Is this an official AWS CloudTrail MCP server?

No. It is Memtro's MCP server with Memtro's AWS CloudTrail connector behind it: the connector reads AWS CloudTrail through its API with the credentials you connect on Dashboard → Connections, and AWS CloudTrail publishes nothing here. The same endpoint carries every other system you connect and Memtro's memory tools.

Nothing on top of Memtro. One price per organisation by its number of users, from $50 a month for up to 10 users after a 7-day free trial, with every connector, the MCP server, jobs and memory included. You bring your own model keys.

Can it change anything in AWS CloudTrail?

Not yet. Today every AWS CloudTrail tool reads, searches or lists; when it gains actions, each is marked, granted by name and used only when you ask, so nothing is created, sent, updated or deleted until you say so.

Any MCP client that speaks Streamable HTTP: Claude Code, Cursor, Claude Desktop, OpenCode, Codex, Zed, Windsurf, Cline and the Anthropic and OpenAI SDKs. There is no local process to run; the server is remote and authenticated with your key.

MCP server · Engineering and operations

AWS CloudTrail MCP server

AWS CloudTrail in any MCP client, through Memtro: AWS CloudTrail does not publish this server. Memtro's AWS CloudTrail connector reads AWS CloudTrail through its API with the credentials you connect, and one endpoint hands those tools, every other system you connect and Memtro's memory tools to Claude Code, Cursor, Claude Desktop or anything else that speaks Streamable HTTP, as you.

What the model can do

Read-only AWS audit log: who did what in the account over the last 90 days, by user, action, resource or service; change summaries for a time window; the full record of one event; and whether trails are logging.

Reads

cloudtrail_eventsLook up CloudTrail management events (last 90 days) in a time window, optionally filtered by one attribute: EventName (e.g. RunInstances), Username…
cloudtrail_eventThe full record of one event by its EventId: identity, request parameters, response elements, user agent and any error.
cloudtrail_summaryWho changed what in a time window (default the last 24 hours): counts of write events by action, principal, service and resource type…
cloudtrail_resource_historyEvery recorded event touching one resource (instance id, bucket name, security group id, role name, function name…) in the last 90 days…
cloudtrail_trailsThe trails configured in the account and whether each is logging: home region, multi-region or organisation trail, S3 bucket…

Connect it

First connect AWS CloudTrail on Dashboard → Connections, then add Memtro to your client once. The AWS CloudTrail tools appear alongside the tools of everything else you have connected; nothing is configured per connector.

Claude Code

One command registers the server; the tools are then available in every session.

claude mcp add --transport http memtro https://platform.memtro.com/api/mcp \
  --header "Authorization: Bearer sk-memtro-..."

Cursor

Add the server to .cursor/mcp.json in the project, or to the global file under ~/.cursor/.

{
  "mcpServers": {
    "memtro": {
      "url": "https://platform.memtro.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk-memtro-..."
      }
    }
  }
}

Claude Desktop

Create a personal API key on Dashboard → Profile → API keys. In Claude Desktop add an MCP server of type HTTP with URL https://platform.memtro.com/api/mcp and the header Authorization: Bearer sk-memtro-…

OpenCode

A remote server in opencode.json.

{
  "mcp": {
    "memtro": {
      "type": "remote",
      "url": "https://platform.memtro.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk-memtro-..."
      }
    }
  }
}

Any other client

Add an MCP server of type HTTP (Streamable HTTP, stateless) at https://platform.memtro.com/api/mcp with the header Authorization: Bearer sk-memtro-.... Codex, Zed, Windsurf, Cline and the SDKs all take a remote server this way.

Who may use it

The key identifies the person, and the server offers that person the tools they may use everywhere else in Memtro. A shared AWS CloudTrail connection is used by the teams an administrator granted it to, tool by tool, on the Permissions page; a personal connection is used by its owner alone, and its tools that act stay off until the owner allows them. See Teams and permissions and Connectors.

Ask it like this

› Who changed the security group sg-0a1b2c yesterday?
› What did the deploy role do between 2pm and 3pm?
› Which IAM changes happened this week?
› Show the history of the prod-uploads bucket
› Are our trails still logging?

Questions

Is this an official AWS CloudTrail MCP server?: No. It is Memtro's MCP server with Memtro's AWS CloudTrail connector behind it: the connector reads AWS CloudTrail through its API with the credentials you connect on Dashboard → Connections, and AWS CloudTrail publishes nothing here. The same endpoint carries every other system you connect and Memtro's memory tools.
What does it cost?: Nothing on top of Memtro. One price per organisation by its number of users, from $50 a month for up to 10 users after a 7-day free trial, with every connector, the MCP server, jobs and memory included. You bring your own model keys.
Can it change anything in AWS CloudTrail?: Not yet. Today every AWS CloudTrail tool reads, searches or lists; when it gains actions, each is marked, granted by name and used only when you ask, so nothing is created, sent, updated or deleted until you say so.
Which clients work?: Any MCP client that speaks Streamable HTTP: Claude Code, Cursor, Claude Desktop, OpenCode, Codex, Zed, Windsurf, Cline and the Anthropic and OpenAI SDKs. There is no local process to run; the server is remote and authenticated with your key.