AWS MCP Server

Instructions

Implementation Reference

• index.ts:168-175 (handler)

  Executes the select-profile tool: validates input with SelectProfileSchema, fetches credentials via getCredentials helper, updates global state variables for the selected profile and region, returns success message.

  } else if (name === "select-profile") {
    const { profile, region } = SelectProfileSchema.parse(args);
    const credentials = await getCredentials(profiles[profile], profile);
    selectedProfile = profile;
    selectedProfileCredentials = credentials;
    selectedProfileRegion = region || "us-east-1";
    return createTextResponse("Authenticated!");
  } else {

• index.ts:90-108 (schema)

  Input schema and metadata for the 'select-profile' tool, returned by ListToolsRequestSchema handler.

  {
    name: "select-profile",
    description:
      "Selects AWS profile to use for subsequent interactions. If needed, does SSO authentication",
    inputSchema: {
      type: "object",
      properties: {
        profile: {
          type: "string",
          description: "Name of the AWS profile to select",
        },
        region: {
          type: "string",
          description: "Region to use (if not provided, us-east-1 is used)",
        },
      },
      required: ["profile"],
    },
  },

• index.ts:120-123 (schema)

  Zod schema used for input validation in the select-profile handler.

  const SelectProfileSchema = z.object({
    profile: z.string(),
    region: z.string().optional(),
  });

• index.ts:51-111 (registration)

  Registers the select-profile tool by including it in the tools list response of ListToolsRequestSchema handler.

  server.setRequestHandler(ListToolsRequestSchema, async () => {
    return {
      tools: [
        {
          name: "run-aws-code",
          description: "Run AWS code",
          inputSchema: {
            type: "object",
            properties: {
              reasoning: {
                type: "string",
                description: "The reasoning behind the code",
              },
              code: {
                type: "string",
                description: codePrompt,
              },
              profileName: {
                type: "string",
                description: "Name of the AWS profile to use",
              },
              region: {
                type: "string",
                description: "Region to use (if not provided, us-east-1 is used)",
              },
            },
            required: ["reasoning", "code"],
          },
        },
        {
          name: "list-credentials",
          description:
            "List all AWS credentials/configs/profiles that are configured/usable on this machine",
          inputSchema: {
            type: "object",
            properties: {},
            required: [],
          },
        },
        {
          name: "select-profile",
          description:
            "Selects AWS profile to use for subsequent interactions. If needed, does SSO authentication",
          inputSchema: {
            type: "object",
            properties: {
              profile: {
                type: "string",
                description: "Name of the AWS profile to select",
              },
              region: {
                type: "string",
                description: "Region to use (if not provided, us-east-1 is used)",
              },
            },
            required: ["profile"],
          },
        },
      ],
    };
  });

• index.ts:234-296 (helper)

  Helper function to retrieve AWS credentials for a given profile, handling SSO authentication via device flow if applicable, or standard provider.

  async function getCredentials(
    creds: any,
    profileName: string
  ): Promise<AWS.Credentials | AWS.SSO.RoleCredentials | any> {
    if (creds.sso_start_url) {
      const region = creds.region || "us-east-1";
      const ssoStartUrl = creds.sso_start_url;
      const oidc = new AWS.SSOOIDC({ region });
  
      const registration = await oidc
        .registerClient({ clientName: "chatwithcloud", clientType: "public" })
        .promise();
  
      const auth = await oidc
        .startDeviceAuthorization({
          clientId: registration.clientId!,
          clientSecret: registration.clientSecret!,
          startUrl: ssoStartUrl,
        })
        .promise();
  
      // open this in URL browser
      if (auth.verificationUriComplete) {
        open(auth.verificationUriComplete);
      }
  
      let handleId: NodeJS.Timeout;
      return new Promise((resolve) => {
        handleId = setInterval(async () => {
          try {
            const createTokenReponse = await oidc
              .createToken({
                clientId: registration.clientId!,
                clientSecret: registration.clientSecret!,
                grantType: "urn:ietf:params:oauth:grant-type:device_code",
                deviceCode: auth.deviceCode,
              })
              .promise();
  
            const sso = new AWS.SSO({ region });
  
            const credentials = await sso
              .getRoleCredentials({
                accessToken: createTokenReponse.accessToken!,
                accountId: creds.sso_account_id,
                roleName: creds.sso_role_name,
              })
              .promise();
  
            clearInterval(handleId);
  
            return resolve(credentials.roleCredentials!);
          } catch (error) {
            if ((error as Error).message !== null) {
              // terminal.error(error);
            }
          }
        }, 2500);
      });
    } else {
      return useAWSCredentialsProvider(profileName);
    }
  }