AWS API MCP Server
The AWS API MCP server is the broadest of the AWS Labs servers and the one most teams will reach for first. It exposes the AWS CLI itself as the agent's interface: any command the local CLI can run, the agent can call. This makes it the universal AWS surface area. The trade-off is that the surface area is gigantic and the safety boundary lives in IAM; tool whitelisting effectively sits at the credential layer. With admin-level credentials, this server lets the agent do anything those credentials permit. The fix is the same as for any cloud-shell-with-an-AI: scope the IAM role narrowly, set AWS_API_MCP_PROFILE_NAME to a profile that uses that role, and route destructive operations through a separate confirmation flow. With that discipline in place, this is the server that pays for itself in week one.