Let AI agents operate your AWS.
You keep the approve button.

Mesoplane is the governance layer between agents like Claude Code and your AWS account. They diagnose and fix, even at 3 AM. Risky actions wait for a human. Every change is audited and reversible.

0 credentials stored · 100+ typed operations · 15+ AWS services · 1 stack to revoke everything

incident · prod · us-east-1 · live replay

what is mesoplane · the one-line answer

Mesoplane is the governance layer between AI agents and AWS: agents request typed operations instead of holding credentials, humans approve the risky ones, every action lands on a tamper-evident audit ledger, and destructive changes stay reversible.

How it works

One governed path between AI agents and AWS

Requests fall from the agent layer. Safe ones pass. Risky ones hold for a human. Out-of-policy ones never reach your account.

safe ops pass through · risky ops hold for a human · out-of-policy ops never reach AWS

1Connect in minutes. One CloudFormation stack, read-only to start.

2Agents request, never touch. Typed operations, zero credentials.

3You stay in charge. Approve risky actions, audit and undo anything.

The honest comparison

Raw access is fast. Governed access is survivable.

Three ways to let an AI agent touch AWS, side by side.

Keys pasted into the agent AWS MCP Server raw IAM access Mesoplane governed operations
Credentials Long-lived keys on the agent's machine Your IAM credentials on the dev machine None. Agents never hold credentials
What can run Anything the keys allow 15,000+ APIs, scoped by IAM alone 100+ typed, risk-tiered operations
Risky actions Run instantly Run instantly Held for human approval
Audit trail CloudTrail: an API call happened CloudTrail plus a service context key Ledger: which agent, what intent, what changed, cross-checked against CloudTrail
Rollback None None Saved before every destructive change
Kill switch Rotate keys and hope Edit IAM policies Delete one CloudFormation stack

Based on AWS public documentation, July 2026. The AWS MCP Server is AWS's own managed endpoint; plenty of teams keep it for docs and read paths while writes go through governed operations.

The console

Approve from anywhere. Audit forever.

  • One inbox for risk. Agents queue the dangerous stuff. You clear it in seconds.
  • Context on the card. Who asked, what changes, and the undo, before you click.
  • Ledger behind every button. Each decision lands as a verifiable entry.

Why it exists

Agents are ready for production. Your credentials are not.

Pasted keys

An agent with your AWS access keys is one bad tool call away from disaster.

No "are you sure?"

IAM allows or denies. It never asks a human first.

Audit gaps

CloudTrail shows an API call. Not which agent did it, or why.

What's in the box

AI agent governance for AWS, built in

Typed operations

A registry of known, risk-tiered AWS ops. Not a free shell, not wildcard IAM.

Human-in-the-loop approvals

Risky actions wait for a person. Everything else just runs.

Tamper-evident audit trail

Every action recorded, exportable, verifiable, cross-checked against CloudTrail.

Rollback built in

Destructive changes save their before-state. Undo is a button.

Kill switch you own

Delete one stack in your AWS account. Access ends instantly.

Scans & drift watch

Findings open, fixes ship governed, drift reopens them.

Security model

Built assuming the worst day happens

What if we get hacked? That question shaped the whole design: there is nothing worth stealing here, and you can cut us off without asking.

Read the security model
mesoplane stored keys: none Your AWS account role: mesoplane-* delete the stack → access ends instantly AssumeRole + ExternalId · STS 15 min the connection is a handshake, not a secret
  • No stored cloud credentials. Short-lived STS only.
  • Your kill switch. Delete the stack, access dies.
  • Fail closed. Unknown workspace? Refused.
  • Attributed. Every session names the acting agent.

FAQ

Frequently asked questions

What is Mesoplane?

Mesoplane is a governance layer that sits between AI agents (Claude Code or any MCP client) and your AWS account. Agents request typed operations instead of holding credentials. Mesoplane verifies identity and policy, holds risky actions for human approval, executes with short-lived credentials, records every action on a tamper-evident ledger, and keeps destructive changes reversible.

How is Mesoplane different from the AWS MCP Server?

The AWS MCP Server gives coding agents raw API access scoped only by IAM: whatever IAM allows runs immediately, logged to CloudTrail. Mesoplane adds the governance layer on top of the same trust primitives: typed risk-tiered operations, human-in-the-loop approvals before risky actions, per-agent attribution, rollback envelopes, and a verifiable audit ledger. Use both together, or route writes through Mesoplane alone.

How do I give Claude Code safe access to AWS?

Do not paste access keys into the agent. Connect your AWS account to Mesoplane with a CloudFormation quick-create stack that creates one IAM role (AssumeRole with an ExternalId), then give Claude Code the Mesoplane skills or MCP endpoint. The agent gets governed operations, never credentials. Start read-only and grant write operations as trust grows.

How does Mesoplane connect to my AWS account?

You launch a CloudFormation quick-create stack that creates one IAM role in your account, trusted via AssumeRole with an ExternalId. No access keys change hands and nothing is installed in your VPC. You can start read-only and grant more later.

Does Mesoplane store my AWS credentials?

No. Mesoplane never stores long-lived AWS credentials, and agents never hold any credentials at all. Every approved operation runs with short-lived STS credentials from the role you created. Delete the CloudFormation stack and all access ends instantly. That kill switch lives in your account, not ours.

What happens when an AI agent tries something risky?

The operation pauses before it touches AWS. Mesoplane risk-tiers every typed operation; destructive or high-blast-radius actions are held while an approval card goes to a human in the console, Slack, or on your phone, showing who asked, what changes, and the rollback plan. Approve and it runs fully attributed. Refuse and nothing happens.

Which AWS services does Mesoplane support?

Governed operations today cover EC2, EBS, S3, RDS, IAM, ECS, EKS, VPC, load balancers, KMS, WAF, CloudWatch, CloudTrail, Security Hub, DynamoDB, and Amplify, plus account-wide security scans, drift watch, and footprint discovery. New capabilities ship as typed, reviewed operations rather than a raw shell.

Which AI agents and tools work with Mesoplane?

Anything that can use skills or an HTTP API works today, including Claude Code. An MCP facade exposes the same governed operations to MCP clients. Every path shares one typed operation registry, so governance is identical wherever a request comes from.

Does Mesoplane replace AWS IAM?

No, it builds on IAM. IAM decides what the Mesoplane role may touch in your account. Mesoplane adds what IAM does not have: per-agent identity, human approvals for risky actions, a verifiable audit ledger, and rollback. IAM stays your floor; Mesoplane is the judgment layer above it.

Give your agents safe hands in AWS

Connect an AWS account read-only in minutes. Nothing to install. Nothing to paste. Nothing we can leak.