aws / aws/amazon-q-developer-cli
Remote MCP servers with remote auth not respecting correct oauth flows
- Dominant language
- Rust
- Stars
- 2k
- Forks
- 439
- PR merge metrics
- No merged PRs in 30d
Description
### Checks
- [x] I have searched [github.com/aws/amazon-q-developer-cli/issues](https://github.com/aws/amazon-q-developer-cli/issues?q=) and there are no duplicates of my issue
- [x] I have run `q doctor` in the affected terminal session
- [x] I have run `q restart` and replicated the issue again
### Operating system
macOS 26.0.1 (25A362)
### Expected behaviour
Given a MCP configuration like:
```
"mcpServers": {
"github-copilot": {
"type": "http",
"url": "https://api.githubcopilot.com/mcp/"
},
"atlassian-remote": {
"type": "http",
"url": "https://mcp.atlassian.com/v1/sse"
}
}
```
I'd expect to launch `q` run `/mcp` and click on the two links to remote auth against the remote MCP servers.
However, both result in a 404 for various reasons.
The Github example should find the well known authorization servers for the endpoint (https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp) and use the Authorization server for is (https://github.com/login/oauth).
For the Atlassian example, I'd expect to be able to click the link. But the Atlassian Authorization endpoint is at https://mcp.atlassian.com/v1/authorize but Q CLI generates a https://mcp.atlassian.com/authorize url. Missing the v1 prefix. It's also missing the `state` query from the uri.
## CLI vs IDE
The CLI and IDE use different schemas for the MCP servers in the ~/.aws/amazonq/mcp.json file. This causes issues when using remote MCP servers. The Q CLI approach to using requested scopes is using a `oauthScopes` parameter. The Q IDE extension uses the supported scopes from the remote MCP auth server. This means that when you launch the IDE and 'fix' the MCP servers it breaks the Q CLI parts of the config.
With a Q CLI MCP Config like:
```
"datadog": {
"url": "https://mcp.datadoghq.eu/api/unstable/mcp-server/mcp",
"type": "http"
}
```
Then trying to connect to this in the IDE Extension, it will complain that the config needs fixing. When you 'fix' it in the IDE, it results in:
```
"datadog": {
"url": "https://mcp.datadoghq.eu/api/unstable/mcp-server/mcp",
"headers": {},
"timeout": 60000,
"disabled": false
}
```
Which breaks the Q CLI
### Actual behaviour
Neither the Github or Atlassian remote MCP servers with remote auth work, for a couple of reasons.
The Github one doesn't respect the authorization servers and the Atlassian one uses the wrong uri.
However, the Atlassian server works in Q IDE extension.
### Steps to reproduce
Add the documented MCP config and launch Q, then try and connect to the MCP servers.
### Environment
```yaml
[q-details]
version = "1.17.1"
hash = "b0ef39f91625c36c2ed6f065628e7165fae9012c"
date = "2025-09-30T22:01:25.726592Z (2d ago)"
[system-info]
os = "macOS 26.0.1 (25A362)"
chip = "Apple M2 Pro"
total-cores = 10
memory = "32.00 GB"
[environment]
cwd = "/Users/USER"
cli-path = "/Users/USER"
install-method = "unknown"
```
# Additional info
Github Server docs, https://github.com/github/github-mcp-server with support for oauth.
Q CLI:
- Takes the incoming URL and uses that for the auth manager, https://github.com/aws/amazon-q-developer-cli/blob/c9d626604ad0ba72513f93e73d9e429f88853cbe/crates/chat-cli/src/mcp_client/oauth_util.rs#L291
- Then passes that URL into AuthState from the Rust MCP lib, https://github.com/aws/amazon-q-developer-cli/blob/c9d626604ad0ba72513f93e73d9e429f88853cbe/crates/chat-cli/src/mcp_client/oauth_util.rs#L459
- The gets the auth url, based on the url/config that was passed in, https://github.com/aws/amazon-q-developer-cli/blob/c9d626604ad0ba72513f93e73d9e429f88853cbe/crates/chat-cli/src/mcp_client/oauth_util.rs#L582
Contributor guide
Assessment
This issue has not been assessed yet.