Switch to allow-write by default and add jq check

Author: bfreiberg

plugins/aws-serverless/.mcp.json

@@ -3,7 +3,8 @@
     "aws-serverless-mcp": {
       "command": "uvx",
       "args": [
-        "awslabs.aws-serverless-mcp-server@latest"
+        "awslabs.aws-serverless-mcp-server@latest",
+        "--allow write"
       ],
       "env": {
         "FASTMCP_LOG_LEVEL": "ERROR"

plugins/aws-serverless/skills/aws-lambda-durable-functions/SKILL.md

@@ -74,6 +74,12 @@ When not specified, ALWAYS use CDK
 - State: "[framework] might not support Lambda durable functions yet"
 - Suggest supported frameworks as alternatives
 
+### Serverless MCP Server Unavailable
+
+- Inform user: "AWS Serverless MCP not responding"
+- Ask: "Proceed without MCP support?"
+- DO NOT continue without user confirmation
+
 ### Step 3: Install SDK
 
 **For TypeScript/JavaScript:**
@@ -181,6 +187,12 @@ When implementing or modifying tests for durable functions, ALWAYS verify:
 3. Replay behavior is tested with multiple invocations
 4. Use `LocalDurableTestRunner` for local testing
 
+### MCP Server Configuration
+
+**Write access is enabled by default.** The plugin ships with `--allow write` in `.mcp.json`, so the MCP server can create projects, generate IaC, and deploy on behalf of the user.
+
+Access to sensitive data (like Lambda and API Gateway logs) is **not** enabled by default. To grant it, add `--allow-sensitive-data-access` to `.mcp.json`.
+
 ## Resources
 
 - [AWS Lambda durable functions Documentation](https://docs.aws.amazon.com/lambda/latest/dg/durable-functions.html)

plugins/aws-serverless/skills/aws-lambda/SKILL.md

@@ -113,7 +113,7 @@ This skill requires that AWS credentials are configured on the host machine:
 
 ### SAM CLI Setup
 
-1. **Install SAM CLI**: Follow the [SAM CLI installation guide](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html)2
+1. **Install SAM CLI**: Follow the [SAM CLI installation guide](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html)
 2. **Verify**: Run `sam --version`
 
 ### Container Runtime Setup
@@ -123,24 +123,15 @@ This skill requires that AWS credentials are configured on the host machine:
 
 ### MCP Server Configuration
 
-The default configuration **prevents** write access and **prevents** access to sensitive data such as Lambda functions logs.
+**Write access is enabled by default.** The plugin ships with `--allow write` in `.mcp.json`, so the MCP server can create projects, generate IaC, and deploy on behalf of the user.
 
-To grant access, add these flags to `.mcp.json`:
-
-- `--allow-write`: Enables write operations (project creation, deployments)
-- `--allow-sensitive-data-access`: Enables access to Lambda logs and API Gateway logs
+Access to sensitive data (like Lambda and API Gateway logs) is **not** enabled by default. To grant it, add `--allow-sensitive-data-access` to `.mcp.json`.
 
 ### SAM Template Validation Hook
 
-This plugin includes a `PostToolUse` hook that runs `sam validate` automatically after any edit to `template.yaml` or `template.yml`. If validation fails, the error is returned as a system message so you can fix it immediately. The hook requires SAM CLI to be installed and silently skips if it is not available. Users can disable it via `/hooks`.
-
-**Version policy:** `.mcp.json` uses `awslabs.aws-serverless-mcp-server@latest`. This is intentional — the package is pre-1.0 (currently 0.1.x) and under active development, so pinning would miss bug fixes and new tool capabilities. If you need a stable, reproducible setup, pin to a specific version:
-
-```json
-"args": ["awslabs.aws-serverless-mcp-server@0.1.17", "--allow-write", "--allow-sensitive-data-access"]
-```
+This plugin includes a `PostToolUse` hook that runs `sam validate` automatically after any edit to `template.yaml` or `template.yml`. If validation fails, the error is returned as a system message so you can fix it immediately. The hook requires SAM CLI and `jq` to be installed and silently skips if it is not available. Users can disable it via `/hooks`.
 
-Check for new versions with `uvx pip index versions awslabs.aws-serverless-mcp-server`.
+**Verify**: Run `jq --version`
 
 ## Language selection
 

…erences/step-functions-testing-skills.md …bda/references/step-functions-testing.mdplugins/aws-serverless/skills/aws-lambda/references/step-functions-testing-skills.md renamed to plugins/aws-serverless/skills/aws-lambda/references/step-functions-testing.md plugins/aws-serverless/skills/aws-lambda/references/step-functions-testing-skills.md renamed to plugins/aws-serverless/skills/aws-lambda/references/step-functions-testing.md

@@ -213,7 +213,7 @@ Avoiding Lambda intermediaries for simple DynamoDB reads/writes, SNS publishes,
 
 ## Testing
 
-For testing Step Functions workflows, see [step-functions-testing-skills.md](step-functions-testing-skills.md) — covers TestState API (mocking, inspection levels, retry simulation, chained tests) and Step Functions Local (Docker).
+For testing Step Functions workflows, see [step-functions-testing.md](step-functions-testing.md) — covers TestState API (mocking, inspection levels, retry simulation, chained tests) and Step Functions Local (Docker).
 
 ## Anti-Polling Pattern
 

plugins/aws-serverless/skills/aws-lambda/references/step-functions.md

@@ -62,16 +62,15 @@ This skill requires that AWS credentials are configured on the host machine:
 
 ### AWS Serverless MCP Server
 
-The default configuration **prevents** write access and **prevents** access to sensitive data such as Lambda functions logs.
+**Write access is enabled by default.** The plugin ships with `--allow write` in `.mcp.json`, so the MCP server can create projects, generate IaC, and deploy on behalf of the user.
 
-To grant access, add these flags to `.mcp.json`:
-
-- `--allow-write`: Enables write operations (project creation, deployments)
-- `--allow-sensitive-data-access`: Enables access to Lambda logs and API Gateway logs
+Access to sensitive data (like Lambda and API Gateway logs) is **not** enabled by default. To grant it, add `--allow-sensitive-data-access` to `.mcp.json`.
 
 ### SAM Template Validation Hook
 
-This plugin includes a `PostToolUse` hook that runs `sam validate` automatically after any edit to `template.yaml` or `template.yml`. If validation fails, the error is returned as a system message so you can fix it immediately. The hook requires SAM CLI to be installed and silently skips if it is not available. Users can disable it via `/hooks`.
+This plugin includes a `PostToolUse` hook that runs `sam validate` automatically after any edit to `template.yaml` or `template.yml`. If validation fails, the error is returned as a system message so you can fix it immediately. The hook requires SAM CLI and `jq` to be installed and silently skips if it is not available. Users can disable it via `/hooks`.
+
+**Verify**: Run `jq --version`
 
 ## IaC framework selection