What happened
AWS says Amazon OpenSearch Service now supports MCP Apps, an extension of the Model Context Protocol that lets AI agents return interactive trace waterfalls, service maps, log views, and other observability visualizations alongside text responses. The capability uses a local MCP server to connect a compatible IDE or AI client with an OpenSearch UI application and connected data sources.
In an AWS blog post dated Aug. 25, 2026, Amazon Web Services describes MCP Apps for Amazon OpenSearch Service as a way to close what it calls the verification gap in agentic observability. Under the current workflow described by AWS, an observability agent can query alerts, logs, traces, and metrics and produce a root-cause hypothesis, but the engineer must leave the agent interface, open a browser-based dashboard, repeat queries, and compare the dashboard with the agent’s text. AWS says MCP Apps add a second response channel so that a tool call returns both a structured text summary for the agent and an interactive visualization for the human reviewer.
The proposed architecture uses a local MCP server running on the engineer’s machine. According to AWS, the server receives a tool call from an IDE or AI client, authenticates with configured AWS credentials, forwards the request to an OpenSearch UI application, and returns a combined response. OpenSearch UI can connect to Amazon OpenSearch Service domains, serverless collections, and Amazon Managed Service for Prometheus. AWS says the organization’s data remains in its AWS account and that the local server acts as a bridge between the agentic client and the OpenSearch UI application.
The examples in the source cover several stages of an incident investigation. An agent may begin with alerts, search and cluster related log entries, locate a distributed trace, inspect span timing, query metrics with PromQL, and render a service dependency map. For a trace investigation, AWS says the text response can include the trace ID, duration, span count, critical path, and suspected failure origin, while the visual response shows the span hierarchy, timing, and error annotations. AWS also describes tools for monitoring AI and agent traces, cluster health, and telemetry quality. The setup requires an OpenSearch UI application with an Observability workspace, Node.js 22 or later, configured AWS credentials with es:ESHttpGet and es:ESHttpPost permissions, and a compatible client such as Claude Desktop, VS Code GitHub Copilot, Goose, ChatGPT, or Cursor.
Read the primary source: aws.amazon.com ↗
Why it matters
The product targets a practical weakness in agent-assisted incident response: engineers still need to leave the agent interface and manually verify the agent’s conclusions in a separate observability dashboard. Inline visual evidence could reduce context switching and make human review easier, although AWS provides no independent data showing how much resolution time improves.
The central change is not that an AI agent can query observability data; AWS’s own description assumes that capability already exists. The change is that the agent’s investigation and the human’s verification can occur in one conversation. That matters because incident response depends on checking evidence, not merely accepting a generated explanation. An inline trace waterfall or service map gives the engineer a direct view of the queried telemetry while preserving the agent’s textual reasoning in the same thread.
AWS presents the visualizations as deterministic because OpenSearch MCP App generates them by executing code against the underlying data sources used by OpenSearch dashboards. This could reduce one important risk in agent-assisted operations: the agent’s written summary may omit, misread, or incorrectly prioritize evidence that is visible in the underlying telemetry. The source does not establish that deterministic rendering makes the overall investigation accurate, however. It only supports the narrower claim that the visualization is generated from the queried data rather than being a purely free-form description produced by the language model.
For organizations already using local or self-managed agentic workflows, the feature may offer a practical middle ground between autonomous querying and human oversight. Engineers can ask an agent to investigate and then inspect the evidence without switching tools or repeating the query. That could improve usability during on-call work and make it easier to identify when an agent’s hypothesis is unsupported. The public impact is primarily operational: fewer interface changes may make AI-assisted incident response easier to adopt. AWS provides no benchmark, customer results, error-rate analysis, or independent assessment showing that the feature actually reduces resolution time or prevents incidents.
What to watch next
The important questions are whether the MCP Apps work reliably across supported clients, how much setup and IAM administration they require, and whether the visualizations remain trustworthy under incomplete or misleading telemetry. AWS also does not specify pricing, regional availability, service limits, or independent evaluations of the claimed performance benefits.
The first issue to watch is real-world reliability across the supported clients. MCP Apps depend on cooperation among the local MCP server, the IDE or AI host, OpenSearch UI, AWS authentication, and the connected telemetry systems. The source gives setup instructions but does not describe compatibility differences among Claude Desktop, VS Code GitHub Copilot, Goose, ChatGPT, and Cursor. It also does not explain how visualizations behave when a client cannot render the added response payload, when credentials expire, or when the underlying data source is unavailable.
Security and governance will also matter. AWS says the MCP server runs locally, credentials and policies remain under the customer’s control, and no cloud resources are provisioned by the setup. Those statements describe the architecture, not a complete security evaluation. The source does not specify credential-isolation mechanisms, audit logging, network controls, data retention, prompt-injection defenses, or protections against an agent using observability tools beyond its intended scope. Teams considering production use would need those details before treating inline evidence as sufficient operational control.
Finally, customers will need clearer information about availability and cost. AWS does not state whether MCP Apps are generally available everywhere Amazon OpenSearch Service or OpenSearch UI is offered, whether additional charges apply, or whether particular visualization and investigation tools have quotas or feature restrictions. It also remains unknown how well the approach handles incomplete telemetry, high-cardinality data, noisy alerts, or a root-cause hypothesis that is wrong despite an accurate visualization. The next meaningful evidence would be documented service limits, security guidance, independent testing, and customer results comparing agent-assisted investigations with existing on-call workflows.
