AWS Cloud

AWS Cloud

Use the unified MCP server for documented AWS HTTP APIs. The gateway validates the exact official endpoint, signs requests in-process with AWS SigV4 or SigV4a, derives private/public ECR Registry authorization internally, connects bounded raw SigV4, Connect Health, Transcribe, IoT, and AppSync WebSocket streams internally, and never executes AWS CLI or returns a token or presigned URL.

Workflow

1. Call cloud_provider_status with provider="aws"; report only adapter availability and credential source/status. unverified is normal before a live API call and is not authentication proof.
2. Verify the service endpoint, HTTP request shape, signing service, region, action, and API version in the official API reference; aws_api_discover returns navigation links.
3. Use aws_api_read only for operations classified as read-only (describe*, list*, get*, head*, search*, and similar).
4. For any other operation, obtain explicit human approval for the exact account, region, resources, operation, and expected effect. Then call aws_api_mutate with force=true.
5. Secret-resource operations require the operator-controlled sensitive gate. Credential issuance or export operations such as STS AssumeRole, login tokens, presigned credentials, and AccessKey creation are never exposed by the gateway.
6. Return the provider RequestId when present. Never return, print, store, or ask the MCP server to reveal credentials.

MCP arguments

• auth_scheme: sigv4 (default), sigv4a for multi-region signing, ecr for private or public Docker/OCI Registry HTTP with an internal IAM authorization token, sigv4-ws for a finite raw-frame IAM WebSocket, connect-health-ws for Connect Health Medical Scribe, transcribe-ws for Transcribe streaming, iot-mqtt-ws for bounded IoT MQTT 3.1.1/5.0 read or bidirectional clients, kinesisvideo-signaling-ws for Kinesis Video WebRTC signaling, appsync-event-ws for a finite IAM AppSync Events channel subscription, or appsync-graphql-ws for a finite IAM AppSync GraphQL subscription.
• service: SigV4 signing service, such as ec2, s3, iam, or cloudcontrolapi.
• operation: documented action name used for read/write classification.
• region: required SigV4 signing region; use the documented pseudo-region for global services.
• region_set: required only for SigV4a, as a comma-separated official region set such as us-east-1,us-west-*. It is not a token or credential.
• payload_mode: use aws-chunked only for SigV4 or SigV4a S3 PutObject or UploadPart streaming bodies. The server creates the 64 KiB chunk framing and HMAC or fixed-length DER-ECDSA chained signatures.
• payload_mode=aws-chunked-trailer: for SigV4 or SigV4a S3 streaming uploads with a signed trailing checksum. Set checksum_algorithm to crc32, crc32c, crc64nvme, sha1, or sha256; the server computes the value and callers must not supply checksum or signing headers.
• payload_mode=aws-eventstream: for a finite or bidirectional HTTP/2 SigV4 request whose body_file contains consecutive CRC-valid unsigned Amazon EventStream frames. The server validates the 24 MiB per-frame bound, adds chained signing envelopes and a terminal frame, and validates every response frame before atomic output. Set stream_interval_ms to pace whole frames; never set stream_chunk_bytes, and include response_file whenever pacing is enabled. This is not a WebSocket transport.
• method and url: exact official AWS HTTPS request.
• parameters: optional scalar query parameters; use body for Query/JSON protocol payloads.
• headers, body, body_file: non-credential request data; local files require an operator-approved root. connect-health-ws requires the Medical Scribe configuration in body and raw finite audio in body_file; transcribe-ws requires raw finite audio and optionally accepts a configuration object. These are the controlled cases where both are accepted.
• response_file: optional new approved-root file for large/binary responses. Use the documented Range header for objects larger than the configured per-call limit; existing files are never overwritten.

Example read: aws_api_read(auth_scheme="sigv4", service="ec2", operation="describe-instances", region="us-east-1", method="POST", url="https://ec2.us-east-1.amazonaws.com/", headers={"Content-Type":"application/x-www-form-urlencoded"}, body="Action=DescribeInstances&Version=2016-11-15&MaxResults=20").

Private ECR Registry example: aws_api_read(auth_scheme="ecr", service="ecr", operation="ListTags", region="us-west-2", method="GET", url="https://123456789012.dkr.ecr.us-west-2.amazonaws.com/v2/team/app/tags/list", parameters={"n":20}). Public example: aws_api_read(auth_scheme="ecr", service="ecr-public", operation="GetManifest", region="us-east-1", method="GET", url="https://public.ecr.aws/v2/<registry-alias>/<repository>/manifests/latest"). The gateway signs the internal GetAuthorizationToken request from the AWS credential chain and never exposes the returned token. Public Registry does not support /tags/list. Private layer GET/HEAD may follow only the exact regional Starport S3 307 with Authorization removed; use response_file for a bounded atomic layer download. Push/upload/delete/mount calls use the mutation tool and approval gate.

Example streaming upload: aws_api_mutate(auth_scheme="sigv4", payload_mode="aws-chunked", service="s3", operation="put-object", region="us-east-1", method="PUT", url="https://bucket.s3.us-east-1.amazonaws.com/object", body_file="/approved/uploads/object.bin", force=true).

Example signed checksum upload: aws_api_mutate(auth_scheme="sigv4", payload_mode="aws-chunked-trailer", checksum_algorithm="crc64nvme", service="s3", operation="put-object", region="us-east-1", method="PUT", url="https://bucket.s3.us-east-1.amazonaws.com/object", body_file="/approved/uploads/object.bin", force=true).

For an official multi-region S3 endpoint, use either streaming example with auth_scheme="sigv4a", its exact multi-region URL, and the documented region_set instead of region.

Example bidirectional HTTP/2 event stream: aws_api_mutate(auth_scheme="sigv4", payload_mode="aws-eventstream", service="health-agent", operation="StartMedicalScribeListeningSession", region="us-west-2", method="POST", url="https://streaming.health-agent.us-west-2.api.aws/medical-scribe-stream/", headers={"x-amzn-medscribe-session-id":"<uuid>","x-amzn-medscribe-domain-id":"<domain-id>","x-amzn-medscribe-subscription-id":"<subscription-id>","x-amzn-medscribe-language-code":"en-US","x-amzn-medscribe-media-encoding":"pcm","x-amzn-medscribe-sample-rate":"16000"}, body_file="/approved/streams/medical-scribe.events", response_file="/approved/streams/transcript.events", stream_interval_ms=100, force=true). The body file must already contain the documented configuration, audio, and END_OF_SESSION logical events; the gateway signs complete frames without exposing AKSK/STS material.

Finite raw-frame IAM WebSockets use auth_scheme="sigv4-ws". The gateway signs the exact WSS host/path/query and all allowed caller headers in-process, sends at most 256 client frames of type json, text, or binary (data_base64), and atomically records at most 256 server frames or 300 seconds as NDJSON. AgentCore targets additionally enforce the official 32 KiB per-frame limit. Every generic signed WebSocket is forced through aws_api_mutate because arbitrary bidirectional frames can have side effects even when an operation label looks read-only. Example AgentCore invocation: aws_api_mutate(auth_scheme="sigv4-ws", service="bedrock-agentcore", operation="InvokeAgentRuntimeWithWebSocketStream", region="us-west-2", method="GET", url="wss://bedrock-agentcore.us-west-2.amazonaws.com/runtimes/<percent-encoded-runtime-arn>/ws?qualifier=prod", headers={"X-Amzn-Bedrock-AgentCore-Runtime-Session-Id":"session-123456789012345678901234567890"}, body={"messages":[{"type":"json","data":{"inputText":"hello"}}],"max_messages":10,"timeout_seconds":30}, response_file="<approved-root>/agentcore.ndjson", force=true).

Use this generic mode only when the provider protocol uses ordinary WebSocket text/binary frames after the SigV4 Upgrade, such as an AgentCore runtime or Managed Blockchain JSON-RPC node. It does not replace transcribe-ws, iot-mqtt-ws, either AppSync mode, or a protocol that requires per-frame AWS EventStream signatures. Authorization, STS token, and the signed handshake never enter MCP output; caller-controlled credential/query, WebSocket control headers, redirects, and unbounded sessions are rejected.

Connect Health ambient documentation uses auth_scheme="connect-health-ws", service="health-agent", operation StartMedicalScribeListeningSession, method GET, and the exact wss://streaming.health-agent.<region>.api.aws/medical-scribe-stream-websocket endpoint in us-east-1 or us-west-2. Supply exactly session-id, domain-id, subscription-id, language-code=en-US, sample-rate, and media-encoding=pcm|flac as parameters. body is the documented MedicalScribeConfigurationEvent object and must contain the S3 post-stream action and exactly one managed or custom note template; body_file is finite raw audio and response_file receives atomic transcript NDJSON.

Example: aws_api_mutate(auth_scheme="connect-health-ws", service="health-agent", operation="StartMedicalScribeListeningSession", region="us-west-2", method="GET", url="wss://streaming.health-agent.us-west-2.api.aws/medical-scribe-stream-websocket", parameters={"session-id":"<uuid>","domain-id":"<dom-or-hai-id>","subscription-id":"<sub-id>","language-code":"en-US","sample-rate":16000,"media-encoding":"pcm"}, body={"postStreamActionSettings":{"outputS3Uri":"s3://<bucket>/<prefix>","clinicalNoteGenerationSettings":{"noteTemplateSettings":{"managedTemplate":{"templateType":"PHYSICAL_SOAP"}}}}}, body_file="<approved-root>/visit.pcm", response_file="<approved-root>/medical-scribe.ndjson", force=true).

The gateway creates the maximum-60-second presigned Upgrade internally, chains a signature over every configuration/audio/session-control EventStream frame, sends raw binaryAudioEvent chunks followed by END_OF_SESSION, and publishes output only after a normal provider close. This is always a write operation because it starts a session and produces S3 artifacts. Obtain and record required recording consent before sending PHI, and require trained clinical review of generated output. The signed URL, AKSK/STS token, and frame signatures never enter MCP output.

Example realtime transcription: aws_api_read(auth_scheme="transcribe-ws", service="transcribe", operation="StartStreamTranscriptionWebSocket", region="us-west-2", method="GET", url="wss://transcribestreaming.us-west-2.amazonaws.com:8443/stream-transcription-websocket", parameters={"language-code":"en-US","media-encoding":"pcm","sample-rate":16000,"session-id":"session-1"}, body_file="/approved/audio/input.pcm", response_file="/approved/results/transcript.ndjson"). The adapter creates the five-minute SigV4 handshake internally, signs every audio event in a chained outer EventStream frame, sends an empty signed terminal event, validates both CRC layers in provider responses, and atomically publishes only bounded JSON event payloads. PCM defaults to 100 ms chunks; use stream_chunk_bytes and stream_interval_ms only when the documented media format requires another cadence.

For /medical-stream-transcription-websocket, use StartMedicalStreamTranscriptionWebSocket and include the documented language-code, specialty, and type. For /call-analytics-stream-transcription-websocket, use StartCallAnalyticsStreamTranscriptionWebSocket; when post-call or channel configuration is needed, pass its JSON object as body while audio remains in body_file.

AWS IoT Core uses auth_scheme="iot-mqtt-ws", service="iotdevicegateway", method GET, and the exact account endpoint wss://<iot-data-endpoint>/mqtt. body.protocol_version is 4 (MQTT 3.1.1, default) or 5; client_id is non-secret bounded UTF-8. Read-only operation SubscribeMQTT requires one to eight QoS 0/1 subscriptions, clean start, max_messages from 1 to 256, timeout_seconds from 1 to 300, and response_file for atomic Base64 NDJSON. Example: aws_api_read(auth_scheme="iot-mqtt-ws", service="iotdevicegateway", operation="SubscribeMQTT", region="us-west-2", method="GET", url="wss://<account>-ats.iot.us-west-2.amazonaws.com/mqtt", body={"protocol_version":5,"client_id":"observer-1","subscriptions":[{"topic_filter":"sensors/+/temperature","qos":1}],"max_messages":10,"timeout_seconds":30}, response_file="<approved-root>/mqtt.ndjson").

Use mutation-only operation ClientMQTT for WSS publishes, unsubscriptions, persistent sessions, retained messages, or Last Will. MQTT 3.1.1 uses clean_start=false; MQTT 5 additionally accepts session_expiry_seconds up to 604800 and optional disconnect_session_expiry_seconds to update or end a nonzero session at DISCONNECT. A resumed session must always declare max_messages, timeout_seconds, and response_file, because AWS can deliver stored QoS 1 traffic immediately after CONNACK even when the plan adds no subscription. Up to eight subscriptions and unsubscriptions and 64 QoS 0/1 publishes may be combined. Publish and Will plans use Base64 payloads and retain; MQTT 5 also supports payload format, content type, message expiry, response topic, correlation data, and ordered user properties. Example: aws_api_mutate(auth_scheme="iot-mqtt-ws", service="iotdevicegateway", operation="ClientMQTT", region="us-west-2", method="GET", url="wss://<account>-ats.iot.us-west-2.amazonaws.com/mqtt", body={"protocol_version":5,"client_id":"device-1","clean_start":false,"session_expiry_seconds":3600,"disconnect_session_expiry_seconds":0,"subscriptions":[{"topic_filter":"devices/device-1/in","qos":1}],"publishes":[{"topic":"devices/device-1/status","qos":1,"retain":true,"payload_base64":"b25saW5l","payload_format":1,"content_type":"text/plain"}],"will":{"topic":"devices/device-1/status","qos":1,"retain":true,"payload_base64":"b2ZmbGluZQ=="},"max_messages":1,"timeout_seconds":30}, response_file="<approved-root>/mqtt-client.ndjson", force=true).

The adapter generates the five-minute SigV4 WSS query internally, applies AWS IoT's documented STS exception by appending the session token only after signing, requires the mqtt subprotocol, checks version-specific CONNACK/SUBACK/UNSUBACK/PUBACK/DISCONNECT reason codes, acknowledges inbound QoS 1 messages, and honors server keepalive. QoS 1 outbound delivery is sequential and bounded by the broker Receive Maximum. Publish pacing enforces the documented 500/s connection quota and the default retained-message 50/s account and 1/s same-topic quotas. The client advertises a 128 KiB packet limit and zero topic aliases and validates broker Maximum QoS, Retain Available, Maximum Packet Size, and session state. QoS 2, subscription identifiers, topic aliases, properties absent from AWS's supported-property table (including Will Delay), caller query/headers/credentials, and unbounded sessions fail closed. Ordinary SigV4 HTTPS /topics/<topic> publishing remains available for request/response-only use cases.

Kinesis Video Streams WebRTC signaling uses auth_scheme="kinesisvideo-signaling-ws", service="kinesisvideo", operation ConnectAsMaster or ConnectAsViewer, method GET, and the exact query-free WSS endpoint returned by GetSignalingChannelEndpoint. This is always aws_api_mutate: the body contains the matching role, channel ARN, Viewer-only client_id, zero to 256 credential-free SDP/ICE JSON messages, and finite output bounds. Each outbound message requires a unique correlation_id; Master messages also require recipient_client_id, while Viewer messages forbid it. Example: aws_api_mutate(auth_scheme="kinesisvideo-signaling-ws", service="kinesisvideo", operation="ConnectAsViewer", region="us-west-2", method="GET", url="wss://<endpoint-id>.kinesisvideo.us-west-2.amazonaws.com/", body={"role":"VIEWER","channel_arn":"arn:aws:kinesisvideo:us-west-2:123456789012:channel/demo/1700000000000","client_id":"viewer-1","messages":[{"action":"SDP_OFFER","payload":{"type":"offer","sdp":"v=0..."},"correlation_id":"offer-1"}],"max_messages":32,"timeout_seconds":30}, response_file="<approved-root>/kvs-signaling.ndjson", force=true).

The gateway implements the official 299-second query presign, including the Channel ARN, Viewer Client ID, and STS token in the canonical query; no signed URL or credential reaches MCP output. It accepts only SDP offer/answer and ICE-candidate actions, Base64-encodes bounded JSON internally, paces at the stricter 5 TPS signaling quota, validates/correlates all documented server event shapes, decodes received Base64 JSON, and atomically publishes mode-0600 NDJSON. This covers the AWS signaling API, not peer-to-peer WebRTC RTP/media transport. Kinesis Video Streams RTMP/HLS media ingest and playback remain a documented non-resource media plane outside the MCP surface.

AWS AppSync Events subscriptions use auth_scheme="appsync-event-ws", service="appsync", operation EventSubscribe, method GET, and wss://<api-id>.appsync-realtime-api.<region>.amazonaws.com/event/realtime (or an operator-approved custom domain). body contains only channel, max_messages from 1 to 256, and timeout_seconds from 1 to 300; response_file receives atomic sanitized NDJSON. Example: aws_api_read(auth_scheme="appsync-event-ws", service="appsync", operation="EventSubscribe", region="us-east-1", method="GET", url="wss://<api-id>.appsync-realtime-api.us-east-1.amazonaws.com/event/realtime", body={"channel":"/news/latest","max_messages":10,"timeout_seconds":30}, response_file="<approved-root>/appsync-events.ndjson").

The adapter separately SigV4-signs the documented connection {} and channel bodies against the AppSync HTTP /event endpoint, keeps the resulting Authorization and STS token inside the dynamic WebSocket subprotocol and subscribe message, generates the subscription ID, validates acknowledgements/data/keep-alives, and explicitly unsubscribes. API keys, JWTs, caller Authorization, arbitrary handshake fields, WebSocket publishing, and unbounded sessions are rejected. AppSync Events publishing remains available through the ordinary SigV4 HTTPS /event write path.

Legacy AppSync GraphQL subscriptions use auth_scheme="appsync-graphql-ws", service="appsync", operation GraphQLSubscribe, method GET, and wss://<api-id>.appsync-realtime-api.<region>.amazonaws.com/graphql. An operator-approved custom domain instead uses /graphql/realtime. body.query must contain exactly one subscription operation; optional variables must contain no credential-like fields. max_messages is 1 to 256, timeout_seconds is 1 to 300, and response_file is mandatory. Example: aws_api_read(auth_scheme="appsync-graphql-ws", service="appsync", operation="GraphQLSubscribe", region="us-east-1", method="GET", url="wss://<api-id>.appsync-realtime-api.us-east-1.amazonaws.com/graphql", body={"query":"subscription OnMessage($room: ID!) { onMessage(room: $room) { id text } }","variables":{"room":"room-1"},"max_messages":10,"timeout_seconds":30}, response_file="<approved-root>/appsync-graphql.ndjson").

The adapter signs the documented HTTPS /graphql/connect body {} and the exact HTTPS /graphql GraphQL request separately, keeps IAM Authorization and the STS token only in the dynamic header-<Base64URL> subprotocol and start.extensions.authorization, validates connection_ack, start_ack, keep-alives, data IDs, payload objects, and completion, then sends stop. Query/mutation documents, multiple operations, caller headers/query parameters, API keys, JWTs, arbitrary IDs, and unbounded sessions are rejected.

Amazon IVS Chat messaging uses auth_scheme="ivs-chat-ws", service="ivschat", method GET, and an exact current wss://edge.ivschat.<region>.amazonaws.com endpoint. Read-only SubscribeChat creates a view-only one-time token internally and atomically collects bounded MESSAGE/EVENT frames. ClientChat mutation-gates up to 64 SEND_MESSAGE actions; ModerateChat is additionally sensitive-gated and accepts only DELETE_MESSAGE or DISCONNECT_USER. Example: aws_api_mutate(auth_scheme="ivs-chat-ws", service="ivschat", operation="ClientChat", region="us-west-2", method="GET", url="wss://edge.ivschat.us-west-2.amazonaws.com", body={"room_identifier":"arn:aws:ivschat:us-west-2:123456789012:room/demo","user_id":"agent","messages":[{"action":"SEND_MESSAGE","content":"hello","request_id":"message-1"}],"max_messages":1,"timeout_seconds":30}, response_file="<approved-root>/ivs-chat.ndjson", force=true).

The server signs the fixed HTTPS CreateChatToken request with the AWS SDK credential chain, infers only the capabilities required by the selected operation, and passes the single-use token only as the internal WebSocket subprotocol. It enforces the official room/user/session/attribute/message limits, seven-region endpoint table and 10 requests/second connection quota. Caller tokens, capabilities, arbitrary actions, credential-bearing provider data, binary frames, and unbounded sessions fail closed; the token and SigV4 authorization never enter MCP output.

Amazon Lex V2 streaming conversations use auth_scheme="lex-v2-conversation", service="lex", operation StartConversation, method POST, and the exact official https://runtime-v2-lex.<region>.amazonaws.com origin. The server validates the bot/alias/locale/session URI identifiers and a bounded credential-free plan, then signs the request and every STREAMING-AWS4-HMAC-SHA256-EVENTS frame internally. It always sends the official ConfigurationEvent first, then supports conversation_mode="TEXT" with one to 64 TextInputEvent frames or conversation_mode="AUDIO" with bounded official 8 kHz lpcm audio_base64, single-character dtmf input, and optional text frames, and atomically publishes sanitized TextResponseEvent/TranscriptEvent/HeartbeatEvent/IntentResultEvent and, in AUDIO mode, AudioResponseEvent/PlaybackInterruptionEvent NDJSON. Example: aws_api_mutate(auth_scheme="lex-v2-conversation", service="lex", operation="StartConversation", region="us-west-2", method="POST", url="https://runtime-v2-lex.us-west-2.amazonaws.com", body={"bot_id":"ABCDEFGHIJ","bot_alias_id":"alias-1","locale_id":"en_US","session_id":"session-1","conversation_mode":"AUDIO","audio_base64":"<base64 lpcm>","dtmf":"12#","texts":[{"text":"hello","event_id":"lex-evt-1"}],"max_events":64,"timeout_seconds":60}, response_file="<approved-root>/lex.ndjson", force=true).

The server rejects caller-supplied signatures, tokens, query/headers, body files, unknown response event types, credential-bearing frames, mode-inconsistent audio events, and unbounded plans; EOF and the documented timeout publish only what arrived, and nothing is published on failure.

Amazon Chime SDK Messaging event streaming uses auth_scheme="chime-messaging-ws", service="chime-messaging", operation SubscribeMessages, method GET, and the exact official wss://data-messaging.chime.aws/connect URL. The server signs the fixed GET https://messaging-chime.<region>.amazonaws.com/endpoints/messaging-session request with the AWS SDK credential chain, validates the returned official endpoint, then SigV4-presigns /connect internally with the caller's bounded user_arn (one official arn:aws:chime:...:app-instance/.../user/... AppInstanceUser ARN), unique session_id, optional prefetch_on_connect, and bounded connect_expires_seconds (10–3600, default 60). The identity needs chime:GetMessagingSessionEndpoint on * and chime:Connect on the AppInstanceUser ARN. Read-only sessions collect bounded sanitized events (SESSION_ESTABLISHED, CHANNEL_DETAILS, channel message/membership/channel lifecycle events with STANDARD|CONTROL|SYSTEM message types), decode each Payload JSON string, and atomically publish NDJSON. Unknown event types, malformed envelopes, invalid payloads, caller query/headers, and unbounded plans fail closed; the signed URL, STS token, and SigV4 material never enter MCP output. Example: aws_api_read(auth_scheme="chime-messaging-ws", service="chime-messaging", operation="SubscribeMessages", region="us-east-1", method="GET", url="wss://data-messaging.chime.aws/connect", body={"user_arn":"arn:aws:chime:us-east-1:123456789012:app-instance/694d2099-cb1e-463e-9d64-697ff5b8950e/user/johndoe","session_id":"session-1","prefetch_on_connect":true,"connect_expires_seconds":60,"max_messages":32,"timeout_seconds":30}, response_file="<approved-root>/chime-messaging.ndjson").

Amazon Connect chat participant streaming uses auth_scheme="connect-chat-ws", service="connect", operation ObserveChat, method POST, region, and the exact official wss://participant.connect.<region>.amazonaws.com/participant/connect URL (query-free). This is mutation-only: the server signs PUT https://connect.<region>.amazonaws.com/contact/chat (connect:StartChatContact) with the AWS SDK credential chain, calls POST https://participant.connect.<region>.amazonaws.com/participant/connection (connectparticipant:CreateParticipantConnection) with the participant token only in the internal X-Amz-Bearer header, validates the returned wss://participant.connect.<region>.amazonaws.com/participant/connect endpoint, and dials it directly. The finite body plan carries instance_id (UUID), contact_flow_id (ARN or UUID), display_name, optional initial_message, up to 16 bounded attributes, optional 1–16 bounded messages (content plus optional content_type of text/plain or text/markdown), plus max_events (1–256) and timeout_seconds (1–300). After the subscription succeeds, the gateway sends each message through POST https://participant.connect.<region>.amazonaws.com/participant/message with the connection token only in the internal X-Amz-Bearer header and a generated idempotent ClientToken, and reports the count in sent_messages metadata. The gateway publishes the official {"topic":"aws/subscribe","content":{"topics":["aws/chat"]}} frame, waits for subscription success, ignores aws/heartbeat/aws/ping, validates every aws/chat content object against the documented Type/ParticipantRole tables, and atomically publishes sanitized bounded NDJSON. The participant token, connection token, and dial URL never enter MCP output; unknown topics, malformed frames, subscribe failure, credential-bearing content, and unbounded plans fail closed. Example: aws_api_mutate(auth_scheme="connect-chat-ws", service="connect", operation="ObserveChat", region="us-east-1", method="POST", url="wss://participant.connect.us-east-1.amazonaws.com/participant/connect", body={"instance_id":"12345678-1234-1234-1234-123456789012","contact_flow_id":"arn:aws:connect:us-east-1:123456789012:contact-flow/87654321-4321-4321-4321-210987654321","display_name":"Observer","max_events":32,"timeout_seconds":30}, response_file="<approved-root>/connect-chat.ndjson", force=true).

Credentials

Use the AWS SDK credential chain: profiles/SSO, web identity, IAM roles, or AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / optional AWS_SESSION_TOKEN. Keep credentials in the server environment or official AWS config, never in MCP arguments.

Read references/official-docs.md when authentication, ECR Registry, Cloud Control, Connect Health, Transcribe, IoT, AppSync, IVS Chat, Chime SDK Messaging, or operation naming needs verification.