Loading ToolBench
Model Context Protocol (MCP) server for AWS - comprehensive AWS CLI wrapper
Server has 4 tools with explicit schemas and descriptions. Tool naming follows verb_noun convention (call_aws, suggest_aws_commands, get_aws_regions, get_caller_identity). Descriptions are present and moderately detailed (100-400 chars), exceeding the 20-char minimum. However, parameter descriptions lack specificity on constraints, formats, and error recovery guidance. The call_aws tool accepts destructive operations but lacks a confirmation/dry-run pattern. Output schemas are not formally documented in the code. Error handling returns structured dicts but lacks actionable recovery guidance (e.g., 'Try search_users() first'). Tool composition is reasonable but call_aws is overloaded, it handles validation, destructive checks, and execution in one tool.
Execute AWS CLI commands with validation and error handling. This is the primary tool for executing AWS CLI commands. Use this when you know the specific AWS service and operation you want to perform. Key points: - Commands MUST start with "aws" and follow AWS CLI syntax - Default region: us-east-1 (override with --region parameter) - Working directory: /tmp/aws-mcp-work - Use absolute paths for files Command restrictions: - DO NOT use shell pipes (|), redirects (>, >>, <), or command substitution $(()) - DO NOT use shell variables or environment variables - DO NOT use relative paths for file operations Examples: - "aws ec2 describe-instances" - List EC2 instances - "aws s3 ls" - List S3 buckets - "aws lambda list-functions" - List Lambda functions - "aws iam list-users" - List IAM users - "aws cloudwatch describe-alarms" - List CloudWatch alarms Returns: Dictionary with success status, output data, and error information
Get a list of available AWS regions. Returns: Dictionary with success status and list of AWS regions
Get the AWS identity of the current caller. Returns information about the IAM user or role whose credentials are used to call the operation. Returns: Dictionary with success status and caller identity (Account, ARN, UserId)
Suggest AWS CLI commands based on a natural language query. Use this tool when you're unsure about the exact AWS CLI command syntax or want to explore available commands for a specific task. Best practices for query formulation: 1. Include the AWS service name (EC2, S3, Lambda, etc.) 2. Describe the action you want to perform 3. Include any relevant context or constraints Query examples: - "List all running EC2 instances in us-east-1" - "Get the size of my S3 bucket named 'my-backup-bucket'" - "List all IAM users with AdministratorAccess policy" - "Show me all Lambda functions in my account" - "Create a new security group for SSH access" Returns: Dictionary with success status, query, and list of suggested commands
call_aws lacks confirmation/dry-run pattern for destructive operations. Tool warns but does not prevent execution of delete/terminate commands. Agents can accidentally destroy resources.
Output schemas not formally documented. Callers cannot predict response structure (success, output, error, truncated fields). LLMs must infer structure from examples.
Error messages lack recovery guidance. 'AWS execution error: <message>' tells agent nothing about next steps. Should suggest 'Try suggest_aws_commands() to find correct syntax' or 'Check AWS credentials with get_caller_identity()'.
Parameter 'max_results' in call_aws lacks constraints. No min/max bounds specified. Description says 'useful for pagination' but tool does not support offset/cursor, only truncates results after fetch.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 54 | <=2025-11-25 | v2 |
suggest_aws_commands parameter 'query' has maxLength=2000 but no guidance on query format. Should document: 'Include service name (EC2, S3, Lambda) and action verb (list, create, delete)' to improve suggestion quality.