{
"markdown": "\n\n# ๐ aws-mcp-connector\n\n**Talk to AWS CLI from an MCP-speaking agent.**\n\n[](https://github.com/FerhatDundar/aws-mcp-connector/actions/workflows/ci.yml)\n[](https://github.com/FerhatDundar/aws-mcp-connector/actions/workflows/codeql.yml)\n[](https://github.com/FerhatDundar/aws-mcp-connector/releases/latest)\n[](https://registry.modelcontextprotocol.io/?q=aws-mcp-connector)\n[](https://go.dev/)\n[](LICENSE)\n[](https://modelcontextprotocol.io/)\n[](https://www.conventionalcommits.org/)\n[](CONTRIBUTING.md)\n\n
\n\n---\n\nA single static Go binary that speaks the [Model Context Protocol](https://modelcontextprotocol.io/)\nand lets an agent run AWS CLI commands: any `aws `\ninvocation, across every service the CLI supports, with a read-only-by-default\nsafety gate on anything that mutates state.\n\nNo Python, no `uv`, no runtime dependency to install โ just a binary and\nan `.mcp.json`. It shells out to the `aws` binary already installed and\nconfigured on the host (profile, SSO, IAM role, or static keys โ whatever\nthe AWS CLI's own credential chain resolves) instead of reimplementing the\nAWS SDK, so it gets the full breadth of the CLI for free rather than a\nhand-curated subset of services.\n\n## โจ Why this exists\n\n> An agent that only has a narrow, hand-picked set of AWS tools hits a wall\n> the moment you need something outside that set. This connector instead\n> wraps the AWS CLI itself, so an agent can run `aws s3 ls`, `aws ec2\n> describe-instances`, `aws iam list-users` โ anything the CLI can do โ\n> without waiting on a new tool to be written for it. Mutating commands are\n> blocked by default and require both a server-level opt-in and a per-call\n> `confirm=true`, so exploring/debugging is safe out of the box.\n\n## ๐งฐ Tools\n\n| Tool | What it does | Write? |\n|---|---|:---:|\n| `aws_exec` | Run any `aws ...` command. Read-only by default โ mutating commands need `AWS_MCP_ALLOW_WRITE=true` on the server *and* `confirm=true` on the call. | โ
(gated) |\n| `aws_help` | Show `aws [subcommand] help` text โ always safe, use it to check exact syntax before calling `aws_exec`. | |\n| `aws_whoami` | Show the AWS identity (account, ARN, user/role) the configured credentials resolve to. | |\n| `aws_list_profiles` | List named profiles configured in `~/.aws/config` on the host. | |\n\nEvery tool accepts an optional `response_format`: `markdown` (default,\npretty tables for a chat UI) or `json` (for programmatic use).\n\n## ๐ Quickstart\n\n**Fastest path:** grab a prebuilt bundle from the [latest release](https://github.com/FerhatDundar/aws-mcp-connector/releases/latest) โ\ndownload `aws-mcp-connector-plugin---.zip`, unzip it,\nand point Cowork/Claude at the `plugin/` folder inside (see step 4 of\n[SETUP.md](SETUP.md)). No Go toolchain required.\n\n**From source:**\n\n```bash\n# 1. Build\ncd go-server\ngo mod tidy\ngo build -o aws-connector-server .\ncp aws-connector-server ../plugin/servers/go/\n\n# 2. Set up auth โ needs the aws CLI itself installed and configured\n# (aws configure / aws sso login) โ see SETUP.md\nexport AWS_PROFILE=default # optional, only if not using \"default\"\n\n# 3. Run\n./go-server/aws-connector-server # serves MCP over stdio\n```\n\nOr `make build` โ see the [Makefile](Makefile) for every shortcut\n(`test`, `vet`, `fmt`, `lint`, `tidy`).\n\nFull walkthrough โ including wiring this up as a Claude/Cowork plugin โ is\nin **[SETUP.md](SETUP.md)**.\n\n## ๐ Configuration\n\nEverything is environment variables, passed through by the plugin's\n`.mcp.json`:\n\n| Variable | Purpose | Default |\n|---|---|---|\n| `AWS_PROFILE` | Named profile from `~/.aws/config` to use. | unset (default profile) |\n| `AWS_REGION` | Default region if not set elsewhere. | AWS CLI's own default |\n| `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN` | Static credentials โ only needed if not using a profile/SSO/role. | unset |\n| `AWS_MCP_ALLOW_WRITE` | `\"true\"` to permit mutating commands at all (still needs `confirm=true` per call). | `false` (read-only) |\n| `AWS_MCP_ALLOWED_SERVICES` | Comma-separated allowlist of AWS CLI service names, e.g. `\"s3,ec2\"`. | unset (unrestricted) |\n| `AWS_MCP_CLI_PATH` | Path to the `aws` binary. | `aws` resolved via `PATH` |\n\n## ๐งช Quality bar\n\nThis isn't a toy script โ it's got the same checks you'd expect from a\nproduction Go service:\n\n- โ
**Unit tests** for every input-validation path (`go test ./...`)\n- โ
**`go vet`** + **`gofmt`** clean\n- โ
**[golangci-lint](https://golangci-lint.run/)** (govet, staticcheck, errcheck, gosec, and more)\n- โ
**[govulncheck](https://go.dev/blog/vuln)** โ no known vulnerabilities in the dependency graph\n- โ
**[CodeQL](https://codeql.github.com/)** static security analysis on every push\n- โ
**End-to-end verified** against a real (or sandboxed) AWS CLI backend โ not mocks\n- โ
**[Dependabot](.github/dependabot.yml)** keeps Go modules and Actions current\n\nAll of it runs in [CI](.github/workflows/ci.yml) on every push and PR.\n\n## ๐ท๏ธ Releases & versioning\n\nVersions follow [semver](https://semver.org/) and are cut automatically by\n[release-please](https://github.com/googleapis/release-please) from\n[Conventional Commits](https://www.conventionalcommits.org/) on `main`:\n\n- `fix: ...` โ patch (`v0.1.0` โ `v0.1.1`)\n- `feat: ...` โ minor (`v0.1.1` โ `v0.2.0`)\n- `feat!: ...` / `BREAKING CHANGE:` footer โ major (`v0.2.0` โ `v1.0.0`)\n\nEvery merged PR updates a standing **\"chore(main): release vX.Y.Z\"** PR\nwith an auto-generated [CHANGELOG.md](CHANGELOG.md). Merging that PR:\n\n1. tags the release and publishes it on GitHub\n2. builds and attaches zipped, ready-to-install plugin bundles for\n linux/darwin/windows ร amd64/arm64\n3. regenerates `server.json` from those exact assets (fresh version +\n SHA-256 hashes) and publishes it to the\n [official MCP Registry](https://registry.modelcontextprotocol.io/) via\n `mcp-publisher`, authenticated with GitHub OIDC โ no stored secrets\n\nSee [.github/workflows/release-please.yml](.github/workflows/release-please.yml)\nand [.github/workflows/publish-mcp-registry.yml](.github/workflows/publish-mcp-registry.yml)\n(also runnable by hand for an existing tag via `workflow_dispatch`).\n\n## ๐ Layout\n\n```\naws-mcp-connector/\nโโโ README.md โ you are here\nโโโ SETUP.md โ step-by-step setup guide\nโโโ CONTRIBUTING.md โ how to contribute\nโโโ CODE_OF_CONDUCT.md\nโโโ SECURITY.md โ vulnerability reporting\nโโโ CODEOWNERS\nโโโ LICENSE โ MIT\nโโโ Makefile โ build / test / lint shortcuts\nโโโ .golangci.yml โ lint rules\nโโโ release-please-config.json โ semver/changelog automation config\nโโโ .release-please-manifest.json\nโโโ server.json โ MCP Registry manifest (regenerated fresh per release by CI)\nโโโ scripts/\nโ โโโ render-server-json.sh โ rebuilds server.json from a release's zip assets\nโโโ .github/\nโ โโโ workflows/\nโ โ โโโ ci.yml โ build, vet, test, lint, govulncheck\nโ โ โโโ codeql.yml โ security scanning\nโ โ โโโ pr-title.yml โ Conventional Commits PR title check\nโ โ โโโ release-please.yml โ version PRs, tagging, GitHub releases\nโ โ โโโ publish-mcp-registry.yml โ publishes server.json to the MCP Registry\nโ โ โโโ rebuild-release-assets.yml โ manual re-attach fallback\nโ โโโ ISSUE_TEMPLATE/\nโ โโโ PULL_REQUEST_TEMPLATE.md\nโ โโโ dependabot.yml\nโโโ go-server/ โ the MCP server source\nโ โโโ main.go\nโ โโโ main_test.go\nโ โโโ go.mod / go.sum\nโ โโโ README.md\nโโโ plugin/ โ installable Cowork/Claude plugin\n โโโ .claude-plugin/plugin.json\n โโโ .mcp.json โ holds credentials locally โ never commit real ones\n โโโ servers/go/ โ compiled binary goes here\n```\n\n## ๐ค Contributing\n\nPRs and issues are very welcome โ see **[CONTRIBUTING.md](CONTRIBUTING.md)**\nfor the full guide (setup, coding conventions, how to add a new tool) and\nthe **[Code of Conduct](CODE_OF_CONDUCT.md)**.\n\n`main` is protected: every change, including the maintainer's, lands via\npull request with CI green. PR titles must follow\n[Conventional Commits](https://www.conventionalcommits.org/) โ that's what\ndrives the automatic versioning above.\n\nFound a security issue? Please follow **[SECURITY.md](SECURITY.md)**\ninstead of opening a public issue.\n\n## ๐ License\n\n[MIT](LICENSE) ยฉ FerhatDundar\n",
"bytes": 9436,
"sha": "db3f1bbb3b6e112d2eeb15ee9978bacdb14c9cd75ac1f671bfb5ba0f22958cfb",
"repo_slug": "ferhatdundar/aws-mcp-connector",
"fonte": "repo",
"truncated": false,
"api": "https://agentalog.com/api/listings/mcp_io_github_ferhatdundar_aws_mcp_connector_11d7004b/readme"
}