MCP server coverage & plugin authoring

Every plugin in the TalkOps DevOps Plugins Marketplace binds MCP servers deterministically across Claude Code (.mcp.json), OpenAI Codex (mcp.json), and portable Agent Plugins 1.0.0 hosts.

Across the upstream awslabs/mcp catalog (62 servers total) plus 8 cloud ecosystem servers:

35 awslabs servers are bundled directly in plugin .mcp.json / mcp.json manifests and start automatically using ambient AWS credentials (defaulting to read-only flags where supported).
11 awslabs servers are modeled as connection-bound connectors in CONNECTORS.md because they require a user-supplied cluster endpoint, secret ARN, or local Docker runtime at startup.
8 ecosystem & proxy servers (aws-mcp, aws-mcp-read-only, terraform, pulumi, tm, drawio, strands-agents, aws-mcp-legacy-proxy) provide core AWS CLI proxying, IaC registry lookups, threat modeling, and architecture diagramming.
16 application-specific awslabs servers (such as Kendra, Q Business, Translate, HealthOmics, and SAP) are intentionally excluded from cloud operations plugins.

How MCP servers bind to plugins

Dual manifests: Every server is declared in .mcp.json (Claude Code format) and mcp.json (portable Agent Plugins 1.0.0 format).
Sub-agent isolation in Agent Plugins: In agent plugins (plugins/agent-plugins/<agent>/), the specialist's tools: allowlist grants access by pattern (mcp__plugin_<plugin>_<server>__*), isolating each sub-agent to only its declared MCP servers.
Direct attachment in Vertical Plugins: In vertical plugins (plugins/vertical-plugins/<domain>/), bundled MCP servers attach directly to your main agent alongside the domain's skills and slash commands.
Connectors (CONNECTORS.md): Because Claude Code ignores "disabled": true and the portable schema has no disabled key, endpoint-bound servers are never shipped disabled in .mcp.json. Instead, they are documented in CONNECTORS.md and pre-authorized in the specialist agent's tools: allowlist (mcp__<key>__*) so they activate as soon as you register them.

Bundled `awslabs/mcp` servers (35 servers)

Key	Upstream `awslabs/mcp` Package	Agent Plugins	Vertical Plugins
`agentcore`	`amazon-bedrock-agentcore-mcp-server`	`aws-agentcore-engineer`	`aws-ai-ml`
`mq`	`amazon-mq-mcp-server`	`aws-platform-engineer`	`aws-messaging-and-streaming`
`sns-sqs`	`amazon-sns-sqs-mcp-server`	`aws-platform-engineer`, `aws-serverless-engineer`	`aws-messaging-and-streaming`, `aws-serverless`
`awsapi`	`aws-api-mcp-server`	`aws-sre-agent`, `aws-deployment-engineer`	`aws-essentials`
`appsync`	`aws-appsync-mcp-server`	`aws-amplify-engineer`	`aws-web-and-mobile`
`dataprocessing`	`aws-dataprocessing-mcp-server`	`aws-data-engineer`	`aws-analytics`
`aws-documentation-mcp`	`aws-documentation-mcp-server`	`aws-serverless-engineer`	—
`awsiac`	`aws-iac-mcp-server`	10 plugins (`aws-iac-engineer`, `aws-platform-engineer`, `aws-sre-agent`, `aws-cloud-security-engineer`, `aws-finops-engineer`, `aws-solutions-architect`, `aws-amplify-engineer`, `aws-modernization-agent`, `aws-deployment-engineer`, `aws-sagemaker-engineer`)	13 plugins (`aws-infrastructure-as-code`, `aws-networking`, `aws-containers`, `aws-compute`, `aws-storage`, `aws-security-identity`, `aws-cost-optimization`, `aws-well-architected`, `aws-ai-ml`, `aws-migration`, `aws-web-and-mobile`, `aws-marketplace-seller`, `aws-end-user-computing`)
`awsknowledge`	`aws-knowledge-mcp-server`	5 plugins (`aws-solutions-architect`, `aws-agentcore-engineer`, `aws-amplify-engineer`, `aws-database-engineer`, `aws-deployment-engineer`)	14 plugins (`aws-essentials`, `aws-infrastructure-as-code`, `aws-serverless`, `aws-web-and-mobile`, `aws-compute`, `aws-networking`, `aws-databases`, `aws-ai-ml`, `aws-observability`, `aws-resilience`, `aws-well-architected`, `aws-marketplace-seller`, `aws-end-user-computing`, `aws-quantum-computing`)
`awslocation`	`aws-location-mcp-server`	`aws-location-engineer`	`aws-web-and-mobile`
`awsnetwork`	`aws-network-mcp-server`	`aws-platform-engineer`, `aws-sre-agent`, `aws-cloud-security-engineer`	`aws-networking`
`awspricing`	`aws-pricing-mcp-server`	7 plugins (`aws-platform-engineer`, `aws-finops-engineer`, `aws-solutions-architect`, `aws-startup-advisor`, `aws-database-engineer`, `aws-deployment-engineer`, `aws-sagemaker-engineer`)	14 plugins (`aws-infrastructure-as-code`, `aws-compute`, `aws-containers`, `aws-storage`, `aws-messaging-and-streaming`, `aws-databases`, `aws-analytics`, `aws-ai-ml`, `aws-cost-optimization`, `aws-well-architected`, `aws-migration`, `aws-marketplace-seller`, `aws-end-user-computing`, `aws-quantum-computing`)
`aws-serverless-mcp`	`aws-serverless-mcp-server`	`aws-platform-engineer`, `aws-serverless-engineer`	`aws-serverless`
`awssupport`	`aws-support-mcp-server`	`aws-sre-agent`	`aws-observability`, `aws-resilience`
`aws-transform-mcp`	`aws-transform-mcp-server`	`aws-modernization-agent`	`aws-migration`
`billing`	`billing-cost-management-mcp-server`	7 plugins (`aws-finops-engineer`, `aws-platform-engineer`, `aws-sre-agent`, `aws-solutions-architect`, `aws-devsecops-engineer`, `aws-startup-advisor`, `aws-serverless-engineer`)	`aws-cost-optimization`, `aws-serverless`
`cloudtrail`	`cloudtrail-mcp-server`	`aws-platform-engineer`, `aws-sre-agent`, `aws-cloud-security-engineer`, `aws-agentcore-engineer`, `aws-devsecops-engineer`	`aws-observability`, `aws-resilience`, `aws-security-identity`
`appsignals`	`cloudwatch-applicationsignals-mcp-server`	`aws-sre-agent`, `aws-agentcore-engineer`	`aws-observability`, `aws-resilience`
`cloudwatch`	`cloudwatch-mcp-server`	12 agent plugins	18 vertical plugins
`dynamodb`	`dynamodb-mcp-server`	`aws-amplify-engineer`, `aws-serverless-engineer`, `aws-database-engineer`	`aws-databases`, `aws-serverless`, `aws-web-and-mobile`
`ecs`	`ecs-mcp-server`	`aws-platform-engineer`, `aws-sre-agent`	`aws-containers`
`eks`	`eks-mcp-server`	`aws-platform-engineer`, `aws-sre-agent`	`aws-containers`
`elasticache`	`elasticache-mcp-server`	`aws-database-engineer`	`aws-databases`
`finch`	`finch-mcp-server`	`aws-platform-engineer`	`aws-containers`
`iam`	`iam-mcp-server`	`aws-platform-engineer`, `aws-cloud-security-engineer`	`aws-security-identity`
`mysql`	`mysql-mcp-server`	`aws-database-engineer`	`aws-databases`
`postgres`	`postgres-mcp-server`	`aws-modernization-agent`, `aws-database-engineer`	`aws-databases`, `aws-migration`
`prometheus`	`prometheus-mcp-server`	`aws-sre-agent`	`aws-observability`
`redshift`	`redshift-mcp-server`	`aws-data-engineer`	`aws-analytics`
`s3tables`	`s3-tables-mcp-server`	`aws-data-engineer`	`aws-analytics`, `aws-storage`
`sagemaker`	`sagemaker-ai-mcp-server`	`aws-sagemaker-engineer`	`aws-ai-ml`
`spark-troubleshooting`	`sagemaker-unified-studio-spark-troubleshooting-mcp-server`	`aws-data-engineer`	`aws-analytics`
`aws-security-agent`	`security-agent-mcp-server`	`aws-devsecops-engineer`	`aws-security-identity`
`wa-security`	`well-architected-security-mcp-server`	`aws-platform-engineer`, `aws-cloud-security-engineer`, `aws-devsecops-engineer`	`aws-security-identity`, `aws-well-architected`

Connection-bound connectors (11 `awslabs` + `terraform`)

Connector Key	Upstream Server / Image	Agent Plugins	Vertical / Partner Plugins
`aurora-dsql`	`awslabs.aurora-dsql-mcp-server`	`aws-serverless-engineer`, `aws-database-engineer`	`aws-databases`
`documentdb`	`awslabs.documentdb-mcp-server`	`aws-database-engineer`	`aws-databases`
`keyspaces`	`awslabs.amazon-keyspaces-mcp-server`	`aws-database-engineer`	`aws-databases`
`lambda-tool`	`awslabs.lambda-tool-mcp-server`	`aws-serverless-engineer`	`aws-serverless`
`memcached`	`awslabs.memcached-mcp-server`	`aws-database-engineer`	`aws-databases`
`mssql`	`awslabs.mssql-mcp-server`	`aws-database-engineer`	`aws-databases`
`neptune`	`awslabs.amazon-neptune-mcp-server`	`aws-database-engineer`	`aws-databases`
`oracle`	`awslabs.oracle-mcp-server`	`aws-database-engineer`	`aws-databases`
`stepfunctions-tool`	`awslabs.stepfunctions-tool-mcp-server`	`aws-serverless-engineer`	`aws-serverless`
`timestream-influxdb`	`awslabs.timestream-for-influxdb-mcp-server`	`aws-database-engineer`	`aws-databases`
`valkey`	`awslabs.valkey-mcp-server`	`aws-database-engineer`	`aws-databases`
`terraform`	`docker run hashicorp/terraform-mcp-server:1`	`aws-iac-engineer`	`aws-infrastructure-as-code`, `terraform`

Ecosystem & AWS proxy MCP servers

Key	Mode	Launch / Endpoint	Used By
`aws-mcp`	Bundled	`uvx mcp-proxy-for-aws-cli==1.7.0 --skip-auth --metadata`	11 agent plugins + all 21 vertical plugins
`aws-mcp-read-only`	Bundled	`uvx mcp-proxy-for-aws-cli==1.7.0 --skip-auth --read-only --metadata`	`aws-sre-agent` (plus `--read-only` on `aws-finops-engineer` & `aws-solutions-architect`)
`pulumi`	Bundled	`https://mcp.ai.pulumi.com/mcp`	`aws-iac-engineer`, `aws-infrastructure-as-code`
`tm`	Bundled	`uvx git+https://github.com/awslabs/threat-modeling-mcp-server.git`	`aws-solutions-architect`, `aws-security-identity`, `aws-well-architected`
`drawio`	Bundled	`npx @drawio/mcp`	`aws-solutions-architect`, `aws-well-architected`
`strands-agents`	Bundled	`uvx strands-agents-mcp-server@latest`	`aws-agentcore-engineer`, `aws-ai-ml`

Authoring & validating plugins

All 40 plugins in plugins/agent-plugins/, plugins/vertical-plugins/, and plugins/partner-built/ are authored in-place and verified with a zero-dependency validator.

1. Agent plugin layout (`plugins/agent-plugins/<agent>/`)

plugins/agent-plugins/<agent>/
├── .claude-plugin/plugin.json     # Claude Code manifest; name == <agent>
├── plugin.json                    # Portable Agent Plugins 1.0.0 manifest
├── .codex-plugin/plugin.json      # Codex overlay manifest + interface card
├── agents/<agent>.md              # Primary specialist sub-agent (YAML frontmatter + 7-section body)
├── codex/agents/<agent>.toml      # Codex custom agent definition
├── skills/<skill>/SKILL.md        # Self-contained domain skills
├── commands/*.md                  # Optional slash commands (/<agent>:<command>)
├── hooks/hooks.json               # PreToolUse / PostToolUse hooks referencing ${CLAUDE_PLUGIN_ROOT}
├── .mcp.json                      # Claude Code MCP server definitions
├── mcp.json                       # Portable Agent Plugins 1.0.0 MCP server definitions
└── README.md

Every agents/<agent>.md file follows a strict 7-section contract verified by scripts/validate_plugins.py:

One-line role statement (You are the ... —)
## What you produce (numbered deliverables)
## Workflow (intent-based routing to named skills in backticks)
## MCP servers bound to this agent (table of bound servers and responsibilities)
## Guardrails (confirmations before mutation/spend, secret handling, and returning missing inputs as a question list when running as a sub-agent)
## Hand-offs (sibling specialist agents that own adjacent domains)
## Skills this agent uses (backtick-quoted list separated by ·, matching skills/*/SKILL.md 1:1)

2. Vertical plugin layout (`plugins/vertical-plugins/<domain>/`)

plugins/vertical-plugins/<domain>/
├── .claude-plugin/plugin.json     # name == <domain>
├── .codex-plugin/plugin.json      # Codex overlay manifest
├── plugin.json                    # Portable Agent Plugins 1.0.0 manifest
├── skills/<skill>/SKILL.md        # Main-agent domain skills
├── commands/*.md                  # Multi-phase slash command playbooks (/<domain>:<command>)
├── hooks/hooks.json               # Deterministic safety & lint hooks
├── .mcp.json                      # Claude Code MCP servers
├── mcp.json                       # Portable Agent Plugins 1.0.0 MCP servers
├── CONNECTORS.md                  # Optional connection-bound MCP servers
└── README.md

3. Running the validator

Before opening a pull request against talkops-ai/devops-plugins, run the validation suite:

# Run structural, manifest, frontmatter, hook, connector, and MCP binding checks across all 40 plugins
python3 scripts/validate_plugins.py

# Optional: also run `claude plugin validate` on each plugin
python3 scripts/validate_plugins.py --claude

How MCP servers bind to plugins​

Bundled awslabs/mcp servers (35 servers)​

Connection-bound connectors (11 awslabs + terraform)​

Ecosystem & AWS proxy MCP servers​

Authoring & validating plugins​

1. Agent plugin layout (plugins/agent-plugins/<agent>/)​

2. Vertical plugin layout (plugins/vertical-plugins/<domain>/)​

3. Running the validator​