aws / aws/amazon-q-developer-cli

Remote MCP servers with remote auth not respecting correct oauth flows

Open
#3,077 1 comment 6 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
2k
Forks
439
PR merge metrics
No merged PRs in 30d

Description

### Checks

- [x] I have searched [github.com/aws/amazon-q-developer-cli/issues](https://github.com/aws/amazon-q-developer-cli/issues?q=) and there are no duplicates of my issue
- [x] I have run `q doctor` in the affected terminal session
- [x] I have run `q restart` and replicated the issue again

### Operating system

macOS 26.0.1 (25A362)

### Expected behaviour

Given a MCP configuration like:

```
"mcpServers": {
"github-copilot": {
"type": "http",
"url": "https://api.githubcopilot.com/mcp/"
},
"atlassian-remote": {
"type": "http",
"url": "https://mcp.atlassian.com/v1/sse"
}
}
```

I'd expect to launch `q` run `/mcp` and click on the two links to remote auth against the remote MCP servers.

However, both result in a 404 for various reasons.

The Github example should find the well known authorization servers for the endpoint (https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp) and use the Authorization server for is (https://github.com/login/oauth).

For the Atlassian example, I'd expect to be able to click the link. But the Atlassian Authorization endpoint is at https://mcp.atlassian.com/v1/authorize but Q CLI generates a https://mcp.atlassian.com/authorize url. Missing the v1 prefix. It's also missing the `state` query from the uri.

## CLI vs IDE

The CLI and IDE use different schemas for the MCP servers in the ~/.aws/amazonq/mcp.json file. This causes issues when using remote MCP servers. The Q CLI approach to using requested scopes is using a `oauthScopes` parameter. The Q IDE extension uses the supported scopes from the remote MCP auth server. This means that when you launch the IDE and 'fix' the MCP servers it breaks the Q CLI parts of the config.

With a Q CLI MCP Config like:
```
"datadog": {
"url": "https://mcp.datadoghq.eu/api/unstable/mcp-server/mcp",
"type": "http"
}
```
Then trying to connect to this in the IDE Extension, it will complain that the config needs fixing. When you 'fix' it in the IDE, it results in:
```
"datadog": {
"url": "https://mcp.datadoghq.eu/api/unstable/mcp-server/mcp",
"headers": {},
"timeout": 60000,
"disabled": false
}
```
Which breaks the Q CLI

### Actual behaviour

Neither the Github or Atlassian remote MCP servers with remote auth work, for a couple of reasons.

The Github one doesn't respect the authorization servers and the Atlassian one uses the wrong uri.

However, the Atlassian server works in Q IDE extension.

### Steps to reproduce

Add the documented MCP config and launch Q, then try and connect to the MCP servers.

### Environment

```yaml

[q-details]
version = "1.17.1"
hash = "b0ef39f91625c36c2ed6f065628e7165fae9012c"
date = "2025-09-30T22:01:25.726592Z (2d ago)"

[system-info]
os = "macOS 26.0.1 (25A362)"
chip = "Apple M2 Pro"
total-cores = 10
memory = "32.00 GB"

[environment]
cwd = "/Users/USER"
cli-path = "/Users/USER"
install-method = "unknown"
```

# Additional info

Github Server docs, https://github.com/github/github-mcp-server with support for oauth.

Q CLI:
- Takes the incoming URL and uses that for the auth manager, https://github.com/aws/amazon-q-developer-cli/blob/c9d626604ad0ba72513f93e73d9e429f88853cbe/crates/chat-cli/src/mcp_client/oauth_util.rs#L291
- Then passes that URL into AuthState from the Rust MCP lib, https://github.com/aws/amazon-q-developer-cli/blob/c9d626604ad0ba72513f93e73d9e429f88853cbe/crates/chat-cli/src/mcp_client/oauth_util.rs#L459
- The gets the auth url, based on the url/config that was passed in, https://github.com/aws/amazon-q-developer-cli/blob/c9d626604ad0ba72513f93e73d9e429f88853cbe/crates/chat-cli/src/mcp_client/oauth_util.rs#L582

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.