aws / aws/amazon-q-developer-cli

Feature Request: Automatic OAuth token lifecycle management for HTTP MCP servers

Open
#2,921 6 comments 4 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
2k
Forks
439
PR merge metrics
No merged PRs in 30d

Description

### Problem Statement

Amazon Q CLI v1.16.0 successfully implemented HTTP transport for remote MCP servers, but lacks automatic OAuth token management. This causes MCP initialization failures when connecting to authenticated enterprise services and prevents compatibility with existing OAuth-enabled MCP servers in the ecosystem.

### Current Behavior

**HTTP Transport Works:**
```json
{
"mcpServers": {
"enterprise_instance_a": {
"type": "http",
"url": "https://mcp.atlassian.com/v1/sse",
"headers": {
"X-Atlassian-Instance": "https://[REDACTED].atlassian.net"
}
}
}
}
```

**Connection Establishes but Authentication Fails:**
```
✗ enterprise_instance_a has failed to load after 20.74 s
- Mcp error: -32002: connection closed: initialize response
```

### Root Cause

HTTP connections establish successfully, but MCP initialize phase fails when servers expect OAuth Bearer tokens. The -32002 error occurs consistently across all authenticated MCP endpoints.

### Enterprise Impact

Organizations cannot use Amazon Q CLI with enterprise MCP servers that require OAuth authentication, including the [Atlassian Remote MCP Server](https://support.atlassian.com/atlassian-rovo-mcp-server/docs/getting-started-with-the-atlassian-remote-mcp-server/) which implements standard OAuth 2.1 PKCE flows.

**Current Status:**
- HTTP transport ✅ (v1.16.0)
- toolAliases ✅ (v1.16.0)
- OAuth token management ❌ (blocking enterprise adoption)

### Request

Add OAuth 2.1 PKCE support for HTTP MCP servers to enable automatic token lifecycle management, including:
- OAuth discovery via `/.well-known` endpoints
- Automatic browser-based authentication flow
- Secure token storage and refresh
- Bearer token injection in MCP requests

### Validation Target

**Atlassian Remote MCP Server** should be the primary integration test case, as it represents the current standard for OAuth-enabled MCP servers in the ecosystem.

### Environment

```
Amazon Q Developer CLI: 1.16.0
Platform: macOS Darwin 24.6.0
Configuration: HTTP transport with X-Atlassian-Instance headers
Error: MCP -32002 connection closed during initialize response
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.