aws / aws/amazon-q-developer-cli
Feature Request: Automatic OAuth token lifecycle management for HTTP MCP servers
- Dominant language
- Rust
- Stars
- 2k
- Forks
- 439
- PR merge metrics
- No merged PRs in 30d
Description
### Problem Statement
Amazon Q CLI v1.16.0 successfully implemented HTTP transport for remote MCP servers, but lacks automatic OAuth token management. This causes MCP initialization failures when connecting to authenticated enterprise services and prevents compatibility with existing OAuth-enabled MCP servers in the ecosystem.
### Current Behavior
**HTTP Transport Works:**
```json
{
"mcpServers": {
"enterprise_instance_a": {
"type": "http",
"url": "https://mcp.atlassian.com/v1/sse",
"headers": {
"X-Atlassian-Instance": "https://[REDACTED].atlassian.net"
}
}
}
}
```
**Connection Establishes but Authentication Fails:**
```
✗ enterprise_instance_a has failed to load after 20.74 s
- Mcp error: -32002: connection closed: initialize response
```
### Root Cause
HTTP connections establish successfully, but MCP initialize phase fails when servers expect OAuth Bearer tokens. The -32002 error occurs consistently across all authenticated MCP endpoints.
### Enterprise Impact
Organizations cannot use Amazon Q CLI with enterprise MCP servers that require OAuth authentication, including the [Atlassian Remote MCP Server](https://support.atlassian.com/atlassian-rovo-mcp-server/docs/getting-started-with-the-atlassian-remote-mcp-server/) which implements standard OAuth 2.1 PKCE flows.
**Current Status:**
- HTTP transport ✅ (v1.16.0)
- toolAliases ✅ (v1.16.0)
- OAuth token management ❌ (blocking enterprise adoption)
### Request
Add OAuth 2.1 PKCE support for HTTP MCP servers to enable automatic token lifecycle management, including:
- OAuth discovery via `/.well-known` endpoints
- Automatic browser-based authentication flow
- Secure token storage and refresh
- Bearer token injection in MCP requests
### Validation Target
**Atlassian Remote MCP Server** should be the primary integration test case, as it represents the current standard for OAuth-enabled MCP servers in the ecosystem.
### Environment
```
Amazon Q Developer CLI: 1.16.0
Platform: macOS Darwin 24.6.0
Configuration: HTTP transport with X-Atlassian-Instance headers
Error: MCP -32002 connection closed during initialize response
```
Contributor guide
Assessment
This issue has not been assessed yet.