The two tools cover the loop that matters during an incident: find the group, then pull the window around the failure with a filter applied - written as 1h rather than as a pair of timestamps.
An MCP server over AWS CloudWatch Logs with two tools: list the log groups in an account, and read events out of one. Reads take a stream name, a filter pattern and a time window expressed either as an ISO timestamp or as a relative string like 5m, 1h or 1d.
- Log groups listed, narrowed by name prefix, with creation time and stored size
- Log events from a group, filtered by pattern and bounded by a time window
- Relative time windows - 5m, 1h, 1d - instead of computed timestamps
- Credentials and region passed per call, when the default identity is not the one you need
AWS credentials the server can find - either in the environment, or a profile configured through the AWS CLI - and read permission on the log groups you care about. Both tools also accept credentials and a region as arguments, which is how you reach a second account without restarting the server.
One command plus a key — docker run -i --rm -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY mcp/cloudwatch-logs, then supply credentials