AWS IAM MCP client with SigV4 auth by DennisTraub · Pull Request #65 · aws/mcp-proxy-for-aws

DennisTraub · 2025-10-30T18:06:46Z

Enables IAM (SigV4) authentication for MCP clients connecting to AWS-hosted MCP servers. This client is a drop-in replacement for existing MCP client usage and works with agent frameworks like Strands Agents, LangChain, LlamaIndex, and the Microsoft Agent Framework.

Adds aws_iam_mcp_client: an async context manager creating a streamable MCP HTTP client signed with SigV4
Establishes a boto3.Session with optional AWS region and profile
Uses existing SigV4HTTPXAuth with resolved credentials, service, and region
Connects via MCP’s streamablehttp_client
Allows injecting a custom httpx_client_factory for transport customization

Unit tests cover:

Parameterization of boto3.Session (region/profile)
Creation and wiring of SigV4HTTPXAuth
Forwarding of client parameters to the underlying streamable client
Proper cleanup behavior of the async context manager

Follow-ups:

Integration tests
Documentation update
Usage examples

wzxxing

Previously in our discussion, we were thinking if the mcp client or transport is the level of abstraction. But seems from the PR, in order to make this feature available to both mcp python sdk and fastmcp v2, the two SDKs needs to be handled separately.

Final comment, would you be able to update the README to include a section of using this feature with popular agent SDKs?

wzxxing · 2025-11-03T09:18:29Z

+    auth = SigV4HTTPXAuth(session.get_credentials(), aws_service, region)
+
+    # Establish connection using MCP SDK's streamable HTTP client
+    async with streamablehttp_client(


This is using the official streamablehttp_client.

Do you know if this will be compatible for the users using fastmcp 2.0?

Yes, the client uses the standard MCP SDK's streamablehttp_client, which speaks the core MCP protocol over HTTP. FastMCP 2.0 servers are MCP-compliant, so any standard MCP client, including this one, will work seamlessly.

If users want to use fastmcp.Client, they'd bypass aws_iam_mcp_client() and use SigV4HTTPXAuth directly.

DennisTraub · 2025-11-04T16:10:45Z

@wzxxing re:

Final comment, would you be able to update the README to include a section of using this feature with popular agent SDKs?

Absolutely. I'll update the README and will switch the PR to "ready for review"

wzxxing · 2025-11-05T09:34:48Z

There are some issues found by the CI: https://github.com/aws/mcp-proxy-for-aws/actions/runs/19081826894/job/54560828478?pr=65

arangatang

Heya thank you for the great examples and the readme in this pass! Codewise I think we are pretty much good to go, but I have concerns about the naming. Due to trademark we shouldn't really have this as a seperate entity in the package. I provided some suggestions of how we could rephrase examples and READMES.

tldr: We can use MCP Proxy for AWS but MCP Client Library and similar would i believe require a new trademark, so to keep it simple lets rephrase.

wzxxing · 2025-11-05T12:58:04Z

Hi Dennis, I forgot to point you to the contributing guide. https://github.com/aws/mcp-proxy-for-aws/blob/main/CONTRIBUTING.md

You need to run uv run pre-commit run --all-files to format all the files.

I see the CI failed because uv.lock file was deleted.

DennisTraub · 2025-11-05T13:01:13Z

There are some issues found by the CI: https://github.com/aws/mcp-proxy-for-aws/actions/runs/19081826894/job/54560828478?pr=65

Should be fixed

arangatang

Some more changes:

Add license header to examples
Fix mcp-proxy-for-aws reference in examples.

wzxxing · 2025-11-05T15:53:43Z

@@ -0,0 +1,58 @@
+# MCP Client Example Tests


We probably don't need README in unit tests.

Yeah, I guess I can remove it.

wzxxing · 2025-11-05T15:56:23Z

+
+
+@pytest.mark.unit
+class TestMcpClientExamples:


I think these should be covered by pyright, if the example code can be validated by pyright, we don't need to do these unit tests.

I was the one who asked to add these. Imo lets leave them for now, we can pivot later?

Yeah, we can. but CI failed: https://github.com/aws/mcp-proxy-for-aws/actions/runs/19107321050/job/54594703458?pr=65

Co-authored-by: wzxxing <169175349+wzxxing@users.noreply.github.com> Signed-off-by: Dennis Traub <dennis.traub@gmail.com>

Co-authored-by: Leonardo Araneda Freccero <arangatang@users.noreply.github.com> Signed-off-by: Dennis Traub <dennis.traub@gmail.com>

Signed-off-by: Dennis Traub <dennis.traub@gmail.com>

arangatang · 2025-11-06T10:31:50Z

Thank you @DennisTraub for the contribution (and handling all our comments)!

wzxxing reviewed Nov 3, 2025

View reviewed changes

DennisTraub marked this pull request as ready for review November 4, 2025 19:59

DennisTraub requested a review from a team as a code owner November 4, 2025 19:59

DennisTraub requested review from acmlau and kyoncal November 4, 2025 19:59

wzxxing reviewed Nov 5, 2025

View reviewed changes

Comment thread mcp_proxy_for_aws/client.py Outdated

Comment thread mcp_proxy_for_aws/client.py Outdated

wzxxing reviewed Nov 5, 2025

View reviewed changes

Comment thread mcp_proxy_for_aws/client.py Outdated

arangatang reviewed Nov 5, 2025

View reviewed changes

wzxxing reviewed Nov 5, 2025

View reviewed changes

Comment thread uv.lock Outdated

arangatang reviewed Nov 5, 2025

View reviewed changes

wzxxing reviewed Nov 5, 2025

View reviewed changes

DennisTraub and others added 15 commits November 5, 2025 17:14

Add client

9c07337

Add client tests

1020886

Add usage examples for MCP client

cd7ab5f

Update README

2cad69b

lint/format

549af1c

Apply suggestions from code review

3e86f6a

Co-authored-by: wzxxing <169175349+wzxxing@users.noreply.github.com> Signed-off-by: Dennis Traub <dennis.traub@gmail.com>

Simplify aws_iam_mcp_client by returning streamablehttp_client directly

6974fcf

Simplify examples

0884f80

Add example .env files

52666c3

Apply suggestions from arangatang's code review

430e841

Co-authored-by: Leonardo Araneda Freccero <arangatang@users.noreply.github.com> Signed-off-by: Dennis Traub <dennis.traub@gmail.com>

Apply further suggestions from review

41a045a

Fix linting issues

a2a0c4c

Add unit tests for client usage examples

e97a47c

Add license headers to examples

7148cac

Apply suggestions from code review

6e82e27

Co-authored-by: Leonardo Araneda Freccero <arangatang@users.noreply.github.com> Signed-off-by: Dennis Traub <dennis.traub@gmail.com>

wzxxing and others added 4 commits November 5, 2025 17:42

chore: use uv workspaces for the examples

8ad2f2e

Fix pyright errors

be56338

Rename to aws_iam_streamablehttp_client

8fea586

Update github workflow to build workspace

4a8c217

wzxxing approved these changes Nov 5, 2025

View reviewed changes

Comment thread mcp_proxy_for_aws/client.py Outdated

wzxxing requested changes Nov 5, 2025

View reviewed changes

Comment thread .github/workflows/python.yml Outdated

DennisTraub added 2 commits November 5, 2025 21:23

Add frozen flag in GH workflow

82385bb

Signed-off-by: Dennis Traub <dennis.traub@gmail.com>

Add return type to client signature

0931e1d

DennisTraub requested a review from wzxxing November 5, 2025 20:58

Update docstring

699003c

wzxxing approved these changes Nov 5, 2025

View reviewed changes

wzxxing enabled auto-merge (squash) November 5, 2025 22:40

arangatang approved these changes Nov 6, 2025

View reviewed changes

wzxxing merged commit eebee32 into aws:main Nov 6, 2025
3 checks passed

DennisTraub deleted the feature/aws-iam-mcp-client branch November 6, 2025 18:49



		@pytest.mark.unit
		class TestMcpClientExamples:

Uh oh!

Conversation

DennisTraub commented Oct 30, 2025

Uh oh!

wzxxing left a comment

Choose a reason for hiding this comment

Uh oh!

wzxxing Nov 3, 2025

Choose a reason for hiding this comment

Uh oh!

DennisTraub Nov 4, 2025

Choose a reason for hiding this comment

Uh oh!

DennisTraub commented Nov 4, 2025

Uh oh!

Uh oh!

Uh oh!

wzxxing commented Nov 5, 2025

Uh oh!

Uh oh!

arangatang left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wzxxing commented Nov 5, 2025

Uh oh!

Uh oh!

DennisTraub commented Nov 5, 2025

Uh oh!

arangatang left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wzxxing Nov 5, 2025

Choose a reason for hiding this comment

Uh oh!

DennisTraub Nov 5, 2025

Choose a reason for hiding this comment

Uh oh!

wzxxing Nov 5, 2025

Choose a reason for hiding this comment

Uh oh!

arangatang Nov 5, 2025

Choose a reason for hiding this comment

Uh oh!

wzxxing Nov 5, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

arangatang commented Nov 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants