Amazon AWS Documentation MCP Server

AWS Labs's AWS Documentation MCP server allows AI agents to search and retrieve official Amazon Web Services documentation, architecture guides, and API reference manuals. It enables agents to verify cloud architecture patterns, look up AWS SDK methods, inspect service limitations, and generate cloud infrastructure solutions.

Start for free

Benefits with Ory + Amazon AWS Documentation MCP Server

AWS Labs' AWS Documentation MCP server lets your agents search and read official AWS documentation and find related pages, which helps them write accurate infrastructure code. It reads only public documentation and changes nothing in your AWS accounts. Ory Agent Security lets you allow it broadly while recording every tool call with the user and agent behind it.

View documentation

Use Cases

— 01 use case

Agent IAM

Infrastructure planners get Read for AWS docs, agents without AWS work are set to Block, and neither Write nor Admin opens anything more.

Explore Agent IAM

Core Functionality

— 04 capabilities

Read, write, admin, or no access
Ory Agent Security classifies every tool on the AWS Documentation MCP server as read, write, or admin, and because the AWS Documentation MCP server only reads public AWS documentation, the choice for each user, team, or agent type comes down to read for coding and architecture agents or no access for agents that shouldn't make outside requests.
Enforced before execution
Ory Agent Security checks each tool call against the user, the agent acting for them, and any sub-agent inside the agent harness, so a denied lookup stops before it reaches the server, with nothing to roll back and no gateway to deploy.
Observe, then enforce
Observe mode shows which agents rely on AWS documentation while they work without blocking anything, so you can apply Ory's pre-built policy for the AWS Documentation MCP server and enforce it on your own schedule.
Complete audit trail
Every allow and deny decision on the AWS Documentation MCP server streams to your SIEM through OpenTelemetry with the user, agent, and action attached, so you can show what an agent looked up before it changed your infrastructure through another server.