aws / aws/mcp-proxy-for-aws

Expired AWS Login credentials are reported as invalid initialize parameters

Open
#304 3 comments 2 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
352
Forks
63
Avg merge
12h 9m
Merged PRs (30d)
19

Description

## Summary

When AWS Login credentials require reauthentication, `mcp-proxy-for-aws` converts the underlying `LoginRefreshRequired` failure during initialization into:

`JSON-RPC error: -32602: Invalid request parameters("")`

The initialize request itself is valid, so MCP client users receive a misleading diagnostic and cannot identify that `aws login` is required.

## Environment

- mcp-proxy-for-aws: 1.6.0
- Transport: stdio proxy to `https://aws-mcp.us-east-1.api.aws/mcp`
- AWS credential source: AWS CLI `aws login`

## Reproduction

1. Configure the proxy normally with AWS Login credentials.
2. Let the AWS Login refresh token expire or otherwise reach a state that requires `aws login`.
3. Send a valid MCP initialize request.

Example request:

```json
{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"diagnostic","version":"1"}}}
```

## Actual result

```json
{"jsonrpc":"2.0","id":1,"error":{"code":-32602,"message":"Invalid request parameters","data":""}}
```

With DEBUG logging enabled, the underlying failure is:

```text
botocore.exceptions.LoginRefreshRequired:
Your session has expired or credentials have changed.
Please reauthenticate using 'aws login'.
```

Running `aws login` restores the same initialize handshake.

## Expected result

Preserve an identifiable authentication error, or emit a clear authentication diagnostic, instead of reporting that valid initialize parameters are invalid.

## Additional context

This affects MCP clients including Codex and Cursor because they only display the returned `-32602` initialize error by default.

Contributor guide

Open the contributing guide

Research direction

Start by tracing the MCP initialize request handling and how botocore.exceptions.LoginRefreshRequired is converted into the JSON-RPC error. Reproduce with expired AWS Login credentials and DEBUG logging, then verify that a valid initialize request produces an identifiable authentication diagnostic rather than invalid request parameters.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
api, authentication, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.