Name: AWS Sage
Author: arunsanna

LABSCO SUMMARY

Safe by default, and the interesting tools are the ones that read across services.

It starts in READ_ONLY, so the careless configuration is the harmless one, and the denylist stays in force even at the loosest setting — you cannot turn off logging or schedule a KMS key for deletion through it at all. What justifies a unified server rather than a per-service one is discover_resources, map_dependencies and impact_analysis: those questions cross service boundaries by definition, and no single-service server can answer them. Point it at LocalStack while you are learning what it does.

What it is

A FastMCP server for AWS that unifies what is normally split across many service-specific servers into 30 tools. Rather than one tool per API call, it takes a natural-language query, validates it against botocore's own service models, and executes it — which is what makes cross-service questions like "what depends on this security group" answerable at all.

What you get

AWS queried in natural language, with an operation checked for validity before it runs and executed only when it is — aws_query, validate_operation, aws_execute
A three-tier safety system: READ_ONLY by default allowing only list, describe and get; STANDARD adding writes with confirmation; UNRESTRICTED allowing everything except a denylist of 70+ operations that are always blocked, including cloudtrail.delete_trail, kms.schedule_key_deletion and organizations.leave_organization — set_safety_mode
Profiles listed and selected, with SSO supported, and the active account, region and identity reported — list_profiles, select_profile, get_account_info
Resources found across every service by tag or name, rather than one service at a time — discover_resources
The relationships that break things: what a resource depends on, and what would break if you changed or deleted it — map_dependencies, impact_analysis
An automated troubleshooting pass on a failing Lambda, a slow load balancer or a security alert — investigate_incident
Cost work built in: idle EC2, RDS, EBS and Elastic IP resources found, EC2 rightsizing suggested, spend broken down by service or tag, and a deployment's cost projected before you make it — find_idle_resources, get_rightsizing_recommendations, get_cost_breakdown, project_costs
AWS reference material without leaving the session: documentation searched, a built-in knowledge base queried, service best practices and default quotas retrieved — search_docs, get_aws_knowledge, get_best_practices, get_service_limits
LocalStack treated as an environment rather than a special case: switch to it, check it is reachable, and diff resources against production — list_environments, switch_environment, get_environment_info, check_localstack, compare_environments
Multi-account work through STS: assume a role in another account, list configured accounts and switch the active one — assume_role, list_accounts, switch_account
Conversation memory so follow-ups work: recent resources kept in context, and aliases like prod-db defined and listed — get_context, set_alias, list_aliases
Automatic pagination, so a list does not silently stop at the first page

Requirements

AWS credentials already configured on the machine — ~/.aws/credentials or ~/.aws/config; for SSO profiles run aws sso login first. AWS_PROFILE selects the profile and AWS_DEFAULT_REGION the region. Python 3.11+. The published package is aws-sage-mcp (version 1.0.4); the repository installs as aws-sage (version 1.0.0) with pip install . and runs as python -m aws_sage.server. A Docker image mounts ~/.aws read-only for container isolation. AWS_SAGE_SAFETY_MODE defaults to read_only, and AWS_SAGE_LOCALSTACK_ENABLED, AWS_SAGE_LOCALSTACK_HOST and AWS_SAGE_LOCALSTACK_PORT point it at LocalStack.

Setup effort

One command plus credentials — pip install git+https://github.com/arunsanna/aws-sage.git, then supply credentials

See installation options

USE CASES

01

Finding out what breaks before you delete something

Ask for the impact of removing the security group or IAM role, and read what depends on it rather than discovering it in production.

impact_analysismap_dependencies

02

Finding everything belonging to one project

Search by tag across every service at once, instead of opening each console page and filtering separately.

discover_resources

03

Cutting the AWS bill

Find idle EC2, RDS, EBS and Elastic IP resources, get rightsizing suggestions, and read the spend breakdown by service to see where the money actually goes.

find_idle_resourcesget_rightsizing_recommendationsget_cost_breakdown

04

Debugging a failing function

Run the incident investigation workflow rather than checking logs, metrics and configuration by hand in three consoles.

investigate_incident

05

Costing a change before you make it

Project the monthly cost of the instances and storage you are about to create, and decide with a number in front of you.

project_costs

06

Working across accounts

Assume a role in the other account, switch the active context, and run the same queries without editing your AWS config.

assume_roleswitch_accountget_account_info

30 tools

Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.

`assume_role`

Assume an IAM role in another AWS account for cross-account access

BEFORE YOU INSTALL

What to know first

Tools you get

30 tools when we connected.

Requires

Python 3.11+

CONTEXT COST

Light Standing cost

Rated by the size of the 30 tool definitions that ride along on every turn, not by how many there are

INSTALLATION

Connect your client

Server setup

Setup

TERMINAL

# 1. Clone and install
git clone https://github.com/arunsanna/aws-sage
cd aws-sage
pip install .

pip

TERMINAL

pip install git+https://github.com/arunsanna/aws-sage.git

MCP Clients

Claude Desktop

CLAUDE DESKTOP · JSON

{
  "mcpServers": {
    "aws-sage": {
      "command": "<YOUR_PATH_TO_PYTHON3>",
      "args": [
        "-m",
        "aws_sage.server"
      ],
      "env": {
        "AWS_PROFILE": "default"
      }
    }
  }
}

Claude Code, Cursor, Windsurf

JSON

{
  "mcpServers": {
    "aws-sage": {
      "command": "python",
      "args": [
        "-m",
        "aws_sage.server"
      ],
      "env": {
        "AWS_PROFILE": "default"
      }
    }
  }
}

Cline

CLINE · JSON

{
  "mcpServers": {
    "aws-sage": {
      "command": "python",
      "args": [
        "-m",
        "aws_sage.server"
      ],
      "env": {
        "AWS_PROFILE": "default"
      },
      "disabled": false
    }
  }
}

Zed

ZED · JSON

{
  "context_servers": {
    "aws-sage": {
      "command": "python",
      "args": [
        "-m",
        "aws_sage.server"
      ],
      "env": {
        "AWS_PROFILE": "default"
      }
    }
  }
}

VS Code

VS CODE · JSON

{
  "servers": {
    "aws-sage": {
      "command": "python",
      "args": [
        "-m",
        "aws_sage.server"
      ],
      "env": {
        "AWS_PROFILE": "default"
      }
    }
  }
}

Any MCP client — Docker

Clone the repository and build the image

ANY MCP CLIENT — DOCKER · TERMINAL

git clone https://github.com/arunsanna/aws-sage
cd aws-sage
docker compose build aws-sage

Add this server entry to your client

The build tags the image aws-sage:latest. On Windows, mount %USERPROFILE%\.aws instead of ${HOME}/.aws.

ANY MCP CLIENT — DOCKER · JSON

{
  "mcpServers": {
    "aws-sage": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-v",
        "${HOME}/.aws:/home/appuser/.aws:ro",
        "-e",
        "AWS_PROFILE=default",
        "aws-sage:latest"
      ]
    }
  }
}

Values written as ${…} are filled in only by clients that expand variables.

AWS Sage

Safe by default, and the interesting tools are the ones that read across services.

What it is

What you get

Requirements

Setup effort

Finding out what breaks before you delete something

Finding everything belonging to one project

Cutting the AWS bill

Debugging a failing function

Costing a change before you make it

Working across accounts

30 tools

assume_role

aws_execute

aws_query

check_localstack

compare_environments

discover_resources

find_idle_resources

get_account_info

get_aws_knowledge

get_best_practices

get_context

get_cost_breakdown

get_environment_info

get_rightsizing_recommendations

get_service_limits

impact_analysis

investigate_incident

list_accounts

list_aliases

list_environments

list_profiles

map_dependencies

project_costs

search_docs

select_profile

set_alias

set_safety_mode

switch_account

switch_environment

validate_operation

What to know first

Tools you get

Requires

Light Standing cost

Connect your client

Server setup

Setup

pip

MCP Clients

Claude Desktop

Claude Code, Cursor, Windsurf

Cline

Zed

VS Code

Any MCP client — Docker

Same category

AWS MCP by RafalWilinski

Gemini Cloud Assist

AWS MCP Server

AWS S3

`assume_role`

`aws_execute`

`aws_query`

`check_localstack`

`compare_environments`

`discover_resources`

`find_idle_resources`

`get_account_info`

`get_aws_knowledge`

`get_best_practices`

`get_context`

`get_cost_breakdown`

`get_environment_info`

`get_rightsizing_recommendations`

`get_service_limits`

`impact_analysis`

`investigate_incident`

`list_accounts`

`list_aliases`

`list_environments`

`list_profiles`

`map_dependencies`

`project_costs`

`search_docs`

`select_profile`

`set_alias`

`set_safety_mode`

`switch_account`

`switch_environment`

`validate_operation`