AWS Agent Toolkit
Tools, knowledge, and guardrails to help AI coding agents build on AWS.
Evidence shows: workflows default to no permissions, least privilege in CI; MCP server provides IAM condition keys to distinguish agent vs human actions, but user confirmation mechanism not explicit; data flow transparency via CloudTrail and CloudWatch mentioned, but implementation details insufficient; sensitive data handling not detailed; dependency security via version pinning and supply chain advice, but no full dependency list; external effects like script execution sandboxed, but user confirmation not explicit; rollback not mentioned; source attribution clear as AWS official. Deductions: user confirmation and sensitive data handling evidence thin, rollback absent.
Evidence shows: repository structure consistent, plugin and skill naming clear; dependency availability via PyPI and GitHub Actions, but no full dependency list; failure messages in tests, e.g., invalid input returns clear error. Deductions: dependency availability not fully verified, failure messages only partial.
Evidence shows: targets multiple coding agents (Claude Code, Codex, Cursor, Kiro), broad scenarios; capability boundaries via plugin and skill division; trigger precision via on-demand skill loading; environment fit supports multiple installation methods. Deductions: some scenarios like Kiro require extra config, but documented.
Evidence shows: information architecture clear, README and docs links complete; install notes detailed, including CLI and plugin install; naming stable, plugin and skill names consistent; examples and FAQ via README and user guide; known limitations mention AWS Labs transition, but not exhaustive; license Apache-2.0 with full LICENSE file; versioning via GitHub Actions and version pinning, but no CHANGELOG; maintenance responsibility clear as AWS official. Deductions: known limitations and versioning changelog insufficient.
Evidence shows: output usability via skills and MCP server providing structured output; marginal value via official tools and skills reducing duplication; cost benefit via free open source and reduced development time. Deductions: no specific performance or cost data.
Evidence shows: claims traceable, README and docs link to official docs; cross-source corroboration limited, mainly single repo; fact vs inference separation, README distinguishes facts and recommendations. Deductions: cross-source corroboration insufficient.
- User confirmation mechanism not explicit, agents may perform high-risk actions without explicit consent.
- Sensitive data handling details insufficient, need to review how MCP server handles credentials and user data.
- Rollback mechanism absent, operations may not auto-recover after failure.
- Dependency list incomplete, need to check security of all dependencies.
What does this agent do, and when should you use it?
The Agent Toolkit for AWS is an official, AWS-supported collection of MCP servers, skills, and plugins that enables AI coding agents (such as Claude Code, Codex, Cursor, and Kiro) to work effectively with AWS services. It includes four core components: the AWS MCP Server provides full AWS API access, sandboxed script execution, and real-time documentation search; skills cover core AWS development, AI agent building, data analytics, and DevSecOps scenarios; plugins bundle the MCP server and skills for one-click installation; and rules files offer project-level guidance. The toolkit is GA (generally available) and licensed under Apache-2.0. It differentiates from earlier AWS Labs tools by offering enterprise controls like IAM condition keys, CloudWatch metrics, and CloudTrail audit logging.
The toolkit leverages the AWS MCP Server (hosted at https://aws-mcp.us-east-1.api.aws/mcp) to give agents access to 300+ AWS services, sandboxed script execution, and real-time documentation search. Agents are configured via CLI (aws configure agent-toolkit) or plugin installation (e.g., /plugin install aws-core@claude-plugins-official). Skills are installed with npx skills add aws/agent-toolkit-for-aws/skills and are discovered on demand. Plugins bundle the MCP server configuration and skills, supporting marketplaces for Claude Code, Codex, and Cursor. For Kiro, users manually configure the MCP server JSON and install skills. Rules files in rules/ provide project-level configuration guiding agents to use the MCP server, discover skills, and search documentation. The execution model: agents call AWS APIs via MCP tools, run Python scripts in a sandbox, and retrieve relevant docs, ultimately producing deployment, configuration, or analysis results.
- A developer using Claude Code installs
aws-coreplugin to get core AWS skills for service selection, CDK/CloudFormation, and deployment. - An AI agent builder uses the
aws-agentsplugin to learn how to build AI agents on Amazon Bedrock and AgentCore. - A data analyst uses the
aws-data-analyticsplugin to handle data lake, analytics, and ETL workflows with S3 Tables, AWS Glue, and Athena. - A security engineer uses
aws-agents-for-devsecopsto investigate incidents, review code, execute UAT, scan for vulnerabilities, and run penetration tests. - A Cursor user adds the repository as a team marketplace and installs the
aws-coreplugin to get AWS capabilities in their IDE.
What are this agent's strengths and limitations?
- Officially supported by AWS, with enterprise-grade security controls (IAM condition keys, CloudWatch metrics, CloudTrail audit logging).
- Plugins support multiple mainstream coding agents (Claude Code, Codex, Cursor, Kiro) out of the box.
- Skills are thoroughly evaluated end-to-end, providing reliable workflow guidance across a wide range of AWS services.
- Core functionality depends on AWS cloud services and is not portable to other cloud providers.
- Only supports AWS services; no benefit for non-AWS workloads.
- Requires an AWS account, local AWS credentials, and dependencies like uv and npx.
How do you install or deploy this agent?
Installation varies by agent:
- AWS CLI: Run aws configure agent-toolkit.
- Claude Code: Use /plugin install aws-core@claude-plugins-official (or aws-agents, aws-data-analytics, aws-agents-for-devsecops). If "Plugin not found", run /plugin marketplace update claude-plugins-official first.
- Codex: Run codex plugin marketplace add aws/agent-toolkit-for-aws, then in Codex run /plugins to install aws-core.
- Cursor: Add the repository as a team marketplace from Settings → Plugins → Team Marketplaces → Add Marketplace → Import from Repo, then install aws-core from the Plugins panel.
- Kiro: Edit .kiro/settings/mcp.json to add the AWS MCP Server (use uvx [email protected]), then run npx skills add aws/agent-toolkit-for-aws/skills.
- Other agents: Configure the AWS MCP Server and run npx skills add aws/agent-toolkit-for-aws/skills.
How do you use this agent?
After configuration, agents can call AWS APIs via the MCP server. For example, in Claude Code, after installing the plugin, the agent automatically discovers skills and invokes relevant ones based on the task. Browse the skills/ directory to see all available skills. For DevSecOps, run /aws-agents-for-devsecops:setup to set up. When using the AWS CLI, aws configure agent-toolkit sets up the configuration. Ensure local AWS credentials are configured (via AWS CLI or environment variables).
How does this agent compare with similar options?
Compared to AWS Labs' MCP servers and skills, the Agent Toolkit offers better enterprise controls and evaluated skills, and is the recommended successor by AWS.