AWS amazonq low security documentation change
Summary
Added documentation for MCP server loading behavior, tool permission levels (auto-approved/requires approval/dangerous), and prompt usage patterns. Updated configuration references and CLI command examples.
Security assessment
The change introduces documentation about dangerous tools requiring careful consideration and approval workflows. This directly relates to security controls for tool usage, though no specific vulnerability is mentioned. The classification of tools into permission levels demonstrates security-conscious design being documented.
Diff
diff --git a/amazonq/latest/qdeveloper-ug/command-line-mcp.md b/amazonq/latest/qdeveloper-ug/command-line-mcp.md index c33ad3df2..169ca074e 100644 --- a//amazonq/latest/qdeveloper-ug/command-line-mcp.md +++ b//amazonq/latest/qdeveloper-ug/command-line-mcp.md @@ -5 +5 @@ -Key benefitsMCP architectureCore MCP concepts +MCP server loadingTools and promptsKey benefitsMCP architectureCore MCP concepts @@ -15 +15,7 @@ The Model Context Protocol (MCP) is an open standard that enables AI assistants - * [MCP server loading](./command-line-mcp-server-loading.html) + * [MCP configuration in the CLI](./command-line-mcp-config-CLI.html) + + * MCP server loading + + * Tools and prompts + + * [MCP configuration for Q Developer in the IDE](./command-line-ide-configuration.html) @@ -23,3 +29 @@ The Model Context Protocol (MCP) is an open standard that enables AI assistants - * [MCP configuration](./command-line-mcp-configuration.html) - - * [MCP tools and prompts](./command-line-mcp-tools-prompts.html) + * [Understanding MCP configuration files](./command-line-mcp-understanding-config.html) @@ -31,0 +36,87 @@ The Model Context Protocol (MCP) is an open standard that enables AI assistants +## MCP server loading + +Amazon Q loads MCP servers in the background, allowing you to start interacting immediately without waiting for all servers to initialize. Tools become available progressively as their respective servers finish loading. + +### Checking server status + +You can use the `/tools` command to see which servers are still loading and which tools are already available. + +### Configuring server initialization + +You can customize the server initialization timeout using: + + + $ q settings mcp.initTimeout [value] + +Where `[value]` is the timeout in milliseconds. This setting controls how long Amazon Q will wait for servers to initialize before allowing you to start interacting. + +## Tools and prompts + +This section covers how to use MCP tools and prompts with Amazon Q Developer CLI. + +### Understanding MCP tools + +MCP tools are executable functions that MCP servers expose to Amazon Q Developer CLI. They enable Amazon Q Developer to perform actions, process data, and interact with external systems on your behalf. + +Each tool in MCP has: + + * **Name** : A unique identifier for the tool + + * **Description** : A human-readable description of what the tool does + + * **Input Schema** : A JSON Schema defining the parameters the tool accepts + + * **Annotations** : Optional hints about the tool's behavior and effects + + + + +### Discovering available tools + +To see what tools are available in your Q CLI session: + + + /tools + +This command displays all available tools, including both built-in tools and those provided by MCP servers. + +Tools can have different permission levels that determine how they're used: + + * **Auto-approved** : These tools can be used without explicit permission for each invocation + + * **Requires approval** : These tools need your explicit permission each time they're used + + * **Dangerous** : These tools are marked as potentially risky and require careful consideration before approval + + + + +### Using tools + +You can use MCP tools in two ways: + + 1. **Natural Language Requests** : Simply describe what you want to do, and Q will determine which tool to use. + + 2. **Direct Tool Invocation** : You can also explicitly request Q to use a specific tool. + + + + +### Working with prompts + +MCP servers can provide predefined prompts that help guide Q in specific tasks: + + * List available prompts: `/prompts` + + * Use a prompt: + + * `@ `prompt-name` arg1 arg2` + + + + +Example of using a prompt with arguments: + + + @fetch https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/command-line-mcp-configuration.html + @@ -74 +165 @@ MCP follows a client-server architecture where: - | Amazon Q Dev CLI | --> | MCP Client API | --> | MCP Server | + | Amazon Q Dev | --> | MCP Client API | --> | MCP Server | @@ -147 +238 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Security considerations +Contributing