# aashari/mcp-server-aws-sso [Health: Active]

**Category:** ☁️ Cloud Platforms  
**Repository:** https://github.com/aashari/mcp-server-aws-sso  
**GitHub Stars:** 15  
**npm Downloads (last month):** 2072  
**Views:** 5  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/aashari-mcp-server-aws-sso

## Description
AWS Single Sign-On (SSO) integration enabling AI systems to securely interact with AWS resources by initiating SSO login, listing accounts/roles, and executing AWS CLI commands using temporary credentials.

## Tools
Capabilities this server exposes over MCP:

- **aws_sso_login** — Initiate AWS SSO device authorization flow to obtain temporary credentials.

This flow works as follows:
1. Generates a unique user verification code and authentication URL
2. Opens a browser to AWS SSO login page (if `launchBrowser: true`)
3. You enter the verification code and complete AWS SSO login
4. Background polling automatically collects and caches the token
5. The cached token is used by other AWS SSO tools

**IMPORTANT FOR AI ASSISTANTS**: When the tool returns authentication instructions:
- ALWAYS check if a browser window opened automatically
- If browser opened: Guide the user to complete authentication
- If no browser opened: Instruct user to manually open the URL and enter code
- Always provide both the verification code and URL as backup

Prerequisites:
- AWS SSO must be configured with a start URL and region
- Browser access is required for authentication
- You must have an AWS SSO account with appropriate permissions

Returns: Authentication status, session details, verification code and URL
- **aws_sso_status** — Check current AWS SSO authentication status.

Verifies if a valid cached token exists and its expiration time. Does NOT perform authentication - only checks status. If no valid token exists, instructs you to run `aws_sso_login`.

Use before calling `aws_sso_ls_accounts` or `aws_sso_exec_command`.

Returns: Authentication status, session details, expiration time, next steps
- **aws_sso_ls_accounts** — List all AWS accounts and roles accessible through AWS SSO.

Provides essential information needed for `aws_sso_exec_command`:
- Fetches all accessible accounts with IDs, names, and emails
- Retrieves all available roles for each account
- Handles pagination internally
- Caches account and role information

Prerequisites:
- MUST first authenticate using `aws_sso_login`
- AWS SSO must be configured with a start URL and region

Returns: Account list with IDs, names, roles, and session status
- **aws_sso_exec_command** — Execute AWS CLI command using temporary credentials from AWS SSO.

Workflow:
1. Verifies valid AWS SSO authentication token
2. Obtains temporary credentials for account and role
3. Executes the AWS CLI command
4. Caches credentials for future use (1 hour)

Prerequisites:
- MUST first authenticate using `aws_sso_login`
- AWS CLI MUST be installed on the system
- AWS SSO must be configured

Required: `accountId`, `roleName`, `command`
Optional: `region`

Returns: Execution context, command output, errors, exit code
- **aws_sso_ec2_exec_command** — Execute shell command on EC2 instance via SSM using AWS SSO credentials.

No SSH access or inbound ports required. Uses SSM's RunShellScript document.

Prerequisites:
- MUST first authenticate using `aws_sso_login`
- EC2 instance MUST have SSM Agent installed
- Instance needs IAM role with AmazonSSMManagedInstanceCore policy
- Your role needs `ssm:SendCommand` and `ssm:GetCommandInvocation` permissions

Required: `instanceId`, `accountId`, `roleName`, `command`
Optional: `region`

Returns: Execution context, command output, errors, troubleshooting guidance

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "mcp-server-aws-sso": {
    "command": "npx",
    "args": ["-y","@aashari/mcp-server-aws-sso"],
    "env": {
      "AWS_SSO_START_URL": "",
      "AWS_SSO_REGION": "",
      "AWS_REGION": ""
    }
  }
}
```

**Requires environment variables:** `AWS_SSO_START_URL`, `AWS_SSO_REGION`, `AWS_REGION` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What aashari/mcp-server-aws-sso MCP server does

The aashari/mcp-server-aws-sso MCP server exposes AWS IAM Identity Center, formerly AWS SSO, through MCP tools. It supports interactive device authorization, account and role discovery, AWS CLI execution, and remote shell execution on EC2 instances through AWS Systems Manager.

Authentication begins with `aws_sso_login`. The tool generates a verification code and URL, optionally opens the URL in a browser, polls for completion, and caches the resulting token. `aws_sso_status` checks whether that cached token remains valid and reports its expiration without starting a new login flow.

After authentication, `aws_sso_ls_accounts` retrieves accessible AWS accounts and roles, handling pagination and caching the results. `aws_sso_exec_command` uses a selected account and role to obtain temporary credentials and run an AWS CLI command. `aws_sso_ec2_exec_command` sends a shell command to an EC2 instance through SSM.

## How it works

The aashari/mcp-server-aws-sso MCP server uses the AWS SSO device authorization flow rather than asking the MCP client for a long-lived AWS secret. The user completes authentication in a browser with the displayed code. Subsequent operations use the cached token, and account-role credentials are cached for future command execution for up to one hour.

AWS CLI commands require an account ID, role name, and command, with an optional region. EC2 commands additionally require an instance ID. The EC2 path uses the SSM `RunShellScript` document, so it does not depend on SSH access or inbound network ports.

The server supports STDIO for local MCP clients and HTTP with Server-Sent Events for server-style deployments. HTTP mode uses port 3000 by default and exposes `/mcp`; the port can be changed with an environment variable.

## Setup and configuration

Configure AWS IAM Identity Center with a start URL, region, identity source, permission sets, and account assignments before using the server. Set `AWS_SSO_START_URL` to the Identity Center start URL and provide the region through `AWS_SSO_REGION` or `AWS_REGION`. `AWS_PROFILE` is optional for AWS CLI compatibility.

The documented MCP client configuration runs the npm package with `npx -y @aashari/mcp-server-aws-sso`. STDIO is the default transport for MCP client integrations. `TRANSPORT_MODE` can select `stdio` or `http`; `PORT` controls the HTTP port, and `DEBUG` enables debug logging.

## Tools and capabilities

- `aws_sso_login`: Starts device authorization and caches the completed session.
- `aws_sso_status`: Reports cached authentication status and expiration.
- `aws_sso_ls_accounts`: Lists accessible accounts, account metadata, and roles.
- `aws_sso_exec_command`: Runs AWS CLI commands with temporary credentials.
- `aws_sso_ec2_exec_command`: Runs shell commands on managed EC2 instances through SSM.

## Limitations and notes

The aashari/mcp-server-aws-sso MCP server requires browser access for authentication and an AWS SSO account with suitable permissions. Users should provide both the verification code and URL to the person completing login, including when the browser does not open automatically.

AWS CLI must be installed for `aws_sso_exec_command`. EC2 targets must have the SSM Agent installed and an IAM instance role containing `AmazonSSMManagedInstanceCore`. The caller needs `ssm:SendCommand` and `ssm:GetCommandInvocation` permissions. Authentication must happen before account listing or either command-execution workflow.

_Full upstream README: https://allmcps.com/mcp/aashari-mcp-server-aws-sso/readme_