Log inSubmit server
MCP Server Aws Sso logo

MCP Server Aws Sso

by aashari

Use AWS IAM Identity Center credentials to discover accounts, run AWS CLI commands, and execute shell commands on EC2 through SSM.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install MCP Server Aws Sso

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "aashari-mcp-server-aws-sso": {
      "command": "npx",
      "args": [
        "-y",
        "@aashari/mcp-server-aws-sso"
      ],
      "env": {
        "AWS_SSO_START_URL": "YOUR_VALUE_HERE",
        "AWS_SSO_REGION": "YOUR_VALUE_HERE",
        "AWS_REGION": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

Automated check passed— started and listed 5 tools correctly (1mo ago).

Overview

The aashari/mcp-server-aws-sso MCP server connects MCP clients to AWS IAM Identity Center for temporary, role-based access to AWS accounts. It provides tools to authenticate through the AWS SSO device flow, inspect login status, list accessible accounts and roles, and run AWS CLI commands. A separate tool executes shell commands on EC2 through AWS Systems Manager without requiring SSH or inbound ports. Reach for it when an AI assistant needs controlled access to multi-account AWS environments and the host has AWS CLI, browser access, and the required IAM permissions.

Use cases

  • Authenticate to AWS IAM Identity Center from an MCP client
  • List accessible AWS accounts and permission-set roles
  • Run AWS CLI commands with temporary role credentials
  • Execute diagnostic shell commands on EC2 through SSM

Key features

  • AWS SSO device authorization and token caching
  • Account and role discovery with pagination
  • Temporary-credential AWS CLI execution
  • EC2 shell execution through AWS Systems Manager
  • STDIO and HTTP/SSE transport modes

Tools5

What MCP Server Aws Sso lets your agent do. Expand a tool for its parameters.

Verified live~1.7k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

6/6 checks healthy over the last 79d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 7d ago via OSV.dev · @aashari/mcp-server-aws-sso (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars15Stargazers on the source repository.
npm downloads2kPackage downloads in the last 30 days.
Last commit7mo agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed5Callable tools this server registers over MCP.
Directory activity7 viewsConfig copies, upvotes, and views on AllMCPs.

How MCP Server Aws Sso works

What aashari/mcp-server-aws-sso MCP server does

The aashari/mcp-server-aws-sso MCP server exposes AWS IAM Identity Center, formerly AWS SSO, through MCP tools. It supports interactive device authorization, account and role discovery, AWS CLI execution, and remote shell execution on EC2 instances through AWS Systems Manager.

Authentication begins with aws_sso_login. The tool generates a verification code and URL, optionally opens the URL in a browser, polls for completion, and caches the resulting token. aws_sso_status checks whether that cached token remains valid and reports its expiration without starting a new login flow.

After authentication, aws_sso_ls_accounts retrieves accessible AWS accounts and roles, handling pagination and caching the results. aws_sso_exec_command uses a selected account and role to obtain temporary credentials and run an AWS CLI command. aws_sso_ec2_exec_command sends a shell command to an EC2 instance through SSM.

How it works

The aashari/mcp-server-aws-sso MCP server uses the AWS SSO device authorization flow rather than asking the MCP client for a long-lived AWS secret. The user completes authentication in a browser with the displayed code. Subsequent operations use the cached token, and account-role credentials are cached for future command execution for up to one hour.

AWS CLI commands require an account ID, role name, and command, with an optional region. EC2 commands additionally require an instance ID. The EC2 path uses the SSM RunShellScript document, so it does not depend on SSH access or inbound network ports.

The server supports STDIO for local MCP clients and HTTP with Server-Sent Events for server-style deployments. HTTP mode uses port 3000 by default and exposes /mcp; the port can be changed with an environment variable.

Setup and configuration

Configure AWS IAM Identity Center with a start URL, region, identity source, permission sets, and account assignments before using the server. Set AWS_SSO_START_URL to the Identity Center start URL and provide the region through AWS_SSO_REGION or AWS_REGION. AWS_PROFILE is optional for AWS CLI compatibility.

The documented MCP client configuration runs the npm package with npx -y @aashari/mcp-server-aws-sso. STDIO is the default transport for MCP client integrations. TRANSPORT_MODE can select stdio or http; PORT controls the HTTP port, and DEBUG enables debug logging.

Tools and capabilities

  • aws_sso_login: Starts device authorization and caches the completed session.
  • aws_sso_status: Reports cached authentication status and expiration.
  • aws_sso_ls_accounts: Lists accessible accounts, account metadata, and roles.
  • aws_sso_exec_command: Runs AWS CLI commands with temporary credentials.
  • aws_sso_ec2_exec_command: Runs shell commands on managed EC2 instances through SSM.

Limitations and notes

The aashari/mcp-server-aws-sso MCP server requires browser access for authentication and an AWS SSO account with suitable permissions. Users should provide both the verification code and URL to the person completing login, including when the browser does not open automatically.

AWS CLI must be installed for aws_sso_exec_command. EC2 targets must have the SSM Agent installed and an IAM instance role containing AmazonSSMManagedInstanceCore. The caller needs ssm:SendCommand and ssm:GetCommandInvocation permissions. Authentication must happen before account listing or either command-execution workflow.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about MCP Server Aws Sso

Run `npx -y @aashari/mcp-server-aws-sso` or configure that command as the MCP client's STDIO server.

Yes. The README provides a Claude Desktop configuration using `npx` and STDIO transport.

Set `AWS_SSO_START_URL` and provide the AWS SSO region with `AWS_SSO_REGION` or `AWS_REGION`. `TRANSPORT_MODE`, `PORT`, `DEBUG`, and `AWS_PROFILE` are optional.

Yes. Its EC2 tool uses AWS Systems Manager RunShellScript and does not require SSH access or inbound ports, but the instance needs SSM Agent and suitable IAM permissions.

Related MCP servers

All in Cloud Platforms All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewMCP Server Aws Sso AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/aashari-mcp-server-aws-sso?style=directory)](https://allmcps.com/mcp/aashari-mcp-server-aws-sso)
HTML Embed
<a href="https://allmcps.com/mcp/aashari-mcp-server-aws-sso"><img src="https://allmcps.com/api/badge/aashari-mcp-server-aws-sso?style=directory" alt="MCP Server Aws Sso on AllMCPs" /></a>