Read-only, opinionated MCP server for safely investigating AWS resources.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"aws-safe-mcp","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# aws-safe-mcp [](https://github.com/harryhazza77/aws-safe-mcp/actions/workflows/ci.yml) [](https://pypi.org/project/aws-safe-mcp/) [](https://pypi.org/project/aws-safe-mcp/) [Changelog](CHANGELOG.md) · [Quickstart](docs/quickstart.md) · [Troubleshooting](docs/troubleshooting.md) Safe, read-only AWS investigation tools for AI coding agents. `aws-safe-mcp` is a local, read-only MCP server for investigating AWS resources without exposing a raw AWS SDK escape hatch. It gives AI clients structured, bounded tools for debugging serverless workloads while preserving IAM as the authorization boundary. **Status:** alpha. The server is intentionally read-only in v1, and tool outputs are designed for investigation rather than complete AWS inventory export. Use it to: - Trace serverless dependencies across Lambda, EventBridge, Step Functions, and API Gateway. - Trace Lambda VPC egress paths to understand inferred internet and private network reachability. - Inspect recent failure signals without exposing secrets or raw payloads. - Check permission paths with IAM simulation when available. - Give AI clients useful AWS context without handing them a raw SDK shell. ## Install In An AI Client Use the published package with any MCP client that supports stdio: Create `~/.config/aws-safe-mcp/config.yaml` first (see [Quickstart](docs/quickstart.md)) — `uvx` will fail without it. ```bash uvx aws-safe-mcp \ --profile dev \ --region eu-west-2 \ --readonly \ --config ~/.config/aws-safe-mcp/config.yaml ``` Client-specific setup: - [Claude Code](docs/claude-code.md) - [Claude Desktop](docs/claude-desktop.md) - [Cursor](docs/cursor.md) - [Provider-neutral notes](docs/ai-clients.md) ```mermaid flowchart LR Client["AI client"] --> MCP["aws-safe-mcp"] MCP --…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.