AWS DevOps Agent Tools for Incident Investigation and Root Cause Analysis

The AWS DevOps Agent provides AI-powered incident investigation capabilities through the Agent Toolkit for AWS, using MCP server-based skills to automatically analyze CloudWatch logs, alarm histories, and resource graphs to identify root causes.

The aws/agent-toolkit-for-aws repository delivers a comprehensive framework for AI coding agents to interact with AWS services. At its core, the AWS DevOps Agent enables automated incident investigation and root cause analysis through specialized skills and plugins that interface with AWS APIs via a secure MCP server.

Architecture of the AWS DevOps Agent

MCP Server and Plugin Layer

The architecture centers on the MCP Server, a managed endpoint that authenticates agents, proxies AWS API calls, and executes sandboxed Python scripts. According to the source code in README.md, this server provides the secure bridge between AI agents and AWS services. The aws-agents-for-devsecops plugin, defined in plugins/aws-agents-for-devsecops/README.md, bundles MCP configuration with curated skills for DevOps workflows.

Skills and Trigger-Based Invocation

Skills are Markdown-driven instructions stored under plugins/aws-agents-for-devsecops/skills/. The primary skill for incident work is investigating-incidents-with-aws-devops-agent/SKILL.md. When an agent detects trigger phrases like "investigate" or "root cause," it automatically invokes the investigate tool. This tool creates investigations, lists tasks, retrieves logs, and surfaces possible root causes without requiring embedded AWS SDK calls in the agent.

Investigation Workflow

The investigation workflow follows four steps:

1. User invokes a command such as /aws-agents-for-devsecops:investigate
2. The plugin loads the investigation skill and calls the MCP investigate API
3. The MCP server authenticates via SigV4 or Bearer token and queries AWS DevOps Agent services
4. Results including CloudWatch logs and alarm histories stream back to the agent

Using AWS DevOps Agent Tools for Root Cause Analysis

Install the DevSecOps Plugin

To begin using AWS DevOps Agent tools for incident investigation and root cause analysis, install the aws-agents-for-devsecops plugin:

/plugin marketplace add aws/agent-toolkit-for-aws
/plugin install aws-agents-for-devsecops
/reload-plugins

Configure Authentication

Run the setup command to configure credentials:

/aws-agents-for-devsecops:setup

This skill guides you through selecting SigV4 or Bearer-token authentication and writes a .mcp.json configuration file as documented in plugins/aws-agents-for-devsecops/README.md.

Start an Investigation

Initiate a new investigation using the investigate command:

/aws-agents-for-devsecops:investigate

This auto-invokes the investigate tool on the MCP server, creating a new investigation that returns summaries of recent alarms, error logs, and related CloudWatch metrics.

Query Logs and Drill Down

To query specific logs and perform root cause analysis:

/aws-agents-for-devsecops:investigate

# Then request:

list my AWS DevOps agent spaces

The agent calls list_agent_spaces to enumerate configured spaces, then uses list_services to drill down to specific services like Lambda or EC2.

Post-Incident Release Readiness

After resolving an incident, verify release readiness:

/aws-agents-for-devsecops:release-readiness

This runs the release-readiness skill, creating a review job that gathers test results and produces a readiness verdict.

Key Configuration Files and Rules

The rules/aws-agent-rules.md file provides recommended IAM condition keys, CloudWatch metrics, and audit-logging policies specifically for agent actions during incident investigations. The core plugin at plugins/aws-core/README.md supplies the MCP configuration used by all DevOps and Security agent skills.

Summary

• AWS DevOps Agent tools provide automated incident investigation through the aws-agents-for-devsecops plugin in the Agent Toolkit for AWS
• The MCP server architecture handles authentication and AWS API proxying, allowing language-agnostic incident analysis
• Skills like investigating-incidents-with-aws-devops-agent auto-trigger on phrases like "investigate" or "root cause" and execute the investigate tool
• Key commands include /aws-agents-for-devsecops:investigate for starting analysis and list_agent_spaces for drilling into service logs
• Configuration files in plugins/aws-agents-for-devsecops/ and rules/aws-agent-rules.md define best practices for secure incident handling

Frequently Asked Questions

What is the AWS DevOps Agent?

The AWS DevOps Agent is a component of the Agent Toolkit for AWS that provides AI agents with the ability to investigate incidents and analyze root causes. It operates through the MCP server to securely interact with AWS services like CloudWatch and AWS DevOps Agent spaces without requiring direct SDK integration in the agent code.

How does the investigate command work?

The investigate command triggers a skill defined in plugins/aws-agents-for-devsecops/skills/investigating-incidents-with-aws-devops-agent/SKILL.md. This skill calls the MCP server's investigate tool, which authenticates with AWS credentials and retrieves alarm histories, logs, and resource graphs to identify potential root causes.

What authentication methods does the AWS DevOps Agent support?

According to the setup skill in plugins/aws-agents-for-devsecops/README.md, the AWS DevOps Agent supports both SigV4 signature authentication and Bearer tokens. The /aws-agents-for-devsecops:setup command walks users through selecting the appropriate method and generates a .mcp.json configuration file.

Can I use AWS DevOps Agent tools with any AI coding agent?

Yes, the tools are designed to be language-agnostic and work with any AI coding agent that supports the MCP protocol, including Claude Code, Codex, and Cursor. The MCP server handles all AWS API interactions, so agents only need to invoke the appropriate slash commands like /aws-agents-for-devsecops:investigate.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}