Remote MCP Servers

[mschrage]

• HTTP transport
• Oauth

[pcolazurdo]

What about SIGv4 to support remote AgentCore runtimes?

[clouatre]

Enterprise Urgency: Remote MCP + OAuth Critical for Client Engagements

This roadmap item is blocking enterprise adoption for consulting engagements requiring multiple authenticated cloud services.

Current Enterprise Reality

We currently maintain 3 Atlassian instances (internal + 2 client environments) that work seamlessly in Claude Code but require extensive workarounds in Amazon Q CLI:

Claude Code (works natively):

• Direct remote MCP connections with built-in OAuth
• Zero additional tooling required
• 75+ tools across 3 instances working perfectly

Amazon Q CLI (requires extensive workarounds):

• Requires mcp-proxy for remote connections
• Requires custom OAuth2 + PKCE wrapper scripts
• Still fails due to tool naming conflicts (issue Feature Request: Support toolAliases in mcp.json like agent #2564)
• Significant development overhead with limited functionality

Business Impact

Client engagements are choosing Claude Code over Amazon Q CLI specifically because of MCP limitations. When clients ask "Which AI coding assistant should we standardize on?", the answer is determined by MCP capabilities.

Competitive Pressure

Claude Code's native remote MCP + OAuth support is becoming a significant competitive advantage. Enterprise clients need seamless integration with their authenticated cloud services (Atlassian, GitHub, internal APIs, etc.).

Request

Please prioritize HTTP transport and OAuth on this roadmap. The consulting industry needs these capabilities to recommend Amazon Q CLI for client engagements. The gap is widening as more enterprise services adopt MCP integration patterns.

[clouatre]

Related Critical MCP Issues

This roadmap item is interconnected with other blocking MCP limitations:

• Feature Request: Support toolAliases in mcp.json like agent #2564 toolAliases Support - Multiple instance support is broken even with workarounds due to tool naming conflicts
• feat: MCP Streamable HTTP Transport Support #2096 Streamable HTTP Transport - Detailed technical specification for the HTTP transport needed here

Enterprise Blocker Chain:

1. No native remote MCP (Remote MCP Servers #2706) → requires mcp-proxy workarounds
2. No OAuth support (Remote MCP Servers #2706) → requires custom authentication wrappers
3. Broken toolAliases (Feature Request: Support toolAliases in mcp.json like agent #2564) → multiple instances still fail despite workarounds

Fixing this roadmap item would eliminate the need for complex workarounds that currently don't even work due to #2564.

[clouatre]

Updated Status: HTTP Transport Working, OAuth Gap Remains

v1.16.0 Progress Update:
✅ HTTP Transport Implemented - Direct "type": "http" configuration working
✅ No mcp-proxy Required - Remote MCP connections establish successfully
❌ OAuth Token Management Missing - Connection fails during MCP initialize phase

Current Enterprise Configuration (Working):

{
  "mcpServers": {
    "atlassian_instance": {
      "type": "http",
      "url": "https://mcp.atlassian.com/v1/sse",
      "headers": {
        "X-Atlassian-Instance": "https://enterprise.atlassian.net"
      }
    }
  }
}

Remaining Technical Gap:
MCP error -32002 ("connection closed: initialize response") indicates HTTP transport connects but fails when MCP server expects OAuth authentication. Claude Code handles this transparently with automatic token lifecycle management.

What's Needed:
Automatic OAuth token injection into HTTP transport requests, similar to Claude Code's seamless authentication handling (/mcp menu shows "✔ connected ✔ authenticated").

HTTP transport implementation is complete - OAuth integration is the final piece for enterprise adoption.

[dingfeli]

@huguesclouatre is the atlassian endpoint using streamable http or sse? We don't yet support sse.

[clouatre]

Technical Analysis: SSE + OAuth Requirements

Testing Results:

curl -v https://mcp.atlassian.com/v1/sse
# Result: HTTP/2 401 "Missing or invalid access token"

Key Finding: Atlassian Uses SSE Transport
The /v1/sse endpoint confirms Atlassian Remote MCP Server uses Server-Sent Events, not basic HTTP.

MCP Specification Requirement:
Per MCP Streamable HTTP Transport, the official protocol includes:

• HTTP POST/GET requests ✅ (Amazon Q CLI v1.16.0 supports)
• Server-Sent Events (SSE) ❌ (Amazon Q CLI missing - required for MCP spec compliance)
• OAuth authentication ❌ (blocking enterprise adoption)

Amazon Q CLI Gaps:

1. SSE Transport Missing: Cannot connect to SSE-based MCP servers (like Atlassian) - see bug: mcpServers in agent doesn't support SSE server transport #2803
2. OAuth Missing: Cannot authenticate with enterprise OAuth servers - see Feature Request: Automatic OAuth token lifecycle management for HTTP MCP servers #2921

Conclusion:
Amazon Q CLI needs both SSE transport support (#2803) AND OAuth 2.1 PKCE (#2921) to be fully MCP-compliant and work with enterprise servers like Atlassian's implementation.

[clouatre]

HTTP Transport Status Update

HTTP transport has been partially implemented in v1.16.0 as evidenced by:

• Release notes v1.16.0 mention HTTP support
• Simple HTTP endpoints work (Cloudflare, Microsoft Docs)
• Bearer token headers work for authenticated endpoints

Working HTTP Configuration Example:

{
  "type": "http",
  "url": "https://api.example.com/mcp",
  "headers": {
    "Authorization": "Bearer [REDACTED]"
  }
}

However, OAuth 2.1 PKCE compliance is missing per MCP Transport Specifications, forcing users to proxy through mcp-remote for OAuth-enabled MCP servers:

Current Workaround Required:

{
  "type": "stdio",
  "command": "mcp-remote",
  "args": ["https://mcp.atlassian.com/v1/sse", "--resource", "https://[REDACTED].atlassian.net/"]
}

Related Issues:

• Feature Request: Automatic OAuth token lifecycle management for HTTP MCP servers #2921 (OAuth lifecycle management)
• bug: mcpServers in agent doesn't support SSE server transport #2803 (SSE schema validation bug)

Current Status: HTTP transport works for simple endpoints but lacks full MCP specification compliance for OAuth flows.