The AWS MCP Server can now diagnose a Lambda function and the seven services around it

Debugging a Lambda function usually means leaving the editor: open the console, find the log group, guess which of the surrounding services changed. AWS published a capability on September 4, 2026 that moves that work into the agent already sitting in the editor, and charges nothing for it.

What the agent can look at

The capability lets an agent inspect a Lambda function together with the resources connected to it, rather than the function in isolation. AWS names seven services it can reach across: Amazon API Gateway, Amazon EventBridge, Amazon S3, Amazon DynamoDB, Amazon SNS, Amazon SQS, and AWS Step Functions. That list is the whole point, because a Lambda failure is usually a failure of the thing on the other side of it.

The one number in the announcement is a 7-day baseline. Error signals are correlated against it to pinpoint what changed, which is a different question from what is broken. AWS also lists recurring error identification, deployment configuration retrieval, recent change tracking, and service latency analysis.

• Correlating error signals against a 7-day baseline to identify what changed.
• Identifying errors that recur rather than errors that happened once.
• Retrieving deployment configuration and tracking recent changes.
• Analyzing latency across the connected services.

Where it runs, and where it can look

Two facts in the announcement are worth reading together. The AWS MCP Server itself runs in the US East (N. Virginia) and Europe (Frankfurt) regions. It can access services across all commercial AWS regions.

One possible reading is that a diagnostic question about a function in Sydney or São Paulo is answered by a server in Virginia or Frankfurt. For most teams that is a footnote. For a team whose data-residency rules name the region their workloads run in, it is a question to answer before the toolkit is configured, and the announcement does not answer it.

What this changes for a small team

Access comes through the Agent Toolkit for AWS or the standalone AWS MCP Server, and the toolkit is configured by running aws configure agent-toolkit from the AWS CLI. There is no new bill attached: AWS states that the serverless diagnostic capabilities are available at no additional cost.

What the announcement does not say is which permissions the agent needs, or whether the inspection is read-only. An agent that can read deployment configuration and recent changes is reading things that an ordinary developer role may not be scoped for, so the identity it runs under deserves a look before it is pointed at production.