Expired AWS Login credentials are reported as invalid initialize parameters
- Dominant language
- Python
- Stars
- 352
- Forks
- 63
- Avg merge
- 12h 9m
- Merged PRs (30d)
- 19
Description
## Summary
When AWS Login credentials require reauthentication, `mcp-proxy-for-aws` converts the underlying `LoginRefreshRequired` failure during initialization into:
`JSON-RPC error: -32602: Invalid request parameters("")`
The initialize request itself is valid, so MCP client users receive a misleading diagnostic and cannot identify that `aws login` is required.
## Environment
- mcp-proxy-for-aws: 1.6.0
- Transport: stdio proxy to `https://aws-mcp.us-east-1.api.aws/mcp`
- AWS credential source: AWS CLI `aws login`
## Reproduction
1. Configure the proxy normally with AWS Login credentials.
2. Let the AWS Login refresh token expire or otherwise reach a state that requires `aws login`.
3. Send a valid MCP initialize request.
Example request:
```json
{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"diagnostic","version":"1"}}}
```
## Actual result
```json
{"jsonrpc":"2.0","id":1,"error":{"code":-32602,"message":"Invalid request parameters","data":""}}
```
With DEBUG logging enabled, the underlying failure is:
```text
botocore.exceptions.LoginRefreshRequired:
Your session has expired or credentials have changed.
Please reauthenticate using 'aws login'.
```
Running `aws login` restores the same initialize handshake.
## Expected result
Preserve an identifiable authentication error, or emit a clear authentication diagnostic, instead of reporting that valid initialize parameters are invalid.
## Additional context
This affects MCP clients including Codex and Cursor because they only display the returned `-32602` initialize error by default.
Contributor guide
Research direction
Start by tracing the MCP initialize request handling and how botocore.exceptions.LoginRefreshRequired is converted into the JSON-RPC error. Reproduce with expired AWS Login credentials and DEBUG logging, then verify that a valid initialize request produces an identifiable authentication diagnostic rather than invalid request parameters.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python
- Domain
- api, authentication, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100