@apono-io/mcp-aws-managed
v0.2.0
Published
Apono MCP server for AWS — signs requests to the managed AWS MCP Server with STS AssumeRole credentials
Readme
@apono-io/mcp-aws-managed
Apono MCP server for AWS. Assumes the granted role via STS, then proxies stdio MCP traffic to the managed AWS MCP Server, signing every request with SigV4.
Unlike @apono-io/mcp-aws it spawns no vendor process, so uvx, uv and Python
are not required on the host.
Usage
Launched by the Apono CLI via npx. Environment variables:
| Variable | Description |
|---|---|
| AWS_ACCESS_KEY_ID | Brokered IAM credentials — access key |
| AWS_SECRET_ACCESS_KEY | Brokered IAM credentials — secret key |
| AWS_SESSION_TOKEN | Brokered IAM credentials — session token |
| AWS_ROLE_ARN | ARN of the role to assume via STS |
| AWS_REGION | Region for the STS call (default us-east-1) |
| AWS_MCP_ENDPOINT | Override the endpoint (default https://aws-mcp.us-east-1.api.aws/mcp; https://aws-mcp.eu-central-1.api.aws/mcp also exists) |
The SigV4 signing service and region are derived from the endpoint hostname, so
overriding AWS_MCP_ENDPOINT is enough to switch region.
Limitations
The role is assumed once at startup, as in @apono-io/mcp-aws. Sessions outliving
the assumed credentials will see ExpiredToken surface as tool errors rather than
as a startup failure.
