feat(mcp): add AWS IAM authentication

[aryasaatvik]

Summary

Add managed AWS MCP as an Executor-native MCP integration. Named Executor connections now carry per-account AWS bootstrap credentials and role configuration, while the MCP plugin derives short-lived AWS bearer tokens at runtime.

Account model

AWS MCP integration
  -> Executor connection (owner + user-chosen name)
  -> STS AssumeRole
  -> GetCallerIdentity account verification
  -> SigV4 CreateOAuth2TokenWithIAM
  -> existing MCP discovery / pool / invocation / health path

Adding production and sandbox connections produces the normal account-scoped tool namespaces; no account names, IDs, role ARNs, or policies are hardcoded by the integration.

Security boundaries

• Uses aws4fetch only to sign STS and AWS Sign-In requests; Effect HttpClient remains the network boundary.
• Accepts IAM-derived bearer tokens only for AWS's managed us-east-1 and eu-central-1 MCP endpoints, with canonical HTTPS ports and paths.
• Derives the authentication region from the selected managed endpoint.
• Keeps temporary role credentials and bearer tokens in process memory only and refreshes them before expiry.
• Versions refreshed credentials so pooled MCP sessions redial instead of retaining an expired bearer.
• Leaves AWS service authorization to the assumed role and normal Executor policy enforcement.

Screenshots

AWS MCP managed preset:

Executor-native account form:

Validation

• bun run --cwd packages/plugins/mcp test — 133 passed, 29 skipped
• bun run --cwd packages/react test — 326 passed
• bun run --cwd packages/core/sdk test — 605 passed
• owned-file oxfmt --check and oxlint --deny-warnings
• bun run --cwd apps/host-cloudflare build
• local Cloudflare host smoke test of preset registration and the native Add connection form
• regression tracer covers STS assume-role, identity verification, token minting, discovery, execution, health, cache concurrency, and forced bearer rotation

The root typecheck remains blocked by pre-existing plugin-toolkits SVG module-resolution errors; the MCP declaration check reports only that existing error set plus the existing Headers.entries error in connection.ts, with no errors in the AWS IAM files.

AWS setup after merge

No AWS resources are created by this PR. The new docs page provides the bootstrap principal, target-role trust policy, signin:CreateOAuth2Token policy, regional endpoint constraints, and multi-account setup steps.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	aws4fetch@​1.0.20
	fast-xml-parser@​5.10.1

View full report

[greptile-apps]

Greptile Summary

The PR adds managed AWS MCP presets with IAM role assumption, account verification, short-lived bearer-token minting, and native account-form support.

• Extends SDK authentication descriptors with provider-consumed credential inputs.
• Adds AWS SigV4 authentication, token caching, endpoint restrictions, and MCP session rotation.
• Adds managed presets, account UI support, tests, and AWS setup documentation.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking cache-eviction issue for long-lived hosts that experience AWS connection or credential churn.

The AWS authentication flow is consistently wired through the SDK, UI, connector, and managed-endpoint boundary, but successful token results remain cached for the plugin lifetime after they expire or their connections are removed.

Files Needing Attention: packages/plugins/mcp/src/sdk/aws-iam.ts

Important Files Changed

Filename	Overview
packages/plugins/mcp/src/sdk/aws-iam.ts	Implements restricted-endpoint AWS role assumption, identity verification, bearer minting, and deduplicated caching; historical cache entries lack eviction.
packages/plugins/mcp/src/sdk/plugin.ts	Integrates AWS token resolution into connector construction, health checks, and credential-versioned pool keys.
packages/plugins/mcp/src/sdk/types.ts	Adds the AWS IAM auth-method schema and its five account credential descriptors.
packages/react/src/components/add-account-modal.tsx	Supports required, optional, secret, and provider-consumed multi-value credential fields.
packages/plugins/mcp/src/react/AddMcpIntegration.tsx	Registers the managed AWS preset with its fixed IAM authentication template.
apps/docs/integrations/aws-mcp.mdx	Documents bootstrap identities, role trust and token policies, regional constraints, and multi-account setup.

Sequence Diagram

sequenceDiagram
  participant User
  participant Executor
  participant STS as AWS STS
  participant SignIn as AWS Sign-In
  participant MCP as Managed AWS MCP
  User->>Executor: Add AWS connection credentials and role
  Executor->>STS: AssumeRole (SigV4)
  STS-->>Executor: Temporary role credentials
  Executor->>STS: GetCallerIdentity (SigV4)
  STS-->>Executor: Account and assumed-role ARN
  Executor->>SignIn: CreateOAuth2TokenWithIAM (SigV4)
  SignIn-->>Executor: Short-lived bearer token
  Executor->>MCP: Discover or invoke with bearer
  MCP-->>Executor: MCP response

Loading

_{Reviews (1): Last reviewed commit: "feat(mcp): add AWS IAM authentication" | Re-trigger Greptile}

[greptile-apps]

Token cache never evicts entries

Each successful mint stores a fingerprint-specific result, but expired entries and entries belonging to removed connections remain until the entire plugin closes. Long-lived hosts with connection or credential churn therefore retain obsolete bearer metadata and identity strings indefinitely, producing unbounded cache growth.

Knowledge Base Used: Plugin system