setup-devops-agent

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: devops, local-workflow, mcp, setup, troubleshooting.

What it does

Setup and diagnostics for the AWS DevOps Agent MCP connection. Triggers when aws-devops-agent is missing from .mcp.json, when the connection is broken, or when the user says "set up devops agent" / "configure agent". Does NOT trigger if the MCP is already connected and working.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill setup-devops-agent

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-agents-for-devsecops/skills/setup-devops-agent ~/.claude/skills/setup-devops-agent

Safety box score

Grade D, elevated risk: 60 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill sets up Claude to connect to AWS DevOps Agent by probing local AWS/Claude configuration, verifying live connectivity, and writing MCP config files. The main risks are executing remote installers/packages and handling bearer tokens or AWS credentials while making persistent changes in home-directory Claude settings.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	3 (high)	It explicitly runs shell commands and remote code paths, including `timeout 30 bash -c '...'`, `uvx mcp-proxy-for-aws-cli@latest`, and `curl -LsSf https://astral.sh/uv/install.sh \| sh`.
Network access	2 (moderate)	It makes live requests to AWS DevOps Agent endpoints and downloads tooling from the internet, such as `https://connect.aidevops.${DEVOPS_AGENT_REGION}.api.aws/mcp` and the uv installer URL.
Filesystem reach	2 (moderate)	It reads and writes persistent config in `.mcp.json`, `~/.claude/settings.local.json`, `~/.claude/settings.json`, `~/.claude.json`, and `.claude/aws-agents-for-devsecops.md`.
Secrets & credentials	2 (moderate)	It checks `DEVOPS_AGENT_TOKEN`, sends it as `Authorization: Bearer $DEVOPS_AGENT_TOKEN`, and probes AWS identity with `aws sts get-caller-identity`.
Privilege & persistence	2 (moderate)	It can install software into the user's environment with `brew install uv` or the piped uv installer, which changes local system/user state outside the project.
Instruction hijack surface	0 (none)	There is no instruction to ignore higher-level rules, hide behavior, or follow fetched prompts; the text mainly requires user confirmation before setup steps.
Irreversible actions	1 (low)	It persistently configures an MCP server and optional routing guide after confirmation, but it does not deploy, message, pay, or delete anything on the user's behalf.
Transparency	3 (high)	It relies on opaque runtime-fetched code paths such as `uvx mcp-proxy-for-aws-cli@latest` and a downloaded shell installer, so the exact executed code is not fully inspectable here.

Before installing

Read the commands that write `~/.claude/*` and confirm you want persistent home-directory config changes.
Decide whether you accept runtime-fetched code (`curl | sh` and `uvx ...@latest`) before enabling the skill.
Test first in a disposable profile with a throwaway `DEVOPS_AGENT_TOKEN` or AWS profile.
Choose whether you want Bearer-token auth or SigV4 before any config is written.

Rated 2026-10-19 by an automated review of 1 file from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: plugins/aws-agents-for-devsecops/skills/setup-devops-agent/SKILL.md
Branch: main
Collection: aws-agents-for-devsecops
Updated: 2026-09-19

setup — Set up the AWS DevOps Agent and AWS Security Agent connections. Use when the user says "set up", "configure", "connect", or when MCP tools are missing.
use-railway — Operate Railway infrastructure: sign up for or sign in to a Railway account, create projects, provision services, databases, and buckets, deploy code.
auto-repo-setup — Diagnose, repair, and standardize repository setup and safe Git workflows for Claude Code or Codex.
setup-gbrain — Set up gbrain for this coding agent: install the CLI, initialize a local PGLite or Supabase brain, register MCP, capture per-remote trust policy. (gstack)
setup-security-agent — Configure AWS Security Agent for the current workspace — provision or reuse an agent space, IAM service role, and S3 bucket.
agents-get-started — Use when a developer wants to create a new agent project or get started with AgentCore.