CloudWatch MCP server: setup & sharing

Logs, metrics, and alarms for remote teammates — fully read-only against your AWS account.

Run on your machine

Start the server on your host machine. Tools not listed in --allow are completely hidden from the agent.

Terminal · Host machine

npx -y @mcpwire/cli share \
  --name cloudwatch \
  --allow "describe_log_groups,analyze_log_group,execute_log_insights_query,get_logs_insight_query_results,cancel_logs_insight_query,execute_cwl_insights_batch,recommend_indexes_loggroup,recommend_indexes_account,get_metric_data,get_metric_metadata,analyze_metric,get_recommended_metric_alarms,execute_promql_query,execute_promql_range_query,get_promql_label_values,get_promql_series,get_promql_labels,get_active_alarms,get_alarm_history" \
  --redact-secrets \
  -- uvx awslabs.cloudwatch-mcp-server==0.3.1

Exposes 19 default tools with pattern-based secret redaction. Optionally set an expiry with --ttl 30m, prompt for approvals with --confirm, or limit calls with --max-calls 20.

Connect your teammate’s agent

MCPWire prints a unique wire://... ticket in your terminal. Send it privately to your teammate to paste into their MCP client:

Claude Desktop · Cursor · Windsurf config

{
  "mcpServers": {
    "cloudwatch": {
      "command": "npx",
      "args": [
        "-y",
        "@mcpwire/cli",
        "join",
        "wire://<TICKET_FROM_HOST>"
      ]
    }
  }
}

Replace <TICKET_FROM_HOST> with the active session ticket. The agent can only discover and call the tools exposed above.

Scoped tool permissions

MCPWire acts as a Layer 7 JSON-RPC firewall. Requests for blocked tools are dropped on the wire before ever touching your machine.

Tool	Default Policy	Notes
`describe_log_groups`	Allowed	Lists log groups.
`analyze_log_group`	Allowed	Summarizes a log group's structure.
`execute_log_insights_query`	Allowed	Runs CloudWatch Logs Insights queries — log contents flow to the guest.
`get_logs_insight_query_results`	Allowed	Reads results of a running query.
`cancel_logs_insight_query`	Allowed	Cancels a running query.
`execute_cwl_insights_batch`	Allowed	Runs several Insights queries at once.
`recommend_indexes_loggroup`	Allowed	Suggests field indexes for a log group.
`recommend_indexes_account`	Allowed	Suggests field indexes account-wide.
`get_metric_data`	Allowed	Reads metric datapoints.
`get_metric_metadata`	Allowed	Describes available metrics.
`analyze_metric`	Allowed	Analyzes metric patterns.
`get_recommended_metric_alarms`	Allowed	Suggests alarms for a metric.
`execute_promql_query`	Allowed	Runs PromQL against Amazon Managed Prometheus.
`execute_promql_range_query`	Allowed	Runs ranged PromQL queries.
`get_promql_label_values`	Allowed	Lists Prometheus label values.
`get_promql_series`	Allowed	Lists Prometheus series.
`get_promql_labels`	Allowed	Lists Prometheus labels.
`get_active_alarms`	Allowed	Lists active alarms.
`get_alarm_history`	Allowed	Reads alarm history.

Test and verify

Try these recommended prompts to confirm the agent receives expected outputs and that restricted actions fail safely.

Try CloudWatch

Configure AWS credentials on the host with read-only CloudWatch permissions (AWS_PROFILE or the standard chain). This is the official AWS Labs server, and every tool is read-only — a natural pairing with the AWS Billing and AWS Documentation guides.

Ask the agent what is alarming with get_active_alarms, then pull logs with execute_log_insights_query, metrics with get_metric_data, or Prometheus series with execute_promql_query. Log and metric contents flow to the guest, so the credential scope — not the allowlist — is what limits disclosure.

The generated command above contains the catalog’s explicit default allowlist. Check the guest’s tool list before making calls and use the server’s argument schema for required fields. See the CLI guide for guest configuration and session controls for approvals, redaction, and expiry.

Review the session in your browser: Add --record session.wirelog to your host command. Drop the resulting file into the Session Replay Viewer to inspect timestamps, latency, blocked attempts, and secret scrubbing.

← All server guides Open in command builder