AWS MCP server
Search AWS documentation, call AWS APIs, and run sandboxed scripts with IAM-scoped access from a single endpoint.
About
Connect Tracecat to AWS to investigate findings across the cloud substrate for SOC and cloud security teams that live in IAM, CloudTrail, and GuardDuty. You can search AWS documentation, call any AWS API, and run sandboxed Python from a single endpoint governed by your existing IAM policies. From there, query CloudTrail for the responsible principal, pull CloudWatch metrics, and run a remediation script with every action captured in CloudTrail under the connected IAM Identity Center user.
Setup
- 1
Sign in with OAuth
You'll authorize Tracecat to access AWS on your behalf. No API keys to manage.
- 2
Select the
AWStile in the Tracecat MCP catalogOpen the
MCP catalogin your workspace, select theAWStile, and complete the OAuth flow. - 3
Enable
AWSin your agentIn your
ai.agentaction orAgents→toolstab, selectAWSfrom theMCP integrationsdropdown.
Tools
search_documentationSearch the official AWS documentation across all services.
get_service_informationRetrieve service overviews, quotas, and regional availability.
call_aws_apiCall any AWS API using the caller's IAM credentials.
run_python_scriptRun Python code in a sandboxed environment with access to AWS SDKs.
list_skillsList curated AWS skills the agent can follow for common workflows.
run_skillExecute a curated AWS skill end to end.
get_cloudwatch_metricsRead CloudWatch metrics for monitoring and incident investigation.
query_cloudtrailSearch CloudTrail for recent API calls for a given principal or resource.