Let AI agents operate your AWS.
You keep the approve button.
Mesoplane is the governance layer between agents like Claude Code and your AWS account. They diagnose and fix, even at 3 AM. Risky actions wait for a human. Every change is audited and reversible.
0 credentials stored · 100+ typed operations · 15+ AWS services · 1 stack to revoke everything
what is mesoplane · the one-line answer
Mesoplane is the governance layer between AI agents and AWS: agents request typed operations instead of holding credentials, humans approve the risky ones, every action lands on a tamper-evident audit ledger, and destructive changes stay reversible.
How it works
One governed path between AI agents and AWS
Requests fall from the agent layer. Safe ones pass. Risky ones hold for a human. Out-of-policy ones never reach your account.
safe ops pass through · risky ops hold for a human · out-of-policy ops never reach AWS
1Connect in minutes. One CloudFormation stack, read-only to start.
2Agents request, never touch. Typed operations, zero credentials.
3You stay in charge. Approve risky actions, audit and undo anything.
The honest comparison
Raw access is fast. Governed access is survivable.
Three ways to let an AI agent touch AWS, side by side.
| Keys pasted into the agent | AWS MCP Server raw IAM access | Mesoplane governed operations | |
|---|---|---|---|
| Credentials | Long-lived keys on the agent's machine | Your IAM credentials on the dev machine | None. Agents never hold credentials |
| What can run | Anything the keys allow | 15,000+ APIs, scoped by IAM alone | 100+ typed, risk-tiered operations |
| Risky actions | Run instantly | Run instantly | Held for human approval |
| Audit trail | CloudTrail: an API call happened | CloudTrail plus a service context key | Ledger: which agent, what intent, what changed, cross-checked against CloudTrail |
| Rollback | None | None | Saved before every destructive change |
| Kill switch | Rotate keys and hope | Edit IAM policies | Delete one CloudFormation stack |
Based on AWS public documentation, July 2026. The AWS MCP Server is AWS's own managed endpoint; plenty of teams keep it for docs and read paths while writes go through governed operations.
The console
Approve from anywhere. Audit forever.
- One inbox for risk. Agents queue the dangerous stuff. You clear it in seconds.
- Context on the card. Who asked, what changes, and the undo, before you click.
- Ledger behind every button. Each decision lands as a verifiable entry.
Close port 22 open to 0.0.0.0/0 on sg-09ab…f2
prod-db-01 · connection pool exhausted
Why it exists
Agents are ready for production. Your credentials are not.
Pasted keys
An agent with your AWS access keys is one bad tool call away from disaster.
No "are you sure?"
IAM allows or denies. It never asks a human first.
Audit gaps
CloudTrail shows an API call. Not which agent did it, or why.
What's in the box
AI agent governance for AWS, built in
Typed operations
A registry of known, risk-tiered AWS ops. Not a free shell, not wildcard IAM.
Human-in-the-loop approvals
Risky actions wait for a person. Everything else just runs.
Tamper-evident audit trail
Every action recorded, exportable, verifiable, cross-checked against CloudTrail.
Rollback built in
Destructive changes save their before-state. Undo is a button.
Kill switch you own
Delete one stack in your AWS account. Access ends instantly.
Scans & drift watch
Findings open, fixes ship governed, drift reopens them.
Security model
Built assuming the worst day happens
What if we get hacked? That question shaped the whole design: there is nothing worth stealing here, and you can cut us off without asking.
Read the security model- No stored cloud credentials. Short-lived STS only.
- Your kill switch. Delete the stack, access dies.
- Fail closed. Unknown workspace? Refused.
- Attributed. Every session names the acting agent.
FAQ
Frequently asked questions
What is Mesoplane?
Mesoplane is a governance layer that sits between AI agents (Claude Code or any MCP client) and your AWS account. Agents request typed operations instead of holding credentials. Mesoplane verifies identity and policy, holds risky actions for human approval, executes with short-lived credentials, records every action on a tamper-evident ledger, and keeps destructive changes reversible.
How is Mesoplane different from the AWS MCP Server?
The AWS MCP Server gives coding agents raw API access scoped only by IAM: whatever IAM allows runs immediately, logged to CloudTrail. Mesoplane adds the governance layer on top of the same trust primitives: typed risk-tiered operations, human-in-the-loop approvals before risky actions, per-agent attribution, rollback envelopes, and a verifiable audit ledger. Use both together, or route writes through Mesoplane alone.
How do I give Claude Code safe access to AWS?
Do not paste access keys into the agent. Connect your AWS account to Mesoplane with a CloudFormation quick-create stack that creates one IAM role (AssumeRole with an ExternalId), then give Claude Code the Mesoplane skills or MCP endpoint. The agent gets governed operations, never credentials. Start read-only and grant write operations as trust grows.
How does Mesoplane connect to my AWS account?
You launch a CloudFormation quick-create stack that creates one IAM role in your account, trusted via AssumeRole with an ExternalId. No access keys change hands and nothing is installed in your VPC. You can start read-only and grant more later.
Does Mesoplane store my AWS credentials?
No. Mesoplane never stores long-lived AWS credentials, and agents never hold any credentials at all. Every approved operation runs with short-lived STS credentials from the role you created. Delete the CloudFormation stack and all access ends instantly. That kill switch lives in your account, not ours.
What happens when an AI agent tries something risky?
The operation pauses before it touches AWS. Mesoplane risk-tiers every typed operation; destructive or high-blast-radius actions are held while an approval card goes to a human in the console, Slack, or on your phone, showing who asked, what changes, and the rollback plan. Approve and it runs fully attributed. Refuse and nothing happens.
Which AWS services does Mesoplane support?
Governed operations today cover EC2, EBS, S3, RDS, IAM, ECS, EKS, VPC, load balancers, KMS, WAF, CloudWatch, CloudTrail, Security Hub, DynamoDB, and Amplify, plus account-wide security scans, drift watch, and footprint discovery. New capabilities ship as typed, reviewed operations rather than a raw shell.
Which AI agents and tools work with Mesoplane?
Anything that can use skills or an HTTP API works today, including Claude Code. An MCP facade exposes the same governed operations to MCP clients. Every path shares one typed operation registry, so governance is identical wherever a request comes from.
Does Mesoplane replace AWS IAM?
No, it builds on IAM. IAM decides what the Mesoplane role may touch in your account. Mesoplane adds what IAM does not have: per-agent identity, human approvals for risky actions, a verifiable audit ledger, and rollback. IAM stays your floor; Mesoplane is the judgment layer above it.
Give your agents safe hands in AWS
Connect an AWS account read-only in minutes. Nothing to install. Nothing to paste. Nothing we can leak.