{
  "slug": "com-pulsemcp-dynamodb",
  "name": "com.pulsemcp/dynamodb",
  "title": "dynamodb",
  "description": "MCP server for AWS DynamoDB with fine-grained tool control and configurable access levels.",
  "version": "0.2.7",
  "publishedAt": "2026-06-17T03:55:49.744407Z",
  "updatedAt": "2026-06-17T03:55:49.744407Z",
  "repoUrl": "https://github.com/pulsemcp/mcp-servers",
  "websiteUrl": null,
  "namespace": {
    "type": "domain",
    "owner": "pulsemcp.com"
  },
  "kind": "local",
  "packages": [
    {
      "registryType": "npm",
      "identifier": "aws-dynamodb-mcp-server",
      "version": "0.2.7",
      "transport": "stdio",
      "runtimeHint": "npx"
    }
  ],
  "remotes": [],
  "envVars": [
    {
      "name": "AWS_REGION",
      "isSecret": false,
      "isRequired": true,
      "description": "AWS region for DynamoDB (or use AWS_DEFAULT_REGION)."
    },
    {
      "name": "AWS_ACCESS_KEY_ID",
      "isSecret": true,
      "isRequired": false,
      "description": "AWS access key ID (uses AWS credential chain if not set)."
    },
    {
      "name": "AWS_SECRET_ACCESS_KEY",
      "isSecret": true,
      "isRequired": false,
      "description": "AWS secret access key (uses AWS credential chain if not set)."
    },
    {
      "name": "DYNAMODB_ENDPOINT",
      "isSecret": false,
      "isRequired": false,
      "description": "Custom endpoint for local DynamoDB or LocalStack."
    },
    {
      "name": "DYNAMODB_ENABLED_TOOL_GROUPS",
      "isSecret": false,
      "isRequired": false,
      "description": "Comma-separated tool groups to enable (readonly, readwrite, admin)."
    },
    {
      "name": "DYNAMODB_ENABLED_TOOLS",
      "isSecret": false,
      "isRequired": false,
      "description": "Comma-separated whitelist of specific tools to enable."
    },
    {
      "name": "DYNAMODB_DISABLED_TOOLS",
      "isSecret": false,
      "isRequired": false,
      "description": "Comma-separated blacklist of specific tools to disable."
    },
    {
      "name": "DYNAMODB_ALLOWED_TABLES",
      "isSecret": false,
      "isRequired": false,
      "description": "Restrict operations to specific tables (comma-separated); all tables accessible if not set."
    },
    {
      "name": "SKIP_HEALTH_CHECKS",
      "isSecret": false,
      "isRequired": false,
      "description": "Skip startup health checks."
    }
  ],
  "category": "cloud-infra",
  "subcategory": "providers",
  "company": "",
  "categoryAuto": true,
  "checks": [
    {
      "id": "source-linked",
      "label": "Source repository linked",
      "result": "pass",
      "detail": "https://github.com/pulsemcp/mcp-servers"
    },
    {
      "id": "version-pinned",
      "label": "Version pinned",
      "result": "pass",
      "detail": "Every package has an explicit version"
    },
    {
      "id": "secrets-requested",
      "label": "Secrets requested",
      "result": "info",
      "detail": "Asks for 2 secrets: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY"
    },
    {
      "id": "known-registry",
      "label": "Known package registry",
      "result": "pass",
      "detail": "All packages come from npm, PyPI, OCI, NuGet or MCPB"
    },
    {
      "id": "namespace",
      "label": "Namespace ownership",
      "result": "info",
      "detail": "Name verified via domain pulsemcp.com"
    },
    {
      "id": "meta-text",
      "label": "Registry text aimed at the AI",
      "result": "pass",
      "detail": "Description and settings contain no hidden characters or instructions to the AI"
    },
    {
      "id": "install-scripts",
      "label": "Install scripts",
      "result": "pass",
      "detail": "aws-dynamodb-mcp-server@0.2.7 runs nothing at install"
    },
    {
      "id": "code-flags",
      "label": "Code red flags",
      "result": "pass",
      "detail": "Read 48 files in aws-dynamodb-mcp-server@0.2.7: no obfuscation, encoded execution, credential reads or data-collection endpoints found"
    },
    {
      "id": "ai-text",
      "label": "Text aimed at the AI",
      "result": "pass",
      "detail": "No hidden characters or instructions to the AI in 48 files, including comments and the README"
    }
  ],
  "scannedAt": "2026-10-29",
  "level": "Scanned",
  "install": [
    {
      "label": "Claude Desktop (npm)",
      "kind": "claude_desktop_json",
      "text": "{\n  \"mcpServers\": {\n    \"dynamodb\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"aws-dynamodb-mcp-server@0.2.7\"\n      ],\n      \"env\": {\n        \"AWS_REGION\": \"<your value>\"\n      }\n    }\n  }\n}"
    }
  ],
  "curated": true,
  "stars": 81,
  "archived": false,
  "pushedAt": "2026-10-09T17:32:15Z",
  "review": {
    "package": "aws-dynamodb-mcp-server",
    "version": "0.2.7",
    "at": "2026-10-31",
    "files": 46,
    "lines": 4162,
    "verdict": "pass-with-notes",
    "summary": "Lets your AI read and change your Amazon DynamoDB tables. It talks only to AWS DynamoDB (or a local DynamoDB endpoint you set), using the AWS credentials you configure. Its job is to send your table data to AWS and back. Watch out: by default it can also write, delete and drop whole tables. Set DYNAMODB_ENABLED_TOOL_GROUPS=readonly (and DYNAMODB_ALLOWED_TABLES) if you only want reading.",
    "hosts": [
      {
        "host": "dynamodb.<AWS_REGION>.amazonaws.com (AWS SDK default endpoint)",
        "when": "only when a tool is called (a new client is built per call; startup makes no network call)",
        "sends": "table names, keys, items, query/scan/update expressions from the tool arguments, signed with the user's AWS credentials"
      },
      {
        "host": "DYNAMODB_ENDPOINT (optional, user-set, e.g. DynamoDB Local / LocalStack)",
        "when": "only when a tool is called, replaces the AWS endpoint",
        "sends": "same as above"
      },
      {
        "host": "AWS credential-chain endpoints (IMDS/SSO/STS) via @aws-sdk default provider chain",
        "when": "on first tool call if AWS_ACCESS_KEY_ID/SECRET not set; dependency behaviour, not in package code",
        "sends": "credential lookup requests only"
      }
    ],
    "env": [
      {
        "name": "AWS_REGION / AWS_DEFAULT_REGION",
        "sent_to": "used to pick the AWS regional endpoint (required)"
      },
      {
        "name": "AWS_ACCESS_KEY_ID",
        "sent_to": "AWS SDK request signing for DynamoDB only; never logged (config resource shows '***configured***')"
      },
      {
        "name": "AWS_SECRET_ACCESS_KEY",
        "sent_to": "AWS SDK request signing for DynamoDB only; never logged"
      },
      {
        "name": "DYNAMODB_ENDPOINT",
        "sent_to": "custom endpoint; logged at DEBUG only"
      },
      {
        "name": "DYNAMODB_ENABLED_TOOL_GROUPS / DYNAMODB_ENABLED_TOOLS / DYNAMODB_DISABLED_TOOLS / DYNAMODB_ALLOWED_TABLES / SKIP_HEALTH_CHECKS / NODE_ENV / DEBUG",
        "sent_to": "local configuration only"
      },
      {
        "name": "DYNAMODB_MOCK_DATA",
        "sent_to": "local only, read by the shipped test entry build/index.integration-with-mock.js"
      },
      {
        "name": "YOUR_RESOURCE_ID",
        "sent_to": "template leftover in shared/state.js, never called by the server"
      }
    ],
    "local": "Reads its own package.json for the version. No other file system reads or writes. No paths taken from tool input.",
    "exec": "None. No child_process, eval, dynamic import or shell use.",
    "telemetry": "None.",
    "tools": [
      "list_tables",
      "describe_table",
      "get_item",
      "query_items",
      "scan_table",
      "batch_get_items",
      "put_item",
      "update_item",
      "delete_item",
      "batch_write_items",
      "create_table",
      "delete_table",
      "update_table"
    ],
    "toolText": "clean",
    "deps": [
      "@modelcontextprotocol/sdk",
      "@aws-sdk/client-dynamodb",
      "@aws-sdk/lib-dynamodb",
      "zod"
    ],
    "findings": [
      {
        "severity": "note",
        "at": "shared/tools.js:176-191",
        "what": "All 13 tools, including write (put/update/delete/batch_write) and admin (create_table, delete_table, update_table) tools, are enabled by default. Users must set DYNAMODB_ENABLED_TOOL_GROUPS=readonly to get a read-only server."
      },
      {
        "severity": "note",
        "at": "shared/tools/delete-table.js:41-61",
        "what": "delete_table permanently deletes a table and all its data with no confirmation step beyond the AI client's own approval prompt. The description does warn that it is destructive."
      },
      {
        "severity": "info",
        "at": "shared/tools.js:104-136",
        "what": "Optional DYNAMODB_ALLOWED_TABLES allow-list is enforced on every tool, and list_tables also hides non-allowed table names and pagination cursors."
      },
      {
        "severity": "info",
        "at": "shared/resources.js:29-37",
        "what": "The dynamodb://config resource masks AWS keys as '***configured***'; no secrets are exposed or logged."
      },
      {
        "severity": "info",
        "at": "build/index.integration-with-mock.js:1-42",
        "what": "A test entry point with an in-memory mock client ships in the package. It is not the package's main entry and makes no network calls."
      },
      {
        "severity": "info",
        "at": "shared/dynamodb-client/dynamodb-client.js:235-245",
        "what": "Quality: batch_get_items accepts projectionExpression/expressionAttributeNames but silently drops them, so full items are always returned."
      },
      {
        "severity": "info",
        "at": "shared/state.js:1-109",
        "what": "Template boilerplate (resource-selection state, YOUR_RESOURCE_ID) is left in but never called; harmless."
      }
    ]
  },
  "health": {
    "score": 63,
    "parts": {
      "popularity": 0.39219813546551197,
      "activity": 0.6674452394758004,
      "issues": 0.7096774193548387,
      "security": 1
    },
    "fail": 0,
    "warn": 0,
    "raw": {
      "stars": 81,
      "forks": 10,
      "downloads": 62,
      "hn": {
        "n": 0,
        "pts": 0,
        "t": []
      },
      "issuesOpen": 27,
      "issuesClosed": 66,
      "prsMerged": 491,
      "commits90": 1,
      "release": "2025-07-03T16:10:39Z",
      "pushed": "2026-10-09T17:32:15Z",
      "growth": null,
      "growthDays": null,
      "archived": false
    },
    "at": "2026-10-31T07:42:38.200Z"
  }
}