Back to integrations

AWS integration for background agents

Enable scoped AWS access for selected sandbox tools and MCP servers.

Integration details

Connection

  • MCP via Access key + AssumeRole

Agent actions

AWS CLI

  • Run AWS CLI commands

    Run AWS CLI commands for the selected services and regions allowed by the connection.

CloudWatch MCP

  • get_metric_data

    Retrieve CloudWatch metric data for namespaces, dimensions, statistics, percentiles, math expressions, or batched metric queries.

  • get_metric_metadata

    Get metadata for a CloudWatch metric.

  • get_recommended_metric_alarms

    Get recommended CloudWatch alarms for a metric based on best practices and statistical analysis.

  • analyze_metric

    Analyze CloudWatch metric data for trend, seasonality, and statistical properties.

  • execute_promql_query

    Execute an instant PromQL query against CloudWatch.

  • execute_promql_range_query

    Execute a PromQL range query over a time window.

  • get_promql_label_values

    Get values for a specific CloudWatch PromQL label.

  • get_promql_series

    Find time series matching CloudWatch PromQL label selectors.

  • get_promql_labels

    List available CloudWatch PromQL label names.

  • get_active_alarms

    Identify currently active CloudWatch alarms across the account.

  • get_alarm_history

    Retrieve historical state changes and patterns for a CloudWatch alarm.

  • describe_log_groups

    Find metadata about CloudWatch log groups.

  • analyze_log_group

    Analyze CloudWatch logs for anomalies, message patterns, and error patterns.

  • execute_log_insights_query

    Start a CloudWatch Logs Insights query and return the query ID for fetching results.

  • execute_cwl_insights_batch

    Run a Logs Insights query across multiple log groups and regions with batching, polling, and result merging.

  • get_logs_insight_query_results

    Retrieve results for a CloudWatch Logs Insights query.

  • cancel_logs_insight_query

    Cancel an in-progress CloudWatch Logs Insights query.

Credential safety

Credential-less sandboxes

Mistle lets agents access connected services without placing provider credentials inside the sandbox. Approved outbound requests are routed through Mistle's credential proxy, where authentication happens outside the agent runtime.

Credentials stay encrypted in Mistle's control plane and are applied only when a request is authorized for the calling sandbox and organization.

Read the credential-less sandboxes article
Diagram showing sandbox traffic routed through an egress proxy before credential injection.