Skip to content
MCP Server Directory logo
developer-tools

Eks Mcp Server

Open source MCP Servers for AWS

Reviewed overview

MCP サーバー概要

What is Eks Mcp Server? The Amazon EKS MCP Server is an open-source Model Context Protocol (MCP) server for Amazon EKS that gives AI code assistants and developers resource management tools and real-time cluster state visibility. It exposes tools to create and manage EKS clusters (via CloudFormation), manage Kubernetes resources, retrieve logs and events, query CloudWatch metrics/logs, and access IAM/policy information — enabling LLM-driven workflows for provisioning, deployment, troubleshooting and optimization.

How to use the project?

  • Prerequisites: Python 3.10+, the uv package manager, and (for IAM auth) a configured AWS CLI with credentials.
  • Install/run the MCP server as an MCP client/server entry (examples provided for Kiro, Cursor, and VS Code). Typical startup uses the uvx command and args like: “awslabs.eks-mcp-server@latest” plus optional flags.
  • Important runtime flags: --allow-write (enables mutating operations) and --allow-sensitive-data-access (enables logs/events/secret reads). Default mode is read-only.
  • Authentication modes: default “iam” (uses AWS credentials and registers AWS-specific tools) or “kubeconfig” (uses local kubeconfig/OIDC tokens; note some AWS tools are not registered in kubeconfig mode).
  • Configure environment vars (AWS_PROFILE, AWS_REGION, EKS_AUTH_MODE, KUBECONFIG, FASTMCP_LOG_LEVEL, HTTP(S)_PROXY) in the MCP server definition.
  • Follow the Quickstart to add the server to supported IDE integrations and verify tools with the /tools command in compatible MCP clients.

Key features

  • Create and manage EKS clusters via CloudFormation (generate, deploy, describe, delete).
  • Generate and apply Kubernetes manifests (generate_app_manifest, apply_yaml) and manage individual k8s resources (create/read/patch/replace/delete).
  • List cluster API versions and resources with filters by namespace, labels and fields.
  • Retrieve pod logs, Kubernetes events and CloudWatch logs/metrics (with sensitive-data access enabled).
  • IAM integration: list role policies and add inline policies (write-only, controlled behavior).
  • EKS diagnostics: get EKS Insights, VPC configuration, and a searchable EKS troubleshooting guide.
  • Security features: SSL verification, resource tagging, client caching, stack protection, least-privilege recommendations.

Common use cases

  1. Provisioning: Automate creation of EKS clusters with recommended networking, node pools and IAM via CloudFormation.
  2. Application deployment: Generate deployment/service manifests and apply YAML to clusters from IDE/LLM prompts.
  3. Troubleshooting: Use get_pod_logs, get_k8s_events, CloudWatch queries and the troubleshoot guide to diagnose failures.
  4. Observability & optimization: Fetch CloudWatch metrics for pods/nodes/services and get guidance on which metrics to use.
  5. Security and policy ops: Inspect IAM role policies, attach new inline policies (carefully), and audit cluster RBAC/insights.
  6. LLM-assisted workflows: Integrate into AI coding assistants to allow natural-language cluster management, deployment, and debugging steps.

FAQ (from the project)

  • Q: Is it safe to enable write access? A: The server runs read-only by default. --allow-write enables mutating operations and should only be used in trusted environments with properly scoped IAM roles. Prefer separate roles for read vs write and enable audit logging.

  • Q: What permissions are required? A: Read-only operations require a curated set of Describe/List/Get permissions. Write operations require broader permissions (CloudFormation, EKS, IAM, VPC) — examples and managed-policy recommendations are included in the docs.

  • Q: How does authentication work? A: Two modes: iam (default) uses AWS credentials and registers AWS-specific tools; kubeconfig uses local kubeconfig/OIDC/certauth and does not register some AWS-specific tools.

  • Q: How do I get logs and events? A: Use get_pod_logs and get_k8s_events; these require --allow-sensitive-data-access. CloudWatch logs/metrics also require appropriate flags and AWS permissions.

  • Q: Can the server modify IAM policies? A: add_inline_policy can create new inline policies but will not modify existing policies; it requires --allow-write and careful scoping.

  • Q: Where is the project hosted and how do I contribute? A: The project is open source on GitHub (awslabs/mcp). See the repository for installation, templates, scripts, and contribution guidance.

  • Q: What are limitations of kubeconfig mode? A: Kubeconfig mode uses local kubeconfig auth and omits AWS-specific tools (CloudWatch, CloudFormation-based stack management, some IAM/VPC tools) because those require AWS SigV4 credentials.

Notes and best practices

  • Keep sensitive flags off unless necessary; store secrets in AWS Secrets Manager or Parameter Store rather than passing secrets via MCP. Use least-privilege IAM roles, separate read/write roles, resource tagging, and CloudTrail for auditing.