aws:ViaAWSMCPService Is Not a Containment Boundary. Here Is What It Is

AWS released its MCP Server, part of the Agent Toolkit for AWS, into general availability on May 6, 2026, introducing two global IAM condition keys that let a single role carry different permissions depending on whether a human or an agent initiated the call. A developer examining the service argues it is a provenance primitive rather than a containment boundary, noting the same credentials can be read-write for a user and read-only for an agent. The server itself is free, with costs limited to the AWS resources touched and CloudTrail management events.

Service: AWS MCP Server part of Agent Toolkit for AWS , GA May 6 2026. No charge for the server, you pay only for resources you touch. Why it fits you specifically: your agent is Claude Code, which you already have on subscription. No Bedrock inference, no ANTHROPIC API KEY, no Agent SDK. The AI half of the demo is free. The AWS half is CloudTrail management events and IAM policy, also free. This is a near zero cost blog post. The thesis: AWS shipped a provenance primitive in IAM. Two global condition keys, confirmed in the Agent Toolkit IAM docs: So the same IAM role can be read-write when you use it and read-only when your agent uses it. Same credentials, different authorization, decided by who initiated the call. That is the demo, and it photographs well.