Documentation

IAN MCP Server

Connect Claude, Cursor, and other MCP-compatible clients to your AWS infrastructure. Manage cost, run security audits, deploy code, and operate resources — all from natural-language conversation.

Quick Start Browse Tools Privacy Policy

Overview

IAN exposes a Model Context Protocol server that lets AI assistants manage AWS infrastructure, monitor costs, run security audits, and deploy code on your behalf. The server speaks Streamable HTTP, authenticates via OAuth 2.0 with PKCE, and enforces granular capability scopes so you control exactly what the AI can do.

Server URL

https://mcp.iancloud.ai

Transport

Streamable HTTP

Auth

OAuth 2.0 + PKCE

Quick Start

Prerequisites

  1. Create a free IAN account at iancloud.ai.
  2. Connect at least one AWS account (a scoped IAM role via CloudFormation).
  3. Go to Settings → MCP and create an MCP server (or use the default).

Connect from Claude (Desktop or Web)

  1. Open Settings → Connectors → Add custom connector.
  2. Enter URL: https://mcp.iancloud.ai
  3. Authorize via OAuth when prompted. Select or create your target server during the browser authorization flow.

Connect from Cursor

  1. Open Settings → MCP.
  2. Add a new Streamable HTTP server with URL: https://mcp.iancloud.ai
  3. Authorize via OAuth when prompted.

Connect from Claude Code

ian mcp install --org {your-org} --server {your-server}

This installs the managed local bridge that handles auth and streaming automatically.

Authentication

IAN uses OAuth 2.0 with PKCE (public client, no client secret required).

  • Grant types: authorization_code, refresh_token
  • Code challenge: S256
  • Dynamic Client Registration: supported (RFC 7591)
  • OAuth metadata: https://mcp.iancloud.ai/oauth/.well-known/oauth-authorization-server
  • Pinned-server metadata: https://mcp.iancloud.ai/{org}/{server}/oauth/.well-known/oauth-authorization-server

For programmatic access, create a Service Token in Settings → MCP and pass it as a Bearer token instead of completing the OAuth flow.

Capability Scopes

Every MCP server has one of three capability levels. Tools are gated by scope, so you can hand out read-only access without risking accidental writes.

Capability Access Use Case
observe Read-only Cost dashboards, security audits, resource inventory
operate Read + write Deploy, manage EC2, tag resources, approve actions
administer Full access Org admin, billing, secrets

Tool Reference (38 total)

Cost Management

  • ian_cost_summary — Summarize recent AWS cost trends (observe)
  • ian_cost_breakdown — Break down costs by service, region, account, or day (observe)
  • ian_cost_alerts — List recent cost alerts (observe)
  • ian_cost_recommendations — List cost optimization recommendations (observe)
  • ian_refresh_costs — Queue a refresh of cost data (operate)
  • ian_cost_recommendation_investigate — AI-backed investigation of a recommendation (operate)

Infrastructure & Resources

  • ian_infra_overview — Infrastructure health summary (observe)
  • ian_resource_list — List tracked AWS resources (observe)
  • ian_resource_details — Fetch resource with metrics and live details (observe)
  • ian_resource_metrics — Time-series metrics for a resource (observe)
  • ian_account_summary — Quick AWS account overview (observe)
  • ian_refresh_infra — Queue infrastructure data refresh (operate)

Security Audits

  • ian_security_groups_audit — Audit security groups for 0.0.0.0/0 ingress (observe)
  • ian_iam_audit — Check IAM users for MFA, old keys, console access (observe)
  • ian_s3_public_access_audit — Find S3 buckets with public access (observe)
  • ian_unattached_resources_audit — Find wasted resources (observe)
  • ian_encryption_audit — Check encryption on EBS, S3, RDS (observe)
  • ian_tag_compliance_audit — Validate required tags on resources (observe)

Resource Management

  • ian_ec2_manage — Start, stop, or reboot EC2 instances (operate)
  • ian_create_snapshot — Create EBS snapshot or EC2 AMI (operate)
  • ian_delete_volume — Delete unattached EBS volume (operate)
  • ian_release_elastic_ip — Release unused Elastic IP (operate)
  • ian_tag_resources — Add tags to AWS resources (operate)

Events & Audit Trail

  • ian_aws_events — List recent AWS CloudTrail events (observe)
  • ian_aws_events_summary — Summarize event activity by severity/category (observe)

Deployments & Operations

  • ian_deploy_run — Queue a deployment (operate)
  • ian_deploy_status — Check deployment status (observe)
  • ian_audit_run — Queue a project audit (operate)
  • ian_audit_status — Check audit status (observe)
  • ian_actions_list — List audit actions (observe)
  • ian_action_approve — Approve an audit action (operate)
  • ian_action_reject — Reject an audit action (operate)

General

  • search — Search organization resources (observe)
  • fetch — Fetch a resource by type and ID (observe)
  • ian_dashboard_read — List dashboard records (observe)
  • ian_dashboard_write — Create/update/destroy dashboard records (operate)
  • ian_orgs_list — List accessible organizations (observe)
  • ian_auth_status — Inspect current credential (observe)
  • ian_assistant_chat — Chat with IAN assistant (operate)
  • ian_assistant_chat — Ask Hermes-backed agents to execute scoped work (operate)

MCP Resources

  • ian://organization/current — Current organization context and settings
  • ian://projects — List of projects in the organization
  • ian://mcp/server — MCP server configuration and capabilities

Examples

Cost review

"How much did we spend on AWS last month? Break it down by service."

IAN calls ian_cost_summary and ian_cost_breakdown and returns a trend analysis with per-service breakdown. Follow up with "any recommendations to cut costs?" and IAN runs ian_cost_recommendations.

Security audit

"Run a security check on our AWS account."

IAN runs ian_security_groups_audit, ian_iam_audit, ian_s3_public_access_audit, and ian_encryption_audit in parallel and returns a consolidated report with severity levels.

Infrastructure cleanup

"Find unused EBS volumes and Elastic IPs in us-east-1, then delete the unattached volumes."

IAN runs ian_unattached_resources_audit, then ian_delete_volume and ian_release_elastic_ip with confirmation for each.

Support