🖥️ AWS MCP Server

Control AWS EC2 infrastructure through natural language — powered by Claude AI and the Model Context Protocol.

This project bridges Claude.ai and AWS using a custom Model Context Protocol (MCP) server. Instead of clicking through the AWS console or writing scripts, you can simply tell Claude to start an instance, run a command, or check the state of your lab environment — and it happens.

Built as part of a cybersecurity home lab to automate EC2 instance management and enable AI-assisted penetration testing workflows.

---

🏗️ Architecture

Claude.ai
    │
    │  HTTPS (remote MCP connection)
    ▼
nginx (reverse proxy + Let's Encrypt SSL)
    │
    │  HTTP  localhost:8000
    ▼
FastMCP HTTP Server  ◄── server.py
    │
    │  boto3
    ▼
AWS EC2 / SSM  (us-east-2)

Claude connects to the MCP server over HTTPS via a nip.io wildcard DNS entry. nginx handles SSL termination and proxies requests to the local FastMCP process running on the EC2 instance.

---

🔧 Tools Exposed

Tool	Description
list_instances	Lists all EC2 instances with name, ID, state, type, and public IP
start_instance	Starts a stopped EC2 instance by ID
stop_instance	Stops a running EC2 instance by ID
run_command	Executes a shell command on an instance via AWS SSM Run Command

---

🚀 Setup

Prerequisites

• An AWS EC2 instance (this server runs on KaliOne, a Kali Linux t2.medium)
• Python 3.10+
• nginx installed on the host instance
• A domain or nip.io address for SSL (e.g. https://1.2.3.4.nip.io)

1. Clone the repo

git clone https://github.com/jesseeastern/aws-mcp-server.git
cd aws-mcp-server

2. Create a virtual environment and install dependencies

python3 -m venv venv
source venv/bin/activate
pip install fastmcp boto3

3. Configure IAM

Attach the following managed policies to your EC2 instance role:

• AmazonEC2FullAccess
• AmazonSSMFullAccess
• AmazonSSMManagedInstanceCore

4. Configure nginx

Create /etc/nginx/sites-available/mcp with an SSL-terminated reverse proxy forwarding /mcp to 127.0.0.1:8000. Use Certbot with the nip.io domain to get a free Let's Encrypt certificate.

5. Start the server

kill $(pgrep -f server.py) 2>/dev/null
cd ~/mcp-server && source venv/bin/activate && python server.py &

6. Connect Claude.ai

In Claude.ai settings, add a new MCP server pointing to:

https://<your-ip>.nip.io/mcp

Claude will now have access to your AWS tools in any conversation.

---

🔒 Security Notes

• This server is intended for lab/educational use only.
• The MCP endpoint should be protected — consider IP allowlisting at the nginx level for production use.
• Never hardcode AWS credentials; rely on the EC2 instance role for authentication (boto3 picks this up automatically).
• SSM Run Command requires the target instance to have the SSM agent running and the correct IAM role attached.

---

💡 Example Usage

Once connected to Claude.ai, you can prompt naturally:

"List my EC2 instances and tell me which ones are running."

"Start KaliTwo and then run whoami on it."

"Stop all instances except KaliOne."

---

🧰 Tech Stack

• Python — FastMCP, boto3
• AWS — EC2, SSM (Systems Manager)
• nginx — Reverse proxy + SSL termination
• Let's Encrypt — Free TLS certificates via Certbot
• Claude.ai — MCP client (natural language interface)

---

📁 Project Structure

aws-mcp-server/
├── server.py       # MCP server — tool definitions and AWS integration
└── README.md       # This file

---

👤 Author

Jesse Easton — github.com/jesseeastern

Built for a cybersecurity lab environment focused on penetration testing automation and AI-assisted infrastructure management.