Updated September 4, 2026. AWS added a serverless diagnostic capability to AWS MCP Server. A coding agent can inspect a Lambda function and connected API Gateway, EventBridge, S3, DynamoDB, SNS, SQS and Step Functions resources, correlate errors against a seven-day baseline, retrieve deployed configuration and recent-change timelines, and analyze latency across connected resources.
The interesting engineering question is not whether an agent can read a Lambda log. It is whether you can expose enough cross-service operational context to make diagnosis useful while keeping IAM scope, auditability and production-change authority under control.
A practical review checklist
- Create dedicated IAM roles for agent workflows instead of reusing broad human-admin roles.
- Separate read-only diagnosis from mutation permissions.
- Review CloudTrail and other audit trails for agent activity.
- Decide which production accounts and resources the agent can inspect.
- Treat retrieved logs and configuration as potentially sensitive context.
Sources and verification
Primary source: AWS What's New — “AWS MCP Server adds a serverless capability for AWS Lambda functions” (September 4, 2026).
This article distinguishes confirmed release facts from engineering interpretation. Dynamic details such as support status, limits and availability should be rechecked against the primary documentation before a production change.
