Model Context Protocol server for AWS CloudWatch Logs and CloudTrail Events
Four tools with complete schemas and descriptions, but quality is uneven. Tool names lack action verbs (cloudWatchLogGroups, cloudWatchLogs, cloudTrailEvents are noun-heavy; testAwsConnection is better). Descriptions are present but generic (10-50 chars for most). Parameters have types and descriptions, but lack constraints (enums, ranges, patterns). No output schemas documented. Error handling and recovery guidance absent. Naming does not follow verb_noun convention consistently.
Retrieve events from CloudTrail
List available CloudWatch Log Groups
Retrieve logs from CloudWatch
Test AWS connectivity
Tool names lack action verbs. 'cloudWatchLogGroups' and 'cloudWatchLogs' are noun-heavy; should be 'list_log_groups' and 'get_logs' to signal intent clearly to LLMs.
No output schemas documented. LLMs cannot infer what fields are returned or plan downstream tool calls. Document the structure of responses (e.g., logGroups array with name, arn, creationTime fields).
Parameter descriptions lack constraints. 'limit' has no min/max (baseline: 1 - 100 for pagination). 'startTime' and 'endTime' accept relative formats (-30m, -1h) but this is not documented in descriptions. Add explicit format and range guidance.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 48 | <=2025-11-25 | v2 |
No error handling or recovery guidance. If AWS credentials are invalid, log group not found, or API rate limit hit, the tool returns a raw error. Add actionable error messages: 'Log group not found. Call cloudWatchLogGroups() to list available groups.'
Tool descriptions are too short (10 - 50 chars). Baseline for A+ tools is 50 - 200 chars. Expand to explain WHAT the tool does, WHEN to use it, and what it returns. E.g., 'Retrieve logs from CloudWatch' → 'Retrieve logs from a CloudWatch log group, optionally filtered by stream name, pattern, and time range. Use this to troubleshoot application errors or analyze logs. Returns log events with timestamps and messages.'