Does agent-toolkit-for-aws auto-invoke its skills?

Not yet. It is indexed on Flowy as a plain plugin. Request auto-invocation on its page and Flowy will route its skills for you as you prompt.

Is agent-toolkit-for-aws free?

Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.

Development

Plugin

agent-toolkit-for-aws

Help AI coding agents build, deploy, and manage applications on AWS. The Agent Toolkit for AWS gives AI coding agents the tools, knowledge, and guardrails they need to work with AWS services.

FLOW.md

aws@aws

GitHub

Plugin Signal91/100Strong

maintained100

capable100

documented75

adopted71

Install on Claude Code

> /plugin marketplace add aws/agent-toolkit-for-aws

Stats

Python TypeScript JavaScript HTML Swift

+7 tags

SQL PostgreSQL MySQL AWS GitHub Anthropic MCP

2,289

Stars

236

Forks

Active

Maintenance

Python

Language

Apache-2.0

License

4h ago

Last commit

3mo ago

Created

Repo: aws/agent-toolkit-for-aws

In this plugin

118 skills 9 commands 3 MCP

See everything inside

What's inside

Skills

146

/analyzing-release-readinessTrigger a pre-merge release readiness review on a GitHub PR, GitLab MR, or local branch. Use when the user wants to analyze code changes for risk, correctness, and potential rollback issues before merging. Trigger words include release readiness, analyze PR, analyze MR, review /chatting-with-aws-devops-agentHave a fast, conversational analysis with the AWS DevOps Agent. Use for cost optimization, architecture review, topology mapping, knowledge / runbook discovery, security audits, dependency questions, and quick diagnostics — anything that needs a 5-30 second answer rather than a /coordinating-multi-space-devops-agentCoordinate the AWS DevOps Agent across multiple AgentSpaces from one Claude Code session — route questions to the right space (prod vs staging vs knowledge), query several spaces in parallel and synthesize, or compare findings across accounts. Use whenever the user has more than /diff-scanning-with-aws-security-agentRun a fast AWS Security Agent diff scan on only the changed code since a git ref. Use when the user asks to scan changes, run a diff scan, check what changed for security issues, scan before committing, scan before PR, or any pre-commit/pre-push security check./investigating-incidents-with-aws-devops-agentRun a deep root-cause investigation on the AWS DevOps Agent. Use when the user describes an incident, alarm, outage, or unexplained behavior — keywords like "5xx", "503", "OOM", "latency spike", "deployment failure", "rollback", "sev1", "investigate", "root cause", "debug",/pentesting-with-aws-security-agentRun an AWS Security Agent penetration test against a live web application — registers and verifies the target domain, exercises the supplied endpoints with the managed Security Agent service, and returns verified runtime findings. Use when the user asks to pentest, run a

Show all 146 skills

/remediating-with-aws-security-agentPull AWS Security Agent findings (penetration tests and code reviews) and drive remediation. Use this whenever the user mentions Security Agent, security findings, pentest or penetration test results, code review findings, vulnerabilities found in their AWS account, "what did /running-release-testsRun automated release testing (UI or API) via the AWS DevOps Agent using a pre-configured test profile. Use when the user wants to validate multi-step workflows, verify features, check for regressions, or test API endpoints. Trigger words include run tests, UAT, test my app,/scanning-with-aws-security-agentRun an AWS Security Agent scan on the workspace — uploads the source to AWS, scans it with the managed Security Agent service, and returns ranked, verified findings with code locations and remediations. Use when the user asks to scan code, find vulnerabilities, run a security /setup-devops-agentSetup and diagnostics for the AWS DevOps Agent MCP connection. Triggers when aws-devops-agent is missing from .mcp.json, when the connection is broken, or when the user says "set up devops agent" / "configure agent". Does NOT trigger if the MCP is already connected and working./setup-security-agentConfigure AWS Security Agent for the current workspace — provision or reuse an agent space, IAM service role, and S3 bucket. Use when the user asks to "set up security agent", "configure security scanner", "is security agent configured", or on first-time use before any scan or /setupSet up the AWS DevOps Agent and AWS Security Agent connections. Use when the user says "set up", "configure", "connect", or when MCP tools are missing./threat-modeling-with-aws-security-agentRun an AWS Security Agent threat model review on spec/design documents. Use when the user asks to review a spec for security, run a threat model, check if a design introduces security risks, review requirements.md or design.md for security posture changes, or STRIDE analysis./agents-buildUse to extend an existing agent project with memory, app integration, VPC, multi-agent, migration, model, browser, code interpreter, payments, or resource removal. Triggers: "add memory", "remember across sessions", "call agent from app", "invoke agent from code", "agent auth",/agents-connectUse when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies. Handles gateway setup, target types, outbound auth (OAuth, API key, IAM), credentials, and Cedar policy authoring. Triggers on: "connect to API", "add /agents-debugUse when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues. Reads traces and logs to diagnose root causes. Also checks prerequisites when the CLI itself isn't working. Triggers on: "agent not working", "wrong answer", "agent /agents-deployUse when deploying your agent to AWS, or when a deploy has failed. Handles pre-flight validation, CDK/IAM/quota error diagnosis, version management, rollback, and canary deployments. Triggers on: "deploy my agent", "agentcore deploy", "deploy failed", "CDK error", "rollback",/agents-get-startedUse when a developer wants to create a new agent project or get started with AgentCore. Handles framework selection, project scaffolding, first deploy, and first invocation. Triggers on: "build an agent", "create an agent", "get started", "new project", "agentcore create",/agents-hardenUse when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle, rate limiting, input validation, and quota guidance. Triggers on: "production checklist", "harden agent", "production ready",/agents-optimizeUse when measuring or improving agent quality and performance — set up evaluators, online monitoring, CI/CD quality gates, observability, or cost optimization. Triggers on: "evaluate my agent", "add evaluator", "measure quality", "quality gate", "run evals", "agent too slow",/agents-payUse when THIS agent needs to pay for x402-protected content at runtime: hitting a paywall mid-task, settling it via AgentCore Payments, and applying operator-defined spend limits. Covers payment setup, policy, session budgets, and troubleshooting. Triggers on: "my agent hit a /agents-payUse when THIS agent needs to pay for x402-protected content at runtime: hitting a paywall mid-task, settling it via AgentCore Payments, and applying operator-defined spend limits. Covers payment setup, policy, session budgets, and troubleshooting. Triggers on: "my agent hit a /amazon-bedrockBuilds generative AI applications on Amazon Bedrock. Covers model invocation (Converse API, InvokeModel), RAG with Knowledge Bases, Bedrock Agents, Guardrails, and AgentCore (including the Harness managed agent loop). Use when invoking models, setting up Knowledge Bases,/aws-ai-mlSelects, deploys, and customizes AI models on Amazon SageMaker. Fine-tuning (SFT, DPO, RLVR, RLAIF), model selection, dataset preparation, evaluation, deployment to SageMaker endpoints or Bedrock, and endpoint diagnostics. Covers the full lifecycle from planning through /aws-billing-and-cost-managementAnalyze AWS costs, find savings, manage budgets, evaluate Savings Plans and Reserved Instances, right-size EC2/Lambda/RDS/EBS with Compute Optimizer, look up service pricing, query CUR with Athena, detect cost anomalies, scope costs to billing views, and monitor Free Tier usage./aws-blocksGuides building full-stack applications with AWS Blocks — an Infrastructure-from-Code framework. Applies when creating APIs, selecting Building Blocks (KVStore, DistributedTable, Database, AuthBasic, AuthCognito, Realtime, AsyncJob, FileBucket, etc.), running local development,/aws-cdkAuthors, deploys, and troubleshoots AWS infrastructure using CDK with TypeScript or Python. Covers best practices, stack architecture, and construct patterns. Always use when writing CDK constructs, bootstrapping environments, running cdk deploy/synth/diff, fixing CDK or /aws-cloudformationAuthor, validate, and troubleshoot AWS CloudFormation templates. Covers template authoring with secure defaults, pre-deployment validation (cfn-lint, cfn-guard, change sets), and root-cause diagnosis of failed stacks using CloudFormation events and CloudTrail correlation./aws-computeProvisions, scales, and operates Amazon EC2 virtual-machine workloads: instance-type selection (Graviton/Arm64, burstable T credits, GPU, instance store vs EBS), launch templates, Auto Scaling groups (scaling policies, instance refresh, mixed instances, Spot, warm pools,/aws-containersDeploys and operates containerized workloads on ECS, Fargate, and ECR. Covers task definitions, Fargate services, ECR repository setup and lifecycle policies, ECS Exec debugging, service scaling, deployment strategies, load balancer integration, and logging configuration. Use /aws-databaseRoutes any task involving AWS databases — choosing, comparing, recommending, getting started with, or operating a database — to the correct service-specific skill. Supersedes general training-data knowledge with post-training service updates, corrected limitations, and decision /aws-deploymentConfigures CI/CD pipelines using AWS CodePipeline, CodeBuild, CodeDeploy, CodeConnections, and CodeArtifact. Covers CodePipeline V2 (triggers, variables, execution modes, cross-account), buildspec.yml (caching, VPC, Docker), CodeDeploy strategies (blue/green, canary, linear),/aws-iamVerified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits, Organizations quirks, and SAML/MFA specifics. Also provides structured workflows for IAM role management and least-privilege /aws-messaging-and-streamingGuides general use of AWS messaging and streaming services. Covers Amazon SQS, Amazon SNS, Amazon EventBridge, Amazon MQ, Amazon Kinesis Data Streams, Amazon Data Firehose, Amazon Managed Service for Apache Flink, and Amazon Managed Streaming for Apache Kafka (MSK). Use when /aws-observabilityBuilds, configures, debugs, and optimizes AWS observability with CloudWatch (Log Insights, Metrics, Alarms, Dashboards, EMF), X-Ray, CloudTrail, and ADOT (AWS Distro for OpenTelemetry), AND enables/onboards services to Application Signals using ADOT auto-instrumentation SDKs./aws-sdk-js-v3-usageAWS SDK for JavaScript v3 development patterns. Use when writing JavaScript or TypeScript code that uses AWS services via @aws-sdk/* packages (aws-sdk-js-v3), or when asked about schemas, runtime validation, serialization, or code generation in the context of the JS/TS AWS SDK./aws-sdk-python-usageAWS SDK for Python (boto3/botocore) development patterns. You MUST use this skill when writing Python code that uses AWS services via boto3 or botocore. This includes creating service clients or resources, configuring sessions and credentials, handling errors with ClientError,/aws-sdk-swift-usageAWS SDK for Swift development patterns. Use when writing Swift code that uses AWS services via aws-sdk-swift package./aws-secrets-managerSecret safety for AWS Secrets Manager, secret management, credentials, API keys, tokens, and passwords. Prevents AI agents from directly fetching secret values and teaches runtime dynamic references with asm-exec so plaintext never enters the LLM context window./aws-serverlessBuilds, deploys, manages, debugs, configures, and optimizes serverless applications on AWS using Lambda, API Gateway, Step Functions, EventBridge, and SAM/CDK. Covers cold starts, CORS debugging, event source mappings, troubleshooting, concurrency, SnapStart, Powertools,/launch-with-awsMigrates vibe-coded web applications to AWS. Handles the full workflow from analysis through migration to deployment, producing deployable AWS Blocks infrastructure code. Supports full-stack apps built with vibe-coding platforms (Lovable, Bolt.new, Replit) and frontend web /signing-in-to-awsGets AWS credentials for CLI/SDK access via `aws login`. Activates when a developer needs to authenticate to AWS for local development, when an AWS operation fails due to missing or expired credentials, or when someone asks about setting up AWS access. Triggers: "set up AWS",/amazon-opensearch-serviceAmazon OpenSearch Service and Serverless across five capabilities — migration (Solr/ES/self-managed OpenSearch into AOS/AOSS, schema/query translation, sizing, cutover); provisioning (domain + AOSS lifecycle, upgrades, storage tiers, FGAC, monitoring); search (vector / semantic /connecting-to-data-sourceCreate and troubleshoot AWS Glue connections to JDBC databases (Oracle, SQL Server, PostgreSQL, MySQL, RDS), Redshift, Snowflake, and BigQuery. Gathers connection hints from user, discovers existing connections and RDS/Redshift candidates, registers credentials in Secrets /creating-data-lake-tableCreate managed Iceberg tables using Amazon S3 Tables (s3tables API namespace) with automatic compaction and snapshot management. Sets up table bucket, namespace, table, schema, Glue catalog registration, partitioning, IAM access control. Triggers on: create table, data lake /exploring-data-catalogFull inventory and audit of AWS Glue Data Catalog assets across S3 Tables, Redshift-federated, and remote Iceberg catalogs. Triggers on: inventory the catalog, audit databases, list all tables, catalog overview, data landscape, enumerate catalogs, data inventory, search the /finding-data-lake-assetsResolve data lake and lakehouse asset references across Glue Data Catalog, S3, S3 Tables, and Redshift. Triggers on: find the table, where is our data, which table has, locate dataset, find data for, search catalog, what tables match, Redshift table, lakehouse table, data lake /ingesting-into-data-lakeImport data into the AWS data lake from S3 files, local uploads, JDBC databases (Oracle, SQL Server, PostgreSQL, MySQL, RDS, Aurora), Amazon Redshift, Snowflake, BigQuery, DynamoDB, or existing Glue catalog tables (migration). Default target is S3 Tables; standard Iceberg on a /querying-data-lakeExecute and manage Athena SQL queries across default and federated catalogs (Glue, S3 Tables, Redshift). Triggers on phrases like: query data, run SQL, athena query, analyze table, SQL query, workgroup status, profile table, query Redshift catalog, query S3 Tables. Do NOT use /storing-and-querying-vectorsStore and query vector embeddings using Amazon S3 Vectors, a cost-effective long-term vector storage service with its own API namespace (s3vectors). Triggers on: create S3 vector bucket, vector index, store embeddings, semantic search, RAG vector storage, similarity search,/amazon-bedrockBuilds generative AI applications on Amazon Bedrock. Covers model invocation (Converse API, InvokeModel), RAG with Knowledge Bases, Bedrock Agents, Guardrails, and AgentCore (including the Harness managed agent loop). Use when invoking models, setting up Knowledge Bases,/aws-ai-mlSelects, deploys, and customizes AI models on Amazon SageMaker. Fine-tuning (SFT, DPO, RLVR, RLAIF), model selection, dataset preparation, evaluation, deployment to SageMaker endpoints or Bedrock, and endpoint diagnostics. Covers the full lifecycle from planning through /aws-authAdds user authentication to web and mobile apps with Amazon Cognito (user pools and identity pools) and the AWS Amplify client auth libraries. Covers sign-up/sign-in flows and the login page (Cognito-hosted UI / managed login), MFA, password policies, OAuth 2.0 / OIDC flows /aws-billing-and-cost-managementAnalyze AWS costs, find savings, manage budgets, evaluate Savings Plans and Reserved Instances, right-size EC2/Lambda/RDS/EBS with Compute Optimizer, look up service pricing, query CUR with Athena, detect cost anomalies, scope costs to billing views, and monitor Free Tier usage./aws-blocksGuides building full-stack applications with AWS Blocks — an Infrastructure-from-Code framework. Applies when creating APIs, selecting Building Blocks (KVStore, DistributedTable, Database, AuthBasic, AuthCognito, Realtime, AsyncJob, FileBucket, etc.), running local development,/aws-cdkAuthors, deploys, and troubleshoots AWS infrastructure using CDK with TypeScript or Python. Covers best practices, stack architecture, and construct patterns. Always use when writing CDK constructs, bootstrapping environments, running cdk deploy/synth/diff, fixing CDK or /aws-cloudformationAuthor, validate, and troubleshoot AWS CloudFormation templates. Covers template authoring with secure defaults, pre-deployment validation (cfn-lint, cfn-guard, change sets), and root-cause diagnosis of failed stacks using CloudFormation events and CloudTrail correlation./aws-computeProvisions, scales, and operates Amazon EC2 virtual-machine workloads: instance-type selection (Graviton/Arm64, burstable T credits, GPU, instance store vs EBS), launch templates, Auto Scaling groups (scaling policies, instance refresh, mixed instances, Spot, warm pools,/aws-containersDeploys and operates containerized workloads on ECS, Fargate, and ECR. Covers task definitions, Fargate services, ECR repository setup and lifecycle policies, ECS Exec debugging, service scaling, deployment strategies, load balancer integration, and logging configuration. Use /aws-databaseRoutes any task involving AWS databases — choosing, comparing, recommending, getting started with, or operating a database — to the correct service-specific skill. Supersedes general training-data knowledge with post-training service updates, corrected limitations, and decision /aws-deploymentConfigures CI/CD pipelines using AWS CodePipeline, CodeBuild, CodeDeploy, CodeConnections, and CodeArtifact. Covers CodePipeline V2 (triggers, variables, execution modes, cross-account), buildspec.yml (caching, VPC, Docker), CodeDeploy strategies (blue/green, canary, linear),/aws-iamVerified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits, Organizations quirks, and SAML/MFA specifics. Also provides structured workflows for IAM role management and least-privilege /aws-messaging-and-streamingGuides general use of AWS messaging and streaming services. Covers Amazon SQS, Amazon SNS, Amazon EventBridge, Amazon MQ, Amazon Kinesis Data Streams, Amazon Data Firehose, Amazon Managed Service for Apache Flink, and Amazon Managed Streaming for Apache Kafka (MSK). Use when /aws-networkingRoutes AWS networking requests to the correct service skill for implementation. Covers Route 53 (DNS, health checks, routing policies, Resolver, DNS Firewall), CloudFront (caching, edge, OAC, mTLS, signed URLs), Transit Gateway (multi-VPC hub, segmentation, centralized egress),/aws-observabilityBuilds, configures, debugs, and optimizes AWS observability with CloudWatch (Log Insights, Metrics, Alarms, Dashboards, EMF), X-Ray, CloudTrail, and ADOT (AWS Distro for OpenTelemetry), AND enables/onboards services to Application Signals using ADOT auto-instrumentation SDKs./aws-sdk-js-v3-usageAWS SDK for JavaScript v3 development patterns. Use when writing JavaScript or TypeScript code that uses AWS services via @aws-sdk/* packages (aws-sdk-js-v3), or when asked about schemas, runtime validation, serialization, or code generation in the context of the JS/TS AWS SDK./aws-sdk-python-usageAWS SDK for Python (boto3/botocore) development patterns. You MUST use this skill when writing Python code that uses AWS services via boto3 or botocore. This includes creating service clients or resources, configuring sessions and credentials, handling errors with ClientError,/aws-sdk-swift-usageAWS SDK for Swift development patterns. Use when writing Swift code that uses AWS services via aws-sdk-swift package./aws-securityCovers AWS security services and workflows — Security Hub V2 (OCSF) findings, connectors, aggregators, automation rules, and security posture summaries; Security Hub CSPM (V1/ASFF) controls and compliance standards; GuardDuty threat findings; Inspector vulnerability findings;/aws-serverlessBuilds, deploys, manages, debugs, configures, and optimizes serverless applications on AWS using Lambda, API Gateway, Step Functions, EventBridge, and SAM/CDK. Covers cold starts, CORS debugging, event source mappings, troubleshooting, concurrency, SnapStart, Powertools,/launch-with-awsMigrates vibe-coded web applications to AWS. Handles the full workflow from analysis through migration to deployment, producing deployable AWS Blocks infrastructure code. Supports full-stack apps built with vibe-coding platforms (Lovable, Bolt.new, Replit) and frontend web /signing-in-to-awsGets AWS credentials for CLI/SDK access via `aws login`. Activates when a developer needs to authenticate to AWS for local development, when an AWS operation fails due to missing or expired credentials, or when someone asks about setting up AWS access. Triggers: "set up AWS",/amazon-opensearch-serviceAmazon OpenSearch Service and Serverless across five capabilities — migration (Solr/ES/self-managed OpenSearch into AOS/AOSS, schema/query translation, sizing, cutover); provisioning (domain + AOSS lifecycle, upgrades, storage tiers, FGAC, monitoring); search (vector / semantic /aws-cleanroomsTroubleshoots and debugs AWS Clean Rooms collaboration issues related to IAM roles, S3 bucket policies, KMS keys, Lake Formation permissions, and CloudWatch logging for custom ML model training and inference jobs. Use when a customer reports permission failures, access errors,/connecting-to-data-sourceCreate and troubleshoot AWS Glue connections to JDBC databases (Oracle, SQL Server, PostgreSQL, MySQL, RDS), Redshift, Snowflake, and BigQuery. Gathers connection hints from user, discovers existing connections and RDS/Redshift candidates, registers credentials in Secrets /developing-applications-on-managed-service-for-apache-flinkMANDATORY for Flink or Amazon Managed Service for Apache Flink (MSF) questions. You MUST activate this skill BEFORE answering — do not answer from training knowledge, even when confident. MSF has service-specific constraints (KPU model, prohibited checkpoint and parallelism /exploring-data-catalogFull inventory and audit of AWS Glue Data Catalog assets across S3 Tables, Redshift-federated, and remote Iceberg catalogs. Triggers on: inventory the catalog, audit databases, list all tables, catalog overview, data landscape, enumerate catalogs, data inventory, search the /finding-data-lake-assetsResolve data lake and lakehouse asset references across Glue Data Catalog, S3, S3 Tables, and Redshift. Triggers on: find the table, where is our data, which table has, locate dataset, find data for, search catalog, what tables match, Redshift table, lakehouse table, data lake /ingesting-into-data-lakeImport data into the AWS data lake from S3 files, local uploads, JDBC databases (Oracle, SQL Server, PostgreSQL, MySQL, RDS, Aurora), Amazon Redshift, Snowflake, BigQuery, DynamoDB, or existing Glue catalog tables (migration). Default target is S3 Tables; standard Iceberg on a /managing-amazon-mskOperates Amazon MSK Provisioned clusters (Standard and Express brokers). Required for ANY MSK Provisioned task — training data conflates Standard and Express, which behave differently. Covers performance, consumer lag, storage, traffic shaping; sizing Standard vs Express; Kafka /migrate-to-mskHelps migrate self-managed Apache Kafka workloads to Amazon MSK Express. Inventories the source cluster (from IaC files, Kafka CLI output, or manual input), assesses MSK Express compatibility across topology, Kafka version, configs, auth, and quotas, produces a target Express /migrating-to-amazon-redshiftGuides an end-to-end data-warehouse migration to Amazon Redshift — discovery, schema/SQL/stored-procedure/macro/script conversion, data migration, validation, performance comparison, and reporting. Source-routed via `references/<source>/`; Teradata (Vantage) is the supported /querying-data-lakeExecute and manage Athena SQL queries across default and federated catalogs (Glue, S3 Tables, Redshift). Triggers on phrases like: query data, run SQL, athena query, analyze table, SQL query, workgroup status, profile table, query Redshift catalog, query S3 Tables. Do NOT use /redshift-guideAmazon Redshift is NOT PostgreSQL — corrects PostgreSQL-derived LLM mistakes; covers Redshift-specific SQL, DDL, COPY/UNLOAD, system views, metadata discovery, and operational patterns. Applies ONLY when the task is about Redshift itself (cluster, Serverless workgroup, or /amazon-aurora-mysqlAmazon Aurora MySQL — creates, modifies, and advises on Aurora MySQL clusters specifically (MySQL-compatible engine, Aurora serverless, parallel query). Trigger for Aurora MySQL cluster operations, ACU sizing, I/O-Optimized storage, commitment pricing, or MySQL upgrade planning./amazon-aurora-postgresqlAmazon Aurora PostgreSQL — creates, modifies, and advises on Aurora PostgreSQL clusters specifically (PostgreSQL-compatible engine, Aurora serverless, express configuration, pgvector, Babelfish). Trigger for Aurora PostgreSQL cluster operations, express-configuration /amazon-documentdbManages Amazon DocumentDB end-to-end — serverless-on-8.0 cluster setup, TLS/VPC/driver config, flexible-schema and vector-search data modeling, MongoDB compatibility assessment, DMS-based migration, slow-query diagnosis, major version upgrades (4.0→5.0→8.0), Well-Architected /amazon-dynamodbDesigns, reviews, and debugs DynamoDB data layers from design axioms — enumerates access patterns, chooses partition/sort keys and GSIs, decides single-table vs. multi-table, configures Streams, Global Tables, TTL, and zero-ETL integrations to OpenSearch/Redshift/SageMaker /amazon-elasticacheActivate when developers have latent caching needs: slow API responses, database read bottlenecks, DynamoDB throttling or cost, RDS/Aurora scaling pressure, Bedrock latency or cost, or adding a cache; activate when working with Redis, Valkey, Memcached, or any in-memory data /amazon-keyspacesProvides authoritative compatibility checks, pricing estimates, connection troubleshooting, pre-warming guidance, and infrastructure mutations for Amazon Keyspaces (for Apache Cassandra). Covers LWT/batch operations, secondary indexes, materialized views, capacity modes, TTL,/aurora-dsqlProvisions and manages Aurora DSQL clusters, connects via psql or DSQL Connectors, manages schemas, runs queries, migrates from MySQL, diagnoses query plans, and develops apps on serverless distributed SQL. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL migration, DDL,/creating-amazon-aurora-db-cluster-with-instancesCreates a complete Amazon Aurora database cluster with instances, handling cluster creation, instance provisioning, and Secrets Manager password management in the proper sequence. Use when setting up new Aurora MySQL or PostgreSQL clusters with production-ready configuration./exporting-rds-to-s3Exports Amazon RDS or Aurora database snapshots to Amazon S3 in Apache Parquet format for analytics, backup, or data migration. Handles snapshot selection or creation, IAM role setup, KMS encryption, S3 bucket preparation, export task execution, progress monitoring, and data /rds-db2Provisions, connects, migrates, and operates Amazon RDS for Db2. Applies when provisioning with IBM customer and site IDs (License Manager, BYOL, GovCloud), connecting over TLS, fixing SQL30082N after Secrets Manager rotation, migration from Db2 LUW (Linux, AIX, Windows, AS400)/rds-oracleDiagnoses and resolves Amazon RDS for Oracle connectivity, authentication, networking, and driver troubleshooting. Applicable to any RDS-for-Oracle question including connecting a Python Lambda to RDS Oracle in a VPC with pooling and cold-start optimization, EKS pods to RDS /rds-ossAdvises on Amazon RDS open-source engines (MySQL, MariaDB, PostgreSQL) for instance creation, upgrade planning, commitment pricing, proxy evaluation, and Blue/Green deployments. Handles any RDS MySQL, MariaDB, or PostgreSQL question, including create a production-ready RDS MySQL /rds-sqlserverProvides connectivity, authentication, and troubleshooting guidance for Amazon RDS for SQL Server. Applicable when users ask about SSMS times out connecting from EC2, Cannot generate SSPI context with Windows auth, connect RDS SQL Server from Lambda with pymssql, auth_scheme /timestream-influxdbRetrieves authoritative guidance on Amazon Timestream for InfluxDB (managed InfluxDB 2, InfluxDB 2 Read Replica Clusters, InfluxDB 3 Core and Enterprise). Applicable to any InfluxDB-on-AWS request including engine selection, provisioning (Marketplace +/creating-ec2-image-builder-pipelineCreates a complete EC2 Image Builder pipeline that builds a custom AMI with pre-installed software, distributes it to target regions, executes the pipeline, and creates a launch template. Use when setting up automated AMI creation with IAM roles, build components, image recipes,/launching-ec2-instance-with-best-practicesLaunches an EC2 instance with secure, cost-efficient defaults including AMI selection, burstable instance sizing, least-privilege IAM roles, hardened security groups, encrypted EBS volumes, and comprehensive tagging. Use when deploying new EC2 instances following AWS best /setting-up-ec2-instance-profilesConfigures EC2 instances to securely call AWS services by creating and attaching IAM roles via instance profiles, eliminating hardcoded credentials. Use when an EC2 instance needs permissions to access AWS services like S3, DynamoDB, SQS, or CloudWatch through temporary /aws-transformPerforms code upgrades, migrations, and transformations using the AWS Transform (ATX) CLI. Use when upgrading language versions, migrating AWS SDKs, migrating frameworks (Angular, Vue.js, Spring Boot, React), upgrading libraries, optimizing performance, migrating x86 to /dms-schema-conversionHandles the full DMS Schema Conversion lifecycle including creating migration projects, converting database schemas to a target engine, running compatibility assessments, navigating metadata trees, exporting converted DDL to S3, applying schema changes to a target database, and /cloudfrontConfigures Amazon CloudFront content delivery across six workflows: when to use CloudFront and how it fits with AWS WAF, Shield, CloudFront Functions, Lambda@Edge, Route 53, and origins (creating a distribution, caching, and Flat Rate Pricing (FRP) versus pay-as-you-go pricing);/configuring-vpc-endpoints-for-private-aws-service-accessConfigures VPC endpoints (interface and gateway) for private AWS service access using AWS PrivateLink. Use when setting up secure private connectivity to S3, DynamoDB, and other AWS services without internet gateway, NAT device, or public IP addresses. Covers endpoint creation,/connecting-vpcs-with-peeringEstablishes VPC peering connections between two VPCs for direct private network connectivity. Always use this skill when creating or managing VPC peering — it validates CIDR overlap, updates all route tables in both VPCs, configures DNS resolution, and provides security group /creating-production-vpc-multi-azCreates a production-ready VPC with public and private subnets across multiple Availability Zones, including internet gateway, NAT gateways, route tables, and security groups following AWS Well-Architected principles. Use when deploying multi-AZ VPC infrastructure with automatic /directconnectConfigures AWS Direct Connect: choosing a connection model (dedicated, hosted, or a link aggregation group) and completing the cross connect; creating private, public, and transit virtual interfaces and bringing up BGP; reaching many VPCs through a Direct Connect gateway /enabling-lambda-vpc-internet-accessEnables internet access for AWS Lambda functions deployed in VPC subnets by creating NAT Gateway infrastructure, configuring public/private subnet routing, and updating security groups. Use when a VPC-attached Lambda function cannot reach the internet./route53Configures Amazon Route 53 DNS: public and private records, traffic-steering routing policies, health checks, DNS Firewall, Route 53 Profiles, VPC Resolver (also known as Route 53 Resolver) for hybrid and Outposts networks, and Global Resolver. Applicable when the customer wants /routing-traffic-with-route53-and-cloudfrontConfigures Amazon Route 53 to route traffic to a CloudFront distribution using a custom domain. Use when setting up DNS alias records, alternate domain names (CNAMEs), ACM certificates for HTTPS, and IPv6 support for CloudFront./shieldadvancedConfigures AWS Shield Advanced for enhanced Distributed Denial of Service (DDoS) protection: subscribing accounts and adding resource protections, enabling automatic application layer (layer 7) mitigation through AWS WAF, configuring health-based detection with Route 53 health /sitetositevpnConfigures AWS Site-to-Site VPN: creating an IPsec VPN connection between an on-premises network and a VPC, choosing the target gateway (virtual private gateway, transit gateway, or AWS Cloud WAN), choosing static or dynamic (BGP) routing, sizing tunnel bandwidth (Standard 1.25 /transitgatewayConfigures AWS Transit Gateway: creating a hub and attaching VPCs, segmenting traffic with route tables, centralizing egress and inspection through a hub (appliances or a Gateway Load Balancer endpoint), forcing east-west traffic between VPCs through AWS Network Firewall,/wafConfigures AWS WAF to filter web traffic: creating web access control lists (web ACLs) on CloudFront, Application Load Balancers, API Gateway, and AppSync; AWS Managed Rules tuned in Count mode; rate-based rules for HTTP floods; IP set and geographic match rules; Bot Control /aws-network-monitoringInstalls, configures, and troubleshoots Network Flow Monitor agents on EC2 instances to monitor network path health. Covers agent installation, IAM permissions, monitoring network paths, and troubleshooting agents reporting no metrics, HTTP 403 errors, or connectivity failures./setting-up-cloudtrail-multi-regionEnables a multi-region AWS CloudTrail trail with S3 log storage, CloudWatch Logs integration, and CloudWatch Logs Insights queries for security monitoring and compliance auditing. Use when setting up centralized API activity logging across all AWS regions./setting-up-cloudwatch-alarm-notificationsSets up notification channels for CloudWatch alarms using SNS topics and subscriptions. Always use this skill when configuring alarm notifications — it creates encrypted SNS topics, configures topic policies for CloudWatch access, sets up email/SMS/webhook subscriptions, and /troubleshooting-application-failuresTroubleshoots failing applications by discovering and analyzing CloudWatch log groups to identify error patterns, root causes, and actionable solutions. Use when an application is experiencing failures and log-based diagnosis is needed./arc-region-switchAnswers questions about Amazon Application Recovery Controller (ARC) Region switch including architecture, plans, execution blocks, workflows, triggers, active/active vs active/passive, cross-account support, recovery time, dashboards, and customer positioning. Applicable when /aws-resilience-lifecycleGuides the end-to-end AWS resilience lifecycle integrating Resilience Hub v2, Fault Injection Service, and Application Recovery Controller. Covers the Define → Test → Operate workflow: from policy creation through failure mode assessment, to FIS experiment validation, to ARC /recovery-controller-setupConfigures AWS Application Recovery Controller (ARC) for operational resilience: routing controls with safety rules for cross-Region failover, and zonal shift / zonal autoshift for AZ-impairment recovery. Applies when setting up failover routing, configuring safety rules,/resilience-hub-failure-mode-assessmentRuns and interprets AWS Resilience Hub v2 failure mode assessments. Covers starting assessments, understanding findings (severity, categories, recommendations), triaging by achievability, working with AI-generated service functions, and resolving findings. Applies when the user /resilience-hub-getting-startedSets up AWS Resilience Hub v2 from scratch: creates resilience policies with SLO targets, registers systems and user journeys, onboards services with input sources, and runs a first failure mode assessment. Applies when the user wants to get started with Resilience Hub v2,/resilience-hub-multi-accountConfigures AWS Resilience Hub v2 for multi-account resilience management across an AWS Organization. Covers the per-service cross-account permission model, cross-account IAM roles, and centralized assessment from a single account. Applies when the user wants to set up org-wide /resilience-program-designDesigns a resilience program: how to structure and standardize resilience policies across an organization, team, or portfolio (tiered policy model with availability/RTO/RPO targets and DR approach selection), and how often to run resilience activities (operational cadence)./creating-secrets-using-best-practicesCreates and manages secrets in AWS Secrets Manager following security best practices. Always use this skill when creating secrets — it sets up dedicated KMS encryption keys, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management that are /aws-lambda-durable-functionsBuilds resilient, long-running, multi-step applications with AWS Lambda durable functions with automatic state persistence, retry logic, and orchestration for long-running executions. Covers the critical replay model, step operations, wait/callback patterns, error handling with /aws-lambda-managed-instancesEvaluates, configures, and migrates workloads to AWS Lambda Managed Instances (LMI). Runs Lambda functions on EC2 instances in the user's account while AWS manages provisioning, patching, scaling, routing, and load balancing. Triggers when queries mention Lambda Managed /aws-lambda-microvmsBuilds, runs, debugs, and operates applications on AWS Lambda MicroVMs — Firecracker-isolated, snapshot-resumable serverless compute environments running inside a container with up to 8 hr lifetimes. Applicable when workloads need strong isolation between tenants, isolated /aws-step-functionsAuthors and edits AWS Step Functions state machines: writes Amazon States Language (ASL) in JSONata, and chooses and structures state types (Task, Choice, Map, Parallel, Pass, Wait, Succeed, Fail). Covers ASL syntax, JSONata data transformation and variables, Retry/Catch error /connecting-lambda-to-api-gatewayConnects an existing AWS Lambda function to Amazon API Gateway by creating a REST or HTTP API with resource/method setup, Lambda proxy integration, permissions, and deployment. Always use this skill when connecting Lambda to API Gateway — it handles CORS, throttling, access /connecting-lambda-to-dynamodbConnects an AWS Lambda function to DynamoDB with IAM roles, stream event source mapping, and read/write permissions. Use when setting up Lambda-DynamoDB integration, processing DynamoDB stream events, or deploying serverless event-driven architectures./creating-api-gateway-stageCreates an API Gateway stage with CloudWatch logging, X-Ray tracing, throttling, WAF integration, and IAM roles following AWS best practices. Use when deploying a REST API to different environments such as dev, test, or production./debugging-lambda-timeoutsDebugs AWS Lambda function timeout failures by systematically analyzing function configuration, CloudWatch logs and metrics, VPC/networking, cold starts, memory constraints, and downstream dependencies to identify root causes with actionable fixes. Use when a Lambda function is /deploying-custom-domain-rest-apiDeploys a Regional REST API with a custom domain name, a Lambda backend function, and a request-based Lambda authorizer using AWS CLI. Covers ACM certificate provisioning, API Gateway REST API creation, Lambda function deployment, request authorizer setup, custom domain /processing-s3-uploads-with-step-functionsDeploy an event-driven workflow that routes S3 uploads to either Lambda or Fargate via Step Functions based on file size. Uses EventBridge to trigger a Step Functions state machine when objects are uploaded to S3. Small files are processed by Lambda, large files by a Fargate /creating-data-lake-tableCreate managed Iceberg tables using Amazon S3 Tables (s3tables API namespace) with automatic compaction and snapshot management. Sets up table bucket, namespace, table, schema, Glue catalog registration, partitioning, IAM access control. Triggers on: create table, data lake /securing-s3-bucketsCreate and secure S3 buckets following AWS best practices for access control, encryption, monitoring, and remediation of misconfigurations. Use when the user wants to secure a new bucket, audit an existing bucket, fix a security finding, configure encryption, or enable logging /storing-and-querying-vectorsStore and query vector embeddings using Amazon S3 Vectors, a cost-effective long-term vector storage service with its own API namespace (s3vectors). Triggers on: create S3 vector bucket, vector index, store embeddings, semantic search, RAG vector storage, similarity search,/troubleshooting-efsDiagnoses and resolves Amazon EFS issues including mount failures, NFS timeouts, permission errors, throughput problems, and burst credit exhaustion. Use when the user has an EFS file system that is not mounting, returning errors, performing slowly, or showing access denied./troubleshooting-s3-filesDiagnoses and resolves Amazon S3 Files issues including mount failures, permission errors, synchronization problems, and performance issues. Use when the user has an S3 file system that is not mounting, returning access denied, not syncing changes to S3, showing files in /querying-aws-cloudwatchRuns SQL queries on CloudWatch Logs data exported as Apache Iceberg tables in S3 Tables. Covers VPC Flow Logs, WAF logs, CloudFront access logs, Route 53 resolver logs, Network Firewall logs, EKS audit logs, Verified Access logs, SES logs, VPC Lattice logs, Step Functions logs,/querying-aws-s3Queries S3 object metadata, tracks bucket activity, audits object changes, searches annotations, and analyzes storage metrics using S3 Metadata system tables (journal, inventory, annotation) and S3 Storage Lens tables via Athena SQL. Applies when counting objects, finding recent /querying-aws-sagemaker-catalogRuns SQL analytics on SageMaker Catalog asset metadata tables exported as Apache Iceberg in S3 Tables. Covers governance queries, asset growth tracking, ownership audits, time-travel over catalog state, and metadata quality analysis. Applies when querying catalog inventory,/aws-amplifyBuild and deploy full-stack web and mobile apps with AWS Amplify Gen2 (TypeScript code-first). Covers auth (Cognito), data (AppSync/DynamoDB), storage (S3), functions, APIs, and AI (Amplify AI Kit with Bedrock). Supports React, Next.js, Vue, Angular, React Native, Flutter,

Commands

/chatOpen a chat session with the AWS DevOps Agent and ask a question /costAsk the AWS DevOps Agent for cost optimization opportunities, scoped to your local IaC /investigateStart a deep root-cause investigation on the AWS DevOps Agent and stream progress /release-readinessTrigger a pre-merge release readiness review on a GitHub PR, GitLab MR, or local branch /release-testingRun automated UAT tests (UI or API) using a test profile on the AWS DevOps Agent /setup-devops-agentSet up the AWS DevOps Agent MCP connection

Show all 9 commands

/setup-security-agentSet up the AWS Security Agent workspace /setupSet up both AWS DevOps Agent and AWS Security Agent connections /spacesList configured AgentSpaces and summarize each one's accounts and capabilities

MCP

aws-devops-agenthttp awsknowledgehttp aws-mcpuvx

Badges

README

Read on GitHub

Agent Toolkit for AWS

Help AI coding agents build, deploy, and manage applications on AWS.

The Agent Toolkit for AWS gives AI coding agents the tools, knowledge, and guardrails they need to work with AWS services. It works with the coding agents developers already use — including Claude Code, Codex, Cursor, and Kiro.

Quick start

AWS CLI

Use the Agent Toolkit directly from your terminal with the AWS CLI:

aws configure agent-toolkit

See the AWS CLI integration guide for setup, configuration, and usage instructions.

Claude Code

The plugins are available on the official Anthropic marketplace (claude-plugins-official) which is added to your Claude Code installation by default. Use the following commands to install supported plugins from the toolkit:

For aws-core that covers service selection, CDK/CloudFormation, serverless, containers, storage, observability, billing, SDK usage, and deployment:

/plugin install aws-core@claude-plugins-official

Tip: If you get Plugin not found, update your local marketplace index first:
/plugin marketplace update claude-plugins-official

For aws-agents that covers building AI agents on AWS with Amazon Bedrock and AgentCore:

/plugin install aws-agents@claude-plugins-official

For aws-data-analytics that covers data lake, analytics, and ETL workflows with S3 Tables, AWS Glue, and Athena:

/plugin install aws-data-analytics@claude-plugins-official

For aws-agents-for-devsecops used to investigate incidents, review code and execute UAT for release readiness, scan code for vulnerabilities, and run penetration tests with AWS DevOps Agent and AWS Security Agent.

/plugin marketplace add aws/agent-toolkit-for-aws
/plugin install aws-agents-for-devsecops
/reload-plugins

# Or from Claude's official marketplace:
/plugin install aws-agents-for-devsecops@claude-plugins-official
/reload-plugins

# Setup:
/aws-agents-for-devsecops:setup

Codex

In your terminal:

codex plugin marketplace add aws/agent-toolkit-for-aws

Then launch Codex and run /plugins to browse and install the aws-core plugin.

Cursor

Add this repository as a team marketplace from Settings → Plugins → Team Marketplaces → Add Marketplace → Import from Repo, pointing it at aws/agent-toolkit-for-aws. Cursor indexes the plugins listed in .cursor-plugin/marketplace.json on import.

Then open the Plugins panel and install the aws-core plugin (start here), or aws-agents and aws-data-analytics as needed. Each plugin bundles the AWS MCP Server configuration and agent skills.

Kiro

Kiro setup has two independent parts: the AWS MCP Server (for runtime AWS API access and documentation search) and local skills (for task-specific agent guidance). They complement each other but work independently — skills don't require the MCP server, and the MCP server doesn't serve locally-installed skills.

1. Add the AWS MCP Server to your Kiro MCP configuration (.kiro/settings/mcp.json):

{
  "mcpServers": {
    "aws": {
      "command": "uvx",
      "args": [
        "mcp-proxy-for-aws@1.6.4",
        "https://aws-mcp.us-east-1.api.aws/mcp",
        "--metadata",
        "AWS_REGION=us-west-2"
      ]
    }
  }
}

Note: It is recommended to pin to a specific version (e.g., @1.6.4) to ensure reproducible behavior and protect against supply chain risks. We recommend regularly checking PyPI for new stable versions and updating accordingly.

The MCP server gives your agent access to AWS APIs, sandboxed script execution, and real-time documentation search.

2. Install skills from this repository:

npx skills add aws/agent-toolkit-for-aws/skills

This installs skill files to ~/.kiro/skills/ (global) or .kiro/skills/ (project-level). Each skill is a directory containing a SKILL.md file and optionally a references/ subdirectory with additional context the agent reads from the local filesystem when needed. Kiro discovers installed skills automatically and activates them on demand when a task matches.

Prerequisites: You need uv installed. An AWS account with credentials configured locally is required for API calls and script execution, but not for documentation search or skill discovery. See the user guide for detailed setup instructions.

Other agents

See the AWS MCP Server getting started guide for instructions on configuring the AWS MCP Server with your agent.

Then install skills from this repository:

npx skills add aws/agent-toolkit-for-aws/skills

Prerequisites: You need uv installed. An AWS account with credentials configured locally is required for API calls and script execution, but not for documentation search or skill discovery. See the user guide for detailed setup instructions.

What's included

Plugins

Plugins bundle the AWS MCP Server configuration and agent skills into a single install for your coding agent.

Plugin	Description
aws-core	Core AWS skills and MCP Server configuration. Covers service selection, CDK/CloudFormation, serverless, containers, storage, observability, billing, SDK usage, and deployment. Start here.
aws-agents	Skills for building AI agents on AWS with Amazon Bedrock and AgentCore.
aws-data-analytics	Skills for data lake, analytics, and ETL workflows with S3 Tables, AWS Glue, and Athena.
aws-agents-for-devsecops	Investigate incidents, review code and execute UAT for release readiness, scan code for vulnerabilities, and run penetration tests with AWS DevOps Agent and AWS Security Agent.

Plugins are currently available for Claude Code, Codex, and Cursor. For other agents, configure the AWS MCP Server directly and install skills from this repository.

Skills

Agent skills are curated packages of instructions and reference materials that help agents complete specific AWS tasks. Skills are loaded on demand — agents discover and retrieve only what's relevant to the current task.

npx skills add aws/agent-toolkit-for-aws/skills

Browse the skills/ directory to see all available skills.

Rules files

Recommended project-level configuration files that tell agents how to use AWS most effectively — for example, by using the AWS MCP Server, discovering available skills, or searching documentation before acting.

See rules/ for details.

AWS MCP Server

The AWS MCP Server is a managed server that gives agents access to AWS through the Model Context Protocol. It provides:

Full AWS API coverage — Interact with any of the 300+ AWS services through a single authenticated endpoint.
Sandboxed script execution — Agents can run Python scripts in an isolated environment for complex multi-step operations.
Real-time documentation access — Search and retrieve current AWS documentation, API references, and service capabilities without authentication.
Enterprise controls — Amazon CloudWatch metrics, IAM context keys for agent-specific policies, and AWS CloudTrail audit logging.

For details on operation, available tools, authentication, and supported Regions, see the AWS MCP Server documentation.

Documentation

User guide — Setup, configuration, and reference documentation.
AWS MCP Server tools — Reference for all available MCP tools.

How the Agent Toolkit relates to the MCP servers, skills, and plugins in AWS Labs

In 2025, AWS began releasing MCP servers, skills, and plugins as part of AWS Labs. The Agent Toolkit for AWS is the successor to those tools. We recommend using the Agent Toolkit for AWS, because it offers key features including:

IAM condition keys that distinguish between agent actions and human actions, so you can write policies that apply only to agents. For example, you can write policies that only allow read-only actions through the MCP server, even if the user’s underlying IAM role can take write actions).
CloudWatch metrics and CloudTrail audit logging for every request, so you can monitor and audit coding agent activity.
Agent skills that have undergone thorough end-to-end evaluations, so you can be confident that workflows will complete successfully.

AWS Labs MCP servers, skills, and plugins will continue to work and accept contributions, and over time the best of AWS Labs will be transitioned to the Agent Toolkit for AWS to ensure that customers can access the broadest array of tooling and guidance for their agents.

License

This project is licensed under the Apache-2.0 License. See LICENSE for details.

File tree

1568

aws/agent-toolkit-for-awsView on GitHub

.agents/
  plugins/
    marketplace.json
.claude-plugin/
  marketplace.json
.cursor-plugin/
  marketplace.json
.editorconfig
.github/
  CODEOWNERS
  dependabot.yml
  ISSUE_TEMPLATE/
    bug_report.yml
    config.yml
    feature_request.yml
  pull_request_template.md
  workflows/
    build.yml
    codeql.yml
    dependency-review.yml
    merge-prevention.yml
    pull-request-lint.yml
    scorecard-analysis.yml
    skill-frontmatter-check.yml
    stale.yml
.gitignore
.markdownlint-cli2.yaml
CODE_OF_CONDUCT.md
CONTRIBUTING.md
LICENSE
mise.toml
NOTICE
plugins/
  aws-agents/
  aws-agents-for-devsecops/
    .claude-plugin/
      plugin.json
    .codex-plugin/
      plugin.json
    .cursor-plugin/
      plugin.json
    .mcp.json
    commands/
      chat.md
      cost.md
      investigate.md
      release-readiness.md
      release-testing.md
      setup-devops-agent.md
      setup-security-agent.md
      setup.md
      spaces.md
    examples/
      multi-space-walkthrough.md
    plugin.json
    README.md
    skills/
      analyzing-release-readiness/
        SKILL.md
      chatting-with-aws-devops-agent/
        SKILL.md
      coordinating-multi-space-devops-agent/
        SKILL.md
      diff-scanning-with-aws-security-agent/
        SKILL.md
      investigating-incidents-with-aws-devops-agent/
        REFERENCE.md
        SKILL.md
      pentesting-with-aws-security-agent/
        SKILL.md
      remediating-with-aws-security-agent/
        SKILL.md
      running-release-tests/
        SKILL.md
      scanning-with-aws-security-agent/
        SKILL.md
      setup/
      setup-devops-agent/
        SKILL.md
      setup-security-agent/
        SKILL.md
        SKILL.md
      threat-modeling-with-aws-security-agent/
        SKILL.md
    .claude-plugin/
      plugin.json
    .codex-plugin/
      plugin.json
    .cursor-plugin/
      plugin.json
    .mcp.json
    mcp.json
    plugin.json
    README.md
    skills/
      agents-build/
        references/
          browser.md
          code-interpreter.md
          integrate.md
          local-vs-deployed.md
          memory.md
          migrate.md
          multi-agent.md
          payments.md
          request-headers.md
          teardown.md
          vpc.md
        scripts/
          setup_payment_user.py
          x402_payment_tool.py
        SKILL.md
      agents-connect/
        references/
          policy.md
        SKILL.md
      agents-debug/
        references/
          doctor.md
        SKILL.md
      agents-deploy/
        references/
          versioning.md
        SKILL.md
      agents-get-started/
        references/
          example-support-agent.md
        SKILL.md
      agents-harden/
        references/
          limits.md
        SKILL.md
      agents-optimize/
        references/
          cost.md
          evals.md
          observability.md
        SKILL.md
      agents-pay/
        packages/
          openclaw/
            .gitignore
            openclaw.plugin.json
            package-lock.json
            package.json
            PUBLISHING.md
            README.md
            runtime/
              agentcore_bridge.py
            scripts/
              stage-skill.mjs
            skills/
              agents-pay/
                SKILL.md
            src/
              bridge.ts
              config.ts
              index.ts
              payments.ts
              x402.ts
            test/
              fixtures/
                v2-security-contract.json
              security.test.mjs
              test_agentcore_bridge.py
            tsconfig.json
        references/
          openclaw-setup.md
          operator-guide.md
          security-model.md
          setup.md
          troubleshooting.md
        requirements.txt
        scripts/
          agents_pay_admin.py
          test_portability.py
          test_x402_policy.py
          x402_fetch_cli.py
          x402_fetch.py
          x402_policy.py
        SKILL.md
  aws-core/
    .claude-plugin/
      plugin.json
    .codex-plugin/
      plugin.json
    .cursor-plugin/
      plugin.json
    .mcp.json
    com.anthropic.claude-code/
      hooks/
        hooks.json
        secret-safety.py
    mcp.json
    plugin.json
    README.md
    skills/
      amazon-bedrock/
        assets/
          kb_shim.py.tmpl
          lambda_shim.py.tmpl
          tool_schema.json.tmpl
        references/
          agentcore-credentials-and-security.md
          agentcore-gateway.md
          agentcore-harness.md
          agentcore-memory-observability.md
          agentcore-payments-setup-script.md
          agentcore-payments-wiring.md
          agentcore-payments.md
          agentcore-registry-evaluations.md
          agentcore-runtime-container-build.md
          agentcore-runtime.md
          agents-and-action-groups.md
          bedrock-agents-to-agentcore-harness/
            cli.md
            deploy.md
            discovery.md
            eligibility.md
            mapping.md
          cost-tracking.md
          guardrails.md
          knowledge-bases-retrieval.md
          knowledge-bases-setup.md
          migrate-bedrock-agents-to-agentcore-harness.md
          model-invocation.md
          model-migration.md
          model-selection-guide.md
          prompt-caching.md
          prompt-engineering-by-model.md
          quota-health.md
          sdk-converse-api-python.md
          sdk-converse-api-typescript.md
        scripts/
          fetch_bedrock_agent.py
        SKILL.md
      aws-ai-ml/
        references/
          dataset-evaluation/
            overview.md
            references/
              custom-scorer-evaluation-dataset-formats.md
              strategy_data_requirements.md
            scripts/
              format_detector.py
          dataset-transformation/
            code_templates/
              transformation.py
            overview.md
            references/
              code_output_guide.md
              dataset_transformation_code.md
              sagemaker_dataset_formats.md
            scripts/
              transformation_tools.py
          directory-management/
            overview.md
          endpoint-diagnostics/
            overview.md
            references/
              minimum_iam_policy.md
            scripts/
              collect_diagnostics.py
          finetuning/
          finetuning-technique/
            overview.md
            references/
              finetune_technique_selection_guide.md
            scripts/
              get_recipes.py
            code_templates/
              dpo.py
              rlaif_builtin.py
              rlaif_custom_prompt.py
              rlvr.py
              sft.py
            overview.md
            references/
              code_output_guide.md
              continuous_customization.md
              eula_links.md
              rlaif_guide.md
              rlvr_reward_function.md
            scripts/
              mlflow_reference.py
            templates/
              nova_rlvr_reward_function_source_template.py
              rlvr_reward_function_source_template.py
          manage-mlflow/
            overview.md
            references/
              app-creation-workflow.md
              app-deletion-workflow.md
              app-discovery-workflow.md
              app-update-workflow.md
              sm-mlflow-guide.md
          model-deployment/
            code_templates/
              deploy-jumpstart-sagemaker.py
              deploy-nova-bedrock.py
              deploy-nova-sagemaker.py
              deploy-oss-bedrock.py
              deploy-oss-sagemaker.py
            overview.md
            references/
              code_output_guide.md
              deploy-jumpstart-sagemaker.md
              deploy-nova-bedrock.md
              deploy-nova-sagemaker.md
              deploy-oss-bedrock.md
              deploy-oss-sagemaker.md
              model-licenses.md
          model-evaluation/
            code_templates/
              custom_scorer_evaluator.py
              llmaaj_evaluator.py
            overview.md
            references/
              code_output_guide.md
              create-reward-function.md
              custom-lambda-scorer.md
              custom-scorer-evaluation.md
              evaluation-type-guide.md
              llmaaj-builtin-evaluation.md
              llmaaj-custom-evaluation.md
              llmaaj-evaluation.md
              supported-judge-models.md
            scripts/
              nova_reward_function_source_template.py
              reward_function_source_template.py
              validate_custom_metrics.py
          model-selection/
            overview.md
            references/
              benchmarks/
                agentic-index.md
                coding-index.md
                gpqa.md
                hle.md
                ifbench.md
                intelligence-index.md
                mmmu-pro.md
                tau2.md
              model-licenses.md
              model-selection.md
              select-for-deployment.md
            scripts/
              filter_deployable_models.py
              get_deployable_models.py
              get_model_names.py
          planning/
            overview.md
            references/
              deploy-base-model-plan.md
              evaluate-first-plan.md
              input-output-contracts.md
              model-customization-plan.md
              skill-routing-constraints.md
          sdk-getting-started/
            overview.md
            references/
              execution-role-setup.md
              sagemaker-python-sdk-setup.md
          use-case-specification/
            overview.md
            references/
              spec-for-deployment.md
              spec-for-finetuning.md
        SKILL.md
      aws-billing-and-cost-management/
        references/
          budgets.md
          cost-audit.md
          cost-explorer.md
          cost-optimization-hub.md
          cur-athena.md
          deterministic-calculations.md
          ebs-optimization.md
          ec2-rightsizing.md
          free-tier.md
          lambda-optimization.md
          pricing-lookup.md
          rds-optimization.md
          reserved-instances.md
          savings-plans.md
          service-optimization.md
        SKILL.md
      aws-blocks/
        SKILL.md
      aws-cdk/
        references/
          bootstrap-and-project-setup.md
          compliance-and-drift.md
          construct-patterns.md
          import-and-migrate.md
          refactor-and-prevent-replacement.md
          troubleshooting-credentials.md
          troubleshooting-deployment.md
          troubleshooting-synth.md
          v1-to-v2-migration.md
... 1600 more

Showing a partial view of a very large repo.

FAQ

agent-toolkit-for-aws is a Claude Code plugin with 146 hand-picked skills for development work, indexed on Flowy. Install it with the command on its page. It includes analyzing-release-readiness, chatting-with-aws-devops-agent, coordinating-multi-space-devops-agent. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.

What is agent-toolkit-for-aws?: Help AI coding agents build, deploy, and manage applications on AWS. The Agent Toolkit for AWS gives AI coding agents the tools, knowledge, and guardrails they need to work with AWS services.
How do I install agent-toolkit-for-aws?: Run these in Claude Code: /plugin marketplace add aws/agent-toolkit-for-aws. Then prompt normally.
Does agent-toolkit-for-aws auto-invoke its skills?: Not yet. It is indexed on Flowy as a plain plugin. Request auto-invocation on its page and Flowy will route its skills for you as you prompt.
Is agent-toolkit-for-aws free?: Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.