一个运行在EC2上并暴露只读的模型上下文协议（MCP）服务器 主机和AWS工具（磁盘使用、顶级进程、S3/EC2/安全组） 列表）通过可流式 HTTP 传输，因此笔记本电脑上的 Claude 代码可以调用它们 远程使用实例的IAM角色——本地或 那个实例。

完整介绍、架构、故障排除和安全说明： docs/mcp-server-on-ec2-demo.md（手动， 逐步设置）以及 docs/cloudformation-deploy.md（自动 使用该仓库的CloudFormation协议栈部署）。

布局

部署

需要现有的VPC、公网子网和EC2密钥对。什么都不做 secret 存储在模板中——部署时提供您自己的数值。 参见docs/cloudformation-deploy.md了解如何 查阅这些，完整的测试流程，以及MapPublicIp，明白了。

然后，一旦实例启动完成（~2分钟）：

使用 RegisterCommand 输出将服务器添加到 Claude Code。

安全提示

• SSH 和 MCP 端口仅限于 CIDR 的 你 电源——绝不离开 这些作为0.0.0.0/0。
• 实例角色的范围是只读操作 （[sts:GetCallerIdentity， s3:List*， ec2:Describe*） — 无写/删除

MCP Server on EC2 — Demo

A Model Context Protocol (MCP) server that runs on EC2 and exposes read-only host and AWS tools (disk usage, top processes, S3/EC2/security-group listings) over streamable HTTP, so Claude Code on a laptop can call them remotely using the instance’s IAM role — no credentials stored locally or on the instance.

Full write-up, architecture, troubleshooting, and security notes: docs/mcp-server-on-ec2-demo.md (manual, step-by-step setup) and docs/cloudformation-deploy.md (automated deploy with this repo’s CloudFormation stack).

Layout

cloudformation/mcp-server-ec2.yaml     CloudFormation stack: EC2 + SG + IAM role,
                                        self-configuring via UserData
src/server.py                          Reference copy of the MCP server (same code
                                        the stack's UserData installs), for local dev
docs/mcp-server-on-ec2-demo.md         Full manual step-by-step guide
docs/cloudformation-deploy.md          Deploy/test/teardown guide for the stack below

Deploy

Requires an existing VPC, a public subnet, and an EC2 key pair. Nothing secret is stored in the template — supply your own values at deploy time. See docs/cloudformation-deploy.md for how to look those up, the full testing procedure, and the MapPublicIp gotcha.

aws cloudformation deploy \
  --template-file cloudformation/mcp-server-ec2.yaml \
  --stack-name demo-mcp-server \
  --parameter-overrides \
      KeyName= \
      VpcId= \
      SubnetId= \
      SSHLocationCidr=/32 \
      McpLocationCidr=/32 \
  --capabilities CAPABILITY_IAM

Then, once the instance finishes booting (~2 minutes):

aws cloudformation describe-stacks --stack-name demo-mcp-server \
  --query "Stacks[0].Outputs"

Use the RegisterCommand output to add the server to Claude Code.

Security notes

• SSH and the MCP port are restricted to CIDRs you supply — never leave these as 0.0.0.0/0.
• The instance role is scoped to read-only actions (sts:GetCallerIdentity, s3:List*, ec2:Describe*) — no write/delete permissions.
• The run_command (arbitrary shell) tool from the guide is intentionally not installed by this template’s UserData. Add it yourself only after reading section 8 of the guide, and prefer an SSH tunnel over exposing the port publicly.
• Nothing in this repo contains real IPs, key names, account IDs, or other personal/account-identifying data — all examples use placeholders.

Local development

python3.11 -m venv .venv
source .venv/bin/activate   # or .venv\Scripts\activate on Windows
pip install "mcp[cli]>=2,<3" boto3
python src/server.py