Aws Sso MCP Server

Aws Sso MCP server is a locally run integration for AI assistants that speak the Model Context Protocol. Node.js/TypeScript MCP server for AWS Single Sign-On (SSO). Enables AI systems (LLMs) with tools to initiate SSO login (device auth flow), list accounts/roles, and.

What you get

Transform how you manage and access your AWS infrastructure by connecting Claude, Cursor AI, and other AI assistants directly to your AWS accounts through AWS IAM Identity Center (formerly AWS SSO). Get instant access to your cloud resources, execute commands, and manage EC2 instances using natural language.

TOON (Token-Oriented Object Notation) is an output format optimized for Large Language Models: - More compact than JSON (saves tokens when sending data to AI) - Still human-readable - Automatically used when available, falls back to JSON if needed - Learn more: @toon-format/toon

What the assistant can call

Once Aws Sso is connected, these are the calls the assistant has available:

• Parameters — launchBrowser (optional, boolean, default: true)
• Required — accountId, roleName, command
• Optional — region
• login — Authenticates via AWS SSO (--no-launch-browser). Ex: mcp-aws-sso login
• status — Checks authentication status (no options). Ex: mcp-aws-sso status
• ls-accounts — Lists accounts/roles (no options). Ex: mcp-aws-sso ls-accounts
• exec-command — Runs AWS CLI command (--account-id, --role-name, --command, --region). Ex: mcp-aws-sso exec-command --account-id 123456789012 --role-name ReadOnly
• ec2-exec-command — Runs shell command on EC2 (--instance-id, --account-id, --role-name, --command, --region). Ex: mcp-aws-sso ec2-exec-command --instance-id
• aws_sso_login — The aws_sso_login tool exposed by this server
• aws_sso_status — The aws_sso_status tool exposed by this server
• aws_sso_ls_accounts — The aws_sso_ls_accounts tool exposed by this server
• aws_sso_exec_command — The aws_sso_exec_command tool exposed by this server

Configuration and credentials

You will need 4 environment variables: AWS_SSO_START_URL, AWS_REGION, DEBUG, AWS_SSO_REGION. The server will not start without them, which is usually why the tools fail to appear on a first run. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.

• Node.js: Version 18.0.0 or higher - AWS CLI: Version 2.x (required only for aws_sso_exec_command) - AWS IAM Identity Center: Configured and accessible - Operating System: macOS, Linux, or Windows

Setting it up

@aashari/mcp-server-aws-sso on npm is all you need. Most clients run it directly, so configuration is a few lines and a restart.

Choosing this one

Among the cloud and infrastructure options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. Aws Sso's toolset — Parameters, Required, Optional and 11 more — is a fair guide to whether it matches your workflow. It is maintained by aashari; worth a glance at recent repository activity before you build anything load-bearing on it.

SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.

Before you rely on it

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• With 14 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Aws Sso.
• Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
• MCP clients confirm each tool call by default. Leave that on until you have watched what the aws sso mcp server does with a few real requests.