LabscoMCP early access ↗
aarora79MCP SERVER

AWS Cost Explorer & Bedrock Logs

Ask what AWS cost you yesterday and which Bedrock models burned it — Cost Explorer and CloudWatch model invocation logs behind four read tools.

by aarora79 ↗Cloud Resources & Infrastructure as CodeCommunity

LABSCO SUMMARY

Four read-only cost tools; the remote deployment is your job.

The tool surface is small and pointed — yesterday's EC2 bill, a day-by-day split by region, service and instance type, and Bedrock usage lifted from your model invocation log group — which is enough to answer most "why did this month jump" questions without opening a dashboard. Running it anywhere but your own machine is the part to plan: SSE mode listens on port 8000 and MCP's JSON-RPC wire format carries no authentication of its own, so the README's own instruction is to terminate HTTPS at nginx with a real certificate before the port is reachable from anywhere.

What it is

A community MCP server that puts AWS Cost Explorer and Amazon Bedrock model invocation logs (stored in Amazon CloudWatch) in front of an assistant, so spend questions get answered in conversation instead of in a console. It runs two ways: locally over stdio with the client on the same machine, or on an Amazon EC2 instance over SSE with an nginx reverse proxy in front for HTTPS — the README carries the full nginx site config for that. Built with FastMCP; the repo also ships a Chainlit chatbot and a LangGraph agent client you can point at the server to check it works.

What you get

  • get_ec2_spend_last_day() — EC2 spending for the previous day
  • get_detailed_breakdown_by_day(days=7) — cost broken out by day, region, service and instance type
  • get_bedrock_daily_usage_stats(days=7, region='us-east-1', log_group_name='BedrockModelInvocationLogGroup') — per-day model usage by region and user
  • get_bedrock_hourly_usage_stats(days=7, region='us-east-1', log_group_name='BedrockModelInvocationLogGroup') — the same breakdown down to the hour
  • Spend from other AWS accounts: set CROSS_ACCOUNT_ROLE_NAME when starting the server, then name an account id in the conversation — it works for every account whose role the server's IAM role can assume

Requirements

Python 3.12 and AWS credentials. The IAM user or role needs full read-only access to Cost Explorer and to CloudWatch — the README links AWS's own sample policies for both. Bedrock model invocation logging has to be turned on in CloudWatch first, and BEDROCK_LOG_GROUP_NAME tells the server which log group to read. MCP_TRANSPORT picks stdio or sse; in sse mode the server listens on TCP port 8000, so the EC2 security group needs an ingress rule for it. Installed from the repository with uv (package aws-cost-explorer-mcp, 0.1.0) or run as a Docker container. MIT licensed.

Setup effort

One command plus a key — uv venv --python 3.12 && source .venv/bin/activate && uv pip install --requirement pyproject.toml, then supply credentials

See installation options