The server itself exposes 8 tools, and some of them can write to your AWS account. Behind TrustGate an agent only sees the tools you allow, requests and responses are inspected, and every call is logged. Anything outside the allowlist is denied before it reaches AWS.

How is this different from connecting AWS MCP directly?

Connected directly, an agent sees every tool the server exposes and holds the credential itself. Through TrustGate you choose which tools each agent gets, and every call is logged against the agent that made it.

What if the AWS MCP API changes?

We track the AWS MCP schema, so the tool catalogue stays current. Tools you have already allowed keep working, and anything new stays denied until you enable it.

Can I give different agents different AWS tools?

Yes. Access is set per agent: one can get a handful of read tools, another the full set. You grant the whole MCP or single tools within it.

Where can I see what my agents did in AWS?

Every call is logged against the agent that made it, with the tool it used. Activity can be sent on to your own monitoring.

Do I need to run the AWS MCP server myself?

No. TrustGate connects to the AWS MCP server and sits in front of it. Your agent only talks to your TrustGate URL, never to AWS directly.

Connect AWS MCP to your AI agents, securely.

One secured endpoint for every AWS call your AI agents make, scoped per user, inspected, and logged.

Get started for free

Get a demo

Try AWS MCP now

What your agents can ask once AWS MCP is connected.

“Search the AWS docs for S3 bucket lifecycle rules”
“List the buckets in my account”
“Is this service available in eu-west-1?”

“Read the full documentation page for IAM policy conditions”
“Which AWS regions can I use?”
“Show me the recommended approach for cross-account access”

Select the tools your AI agents can call

8 tools from the AWS MCP schema.

Showing 8 tools

aws___search_documentationreadSearch across all AWS documentation, including API references, best practices, and service guides.
aws___read_documentationreadRetrieve and convert AWS documentation pages to markdown format.
aws___retrieve_skillreadRetrieve domain-specific expertise for a particular AWS domain.
aws___list_regionsreadList the AWS regions available to the account.
aws___get_regional_availabilityreadCheck regional availability of AWS services, APIs, and CloudFormation resources.
aws___get_tasksreadRetrieve the status of tasks started through the server.
aws___get_presigned_urlreadGenerate a presigned URL for an AWS resource.
aws___run_scripthigh riskExecute Python code in a sandboxed environment with AWS API access.

What AWS MCP exposes

AWS MCP groups its 8 tools into 2 categories, each with a suggested starting policy.

Category	Covers	Access	Suggested policy
Knowledge	Documentation search, service guides, skills, regions and availability	Read	Allow documentation searches
API	Authenticated AWS API calls, sandboxed scripts, presigned URLs and task status	Read / Write	Scope IAM credentials; approve any call that changes infrastructure