DE//AGENT
Explore
Tutorial Lesson 7 of 10 · The Cloud Series community beginner

Wire cloud tooling — registry skills, MCP servers, and one review workflow

Wire the registry's cloud tooling into one agent workflow: install the Glue and Athena review skills, bind the AWS MCP server to a least-privilege profile, and compose both skills plus the MCP server into the architecture reviewer. The same pattern covers GCP with the BigQuery server.

At a glance

When You are setting up an agent to review or operate a cloud data platform; A team shares one admin role for agents and needs the least-privilege pattern
Where AWS
Why An agent is only as safe and useful as the skills and credentials bound to it — least-privilege profiles and curated checklists beat a general-purpose admin role.

Learning objectives

  • Install a registry skill and bind an MCP server with least-privilege credentials
  • Compose skills and MCP servers into a single review workflow
  • Keep agent access read-only by default

What you need

  • An AWS named profile with least-privilege permissions
  • [object Object]

Steps

  1. Add the Athena advisor to your agent — the install command is npx de-agent-platform add athena-partition-advisor. (from skill-athena-partition-advisor )
  2. Give the agent the Glue checklist — it reviews Glue/Spark jobs for worker sizing, job bookmarks, partition pruning, and the catalogue/schema pitfalls that cause silent full reprocessing. (from skill-aws-glue-reviewer )
  3. Give it the Athena lever — the advisor recommends partition projection, bucketing or file-layout changes to reduce bytes-scanned, and writes the projection DDL. (from skill-athena-partition-advisor )
  4. Bind the AWS MCP server — uvx awslabs.core-mcp-server@latest, with AWS_PROFILE supplied through the environment. (from mcp-aws )
  5. Know the AWS tool surface — aws_documentation_search, read_documentation, recommend, and run_iac_generation. (from mcp-aws )
  6. Compose the reviewer — it ships with the Glue reviewer and Athena advisor skills attached, plus mcp-aws among its MCP servers. (from agent-aws-architecture-reviewer )
  7. Same pattern for GCP — the BigQuery server exposes execute_query, list_datasets, list_tables, and describe_table. (from mcp-bigquery )

Check yourself

  • npx de-agent-platform add athena-partition-advisor succeeds and the skill appears in the agent's list.
  • The AWS MCP server starts with AWS_PROFILE pointing at a dedicated least-privilege profile, not an admin role.
  • The architecture reviewer lists skill-aws-glue-reviewer and skill-athena-partition-advisor among its skills, and mcp-aws among its MCP servers.

Worked example

Install the Athena advisor skill — from skill-athena-partition-advisor 

npx de-agent-platform add athena-partition-advisor

Bind the AWS MCP server — from mcp-aws 

mcpServers:
  aws-core:
    command: uvx
    args: [awslabs.core-mcp-server@latest]
    env:
      AWS_PROFILE: ${AWS_PROFILE}
      FASTMCP_LOG_LEVEL: ERROR

Bind the BigQuery MCP server — from mcp-bigquery 

mcpServers:
  bigquery:
    command: uvx
    args: [mcp-server-bigquery, --project, my-project]

Sourced from

Security scan

Last sweep 2026-10-24: 0 finding(s), 0 marked as examples.

Common gotchas

  • Server capabilities vary widely; some AWS MCP servers can create resources — treat resource-creating tools as requiring human confirmation.
  • The BigQuery server needs GOOGLE_APPLICATION_CREDENTIALS pointing at a service-account key with BigQuery roles — scope those roles down before binding.
  • AWS_PROFILE is required for the AWS MCP server — the named profile's IAM permissions define what is reachable.

Production considerations

  • Bind each MCP server to a dedicated profile with short-lived SSO credentials; never attach an admin role.
  • Prefer key-pair auth over passwords for service users on warehouse MCP servers.

Diagram

cloud agent tooling
   |
   |- npx de-agent-platform add aws-glue-job-reviewer   --> Glue checklist
   |- npx de-agent-platform add athena-partition-advisor --> bytes-scanned levers
   |
   |- mcp-aws: uvx awslabs.core-mcp-server@latest + AWS_PROFILE --> least privilege
   |
   |- agent-aws-architecture-reviewer: skills + mcp-aws composed
   |
    --> GCP same pattern: mcp-server-bigquery (execute_query, list_datasets, ...)

Registry stats

Verification community · Oct 23, 2026
Completeness 81
Trust multiplier ×1.25
Composite 34.15 · adequate
Freshness 1 days since last source check
Difficulty beginner
Version 0.1.0
License CC-BY-4.0
Security flags none