Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

Using AWS Model Context Protocol awslabs-cost-analysis-mcp-server

I've recently started using Claude Pro on the desktop. It can do a lot of things like simple coding and producing readable reports from data I was interested to learn about the Model Context Protocol recently. To greatly simplify what…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

I've recently started using Claude Pro on the desktop. It can do a lot of things like simple coding and producing readable reports from data



I was interested to learn about the Model Context Protocol recently. To greatly simplify what it does, it pushes external data into prompts



With this crude method it seems possible that LLMs can be interoperable across differing corporate software, across different types of interface and could be a rosetta stone for a new dawn of one thing speaking to another



I saw that AWS had a new set of MCP servers available, including one that dealt with billing and cost. I am interested in the costs so I did a quick try out. TDLR; this is not a new dawn






step one, get the MCP server running



The information to get the MCP server running with Claude Desktop was scanty but here is a recipe that worked for me (on a Mac)



Do this in the shell. The uv thing is required. uv does some package management plus there is a uvx command that we need in the next step




brew install uv
uv python install 3.13
uv venv
source .venv/bin/activate
uv init costly
cd costly
uv add "mcp[cli]" httpx
pip install awslabs-cost-analysis-mcp-server






Do this in Claude Desktop -> settings -> developer -> edit config. The edit config for me opened vscode. Remove the empty braces and add. I have nothing in the MCP_SETTINGS_PATH. I really do have a AWS profile called Hauptsteuerung




{
"mcpServers": {
"awslabs.core-mcp-server": {
"command": "uvx",
"args": [
"awslabs.core-mcp-server@latest"
],
"env": {
"FASTMCP_LOG_LEVEL": "ERROR",
"MCP_SETTINGS_PATH": "/Users/jamesandrews/mcp/mcp.json"
},
"autoApprove": [],
"disabled": false
},
"awslabs.cost-analysis-mcp-server": {
"command": "uvx",
"args": [
"awslabs.cost-analysis-mcp-server@latest"
],
"env": {
"AWS_PROFILE": "Hauptsteuerung",
"FASTMCP_LOG_LEVEL": "ERROR"
}
}
}
}






Now in the Claude window there is an extra icon that looks like a hammer. If I click on it it gives some info on the new MCP things I have installed






prompting - hot or not



Here's where it all goes wrong. I added an export file of our RDS servers.

The phrase get_pricing_from_api service_code=AmazonRDS should get Claude to use the MCP to get the current up to date data from AWS api! I whacked in the prompt below, Claude confirmed that it was allowed to run the MCP commands, it was all looking great...




the rdsapr2.csv file has the name of the RDS in column 2, region in column 4 and the instance size in column 5

using get_pricing_from_api service_code=AmazonRDS and the regions available in the rdsapr2.csv file, generate a report of the relative cost of each RDS instance in the rdsapr2 file

I need to compare the no upfront 1 year RI vs. on demand cost






This is the result it came out with









RDS Instances Pricing Analysis






Regional Distribution
















































Region Number of Instances Percentage
us-east-1 38 55.07%
eu-west-1 13 18.84%
eu-central-1 7 10.14%
eu-west-2 6 8.70%
ap-southeast-1 3 4.35%
us-west-2 2 2.90%
Total 69 100%





Pricing Insights






On-Demand vs Reserved Instance Cost Comparison


















































Instance Type On-Demand Hourly Rate 1-Year No Upfront RI Rate Potential Savings
db.t2.micro (MariaDB) $0.017 Not significant Minimal
db.m5d.xlarge (Oracle SE2) $0.805 $0.576 28.4%
db.t3.2xlarge (MySQL) $1.088 $0.765 29.7%
db.r5.12xlarge (Oracle EE) $11.184 $6.469 42.2%
db.z1d.12xlarge (SQL Server SE) $20.513 $19.385 5.5%
db.x2iedn.16xlarge (MySQL) $35.533 $27.360 23.0%





Cost Optimization Recommendations




  1. Regional Consolidation




- 55% of instances are in us-east-1
- Consider consolidating or optimizing multi-region deployments





  1. Instance Type Analysis




- High variation in instance sizes and types
- Recommend comprehensive utilization review
- Potential for significant cost savings through right-sizing





  1. Reserved Instance Strategy




- Most instance types offer 20-40% savings with 1-year No Upfront RIs
- Evaluate workload stability for potential RI purchases





  1. Database Engine Considerations




- Mix of engines: Oracle, MySQL, SQL Server, MariaDB
- Licensing costs vary significantly
- Review BYOL vs. included license models






Detailed Observations





  • Lowest Cost Instance: db.t2.micro (MariaDB) at $0.017/hour


  • Highest Cost Instance: db.z1d.12xlarge (SQL Server SE) at $20.513/hour


  • Most Common Region: us-east-1 with 38 instances


  • Least Utilized Region: us-west-2 with 2 instances





Next Steps




  1. Conduct a comprehensive audit of current RDS instances

  2. Create a detailed utilization report

  3. Develop a rightsizing and cost optimization strategy

  4. Consider Reserved Instance purchases for stable workloads

  5. Implement tagging for better cost tracking and allocation





Which is great except




  • I have no MariaDB

  • I have no db.z1d.12xlarge instances, not even one

  • Most of my servers are postgresql which isn't mentioned



I queried this and



what is the name of the db.z1d.12xlarge server mentioned in the csv file?

Edit

I'll retrieve the name of the db.z1d.12xlarge server from the CSV file.

Analysis

I apologize, but it seems that there might be no db.z1d.12xlarge server in the actual CSV file, despite being mentioned in the pricing analysis. This could be because the pricing information comes from AWS's standard pricing API, while the specific servers in your CSV might differ.






So not quite got it doing any useful work yet but maybe some day soon :)

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - Using AWS Model Context Protocol awslabs-cost-analysis-mcp-server
id: 267cb663-01e9-4300-9fb1-e7eab6018420
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "Using AWS Model Context Protoc" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Using AWS Model Context Protocol awslabs")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*Using AWS Model Context Protocol awslabs*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "Using AWS Model Context Protocol awslabs"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

CTI Threat Relationship Graph3 Knoten / 2 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Using AWS Model Context Protocol awslabs.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Using AWS Model Context Protocol awslabs-cost-analysis-mcp-server

Thematisch verwandte Begriffe: Using, Model, Context, Protocol · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-97818 | phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and i…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag