aws-knowledge-plus

A Kiro Power for the AWS knowledge sources the official AWS Knowledge MCP Server does not index.

Why this exists

The official server is free, unauthenticated, maintained by AWS, and already covers AWS documentation, AWS blogs, What's New, Well-Architected, and re:Post Knowledge Center articles. Rebuilding any of that would mean scraping undocumented endpoints for content already available through a supported interface.

So this power covers only what the official server rejects. Its read_documentation allow-list is the authoritative boundary:

Related MCP server: NexusNote MCP Server

Prerequisites

• uv on PATH (provides uvx). The power needs no Python of its own; uv fetches an interpreter.

• The official AWS Knowledge MCP Server, for everything in the "Covered" rows above. This power deliberately does not declare it, so that clients which already have it do not open a second connection to the same endpoint and load a duplicate set of tools. If you do not have it yet, add this to ~/.kiro/settings/mcp.json:

  {
    "mcpServers": {
      "aws-knowledge": {
        "url": "https://knowledge-mcp.global.api.aws"
      }
    }
  }

Install

From GitHub (recommended for teams)

1. Kiro → Powers panel → Add Custom Power → Import power from GitHub

2. Paste this repository's URL

From a local clone

1. git clone https://github.com/hey-iam-ryan/kiro-power-aws-knowledge-plus

2. Kiro → Powers panel → Add Custom Power → Import power from a folder

3. Select the cloned directory

Without the Powers panel — add the server straight to ~/.kiro/settings/mcp.json:

{
  "mcpServers": {
    "aws-knowledge-plus": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/hey-iam-ryan/kiro-power-aws-knowledge-plus@v0.1.0",
        "aws-knowledge-plus-mcp"
      ],
      "autoApprove": ["search_aws_knowledge", "read_aws_content", "list_sources"]
    }
  }
}

The first launch resolves the dependency tree and takes a few seconds; later launches are cached by uv.

Using this power in a team

This power is read-only for everyone except the maintainer. On a public GitHub repository, only accounts explicitly added as collaborators can push, and none are. Cloning, installing and forking do not grant any ability to change what your teammates install.

Installs are pinned to a release tag, not to main. mcp.json points at @v0.1.0, so every teammate runs the same reviewed code even while main moves on. Nobody is silently upgraded.

Need a change? Open an issue or a pull request. The maintainer reviews it, merges it, and cuts a new tag; teammates pick it up when the pin is updated.

Shipping a new version, for the maintainer:

# after merging changes to main
uv run python smoke_test.py            # must pass: it hits the live sources
git tag v0.2.0 && git push origin v0.2.0
# then bump the @v0.1.0 pin in mcp.json and README.md, commit, and push

Tools

Search snippets are intentionally short: they exist to help pick what to read, not to answer from.

What the reads look like

• re:Post — rebuilt from the thread's schema.org QAPage data, so you get the question plus every answer with authors, dates, vote counts, and the accepted-answer marker. No HTML scraping, and code blocks survive intact.

• kiro.dev docs — fetched from the published markdown twin (/docs/steering reads /docs/steering.md), so there is no site chrome to strip.

• Builder Center — feed summary only, with an explicit note that the body was not retrieved.

Configuration

Known limitations

• Builder Center is structurally limited. Its only public index is a 30-entry Atom feed whose next link loops back on itself, so older posts cannot be discovered. Article bodies render client-side and are not retrieved. This is why the source is weighted low and can be disabled.

• re:Post search depth. The site honours pageSize but not page, so results come from a single larger page rather than deep pagination.

• Undocumented endpoints. re:Post's search response is read from the __NEXT_DATA__ payload its own page embeds. That is not a published API and can change. The adapter tolerates both payload shapes it currently emits and returns an empty result rather than crashing if neither is found, but a redesign of the site would need a fix here.

Development

uv sync
uv run python smoke_test.py     # live checks against all three sources
uv run aws-knowledge-plus-mcp   # start on stdio

smoke_test.py hits the real sites, so it doubles as a canary: if a source changes its markup or payload, it fails there first.

Security

Outbound requests are restricted to an allow-list built from each adapter's declared host and path prefixes. Redirects are followed one hop at a time and every hop is re-validated, so a redirect cannot walk the fetcher onto an unlisted host. Only https is accepted. Requests carry no credentials, and every source is public.

License

Apache-2.0