diff --git a/packs/claude-code/install.sh b/packs/claude-code/install.sh
index cf4aeef..c74a1ee 100755
--- a/packs/claude-code/install.sh
+++ b/packs/claude-code/install.sh
@@ -156,14 +156,33 @@ ok "claude --version: ${CLAUDE_VER}"
 
 # ── Done ─────────────────────────────────────────────────────────────────────
 
-# ── Install loki-skills library ───────────────────────────────────────────────
-# Best-effort: pre-install skills for auto-discovery.
+# ── Install AWS Agent Toolkit plugins ────────────────────────────────────────
+# Plugins bundle MCP server config + skills in one install.
+# Prefer toolkit over loki-skills for overlapping AWS skills (toolkit is newer).
+step "Installing AWS Agent Toolkit plugins"
+if command -v claude &>/dev/null; then
+  # Update marketplace index first (non-fatal if offline)
+  claude --dangerously-skip-permissions /plugin marketplace update claude-plugins-official \
+    2>/dev/null || true
+  for plugin in aws-core aws-agents; do
+    claude --dangerously-skip-permissions /plugin install "${plugin}@claude-plugins-official" \
+      2>/dev/null \
+      && ok "Plugin installed: ${plugin}" \
+      || warn "Plugin install skipped: ${plugin} (may already be installed or offline)"
+  done
+else
+  warn "claude CLI not on PATH — skipping plugin install (non-fatal)"
+fi
+
+# ── Install loki-skills (non-AWS skills) + AWS Agent Toolkit skills ───────────
+# AWS toolkit skills overwrite any duplicate loki-skills (toolkit is preferred).
 PACK_SKILLS_DIR="${HOME}/.claude/skills"
 if ensure_skills_clone "${PACK_SKILLS_DIR}"; then
-  ok "Skills installed to ${PACK_SKILLS_DIR} (auto-discovered)"
+  ok "loki-skills installed to ${PACK_SKILLS_DIR}"
 else
-  warn "Skills clone failed (optional; claude is still usable without skills)"
+  warn "loki-skills clone failed (optional)"
 fi
+install_aws_toolkit_skills "${PACK_SKILLS_DIR}"
 write_done_marker "claude-code"
 printf "\n[PACK:claude-code] INSTALLED — claude CLI ready (model: %s via Bedrock region: %s)\n" \
   "${MODEL}" "${REGION}"
diff --git a/packs/codex-cli/install.sh b/packs/codex-cli/install.sh
index 31d0d2b..477c545 100755
--- a/packs/codex-cli/install.sh
+++ b/packs/codex-cli/install.sh
@@ -291,13 +291,26 @@ NOTICE
 
 # ── Done ──────────────────────────────────────────────────────────────────────
 
-# ── Install loki-skills library ───────────────────────────────────────────────
-# Best-effort: pre-install skills for auto-discovery.
+# ── Install AWS Agent Toolkit plugin ─────────────────────────────────────────
+step "Installing AWS Agent Toolkit plugin for Codex"
+if command -v codex &>/dev/null; then
+  codex plugin marketplace add aws/agent-toolkit-for-aws 2>/dev/null \
+    && ok "AWS toolkit marketplace added" \
+    || warn "Marketplace add skipped (may already exist or offline)"
+  codex plugin install aws-core 2>/dev/null \
+    && ok "Plugin installed: aws-core" \
+    || warn "aws-core plugin install skipped (non-fatal)"
+else
+  warn "codex CLI not on PATH — skipping plugin install (non-fatal)"
+fi
+
+# ── Install loki-skills + AWS Agent Toolkit skills ───────────────────────
 PACK_SKILLS_DIR="${HOME}/.codex/skills"
 if ensure_skills_clone "${PACK_SKILLS_DIR}"; then
-  ok "Skills installed to ${PACK_SKILLS_DIR} (auto-discovered)"
+  ok "loki-skills installed to ${PACK_SKILLS_DIR}"
 else
-  warn "Skills clone failed (optional; codex is still usable without skills)"
+  warn "loki-skills clone failed (optional)"
 fi
+install_aws_toolkit_skills "${PACK_SKILLS_DIR}"
 write_done_marker "codex-cli"
 printf "\n[PACK:codex-cli] INSTALLED — codex CLI ready (model: %s)\n" "${MODEL}"
diff --git a/packs/common.sh b/packs/common.sh
index 6613a05..e035c6d 100755
--- a/packs/common.sh
+++ b/packs/common.sh
@@ -272,3 +272,94 @@ run_optional_sidecar() {
     exit 0
   ) || true
 }
+
+# ── install_aws_toolkit_skills ────────────────────────────────────────────────
+# Install AWS Agent Toolkit skills into an agent's skills directory.
+# Usage: install_aws_toolkit_skills <target_dir>
+#   target_dir: agent-specific skills path (e.g. ~/.claude/skills)
+# Prefers 'npx skills add' (official method). Falls back to sparse git clone.
+# Best-effort: never fails the parent installer.
+# Duplicate loki-skills are overwritten by the toolkit (newer, preferred).
+install_aws_toolkit_skills() {
+  local target_dir="$1"
+  local toolkit_repo="aws/agent-toolkit-for-aws"
+  local toolkit_skills_path="skills"
+
+  mkdir -p "${target_dir}"
+
+  if command -v npx &>/dev/null; then
+    log "Installing AWS Agent Toolkit skills via npx → ${target_dir}"
+    SKILLS_DIR="${target_dir}" npx --yes skills add "${toolkit_repo}/${toolkit_skills_path}" \
+      2>&1 | grep -v "^npm warn" || true
+    if [[ -d "${target_dir}/core-skills" || -d "${target_dir}/specialized-skills" ]]; then
+      ok "AWS Agent Toolkit skills installed → ${target_dir}"
+      return 0
+    fi
+    warn "npx skills add returned but skills dirs not found — falling back to git clone"
+  fi
+
+  # Fallback: sparse git clone of skills subtree
+  local tmp_clone; tmp_clone="$(mktemp -d)"
+  if git clone --depth=1 --filter=blob:none --sparse \
+      "https://github.com/${toolkit_repo}.git" "${tmp_clone}" 2>/dev/null; then
+    git -C "${tmp_clone}" sparse-checkout set "${toolkit_skills_path}" 2>/dev/null
+    if [[ -d "${tmp_clone}/${toolkit_skills_path}" ]]; then
+      cp -r "${tmp_clone}/${toolkit_skills_path}/." "${target_dir}/"
+      ok "AWS Agent Toolkit skills installed (git clone fallback) → ${target_dir}"
+    else
+      warn "AWS Agent Toolkit skills: sparse checkout empty — skipping"
+    fi
+  else
+    warn "AWS Agent Toolkit skills: git clone failed — skipping (non-fatal)"
+  fi
+  rm -rf "${tmp_clone}"
+  return 0
+}
+
+# ── install_aws_mcp_proxy ─────────────────────────────────────────────────────
+# Install and wire mcp-proxy-for-aws (official AWS MCP server successor).
+# Writes ~/.kiro/agents/aws-mcp.json (kiro format) or ~/.config/mcp/aws.json.
+# Usage: install_aws_mcp_proxy <region> [<config_path>]
+# Requires: uv (installed by kiro-cli step 2 or present on system)
+MCP_PROXY_VERSION="1.6.3"
+install_aws_mcp_proxy() {
+  local region="${1:-us-east-1}"
+  local config_path="${2:-}"
+
+  if ! command -v uv &>/dev/null && ! command -v uvx &>/dev/null; then
+    warn "uv/uvx not found — skipping mcp-proxy-for-aws install (non-fatal)"
+    return 0
+  fi
+
+  local uvx_cmd
+  uvx_cmd="$(command -v uvx 2>/dev/null || echo "uv run --with uvx uvx")"
+
+  log "Configuring mcp-proxy-for-aws@${MCP_PROXY_VERSION} (region: ${region})"
+
+  # Write MCP server config (JSON used by kiro and other MCP-aware agents)
+  if [[ -n "${config_path}" ]]; then
+    mkdir -p "$(dirname "${config_path}")"
+    cat > "${config_path}" << MCPJSON
+{
+  "mcpServers": {
+    "aws": {
+      "command": "uvx",
+      "args": [
+        "mcp-proxy-for-aws@${MCP_PROXY_VERSION}",
+        "https://aws-mcp.${region}.api.aws/mcp",
+        "--metadata",
+        "AWS_REGION=${region}"
+      ]
+    }
+  }
+}
+MCPJSON
+    chmod 600 "${config_path}"
+    ok "AWS MCP proxy config written: ${config_path}"
+  fi
+
+  # Pre-warm: pull the package so first run is instant
+  ${uvx_cmd} "mcp-proxy-for-aws@${MCP_PROXY_VERSION}" --help &>/dev/null &
+  ok "mcp-proxy-for-aws@${MCP_PROXY_VERSION} configured (region: ${region})"
+  return 0
+}
diff --git a/packs/hermes/install.sh b/packs/hermes/install.sh
index 127a3df..80d4bed 100755
--- a/packs/hermes/install.sh
+++ b/packs/hermes/install.sh
@@ -147,10 +147,11 @@ fi
 # ── Install skills ────────────────────────────────────────────────────────────
 PACK_SKILLS_DIR="${HOME}/.hermes/skills"
 if ensure_skills_clone "${PACK_SKILLS_DIR}"; then
-  ok "Skills installed to ${PACK_SKILLS_DIR}"
+  ok "loki-skills installed to ${PACK_SKILLS_DIR}"
 else
-  warn "Skills clone failed (optional; hermes is still usable without skills)"
+  warn "loki-skills clone failed (optional)"
 fi
+install_aws_toolkit_skills "${PACK_SKILLS_DIR}"
 
 # ── Done ──────────────────────────────────────────────────────────────────────
 write_done_marker "hermes"
diff --git a/packs/kiro-cli/install.sh b/packs/kiro-cli/install.sh
index b031827..3117f73 100755
--- a/packs/kiro-cli/install.sh
+++ b/packs/kiro-cli/install.sh
@@ -226,27 +226,12 @@ else
   warn "uvenv not found — will skip MCP server installs"
 fi
 
-# ── Step 3: Install common AWS MCP servers ────────────────────────────────────
-step "Installing common AWS MCP servers"
-
-if command -v uvenv &>/dev/null; then
-  MCP_SERVERS=(
-    "awslabs.terraform-mcp-server"
-    "awslabs.ecs-mcp-server"
-    "awslabs.eks-mcp-server"
-    "awslabs.core-mcp-server"
-    "awslabs.aws-documentation-mcp-server"
-  )
-
-  for mcp_server in "${MCP_SERVERS[@]}"; do
-    log "Installing MCP server: ${mcp_server}"
-    uvenv install "${mcp_server}" 2>/dev/null && \
-      ok "Installed: ${mcp_server}" || \
-      warn "Could not install ${mcp_server} (will be fetched on first use)"
-  done
-else
-  warn "uvenv not available — skipping MCP server installs (install manually with: uvenv install awslabs.<server>)"
-fi
+# ── Step 3: Configure AWS MCP proxy (mcp-proxy-for-aws) ───────────────────────
+# mcp-proxy-for-aws is the official AWS successor to individual awslabs.*
+# MCP servers — one endpoint covers all 300+ AWS services with IAM audit logging.
+# Pinned version for reproducibility; check https://pypi.org/project/mcp-proxy-for-aws/
+step "Configuring AWS MCP proxy"
+install_aws_mcp_proxy "${REGION}" "${HOME}/.kiro/settings/mcp.json"
 
 # ── Step 4: Wire up KIRO_API_KEY if provided ─────────────────────────────────
 if [[ -n "${PACK_ARG_API_KEY}" ]]; then
@@ -359,14 +344,15 @@ if [[ -f "${SHELL_PROFILE}" && -d /etc/profile.d ]]; then
     warn "Could not install shell profile (permission denied?)"
 fi
 
-# ── Install loki-skills library ───────────────────────────────────────────────
-# Best-effort: pre-install skills for auto-discovery.
+# ── Install loki-skills + AWS Agent Toolkit skills ────────────────────────────
+# Toolkit skills overwrite duplicates (toolkit is preferred — newer + evaluated).
 PACK_SKILLS_DIR="${HOME}/.kiro/skills"
 if ensure_skills_clone "${PACK_SKILLS_DIR}"; then
-  ok "Skills auto-installed to ${PACK_SKILLS_DIR} (auto-discovered)"
+  ok "loki-skills installed to ${PACK_SKILLS_DIR}"
 else
-  warn "Skills clone failed (optional; kiro is still usable without skills)"
+  warn "loki-skills clone failed (optional)"
 fi
+install_aws_toolkit_skills "${PACK_SKILLS_DIR}"
 
 # ── Done ──────────────────────────────────────────────────────────────────────
 write_done_marker "kiro-cli"
diff --git a/packs/openclaw/install.sh b/packs/openclaw/install.sh
index 71947fb..213c90a 100755
--- a/packs/openclaw/install.sh
+++ b/packs/openclaw/install.sh
@@ -361,6 +361,28 @@ else
 fi
 
 
+
+# ── Install AWS Agent Toolkit plugin + skills ──────────────────────────────
+step "Installing AWS Agent Toolkit"
+if openclaw plugins list 2>/dev/null | grep -q "aws-core"; then
+  openclaw plugins update aws-core \\
+    && ok "Plugin updated: aws-core" \\
+    || warn "aws-core plugin update failed (non-fatal)"
+else
+  openclaw plugins install "aws-core@claude-plugins-official" \\
+    && ok "Plugin installed: aws-core" \\
+    || warn "aws-core plugin install failed (non-fatal)"
+fi
+if openclaw plugins list 2>/dev/null | grep -q "aws-agents"; then
+  openclaw plugins update aws-agents 2>/dev/null || true
+else
+  openclaw plugins install "aws-agents@claude-plugins-official" 2>/dev/null \\
+    && ok "Plugin installed: aws-agents" \\
+    || warn "aws-agents plugin install skipped (non-fatal)"
+fi
+SKILLS_DIR="${HOME}/.openclaw/workspace/skills"
+install_aws_toolkit_skills "${SKILLS_DIR}"
+
 # ── Done ──────────────────────────────────────────────────────────────────────
 # Mark the pack done and show the success banner BEFORE optional sidecars.
 # The user should not wait on best-effort work to see that their install
diff --git a/packs/pi/install.sh b/packs/pi/install.sh
index b293b60..7d73e45 100755
--- a/packs/pi/install.sh
+++ b/packs/pi/install.sh
@@ -132,10 +132,11 @@ ok "Pi config written: ${HOME}/.pi/agent/models.json"
 # Users can also create manual TypeScript extension adapters if needed.
 PACK_SKILLS_DIR="${HOME}/.pi/agent/extensions"
 if ensure_skills_clone "${PACK_SKILLS_DIR}"; then
-  ok "Skills installed to ${PACK_SKILLS_DIR} (auto-discovered by pi)"
+  ok "loki-skills installed to ${PACK_SKILLS_DIR}"
 else
-  warn "Skills clone failed (optional; pi is still usable without skills)"
+  warn "loki-skills clone failed (optional)"
 fi
+install_aws_toolkit_skills "${PACK_SKILLS_DIR}"
 
 # ── Sanity check ─────────────────────────────────────────────────────────────
 step "Sanity check"
diff --git a/packs/roundhouse/install.sh b/packs/roundhouse/install.sh
index caa6437..cadaed6 100755
--- a/packs/roundhouse/install.sh
+++ b/packs/roundhouse/install.sh
@@ -155,6 +155,15 @@ fi
 
 
 # ── Done ──────────────────────────────────────────────────────────────────────
+# ── Install loki-skills + AWS Agent Toolkit skills ───────────────────────────
+PACK_SKILLS_DIR="${HOME}/.roundhouse/skills"
+if ensure_skills_clone "${PACK_SKILLS_DIR}"; then
+  ok "loki-skills installed to ${PACK_SKILLS_DIR}"
+else
+  warn "loki-skills clone failed (optional)"
+fi
+install_aws_toolkit_skills "${PACK_SKILLS_DIR}"
+
 write_done_marker "roundhouse"
 printf "\n[PACK:roundhouse] INSTALLED — Telegram bot connected (systemd: roundhouse)\n"