AWS MCP server with Atomic Agent

AWS runs a managed AWS MCP Server that searches AWS documentation, retrieves AWS skills and calls AWS APIs. Clients reach it through the MCP Proxy for AWS, a small local process that signs every request with SigV4 using your normal AWS credentials. In Atomic Agent that proxy is a stdio server. Source: Setting up the AWS MCP Server.

Older awslabs server

The open-source awslabs.aws-api-mcp-server is marked as superseded by this AWS MCP Server in the awslabs docs. New setups should use the config below.

Config

{
  "name": "aws",
  "description": "AWS MCP Server (SigV4 proxy)",
  "transport": {
    "kind": "stdio",
    "command": "uvx",
    "args": [
      "mcp-proxy-for-aws-cli@latest",
      "https://aws-mcp.us-east-1.api.aws/mcp",
      "--metadata", "AWS_REGION=us-west-2",
      "--read-only"
    ]
  }
}

Before you add it:

1. Install the AWS CLI 2.32.0 or later and sign in with aws login (or SSO, or access keys). Check with aws sts get-caller-identity.
2. Install uv for uvx.
3. Run uvx mcp-proxy-for-aws-cli@latest https://aws-mcp.us-east-1.api.aws/mcp once in a terminal and stop it. The first run downloads dependencies and can take longer than Atomic Agent’s 15-second connect window.

The endpoint picks the AWS MCP Server region (us-east-1 or eu-central-1); AWS_REGION in --metadata sets the default region for AWS operations. --read-only disables tools that may need write permissions. Remove it only when you want the agent to change resources. To choose a profile, add "--profile", "my-profile".

Where to add it:

• Desktop app: Settings › Connections › MCP servers › Add server, paste the object, press ⌘Enter (Ctrl+Enter on Windows and Linux), then Restart on the new row.
• Terminal UI: /mcp add, paste the object. It connects right away.
• By hand: add the object to mcp.servers in ~/.atomic-agent/config.json and restart the agent.

Documentation only, no credentials

If you only want AWS documentation search, the awslabs AWS Documentation MCP Server needs no AWS account:

{
  "name": "aws-docs",
  "trust": "pure_read",
  "transport": {
    "kind": "stdio",
    "command": "uvx",
    "args": ["awslabs.aws-documentation-mcp-server@latest"]
  },
  "env": { "FASTMCP_LOG_LEVEL": "ERROR" }
}

Its tools only read public documentation, so pure_read is reasonable here. Note the server name cannot contain dots, so it is aws-docs, not the package name.

What to ask the agent

Tools arrive as mcp.aws.<tool> (AWS names them like aws___search_documentation). Some prompts that work well:

• “Which S3 bucket naming rules would My_Bucket.prod break? Cite the AWS docs.”
• “List my Lambda functions in us-west-2 with their runtimes and flag any on a deprecated runtime.”
• “Read the CloudFormation template in infra/ and check each resource against the current AWS docs for deprecated properties.”
• “Show the last 50 CloudWatch log lines for the orders-api log group and summarize the errors.”

Credentials and approvals

• No token in config.json. The proxy signs requests with credentials from your AWS CLI setup (~/.aws, aws login, SSO). Nothing secret goes into Atomic Agent’s config for this server.
• Read-only tools run without a prompt. The proxy marks tools that do not need write permissions with readOnlyHint, and Atomic Agent runs those without asking. Every other tool asks first. With --read-only, write tools are not offered at all. At approval level 5 (full trust) nothing asks.
• Scope the credentials, not just the agent. Use a profile whose IAM role only allows what you want the agent to do. That limit holds even if you approve something by mistake.
• Stdio servers see your whole environment. The proxy inherits every variable the agent holds, including keys in ~/.atomic-agent/.env.
• OAuth is not an option here. AWS also offers an OAuth path for the AWS MCP Server. Atomic Agent does not run the MCP OAuth flow, so use the SigV4 proxy shown above.

Troubleshooting

connect timeout after 15000ms. The proxy was still downloading. Run the uvx command once in a terminal (step 3 above), then press Restart.

spawn uvx ENOENT. uv is not on the agent’s PATH. The desktop app on macOS (launched from Finder or the Dock) does not inherit your shell’s PATH; use the full path from which uvx.

ExpiredToken or credential errors. aws login sessions rotate and expire. Sign in again, then press Restart on the row.

Tool calls time out. Atomic Agent gives each tool call 60 seconds. Ask for narrower queries (one region, one service, a time window).

Lists look cut off. Tool results reach the model capped at about 8,000 characters. Ask for counts or filtered lists.

FAQ

Is this the official AWS MCP server?

Yes. The AWS MCP Server is operated by AWS, and mcp-proxy-for-aws is published by AWS on GitHub and PyPI. The AWS Documentation MCP Server is part of AWS Labs’ open-source MCP servers.

Which credentials does it use?

The standard AWS credential chain: the --profile you pass, otherwise AWS_PROFILE, otherwise your default profile.

Can it work across several AWS accounts?

The proxy accepts several profiles (--profile prod-readonly dev staging) and lets the agent pick one per call. Start with a single read-only profile.

---

Checked on 22 Oct 2026 against Atomic Agent v0.6.10 and Desktop v0.0.4, the AWS MCP Server guide, the mcp-proxy-for-aws README and the AWS Documentation MCP Server docs.