AWS amazonq medium security documentation change

Service: amazonq · 2025-09-19 · Security-related medium

File: amazonq/latest/qdeveloper-ug/command-line-mcp-config-CLI.md

Summary

Added documentation for remote MCP servers with OAuth authentication flow and configuration details

Security assessment

The change introduces documentation for OAuth authentication flows and mentions servers with/without authentication requirements. This directly relates to security controls for remote service access. The explicit guidance around authentication requirements and authorization flows constitutes security documentation.

Diff

diff --git a/amazonq/latest/qdeveloper-ug/command-line-mcp-config-CLI.md b/amazonq/latest/qdeveloper-ug/command-line-mcp-config-CLI.md
index 45e7c0c61..ae016865c 100644
--- a//amazonq/latest/qdeveloper-ug/command-line-mcp-config-CLI.md
+++ b//amazonq/latest/qdeveloper-ug/command-line-mcp-config-CLI.md
@@ -5 +5 @@
-Configuration commands
+Configuration commandsRemote MCP servers
@@ -23,0 +24,41 @@ MCP configuration commands Command | Description
+## Remote MCP servers
+
+In addition to local MCP servers that run as processes, Amazon Q Developer CLI supports remote MCP servers that communicate over HTTP. Remote servers can use OAuth authentication or be open (no authentication required).
+
+### Configuration
+
+Remote MCP servers are configured in your agent configuration file using the `type` and `url` fields:
+    
+    
+    {
+      "mcpServers": {
+        "find-a-domain": {
+          "type": "http",
+          "url": "https://api.findadomain.dev/mcp"
+        }
+      }
+    }
+
+### OAuth authentication flow
+
+When using remote MCP servers that require OAuth authentication:
+
+  1. Start your Q CLI session with an agent that includes the remote MCP server
+
+  2. The server will initially show as "not yet loaded"
+
+  3. Use the `/mcp` command to begin authentication
+
+  4. Q CLI will indicate that the server requires authentication and provide a URL
+
+  5. Open the provided URL in your browser while keeping the Q CLI session open
+
+  6. Follow the authentication instructions in your browser
+
+  7. Return to the Q CLI window - you will be signed into the MCP server if authentication was successful
+
+
+
+
+The server's tools will become available once authentication is complete.
+