AWS IAM MCP client with SigV4 auth #65

DennisTraub · 2025-10-30T18:06:46Z

Enables IAM (SigV4) authentication for MCP clients connecting to AWS-hosted MCP servers. This client is a drop-in replacement for existing MCP client usage and works with agent frameworks like Strands Agents, LangChain, LlamaIndex, and the Microsoft Agent Framework.

Adds aws_iam_mcp_client: an async context manager creating a streamable MCP HTTP client signed with SigV4
Establishes a boto3.Session with optional AWS region and profile
Uses existing SigV4HTTPXAuth with resolved credentials, service, and region
Connects via MCP’s streamablehttp_client
Allows injecting a custom httpx_client_factory for transport customization

Unit tests cover:

Parameterization of boto3.Session (region/profile)
Creation and wiring of SigV4HTTPXAuth
Forwarding of client parameters to the underlying streamable client
Proper cleanup behavior of the async context manager

Follow-ups:

Integration tests
Documentation update
Usage examples

wzxxing

Previously in our discussion, we were thinking if the mcp client or transport is the level of abstraction. But seems from the PR, in order to make this feature available to both mcp python sdk and fastmcp v2, the two SDKs needs to be handled separately.

Final comment, would you be able to update the README to include a section of using this feature with popular agent SDKs?

wzxxing · 2025-11-03T09:18:29Z

mcp_proxy_for_aws/client.py

+    auth = SigV4HTTPXAuth(session.get_credentials(), aws_service, region)
+
+    # Establish connection using MCP SDK's streamable HTTP client
+    async with streamablehttp_client(


This is using the official streamablehttp_client.

Do you know if this will be compatible for the users using fastmcp 2.0?

Yes, the client uses the standard MCP SDK's streamablehttp_client, which speaks the core MCP protocol over HTTP. FastMCP 2.0 servers are MCP-compliant, so any standard MCP client, including this one, will work seamlessly.

If users want to use fastmcp.Client, they'd bypass aws_iam_mcp_client() and use SigV4HTTPXAuth directly.

DennisTraub · 2025-11-04T16:10:45Z

@wzxxing re:

Final comment, would you be able to update the README to include a section of using this feature with popular agent SDKs?

Absolutely. I'll update the README and will switch the PR to "ready for review"

mcp_proxy_for_aws/client.py

wzxxing · 2025-11-05T09:34:48Z

There are some issues found by the CI: https://github.com/aws/mcp-proxy-for-aws/actions/runs/19081826894/job/54560828478?pr=65

mcp_proxy_for_aws/client.py

arangatang

Heya thank you for the great examples and the readme in this pass! Codewise I think we are pretty much good to go, but I have concerns about the naming. Due to trademark we shouldn't really have this as a seperate entity in the package. I provided some suggestions of how we could rephrase examples and READMES.

tldr: We can use MCP Proxy for AWS but MCP Client Library and similar would i believe require a new trademark, so to keep it simple lets rephrase.

examples/mcp-client/agent-framework/main.py

README.md

examples/mcp-client/strands/main.py

examples/mcp-client/strands/README.md

examples/mcp-client/llamaindex/main.py

examples/mcp-client/langchain/main.py

wzxxing · 2025-11-05T12:58:04Z

Hi Dennis, I forgot to point you to the contributing guide. https://github.com/aws/mcp-proxy-for-aws/blob/main/CONTRIBUTING.md

You need to run uv run pre-commit run --all-files to format all the files.

I see the CI failed because uv.lock file was deleted.

uv.lock

DennisTraub · 2025-11-05T13:01:13Z

There are some issues found by the CI: https://github.com/aws/mcp-proxy-for-aws/actions/runs/19081826894/job/54560828478?pr=65

Should be fixed

arangatang

Some more changes:

Add license header to examples
Fix mcp-proxy-for-aws reference in examples.

examples/mcp-client/agent-framework/main.py

examples/mcp-client/langchain/main.py

examples/mcp-client/llamaindex/main.py

examples/mcp-client/strands/main.py

examples/mcp-client/langchain/pyproject.toml

examples/mcp-client/llamaindex/pyproject.toml

examples/mcp-client/strands/pyproject.toml

wzxxing · 2025-11-05T15:53:43Z

tests/unit/examples/README.md

@@ -0,0 +1,58 @@
+# MCP Client Example Tests


We probably don't need README in unit tests.

Yeah, I guess I can remove it.

wzxxing · 2025-11-05T15:56:23Z

tests/unit/examples/test_mcp_client_examples.py

+
+
+@pytest.mark.unit
+class TestMcpClientExamples:


I think these should be covered by pyright, if the example code can be validated by pyright, we don't need to do these unit tests.

I was the one who asked to add these. Imo lets leave them for now, we can pivot later?

Yeah, we can. but CI failed: https://github.com/aws/mcp-proxy-for-aws/actions/runs/19107321050/job/54594703458?pr=65

Co-authored-by: wzxxing <169175349+wzxxing@users.noreply.github.com> Signed-off-by: Dennis Traub <dennis.traub@gmail.com>

Co-authored-by: Leonardo Araneda Freccero <arangatang@users.noreply.github.com> Signed-off-by: Dennis Traub <dennis.traub@gmail.com>

mcp_proxy_for_aws/client.py

.github/workflows/python.yml

Signed-off-by: Dennis Traub <dennis.traub@gmail.com>

wzxxing reviewed Nov 3, 2025

View reviewed changes

DennisTraub force-pushed the feature/aws-iam-mcp-client branch from 789d63f to c4a7dd6 Compare November 4, 2025 15:56

DennisTraub marked this pull request as ready for review November 4, 2025 19:59

DennisTraub requested a review from a team as a code owner November 4, 2025 19:59

DennisTraub requested review from acmlau and kyoncal November 4, 2025 19:59

DennisTraub force-pushed the feature/aws-iam-mcp-client branch from 0820cf8 to 63091f7 Compare November 4, 2025 20:24

wzxxing reviewed Nov 5, 2025

View reviewed changes

mcp_proxy_for_aws/client.py Outdated Show resolved Hide resolved

mcp_proxy_for_aws/client.py Outdated Show resolved Hide resolved

wzxxing reviewed Nov 5, 2025

View reviewed changes

mcp_proxy_for_aws/client.py Outdated Show resolved Hide resolved

arangatang reviewed Nov 5, 2025

View reviewed changes

wzxxing reviewed Nov 5, 2025

View reviewed changes

uv.lock Outdated Show resolved Hide resolved

DennisTraub force-pushed the feature/aws-iam-mcp-client branch from 16416bd to 0bcf608 Compare November 5, 2025 13:03

arangatang reviewed Nov 5, 2025

View reviewed changes

DennisTraub force-pushed the feature/aws-iam-mcp-client branch from 0bcf608 to a9dd648 Compare November 5, 2025 15:27

wzxxing reviewed Nov 5, 2025

View reviewed changes

DennisTraub and others added 11 commits November 5, 2025 17:14

Add client

9c07337

Add client tests

1020886

Add usage examples for MCP client

cd7ab5f

Update README

2cad69b

lint/format

549af1c

Apply suggestions from code review

3e86f6a

Co-authored-by: wzxxing <169175349+wzxxing@users.noreply.github.com> Signed-off-by: Dennis Traub <dennis.traub@gmail.com>

Simplify aws_iam_mcp_client by returning streamablehttp_client directly

6974fcf

Simplify examples

0884f80

Add example .env files

52666c3

Apply suggestions from arangatang's code review

430e841

Co-authored-by: Leonardo Araneda Freccero <arangatang@users.noreply.github.com> Signed-off-by: Dennis Traub <dennis.traub@gmail.com>

Apply further suggestions from review

41a045a

DennisTraub and others added 6 commits November 5, 2025 17:16

Fix linting issues

a2a0c4c

Add unit tests for client usage examples

e97a47c

Add license headers to examples

7148cac

Apply suggestions from code review

6e82e27

Co-authored-by: Leonardo Araneda Freccero <arangatang@users.noreply.github.com> Signed-off-by: Dennis Traub <dennis.traub@gmail.com>

chore: use uv workspaces for the examples

8ad2f2e

Fix pyright errors

be56338

DennisTraub force-pushed the feature/aws-iam-mcp-client branch from 2a05470 to be56338 Compare November 5, 2025 17:16

DennisTraub added 2 commits November 5, 2025 18:32

Rename to aws_iam_streamablehttp_client

8fea586

Update github workflow to build workspace

4a8c217

wzxxing approved these changes Nov 5, 2025

View reviewed changes

mcp_proxy_for_aws/client.py Outdated Show resolved Hide resolved

wzxxing requested changes Nov 5, 2025

View reviewed changes

.github/workflows/python.yml Outdated Show resolved Hide resolved

Add frozen flag in GH workflow

82385bb

Signed-off-by: Dennis Traub <dennis.traub@gmail.com>

DennisTraub force-pushed the feature/aws-iam-mcp-client branch from b67a57f to 82385bb Compare November 5, 2025 20:42

Add return type to client signature

0931e1d

DennisTraub requested a review from wzxxing November 5, 2025 20:58

Update docstring

699003c

wzxxing approved these changes Nov 5, 2025

View reviewed changes

wzxxing enabled auto-merge (squash) November 5, 2025 22:40



		@pytest.mark.unit
		class TestMcpClientExamples:

AWS IAM MCP client with SigV4 auth #65

Are you sure you want to change the base?

AWS IAM MCP client with SigV4 auth #65

Conversation

DennisTraub commented Oct 30, 2025

Uh oh!

wzxxing left a comment

Choose a reason for hiding this comment

Uh oh!

wzxxing Nov 3, 2025

Choose a reason for hiding this comment

Uh oh!

DennisTraub Nov 4, 2025

Choose a reason for hiding this comment

Uh oh!

DennisTraub commented Nov 4, 2025

Uh oh!

Uh oh!

Uh oh!

wzxxing commented Nov 5, 2025

Uh oh!

Uh oh!

arangatang left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wzxxing commented Nov 5, 2025

Uh oh!

Uh oh!

DennisTraub commented Nov 5, 2025

Uh oh!

arangatang left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wzxxing Nov 5, 2025

Choose a reason for hiding this comment

Uh oh!

DennisTraub Nov 5, 2025

Choose a reason for hiding this comment

Uh oh!

wzxxing Nov 5, 2025

Choose a reason for hiding this comment

Uh oh!

arangatang Nov 5, 2025

Choose a reason for hiding this comment

Uh oh!

wzxxing Nov 5, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants