// SCAN REPORT

AWS Labs CloudWatch MCP Server

19 tools. 5 can modify or destroy data without limits.

1 destructive tool with no built-in limits. Policy required.

Last updated: 28 May 2026

5 can modify or destroy data

14 read-only

19 tools total

// TOOL MAP

Read (14) Write / Execute (4) Destructive / Financial (1)

// WHAT CAN GO WRONG

Destructive tools (cancel_logs_insight_query) permanently delete resources. There is no undo. An agent calling these in a retry loop causes irreversible damage.

Execute tools (execute_cwl_insights_batch, execute_log_insights_query, execute_promql_query) trigger processes with side effects. Builds, notifications, workflows — all fired without throttling.

// RECOMMENDED RULES

Deny destructive operations

cancel_logs_insight_query:
  rules:
    - action: deny

Destructive tools should never be available to autonomous agents without human approval.

Cap read operations

analyze_log_group:
  rules:
    - rate_limit: 60/minute

Controls API costs and prevents retry loops from exhausting upstream rate limits.

// ALL 19 AWS LABS CLOUDWATCH MCP SERVER TOOLS

DESTRUCTIVE 1 tools

Destructive cancel_logs_insight_query

EXECUTE 4 tools

Execute execute_cwl_insights_batch Execute execute_log_insights_query Execute execute_promql_query Execute execute_promql_range_query

READ 14 tools

Read analyze_log_group Read analyze_metric Read describe_log_groups Read get_active_alarms Read get_alarm_history Read get_logs_insight_query_results Read get_metric_data Read get_metric_metadata Read get_promql_label_values Read get_promql_labels Read get_promql_series Read get_recommended_metric_alarms Read recommend_indexes_account Read recommend_indexes_loggroup

// FAQ

Can an AI agent delete data through the AWS Labs CloudWatch MCP Server MCP server? +

Yes. The AWS Labs CloudWatch MCP Server server exposes 1 destructive tools including cancel_logs_insight_query. These permanently remove resources with no undo. Intercept blocks destructive tools by default so they never reach the upstream server.

How many tools does the AWS Labs CloudWatch MCP Server MCP server expose? +

19 tools across 3 categories: Destructive, Execute, Read. 14 are read-only. 5 can modify, create, or delete data.

How do I add Intercept to my AWS Labs CloudWatch MCP Server setup? +

One line change. Instead of running the AWS Labs CloudWatch MCP Server server directly, prefix it with Intercept: intercept -c aws-labs-cloudwatch-mcp-server.yaml -- npx -y @awslabs.cloudwatch-mcp-server. Download a pre-built policy from policylayer.com/policies/aws-labs-cloudwatch-mcp-server and adjust the limits to match your use case.

// RELATED SERVERS

Other MCP servers with similar tools.

Starter policies available for each. Same risk classification, same one-command setup.

AWS Labs CloudWatch MCP Server

Other MCP servers with similar tools.

Let agents act without letting them run wild.