The service list is the point: VPC, subnet, internet gateway, route table, security group and key pair are the parts people usually get wrong by hand, and having them behind the same interface as the instance itself means the whole environment comes up together. These are real create-and-delete calls against your account, so the credentials you hand it define the blast radius — scope the key to what you want changed. Credentials travel in client config headers today; role ARN support is stated as future work.
A TypeScript server over the AWS SDK that turns infrastructure requests into API calls, covering the pieces you need for a working EC2 environment.
- EC2 instances, AMIs, key pairs and instance tags
- Networking: VPC, subnets, internet gateways, route tables and security groups
- RDS databases, create through delete
- S3 buckets and objects
- Two endpoints so either client style works — HTTP streaming at /mcp, SSE at /sse
AWS credentials — an access key ID and secret access key — passed as headers in your MCP client configuration rather than as environment variables. Node.js 18.0.0 or higher with pnpm 10.0.0 for the development path, or Docker Compose for the container. Lambda, API Gateway, IAM and ECS are on the roadmap, not in it yet.
One command plus a key — npx -y aws-mcp, then supply credentials