The tool surface is small and pointed — yesterday's EC2 bill, a day-by-day split by region, service and instance type, and Bedrock usage lifted from your model invocation log group — which is enough to answer most "why did this month jump" questions without opening a dashboard. Running it anywhere but your own machine is the part to plan: SSE mode listens on port 8000 and MCP's JSON-RPC wire format carries no authentication of its own, so the README's own instruction is to terminate HTTPS at nginx with a real certificate before the port is reachable from anywhere.
A community MCP server that puts AWS Cost Explorer and Amazon Bedrock model invocation logs (stored in Amazon CloudWatch) in front of an assistant, so spend questions get answered in conversation instead of in a console. It runs two ways: locally over stdio with the client on the same machine, or on an Amazon EC2 instance over SSE with an nginx reverse proxy in front for HTTPS — the README carries the full nginx site config for that. Built with FastMCP; the repo also ships a Chainlit chatbot and a LangGraph agent client you can point at the server to check it works.
- `get_ec2_spend_last_day()` — EC2 spending for the previous day
- `get_detailed_breakdown_by_day(days=7)` — cost broken out by day, region, service and instance type
- `get_bedrock_daily_usage_stats(days=7, region='us-east-1', log_group_name='BedrockModelInvocationLogGroup')` — per-day model usage by region and user
- `get_bedrock_hourly_usage_stats(days=7, region='us-east-1', log_group_name='BedrockModelInvocationLogGroup')` — the same breakdown down to the hour
- Spend from other AWS accounts: set `CROSS_ACCOUNT_ROLE_NAME` when starting the server, then name an account id in the conversation — it works for every account whose role the server's IAM role can assume
Python 3.12 and AWS credentials. The IAM user or role needs full read-only access to Cost Explorer and to CloudWatch — the README links AWS's own sample policies for both. Bedrock model invocation logging has to be turned on in CloudWatch first, and `BEDROCK_LOG_GROUP_NAME` tells the server which log group to read. `MCP_TRANSPORT` picks `stdio` or `sse`; in `sse` mode the server listens on TCP port 8000, so the EC2 security group needs an ingress rule for it. Installed from the repository with `uv` (package `aws-cost-explorer-mcp`, 0.1.0) or run as a Docker container. MIT licensed.
One command plus a key — uv venv --python 3.12 && source .venv/bin/activate && uv pip install --requirement pyproject.toml, then supply credentials