MCP Proxy for AWS

Content

MCP Proxy for AWS is an AWS-maintained proxy and Python library for connecting MCP clients and agent frameworks to MCP servers on AWS that use IAM SigV4 authentication. It handles request signing with local AWS credentials so standard MCP clients do not need to implement SigV4 support themselves.

The package can run as a stdio bridge for clients such as Claude Desktop and Kiro CLI, or it can be imported as a library for Python agent frameworks such as LangChain, LlamaIndex, Strands Agents, and Microsoft Agent Framework.

Source Review

• https://github.com/aws/mcp-proxy-for-aws
• https://github.com/aws/mcp-proxy-for-aws/blob/main/README.md
• https://github.com/aws/mcp-proxy-for-aws/blob/main/LICENSE
• https://github.com/aws/mcp-proxy-for-aws/blob/main/pyproject.toml
• https://github.com/aws/mcp-proxy-for-aws/blob/main/mcp_proxy_for_aws/server.py
• https://github.com/aws/mcp-proxy-for-aws/blob/main/mcp_proxy_for_aws/sigv4_helper.py
• https://github.com/aws/mcp-proxy-for-aws/blob/main/mcp_proxy_for_aws/client.py
• https://pypi.org/pypi/mcp-proxy-for-aws/json
• https://gallery.ecr.aws/mcp-proxy-for-aws/mcp-proxy-for-aws

These sources were reviewed on 2026-06-06. Prefer the live repository, README, package metadata, server implementation, SigV4 helper, client library, PyPI JSON, public ECR gallery page, and license file for current install, credential, profile, signing, and integration behavior.

Features

• Sign MCP requests to AWS-hosted MCP endpoints with SigV4.
• Resolve AWS credentials from profiles, environment variables, shared credential files, or IAM roles.
• Run as a stdio bridge for MCP clients that cannot sign AWS IAM requests.
• Use multi-profile switching so agents can call allowed AWS profiles per tool call.
• Infer or accept the AWS service name used for SigV4 signing.
• Inject metadata such as region into MCP requests.
• Enable read-only mode for tools that are annotated as write-capable by the upstream server.
• Configure retries, connect/read/write timeouts, tool-call timeout, and log level.
• Run from PyPI with uvx, from source with uv, or from the public AWS ECR image.
• Import the Python client helpers in LangChain, LlamaIndex, Strands Agents, or Microsoft Agent Framework workflows.

Installation

Run the proxy with uvx and the SigV4-protected MCP endpoint:

uvx mcp-proxy-for-aws@latest SIGV4_MCP_ENDPOINT_URL --region AWS_REGION --profile AWS_PROFILE

For multiple allowed profiles, pass profiles on the command line or set AWS_MCP_PROXY_PROFILES. The first profile is the default, and later profiles can be selected per call through the injected aws_profile parameter.

Use --read-only when the agent should avoid write-capable tools, and combine it with least-privilege IAM credentials. The README also documents a public ECR image for Docker-based MCP client configs.

Use Cases

• Connect Claude to an MCP server on AWS that requires IAM SigV4 signing.
• Let Kiro CLI or another MCP client use AWS credentials without custom signing code.
• Bridge Bedrock AgentCore-style MCP endpoints into local MCP clients.
• Give an agent a constrained set of AWS profiles for cross-account inspection.
• Use read-only mode while still enforcing least privilege through IAM.
• Build Python agents that call IAM-secured MCP servers through framework-specific client helpers.
• Run the proxy in Docker with a read-only AWS credential mount for local development.

Safety and Privacy

MCP Proxy for AWS makes AWS credentials usable by agent tool calls. Keep IAM permissions narrow, prefer short-lived credentials, and restrict multi-profile mode to profiles that are appropriate for the task. The --read-only flag helps filter write-capable tools when annotations are available, but IAM permissions remain the real enforcement boundary.

Avoid --skip-auth unless the upstream MCP endpoint is intentionally public or protected by another control. Be careful with Docker credential mounts and framework logs; profile names, endpoint URLs, AWS errors, SigV4 metadata, tool arguments, and tool results can all reveal sensitive account or workload data.

Treat MCP client configs, .env files, AWS credential directories, session tokens, endpoint URLs, telemetry, and logs as sensitive. Rotate credentials and avoid giving agents profiles that can modify production systems unless the host workflow includes explicit approval.

Duplicate Check

No aws/mcp-proxy-for-aws source entry, MCP Proxy for AWS entry, or matching source URL was found in content/mcp. Existing AWS Labs MCP coverage is distinct from this SigV4 proxy and Python client bridge for IAM-secured MCP servers on AWS.