a ProgressEvent with OperationStatus=IN_PROGRESS and a top-level `requestToken`. Pass `awaitCompletion: true` to have the server poll until terminal. Destructive -- double-check `identifier` before calling. Input parameters: - `awaitCompletion` (boolean): If true, poll get-resource-request-status until the operation reaches SUCCESS / FAILED / CANCEL_COMPLETE and return the final ProgressEvent. Default false (returns immediately with IN_PROGRESS, calle… - `clientToken` (string): Idempotency token (max 128 chars). - `identifier` (string, required): Primary identifier for the resource. - `maxWaitMs` (integer): Maximum total wait in ms when awaitCompletion is true (range 1000-1800000). Default 300000. On timeout, returns the last seen status with a hint to keep polling. - `pollIntervalMs` (integer): Poll interval in ms when awaitCompletion is true (range 500-30000). Default 2000. ProgressEvent.RetryAfter overrides when CCAPI returns one. - `profile` (string): Override session profile for this call. - `region` (string): Override session region for this call. - `timeoutMs` (integer): Timeout in milliseconds. Default 60000. - `typeName` (string, required): CloudFormation type name. ### `aws_resource_status` (~120 tokens) Poll the status of an async Cloud Control API request (create/update/delete). Pass the `requestToken` returned by those tools. Returns the current ProgressEvent with OperationStatus: PENDING | IN_PROGRESS | SUCCESS | FAILED | CANCEL_IN_PROGRESS | CANCEL_COMPLETE. Input parameters: - `profile` (string): Override session profile for this call. - `region` (string): Override session region for this call. - `requestToken` (string, required): RequestToken from a previous create/update/delete call. - `timeoutMs` (integer): Timeout in milliseconds. Default 60000. ### `aws_resource_diff` (~234 tokens) Dry-run a CCAPI update: fetch the current resource state, simulate applying a JSON Patch in memory, and return before/after plus a flat list of changed paths. No mutation is sent to AWS. Use this before aws_resource_update to verify the patch does what you expect. Supports the add/remove/replace subset of RFC 6902 (covers the vast majority of CCAPI updates); 'move'/'copy'/'test' are rejected at schema validation -- use aws_resource_update directly if you need those (CCAPI accepts them, this preview tool just doesn't simulate them locally). Input parameters: - `identifier` (string, required): Primary identifier for the resource. - `patchDocument` (array, required): RFC 6902 JSON Patch (add/remove/replace subset). For move/copy/test, use aws_resource_update directly. - `profile` (string): Override session profile for this call. - `region` (string): Override session region for this call. - `timeoutMs` (integer): Timeout in milliseconds. Default 60000. - `typeName` (string, required): CloudFormation type name, e.g. 'AWS::Lambda::Function'. ### `aws_multi_region` (~390 tokens) Run the same AWS API operation across multiple regions in parallel. Same shape as aws_call (service, operation, params?, query?, outputFormat?, timeoutMs?) but takes `regions: string[]` instead of `region`. Returns an array of `{region, ok, data?, command?, error?, errorKind?}` -- partial failure is expected (services aren't everywhere, perms may be region-scoped). Duplicate regions in the input are collapsed (first occurrence wins), so `results.length` may be less than `regions.length`; use the returned `regionCount` for the actual count run. Use for fleet-wide reads: 'describe-instances across all our regions', 'list buckets in every region', 'check IAM password policy everywhere'. Input parameters: - `concurrency` (integer): Max regions in flight at once (1-32). Default 8. - `operation` (string, required): Operation in kebab-case: 'describe-instances', 'list-buckets', etc. - `outputFormat` (string): Output format. Default 'json'. - `params` (object): Operation parameters (PascalCase keys) -- same shape as aws_call. - `profile` (string): Override session profile for the batch. - `query` (string): JMESPath expression for --query (server-side trimming per region). - `regions` (array, required): Region IDs (e.g. ['us-east-1','us-west-2','eu-west-1']). 1-32. Validated for argv-safety; a bad region name yields a clear per-region error and skips its CLI spawn (per-region isolation comes from ea… - `service` (string, required): AWS service in kebab-case: 's3api', 'ec2', 'iam', etc. - `timeoutMs` (integer): Timeout in ms applied PER region. Default 60000. ### `aws_iam_simulate` (~425 tokens) Simulate IAM permissions for a principal: can principal X do actions Y on resources Z? Wraps `iam simulate-principal-policy`. Returns one entry per (action, resource) pair with `decision` (allowed / explicitDeny / implicitDeny / unknown -- unknown is the malformed-response fallback when EvalDecision is missing or unrecognised), `matchedStatementIds` (which IAM statements decided), and `missingContextValues` (context keys the policy needed but you didn't provide -- common for tag-based policies). Use this BEFORE a risky operation to avoid a 403; pairs with the post-failure Suggestion you get from aws_call. Requires iam:SimulatePrincipalPolicy on the caller. Input parameters: - `actions` (array, required): IAM action names to test, e.g. ['lambda:CreateFunction', 's3:GetObject']. 1-50 entries. Wildcards (e.g. 's3:*') are accepted. - `contextEntries` (array): Context keys for policies that depend on request context -- 'aws:RequestTag/Project' = 'foo', etc. Provide when the policy you're testing references condition keys; the response's `missingContextValu… - `principalArn` (string, required): ARN of the principal whose policies you want to evaluate, e.g. 'arn:aws:iam::123456789012:user/jeff' or 'arn:aws:iam::123456789012:role/my-role'. - `profile` (string): Override session profile for this call. - `region` (string): Override session region for this call (IAM is global; affects API endpoint). - `resources` (array): Resource ARNs to test against, e.g. ['arn:aws:s3:::my-bucket/*']. When omitted, AWS applies its own default of ['*'] server-side (best-case 'is this action ever allowed?') -- this tool does not injec… - `timeoutMs` (integer): Timeout in milliseconds. Default 60000. ### `aws_docs_search` (~144 tokens) Search the live AWS documentation (the same backend that powers the docs.aws.amazon.com search box). Use this to discover the right doc page for a service, API, or concept the model may not know about -- new services, recently changed APIs, exact parameter names. Returns ranked results as {title, url, summary, excerpt}. Follow up with aws_docs_read on a result's url to get the full page as markdown. Input parameters: - `limit` (integer): Max results to return (1-50). Default 10. - `query` (string, required): Search phrase, e.g. 'S3 bucket naming rules', 'Lambda environment variables', 'DynamoDB GSI'. ### `aws_docs_read` (~184 tokens) Fetch an AWS documentation page and return it as markdown. `url` must be an https://docs.aws.amazon.com/...html page (typically one returned by aws_docs_search). Long pages are paginated: pass `startIndex` (default 0) and `maxLength` (default 5000 chars); the response includes `hasMore` and `nextStartIndex` -- call again with nextStartIndex to continue. Strips nav/cookie-banner/feedback chrome before converting. Input parameters: - `maxLength` (integer): Max characters of markdown to return. Default 5000; max 1000000. - `startIndex` (integer): Character offset to start from (for paginated reads). Default 0. - `url` (string, required): AWS docs page URL: https://docs.aws.amazon.com/<...>.html. Usually from an aws_docs_search result. ### `aws_script` (~564 tokens) Run a short JavaScript snippet that orchestrates other aws-mcp tools (aws.call, aws.paginate, aws.paginateAll, aws.resource.*, aws.logsTail, aws.metricsQuery, aws.iamSimulate, aws.multiRegion, aws.assumeRole, aws.docs.{search,read}) and returns a combined result. Best for batched read+filter+aggregate workflows that would otherwise need N tool round-trips: 'list all Lambdas, fetch each one's config, return those with memory > 1024'. Use `return ` at the end to surface a result; console.log lines are captured and returned alongside. Helpers throw Errors on failure -- use try/catch. NOT a security sandbox -- treat the same as any other tool the model can call. Input parameters: - `code` (string, required): JavaScript snippet evaluated inside `(async () => { ... })()`. Use `return ` to surface a result. Bound globals: aws.call, aws.paginate, aws.paginateAll, aws.resource.{get,list,create,update,d… - `timeoutMs` (integer): Wall-clock timeout in milliseconds. Default 60000; max 300000. Best-effort across evaluation plus awaited aws.* calls -- it fires on synchronous spin before the first await and on async wall-clock on… ## Diagnostics Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/yawlabs-aws-mcp/yawlabs-aws-mcp#diagnostics ## Score history - 2026-08-06: 67 - 2026-08-05: 66 - 2026-08-04: 66 - 2026-08-03: 65 - 2026-08-02: 62 - 2026-08-01: 47 - 2026-07-31: 54 - 2026-07-29: 72 - 2026-07-28: 72 - 2026-07-27: 72 - 2026-07-26: 41 ## Links - npm package: https://www.npmjs.com/package/@yawlabs/aws-mcp - Socket report: https://socket.dev/npm/package/@yawlabs/aws-mcp - Changelog RSS feed: https://verifymcp.io/servers/yawlabs-aws-mcp/yawlabs-aws-mcp.xml - Changelog JSON feed: https://verifymcp.io/servers/yawlabs-aws-mcp/yawlabs-aws-mcp.json - HTML version of this page: https://verifymcp.io/servers/yawlabs-aws-mcp/yawlabs-aws-mcp