feat: Simplify MCP server authentication to use AppSync API keys

- Remove separate DynamoDB API key table and custom authorizer
- Pass API keys from MCP requests directly to GraphQL calls
- Let AppSync handle API key validation instead of custom auth
- MCP endpoints are publicly accessible, GraphQL ops require valid keys
- Add Makefile targets for testing MCP server with API keys

This simplifies the architecture by reusing existing AppSync API keys
for n8n integration instead of managing a separate authentication system.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: guyernest

ui_amplify/Makefile

@@ -23,6 +23,10 @@ help:
 	@echo "  make format        - Format code"
 	@echo "  make clean         - Clean build artifacts"
 	@echo ""
+	@echo "Testing commands:"
+	@echo "  make test-mcp-server MCP_URL=<url>         - Test MCP server basic endpoints"
+	@echo "  make test-mcp-graphql MCP_URL=<url> API_KEY=<key> - Test MCP with GraphQL auth"
+	@echo ""
 
 # Install dependencies
 install:
@@ -98,6 +102,41 @@ clean:
 	@cd $(MCP_SERVER_DIR) && make clean
 	@echo "Clean complete!"
 
+# Test MCP server endpoints
+test-mcp-server:
+	@echo "Testing MCP server endpoints..."
+	@if [ -z "$(MCP_URL)" ]; then \
+		echo "❌ Please set MCP_URL environment variable"; \
+		echo "Example: make test-mcp-server MCP_URL=https://your-api.execute-api.region.amazonaws.com/mcp"; \
+		exit 1; \
+	fi
+	@echo "Testing initialize..."
+	@curl -X POST $(MCP_URL) \
+		-H "Content-Type: application/json" \
+		-d '{"jsonrpc":"2.0","method":"initialize","params":{},"id":1}' | jq '.'
+	@echo "\nTesting tools/list..."
+	@curl -X POST $(MCP_URL) \
+		-H "Content-Type: application/json" \
+		-d '{"jsonrpc":"2.0","method":"tools/list","params":{},"id":2}' | jq '.'
+
+# Test MCP server with GraphQL API key
+test-mcp-graphql:
+	@echo "Testing MCP server with GraphQL authentication..."
+	@if [ -z "$(MCP_URL)" ]; then \
+		echo "❌ Please set MCP_URL environment variable"; \
+		exit 1; \
+	fi
+	@if [ -z "$(API_KEY)" ]; then \
+		echo "❌ Please set API_KEY environment variable (your AppSync API key)"; \
+		echo "You can find this in the AWS AppSync console"; \
+		exit 1; \
+	fi
+	@echo "Testing list_available_agents with API key..."
+	@curl -X POST $(MCP_URL) \
+		-H "Content-Type: application/json" \
+		-H "x-api-key: $(API_KEY)" \
+		-d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"list_available_agents","arguments":{}},"id":3}' | jq '.'
+
 # Local development helpers
 dev-mcp:
 	@echo "Running MCP server locally..."

ui_amplify/amplify/mcp-server/constructs/SimpleApiKeyMcpConstruct.ts

@@ -37,19 +37,18 @@ export class SimpleApiKeyMcpConstruct extends Construct {
         environment: {
           ENVIRONMENT: props.environment,
           APPLICATION_NAME: props.applicationName,
-          API_KEY_TABLE_NAME: props.apiKeyTable.tableName,
           AWS_ACCOUNT_ID: Stack.of(this).account,
           // GraphQL endpoint will be set after creation
           GRAPHQL_ENDPOINT: props.graphqlApi.attrGraphQlUrl || "", // Note: capital Q in GraphQl
-          // Use the API key from the created CfnApiKey
-          GRAPHQL_API_KEY: props.graphqlApiKey?.attrApiKey || "",
+          // API key will be passed from request headers
           RUST_LOG: "info",
           RUST_BACKTRACE: "1",
         },
         description: "Rust MCP server with API key authentication for Step Functions agents",
       }
     );
 
+
     // Create HTTP API integration
     const mcpIntegration = new HttpLambdaIntegration(
       `${props.projectName}-mcp-integration`,
@@ -58,6 +57,7 @@ export class SimpleApiKeyMcpConstruct extends Construct {
 
     // Add MCP routes to HTTP API Gateway
     // Main MCP endpoint (handles all MCP protocol requests)
+    // Authentication is handled by passing API key to GraphQL
     props.httpApi.addRoutes({
       path: "/mcp",
       methods: [
@@ -67,14 +67,15 @@ export class SimpleApiKeyMcpConstruct extends Construct {
       integration: mcpIntegration,
     });
 
-    // Health check endpoint
+    // Health check endpoint - NOT PROTECTED (useful for monitoring)
     props.httpApi.addRoutes({
       path: "/health",
       methods: [
         apigateway.HttpMethod.GET,
         apigateway.HttpMethod.OPTIONS,
       ],
       integration: mcpIntegration,
+      // No authorizer - health check is public
     });
 
     // MCP-specific endpoints following the protocol
@@ -88,20 +89,11 @@ export class SimpleApiKeyMcpConstruct extends Construct {
       integration: mcpIntegration,
     });
 
-    // Ensure GraphQL endpoint is set (similar to reference project)
+    // Ensure GraphQL endpoint is set
     // The attribute name uses capital Q: attrGraphQlUrl
     const graphqlUrl = props.graphqlApi.attrGraphQlUrl;
     if (graphqlUrl) {
       this.mcpServerFunction.addEnvironment("GRAPHQL_ENDPOINT", graphqlUrl);
     }
-    
-    // Also ensure API key is properly set from the created key
-    if (props.graphqlApiKey) {
-      const apiKeyValue = props.graphqlApiKey.attrApiKey;
-      console.log("Using created GraphQL API Key");
-      this.mcpServerFunction.addEnvironment("GRAPHQL_API_KEY", apiKeyValue);
-    } else {
-      console.log("Warning: No API key provided to construct");
-    }
   }
 }

ui_amplify/amplify/mcp-server/constructs/common-interfaces.ts

@@ -1,5 +1,4 @@
 import * as apigateway from "aws-cdk-lib/aws-apigatewayv2";
-import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as cognito from "aws-cdk-lib/aws-cognito";
 import * as logs from "aws-cdk-lib/aws-logs";
@@ -14,30 +13,11 @@ export interface McpConstructProps {
   userPool: cognito.UserPool;
   userPoolClient: cognito.UserPoolClient;
   graphqlApi: any; // AppSync GraphQL API reference
-  graphqlApiKey?: any; // AppSync API Key reference
   mcpServerLogGroup: logs.LogGroup;
-  apiKeyTable: dynamodb.Table;
   lambdaRole: iam.Role;
   httpApi: apigateway.HttpApi;
 }
 
-/**
- * API Key structure for DynamoDB storage
- */
-export interface ApiKeyRecord {
-  api_key_hash: string; // PK - SHA256 hash of the API key
-  client_id: string; // GSI - Client identifier for lookup
-  client_name: string; // Human readable name
-  created_at: string; // ISO timestamp
-  expires_at: string; // ISO timestamp
-  last_used?: string; // ISO timestamp
-  is_active: boolean;
-  permissions: string[]; // Array of allowed operations
-  usage_count: number;
-  created_by: string; // User who created the key
-  metadata?: Record<string, any>; // Additional metadata
-}
-
 /**
  * MCP Tool definition for the server
  */

ui_amplify/amplify/mcp-server/resource.ts

@@ -178,9 +178,7 @@ export function createMcpServerResources(backend: Backend<{ auth: any; data: any
     userPool,
     userPoolClient,
     graphqlApi,
-    graphqlApiKey: apiKey,
     mcpServerLogGroup,
-    apiKeyTable,
     lambdaRole,
     httpApi,
   };
@@ -212,9 +210,6 @@ export function createMcpServerResources(backend: Backend<{ auth: any; data: any
         mcpServer: `${PROJECT_NAME}-mcp-server`,
       },
 
-      dynamoDbTables: {
-        apiKeys: apiKeyTable.tableName,
-      },
 
       logGroups: {
         mcpServer: mcpServerLogGroup.logGroupName,
@@ -229,7 +224,6 @@ export function createMcpServerResources(backend: Backend<{ auth: any; data: any
   return {
     httpApi,
     mcpConstruct,
-    apiKeyTable,
     mcpServerLogGroup,
   };
 }

ui_amplify/amplify/mcp-server/rust-mcp-server/src/agents.rs

@@ -6,7 +6,7 @@ use anyhow::{Result, anyhow};
 use serde::{Deserialize, Serialize};
 use chrono::{DateTime, Utc};
 use std::collections::HashMap;
-use tracing::info;
+use tracing::{info, warn};
 use uuid::Uuid;
 use serde_json::{json, Value};
 
@@ -16,7 +16,7 @@ pub struct StepFunctionsAgentsClient {
     dynamodb: DynamoDbClient,
     environment: String,
     graphql_endpoint: Option<String>,
-    api_key: Option<String>,
+    // API key will be passed per request, not stored
 }
 
 /// Agent definition from registry
@@ -75,26 +75,19 @@ impl StepFunctionsAgentsClient {
         let dynamodb = DynamoDbClient::new(aws_config);
         let environment = std::env::var("ENVIRONMENT").unwrap_or_else(|_| "prod".to_string());
         let graphql_endpoint = std::env::var("GRAPHQL_ENDPOINT").ok();
-        let api_key = std::env::var("GRAPHQL_API_KEY").ok();
 
         info!("Initialized StepFunctionsAgentsClient for environment: {}", environment);
         if let Some(ref endpoint) = graphql_endpoint {
             info!("GraphQL endpoint configured: {}", endpoint);
         } else {
             info!("GraphQL endpoint not found in environment variables");
         }
-        if api_key.is_some() {
-            info!("GraphQL API key configured");
-        } else {
-            info!("GraphQL API key not found in environment variables");
-        }
 
         Self {
             sfn,
             dynamodb,
             environment,
             graphql_endpoint,
-            api_key,
         }
     }
 
@@ -217,15 +210,19 @@ impl StepFunctionsAgentsClient {
     }
 
     /// List available agents from registry
-    pub async fn list_available_agents(&self) -> Result<Vec<Agent>> {
+    pub async fn list_available_agents(&self, api_key: Option<String>) -> Result<Vec<Agent>> {
         info!("Listing available agents from registry");
 
         // If GraphQL endpoint is configured, use it
-        if let (Some(endpoint), Some(api_key)) = (&self.graphql_endpoint, &self.api_key) {
+        if let Some(endpoint) = &self.graphql_endpoint {
             info!("Using GraphQL API to list agents");
             info!("GraphQL endpoint: {}", endpoint);
-            // Log API key length for security (not the actual key)
-            info!("API key length: {}", api_key.len());
+            if let Some(ref key) = api_key {
+                // Log API key length for security (not the actual key)
+                info!("API key provided, length: {}", key.len());
+            } else {
+                warn!("No API key provided for GraphQL request");
+            }
 
             let query = r#"
                 query ListAgentsFromRegistry {
@@ -254,11 +251,15 @@ impl StepFunctionsAgentsClient {
                 .post(endpoint)
                 .header("Content-Type", "application/json");
 
-            // Only add API key header if it's not empty
-            if !api_key.is_empty() {
-                request = request.header("x-api-key", api_key);
+            // Add API key header if provided
+            if let Some(ref key) = api_key {
+                if !key.is_empty() {
+                    request = request.header("x-api-key", key);
+                } else {
+                    info!("Warning: API key is empty, request may fail");
+                }
             } else {
-                info!("Warning: API key is empty, request may fail");
+                warn!("No API key provided, GraphQL request may fail");
             }
 
             let response = request