AWS added a new card to the console this week: Agent Toolkit for AWS. It is free, generally available, and works with Claude Code, Codex, Cursor, and Kiro. One setup prompt gives your coding agent an MCP server for AWS APIs, curated skills for common tasks, and IAM guardrails. The toolkit itself is useful. What it admits is bigger: the primary reader of AWS documentation is no longer a person.

What ships in the box

Three layers, and they work independently of each other:

  • The AWS MCP Server. A hosted endpoint (aws-mcp.us-east-1.api.aws) your agent reaches through mcp-proxy-for-aws. It gives the agent AWS API access, sandboxed script execution, and real-time documentation search. Credentials are only needed for API calls; documentation search works without them.
  • Plugins. aws-core covers service selection, CDK and CloudFormation, serverless, containers, storage, observability, and billing. aws-agents adds Bedrock and AgentCore skills, aws-data-analytics and aws-agents-for-devsecops cover their own domains. On Claude Code they install from the official plugin marketplace with a single /plugin install.
  • Skills. Curated task instructions installed with npx skills add aws/agent-toolkit-for-aws/skills. Loaded on demand: the agent pulls in only what matches the current task, so they cost nothing until used.

Authentication runs through the new browser-based aws login flow, verified with aws sts get-caller-identity. If you live in the terminal, aws configure agent-toolkit wires the same thing through the AWS CLI.

The setup is a prompt, not a script

Here is the detail worth pausing on. The console does not hand you a shell script. It hands you one sentence to paste into your agent:

Set up Agent Toolkit for AWS by following instructions:
https://raw.githubusercontent.com/aws/agent-toolkit-for-aws/refs/heads/main/setup-instructions/setup.md

That URL is a Markdown file. Your agent reads it, detects your OS, installs the AWS CLI if missing, runs aws login, wires up the MCP server, and installs the skills. The document is structured like a runbook for a machine: numbered steps, error handling tables, verification commands after every stage. AWS wrote an installation guide whose intended audience is not you. You just approve the permission prompts.

That is the pattern to notice. Install instructions used to be prose for humans with code blocks to copy. This is code for agents with prose the human skims once.

Nobody reads the docs anymore, except the agents

I will admit something. For years my weekend reading was not crime novels or fiction. It was AWS documentation: service quotas, API edge cases, the changelog of some storage class nobody talks about. That reading built the mental index that made me fast, because knowing where the answer lives was most of the job.

That index is now a commodity. An agent with documentation search reads the current page, not the one I memorized two years ago, and it reads it in seconds. The toolkit makes this official: AWS now maintains a dedicated pipeline for feeding its own docs to machines, with "up-to-date documentation and tested procedures" as the headline feature. The docs team's most important customer has changed species.

What does not become a commodity is judgment. Which service fits, what the blast radius of a change is, whether the agent's plan survives contact with your account's realities. That is why the third word in AWS's own pitch is guardrails: an agent with working credentials is a principal like any other, and it gets least privilege like any other. Two practical notes on that front:

  • Pin the proxy version (mcp-proxy-for-aws@1.6.3 style). AWS's own README recommends this against supply chain risk, and they are right.
  • Scope the agent's role read-only by default and gate every mutating path separately. The toolkit's IAM guardrails help, but the policy is still yours to write.

Wrapping up

The agentic era of AWS development did not arrive with a keynote. It arrived as a small card in the console offering a setup prompt. AWS now assumes your first collaborator on any project is an agent, and it ships documentation, procedures, and permission boundaries built for that reader. My weekends might finally have room for a detective novel. The docs are in good hands, and the interesting work, deciding what to build and what an agent may touch, was always the part that could not be indexed anyway.

Read this next