aws / aws/amazon-q-developer-cli

MCP disabled for API key users due to GetProfile call failure (v2.3.0)

Open
#3,805 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
2k
Forks
439
PR merge metrics
No merged PRs in 30d

Description

## Description

When authenticated with an API key (`KIRO_API_KEY`), running `kiro-cli mcp list` or starting a chat session shows:

```
⚠️ WARNING: Failed to retrieve MCP settings; MCP functionality disabled
```

## Root Cause

The MCP governance check calls `GetProfile` which returns `AccessDeniedException` for API key users:

```
ERROR chat_cli::api_client::profile: GetProfile failed on all endpoints for API key
WARN chat_cli::cli::mcp: Failed to check MCP configuration, defaulting to disabled
err=GetProfileError(ServiceError(AccessDeniedError: "Your account is not authorized to make this call."))
```

Running `kiro-cli profile` confirms: `error: This command is only available for IAM Identity Center or External IdP users`

## Expected Behavior

For API key users without MCP Registry/governance, the CLI should skip the governance check and load locally configured MCP servers from `~/.kiro/settings/mcp.json` and `.kiro/settings/mcp.json` normally.

## Environment

- kiro-cli version: 2.3.0
- Auth method: API key (`KIRO_API_KEY` env var)
- OS: Linux (Ubuntu)
- MCP servers configured in `~/.kiro/settings/mcp.json` (global) and `.kiro/settings/mcp.json` (workspace)

## Steps to Reproduce

1. Authenticate with API key: `export KIRO_API_KEY=ksk_...`
2. Configure MCP servers in `~/.kiro/settings/mcp.json`
3. Run `kiro-cli mcp list`
4. Observe warning and empty MCP list

## Workaround

MCP servers still work within active chat sessions despite the warning. The issue only affects the `mcp list` command output and initial governance check.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.