Cloud Tools vs AWS MCP Server
A side-by-side look at the Cloud Tools and AWS MCP Server MCP servers: transport, auth, tools, quality signals, and the config to install either one in Claude, Cursor, Windsurf or VS Code.
Verdict: choose Cloud Tools for cloud platforms work as a local process; choose AWS MCP Server for cloud platforms as a local process. You can also run both side by side in one mcpServers block.
Which MCP server should you choose?
Choose Cloud Tools when
- You need dedicated capabilities in the Cloud Platforms domain.
- You prefer a local stdio subprocess transport.
- Its auth model fits you: other.
- You have the keys it needs:
AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_PROFILE, GOOGLE_APPLICATION_CREDENTIALS, CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID, OVH_APPLICATION_KEY, OVH_CONSUMER_KEY. - You want tools like
compare_costs, get_commitments, get_costs.
Choose AWS MCP Server when
- You need dedicated capabilities in the Cloud Platforms domain.
- You prefer a local stdio subprocess transport.
- You want tools like
aws_whoami, aws_login_start, aws_login_complete.
Feature & specification comparison
Rows where the two servers differ are marked.
| Spec | ||
|---|---|---|
| Category | Cloud Platforms | Cloud Platforms |
| Quality signal | 61/100 · Good | 64/100 · Good |
| Install command | Confirmed | Confirmed |
| Transport | Local subprocess (stdio) | Local subprocess (stdio) |
| Auth | other | Not declared |
| Pricing | Free | Not declared |
| Required env vars | AWS_ACCESS_KEY_IDAWS_SECRET_ACCESS_KEYAWS_PROFILEGOOGLE_APPLICATION_CREDENTIALSCLOUDFLARE_API_TOKENCLOUDFLARE_ACCOUNT_IDOVH_APPLICATION_KEYOVH_CONSUMER_KEY | None listed |
| Verified owner | Community listing | Community listing |
| GitHub stars | 0 | 5 |
| Directory activity | 3 views 0 installs 0 upvotes | 1 views 0 installs 0 upvotes |
| Tools | 7 | 28 |
| Full listing | View Cloud Tools | View AWS MCP Server |
Tools & capabilities
Cloud Tools tools 7
compare_costsThis period against the same day window of the previous month, so a partial month does not read as a fall. AWS and GCP only. GCP needs credentials.gcp.billing_table.get_commitmentsCommitments you are paying for, and whether you are consuming them, over the last 30 days. AWS: Savings Plans utilisation, coverage of eligible spend, and the saving a further commitment would give. GCP: committed use discounts with their expiry. Not implemented for Cloudflare or OVH, which sell no commitments.get_costsCloud spend. AWS: by service over a date range, from Cost Explorer; pass group_by="data_transfer" for transfer cost by usage type. GCP: by service from the BigQuery billing export, which credentials.gcp.billing_table must name — without it you get budget amounts, not spend. Cloudflare: subscriptions and zone plan costs. OVH: the 6 most recent invoices.get_cross_cloud_summaryOne cost and waste report over every cloud you pass credentials for, with a grand total. Omit a cloud's credentials to skip it.get_inventoryWhat exists. GCP: GCE instances, disks, addresses, snapshots, forwarding rules, GKE clusters with node pools, Cloud SQL, Cloud Functions, Cloud Run, GCS buckets, Cloud NAT, Cloud IDS, Artifact Registry, VPN gateways, subnets, PSC endpoints and Cloud Logging ingestion, with a per-project summary. Cloudflare: zones with plan and price, DNS records split proxied against dns-only, certificates with hosts and expiry, and Workers with invocation counts. OVH: instances and active services with renewal dates and monthly cost. Not implemented for AWS.get_recommendationsThe cloud provider's own optimisation suggestions. GCP: the Recommender API across every zone and region — idle VMs, machine type rightsizing, idle disks and addresses, idle and oversized Cloud SQL. Not implemented for the others; AWS Compute Optimizer is read as part of get_waste instead.get_wasteWhat is wasted, with the monthly cost of each finding and the utilisation evidence behind it. AWS: idle and oversized EC2 and RDS measured from CloudWatch CPU series, stopped instances, orphaned volumes and snapshots, unused AMIs and Elastic IPs, idle load balancers and NAT gateways, DynamoDB and ElastiCache, and log groups with no retention. GCP: idle and oversized instances, orphaned disks, unattached addresses, snapshots over 90 days, idle Cloud SQL, GKE clusters with no nodes, Cloud Functions and Cloud Run with no invocations, buckets with no lifecycle rule. Not implemented for Cloudflare or OVH.
AWS MCP Server tools 28
aws_whoamiShow the current AWS identity (account, role ARN, user ID) plus SSO token status and time remaining. Use this first to verify auth before running other AWS operations. Returns a structured fix-it message if SSO is expired.aws_login_startStart an AWS SSO login via the device-code flow (no browser spawned from this process). Returns a verification URL and short code -- surface these to the user so they can open the URL in their own browser and paste the code. After they auth, call aws_login_complete with the returned sessionId to confirm completion.aws_login_completeBlock until the SSO login started by aws_login_start finishes (user completed auth in browser, or subprocess exited with error). Returns the new identity on success, or a structured error.aws_refresh_if_expiring_soonProactive SSO token check. If the cached token has fewer than `thresholdMinutes` left (default 10), this kicks off aws_login_start and returns the verification URL + code in one round-trip. If plenty of time remains, returns `status: 'ok'` with the minutes left. Use at the start of a multi-step AWS workflow to avoid mid-session expiry. `status: 'ok'` is a point-in-time reading of the cache, not a lease: nothing re-checks afterwards, so a token that lapses mid-workflow still surfaces as an sso_expired error from the next aws_call / aws_whoami. Raise `thresholdMinutes` to cover the expected length of the workflow rather than treating 'ok' as a guarantee.aws_session_setSet the default AWS profile and/or region for the rest of this MCP session. Subsequent calls to aws_whoami, aws_login_*, and other AWS tools will use these values unless they override explicitly. Use when the user says 'switch to prod', 'use us-west-2', 'look at the staging account', etc. Both params are optional; pass whichever changed. Returns the resulting session state.aws_session_getShow the current session's default AWS profile and region, and where each value came from ('session' = set by aws_session_set, 'env' = AWS_PROFILE/AWS_REGION env var, 'default' = built-in fallback). Useful for confirming state before running operations or debugging why a call hit the wrong account.aws_session_clearRemove session-set profile and/or region overrides so subsequent calls fall back to env vars / defaults. No args clears both. Pass `profile: true` or `region: true` to clear just one. Use when the user says 'go back to the default profile,' 'unset the region,' or 'reset session.'aws_callRun an arbitrary AWS API operation via the aws CLI. Use kebab-case service and operation names as in `aws help` (service='s3api', operation='list-buckets'). Pass params as a JSON object using the AWS API's PascalCase keys (e.g. {Bucket: 'foo'}); they go through --cli-input-json. Session profile/region (from aws_session_set) are used by default; override per-call when needed. Hand-written CLI commands (aws s3 cp/ls/sync, aws logs tail) and operations that stream their response to an output file (s3api get-object, bedrock-runtime invoke-model, bedrock-agentcore invoke-agent-runtime, lambda invoke) do not accept --cli-input-json and cannot run here -- use aws_lambda_invoke or aws_logs_tail where they exist, bedrock-runtime converse for text inference, otherwise your shell. Waiters work: operation 'wait instance-running'. Blob-typed members of params (KMS Plaintext, Kinesis Data, DynamoDB B) take base64 -- the server runs the CLI with --cli-binary-format base64 whatever your AWS config says. Returns parsed JSON output by default, plus the literal command that was run.aws_list_profilesList AWS profiles configured in ~/.aws/config. Returns profile name, region, and SSO metadata (start URL, region, session name) where set, plus an `isSso` flag. Use when the user hasn't named a profile, when they ask to switch profiles, or when an SSO-expired error mentions a profile you haven't seen.aws_paginateFetch one page of a paginated AWS list/describe operation. Identical to aws_call plus `maxItems` (page size) and `startingToken` (resume cursor). When `query` is supplied it is wrapped server-side as {NextToken, items: <query>} so pagination survives a projection that would otherwise drop NextToken; the handler unwraps `items` before returning. Returns the parsed response, a `nextToken` (null when the list is exhausted), and `hasMore`. Call again with the returned nextToken as startingToken until hasMore is false. Use this instead of aws_call for operations that might exceed the 5 MB stdout cap: list-objects-v2, describe-instances, describe-log-streams, list-roles, etc.aws_assume_roleCall STS AssumeRole and stash the returned temporary credentials as a named profile in the shared credentials file ($AWS_SHARED_CREDENTIALS_FILE when set, otherwise ~/.aws/credentials; the resolved path is returned as credentialsPath). Subsequent calls to aws_call / aws_whoami / aws_paginate can use profile='mcp-<sessionName>' (or your overridden targetProfile name). The raw secret key / session token are NOT returned to the caller — only the profile name, expiration, and assumed identity. Use for cross-account access: a source profile (your SSO identity) assumes a role in another account. Default timeout is 120s (raise via timeoutMs for slow SAML / credential_process setups on cold start).aws_logs_tailFetch the newest CloudWatch Logs events for one log group over the last `since` (default 10m), via FilterLogEvents ('aws logs filter-log-events'). Returns events oldest first as {timestamp (ISO 8601 UTC), logStreamName, message (verbatim)}; any of the three is null on an event that arrived without it, which is kept rather than dropped. At most `maxEvents` come back (default 500, max 10000); when the window held more, the OLDEST are dropped and `truncated` is true. On AWS CLI 2.35.8+ the read goes newest-first and stops once it has enough, so a busy group costs a page or two -- and a truncated result reports `totalEvents: null` because the rest was never read. Older CLIs read the whole window (exact `totalEvents`); narrow `since` or add `filterPattern` if a wide window times out. `logGroupName` takes a bare name or a log-group ARN in the call's region; an ARN is sent as logGroupIdentifier, so a source-account ARN works from a cross-account monitoring account (AWS CLI 2.9.15+). Does not stream: call again for newer events. eventId and ingestionTime are omitted -- use aws_call for them.- +16 more on the listing page
Ready-to-paste client configs
Paste either block (or both) into your client config, e.g. claude_desktop_config.json or ~/.cursor/mcp.json. We only show a config when the install command is confirmed.
Cloud Tools
{
"mcpServers": {
"cloud-tools": {
"command": "npx",
"args": [
"-y",
"@munhq/cloud-tools"
],
"env": {
"AWS_ACCESS_KEY_ID": "YOUR_AWS_ACCESS_KEY_ID_HERE",
"AWS_SECRET_ACCESS_KEY": "YOUR_AWS_SECRET_ACCESS_KEY_HERE",
"AWS_PROFILE": "YOUR_AWS_PROFILE_HERE",
"GOOGLE_APPLICATION_CREDENTIALS": "YOUR_GOOGLE_APPLICATION_CREDENTIALS_HERE",
"CLOUDFLARE_API_TOKEN": "YOUR_CLOUDFLARE_API_TOKEN_HERE",
"CLOUDFLARE_ACCOUNT_ID": "YOUR_CLOUDFLARE_ACCOUNT_ID_HERE",
"OVH_APPLICATION_KEY": "YOUR_OVH_APPLICATION_KEY_HERE",
"OVH_CONSUMER_KEY": "YOUR_OVH_CONSUMER_KEY_HERE"
}
}
}
}
AWS MCP Server
{
"mcpServers": {
"aws-mcp-server-3": {
"command": "npx",
"args": [
"-y",
"@yawlabs/aws-mcp"
]
}
}
}
Frequently asked questions
Cloud Tools is categorized under Cloud Platforms and uses a local stdio subprocess. AWS MCP Server belongs to Cloud Platforms and uses a local stdio subprocess. Pick Cloud Tools for cloud platforms work and AWS MCP Server for cloud platforms.
Copy the mcpServers block from the config section on this page into your client's config (for example claude_desktop_config.json or ~/.cursor/mcp.json), then fully restart the client.
Cloud Tools is listed as free. Auth: other. AWS MCP Server has no declared pricing — check the project's own site. If a server needs environment variables such as API keys, define them under the env key in your client's MCP config.
Yes. MCP clients support multiple servers: add cloud-tools and aws-mcp-server-3 as separate keys in the same mcpServers object, and your assistant will call tools from either one.
On AllMCPs, Cloud Tools has a quality signal of 61/100 (Good) with 3 views, 0 installs and 0 GitHub stars. AWS MCP Server has 64/100 (Good) with 1 views, 0 installs and 5 GitHub stars.