aws / aws/amazon-q-developer-cli
MCP disabled for API key users due to GetProfile call failure (v2.3.0)
- Dominant language
- Rust
- Stars
- 2k
- Forks
- 439
- PR merge metrics
- No merged PRs in 30d
Description
## Description
When authenticated with an API key (`KIRO_API_KEY`), running `kiro-cli mcp list` or starting a chat session shows:
```
⚠️ WARNING: Failed to retrieve MCP settings; MCP functionality disabled
```
## Root Cause
The MCP governance check calls `GetProfile` which returns `AccessDeniedException` for API key users:
```
ERROR chat_cli::api_client::profile: GetProfile failed on all endpoints for API key
WARN chat_cli::cli::mcp: Failed to check MCP configuration, defaulting to disabled
err=GetProfileError(ServiceError(AccessDeniedError: "Your account is not authorized to make this call."))
```
Running `kiro-cli profile` confirms: `error: This command is only available for IAM Identity Center or External IdP users`
## Expected Behavior
For API key users without MCP Registry/governance, the CLI should skip the governance check and load locally configured MCP servers from `~/.kiro/settings/mcp.json` and `.kiro/settings/mcp.json` normally.
## Environment
- kiro-cli version: 2.3.0
- Auth method: API key (`KIRO_API_KEY` env var)
- OS: Linux (Ubuntu)
- MCP servers configured in `~/.kiro/settings/mcp.json` (global) and `.kiro/settings/mcp.json` (workspace)
## Steps to Reproduce
1. Authenticate with API key: `export KIRO_API_KEY=ksk_...`
2. Configure MCP servers in `~/.kiro/settings/mcp.json`
3. Run `kiro-cli mcp list`
4. Observe warning and empty MCP list
## Workaround
MCP servers still work within active chat sessions despite the warning. The issue only affects the `mcp list` command output and initial governance check.
Contributor guide
Assessment
This issue has not been assessed yet.