MCP Server Aws Sso

What aashari/mcp-server-aws-sso MCP server does

The aashari/mcp-server-aws-sso MCP server exposes AWS IAM Identity Center, formerly AWS SSO, through MCP tools. It supports interactive device authorization, account and role discovery, AWS CLI execution, and remote shell execution on EC2 instances through AWS Systems Manager.

Authentication begins with aws_sso_login. The tool generates a verification code and URL, optionally opens the URL in a browser, polls for completion, and caches the resulting token. aws_sso_status checks whether that cached token remains valid and reports its expiration without starting a new login flow.

After authentication, aws_sso_ls_accounts retrieves accessible AWS accounts and roles, handling pagination and caching the results. aws_sso_exec_command uses a selected account and role to obtain temporary credentials and run an AWS CLI command. aws_sso_ec2_exec_command sends a shell command to an EC2 instance through SSM.

How it works

The aashari/mcp-server-aws-sso MCP server uses the AWS SSO device authorization flow rather than asking the MCP client for a long-lived AWS secret. The user completes authentication in a browser with the displayed code. Subsequent operations use the cached token, and account-role credentials are cached for future command execution for up to one hour.

AWS CLI commands require an account ID, role name, and command, with an optional region. EC2 commands additionally require an instance ID. The EC2 path uses the SSM RunShellScript document, so it does not depend on SSH access or inbound network ports.

The server supports STDIO for local MCP clients and HTTP with Server-Sent Events for server-style deployments. HTTP mode uses port 3000 by default and exposes /mcp; the port can be changed with an environment variable.

Setup and configuration

Configure AWS IAM Identity Center with a start URL, region, identity source, permission sets, and account assignments before using the server. Set AWS_SSO_START_URL to the Identity Center start URL and provide the region through AWS_SSO_REGION or AWS_REGION. AWS_PROFILE is optional for AWS CLI compatibility.

The documented MCP client configuration runs the npm package with npx -y @aashari/mcp-server-aws-sso. STDIO is the default transport for MCP client integrations. TRANSPORT_MODE can select stdio or http; PORT controls the HTTP port, and DEBUG enables debug logging.

Tools and capabilities

• aws_sso_login: Starts device authorization and caches the completed session.
• aws_sso_status: Reports cached authentication status and expiration.
• aws_sso_ls_accounts: Lists accessible accounts, account metadata, and roles.
• aws_sso_exec_command: Runs AWS CLI commands with temporary credentials.
• aws_sso_ec2_exec_command: Runs shell commands on managed EC2 instances through SSM.

Limitations and notes

The aashari/mcp-server-aws-sso MCP server requires browser access for authentication and an AWS SSO account with suitable permissions. Users should provide both the verification code and URL to the person completing login, including when the browser does not open automatically.

AWS CLI must be installed for aws_sso_exec_command. EC2 targets must have the SSM Agent installed and an IAM instance role containing AmazonSSMManagedInstanceCore. The caller needs ssm:SendCommand and ssm:GetCommandInvocation permissions. Authentication must happen before account listing or either command-execution workflow.