AWS quick documentation change
Summary
Updated MCP integration documentation with more detailed technical explanation, removed 'Popular MCP servers' section, restructured authentication flow details, added security implementation specifics (PKCE, RFC 8707), updated subscription requirements to Enterprise, and expanded limitations section.
Security assessment
The changes add detailed documentation about security features including PKCE with S256 challenge method and Resource Indicators (RFC 8707) for token binding, OAuth 2.0 Protected Resource Metadata (RFC 9728) discovery, and Dynamic Client Registration. However, there is no evidence this addresses a specific security vulnerability or incident - it appears to be routine documentation enhancement of existing security features.
Diff
diff --git a/quick/latest/userguide/mcp-integration.md b/quick/latest/userguide/mcp-integration.md index 461571a15..5d15b1d5f 100644 --- a//quick/latest/userguide/mcp-integration.md +++ b//quick/latest/userguide/mcp-integration.md @@ -5 +5 @@ -What you can doBefore you beginPopular MCP serversPrepare MCP server setup and authenticationSet up MCP integrationManage knowledge basesReview integrationManage MCP integrationsLimitations +What you can doBefore you beginPrepare MCP server setup and authenticationSet up MCP integrationReview integrationManage MCP integrationsLimitations @@ -9 +9,3 @@ What you can doBefore you beginPopular MCP serversPrepare MCP server setup and a -With Model Context Protocol (MCP) integration in Amazon Quick, you can connect to MCP servers for both task execution and data access capabilities. MCP provides a standardized way to connect AI systems with external tools and data sources. +Model Context Protocol (MCP) is an open standard that defines how AI applications communicate with external tools and data sources. MCP uses a client-server architecture. AI applications act as clients that connect to MCP servers. Each MCP server exposes a set of tools. These tools are structured operations that the AI application can invoke to perform tasks, such as querying databases, calling APIs, or interacting with third-party services. + +With MCP integration in Amazon Quick, you can connect to remote MCP servers so that your AI assistant can use the tools that those servers provide. For example, you can connect to an MCP server that provides access to your project management system. This connection allows the assistant to create tickets, look up issues, or update statuses as part of a conversation. Because MCP is an open standard, you can connect to any compatible server without building custom integrations for each tool. @@ -13 +15 @@ With Model Context Protocol (MCP) integration in Amazon Quick, you can connect t -With MCP integration, you can connect to MCP servers for both action execution and data access through standardized protocols. +MCP integration registers MCP server tools as actions in Amazon Quick. @@ -18,6 +20 @@ With MCP integration, you can connect to MCP servers for both action execution a -Connect to MCP servers to perform actions and execute tasks through standardized MCP protocols. - -**Data access integration** - - -Access data sources through MCP servers to create knowledge bases and retrieve information. +Each tool that is exposed by an MCP server is registered as an action that your AI assistant can invoke during conversations. The integration secures these connections by using Proof Key for Code Exchange (PKCE) with the S256 challenge method and Resource Indicators (RFC 8707) to bind access tokens to specific MCP servers. @@ -27,9 +24 @@ Access data sources through MCP servers to create knowledge bases and retrieve i -Before you set up MCP integration, make sure you have the following: - - * MCP server endpoint with appropriate access. - - * Authentication credentials for the MCP server. - - * Amazon Quick Author or higher for action connectors. - - * Amazon Quick Professional subscription +Before you set up MCP integration, make sure that you have the following: @@ -36,0 +26 @@ Before you set up MCP integration, make sure you have the following: + * An MCP server endpoint with appropriate access. @@ -37,0 +28 @@ Before you set up MCP integration, make sure you have the following: + * Authentication credentials for the MCP server, if required. For more information, see Prepare MCP server setup and authentication. @@ -38,0 +30 @@ Before you set up MCP integration, make sure you have the following: + * An Amazon Quick Enterprise subscription. @@ -40,7 +31,0 @@ Before you set up MCP integration, make sure you have the following: -###### Note - -MCP integration supports remote servers only. HTTP streaming is preferred over Server-Sent Events (SSE). Local stdio connections are not supported. VPC connectivity is not supported. - -## Popular MCP servers - -The following are examples of popular MCP servers being used with Amazon Quick and the remote MCP server URLs: @@ -48 +32,0 @@ The following are examples of popular MCP servers being used with Amazon Quick a -: @@ -50,17 +33,0 @@ The following are examples of popular MCP servers being used with Amazon Quick a -Popular MCP servers Provider | MCP Server URL ----|--- -Asana | `https://mcp.asana.com/sse` -Atlassian | `https://mcp.atlassian.com/v1/sse` -AWS Knowledge MCP Server | [https://knowledge-mcp.global.api.aws](https://knowledge-mcp.global.api.aws) -Box | `http://mcp.box.com/` -HubSpot | `https://mcp.hubspot.com` -HuggingFace | `https://huggingface.co/mcp` -Intercom | `https://mcp.intercom.com/mcp` -Linear | `https://mcp.linear.app/mcp` -Monday | `https://mcp.monday.com/sse` -Notion | `https://mcp.notion.com/mcp` -PagerDuty | `https://identity.pagerduty.com/global/oauth/anonymous/.well-known/openid-configuration` -Workato | `https://`MCP_ID`.apim.mcp.workato.com` -Zapier | [https://mcp.zapier.com/MCP_ID](https://mcp.zapier.com/\(unique) - -The proceeding table shows just some of the many MCPs supported for use with Amazon Quick. @@ -70 +37 @@ The proceeding table shows just some of the many MCPs supported for use with Ama -These servers require appropriate authentication credentials. Refer to each provider's documentation for specific authentication requirements. +MCP integration supports remote servers only. HTTP streaming is preferred over Server-Sent Events (SSE). Local stdio connections and VPC connectivity are not supported. @@ -74,3 +41 @@ These servers require appropriate authentication credentials. Refer to each prov -Before setting up the integration in Amazon Quick, prepare your MCP server configuration and authentication credentials. MCP integration supports multiple authentication methods and configuration approaches. Choose the method that matches your MCP server requirements: - -**User authentication (OAuth)** +When you connect to an MCP server, Amazon Quick uses OAuth 2.0 Protected Resource Metadata (RFC 9728) to automatically discover authorization server information. The client sends an initial unauthenticated request to the MCP server. If the server responds with a 401 status that contains a `WWW-Authenticate` header with a `resource_metadata` URL, then Amazon Quick uses that URL to fetch the metadata document. If the header is not present, Amazon Quick falls back to the well-known URI at the server root. @@ -77,0 +43 @@ Before setting up the integration in Amazon Quick, prepare your MCP server confi +If the authorization server supports Dynamic Client Registration (DCR), Amazon Quick automatically registers itself by using the discovered `registration_endpoint` from the authorization server metadata. No manual credential configuration is required. Both confidential and public client flows are supported. DCR applies regardless of the authentication method that you choose. @@ -79 +45 @@ Before setting up the integration in Amazon Quick, prepare your MCP server confi -MCP servers support two configuration approaches for OAuth authentication: +If the authorization server does not support DCR, you must manually provide credentials. Choose the authentication method that matches your MCP server requirements. @@ -81 +47 @@ MCP servers support two configuration approaches for OAuth authentication: -**Dynamic Client Registration (DCR)** +**User authentication (OAuth)** @@ -84 +50 @@ MCP servers support two configuration approaches for OAuth authentication: -When your MCP server advertises Dynamic Client Registration support, no manual configuration is required. The MCP client automatically registers itself with the server and receives the necessary credentials during the connection process. This streamlined approach eliminates the need to manually gather client IDs, secrets, and endpoint URLs. +Gather the following information from your MCP server configuration: @@ -86 +52 @@ When your MCP server advertises Dynamic Client Registration support, no manual c -**Manual configuration** + * **Client ID** – The OAuth client ID. @@ -87,0 +54 @@ When your MCP server advertises Dynamic Client Registration support, no manual c + * **Client Secret** – The OAuth client secret. @@ -89 +56 @@ When your MCP server advertises Dynamic Client Registration support, no manual c -For MCP servers that don't support DCR, gather the following information from your MCP server configuration: + * **Token URL** – The OAuth token endpoint. @@ -91 +58 @@ For MCP servers that don't support DCR, gather the following information from yo - * **Client ID** \- OAuth client ID. + * **Authorization URL** – The OAuth authorization endpoint. @@ -93 +60 @@ For MCP servers that don't support DCR, gather the following information from yo - * **Client Secret** \- OAuth client secret. + * **Redirect URL** – The OAuth redirect URI. @@ -95 +61,0 @@ For MCP servers that don't support DCR, gather the following information from yo - * **Token URL** \- OAuth token endpoint. @@ -97 +62,0 @@ For MCP servers that don't support DCR, gather the following information from yo - * **Auth URL** \- OAuth authorization endpoint. @@ -99 +63,0 @@ For MCP servers that don't support DCR, gather the following information from yo - * **Redirect URL** \- OAuth redirect URI. @@ -100,0 +65 @@ For MCP servers that don't support DCR, gather the following information from yo +**Service authentication (Service-to-Service)** @@ -102,0 +68 @@ For MCP servers that don't support DCR, gather the following information from yo +Gather the following information from your MCP server configuration: @@ -104 +70 @@ For MCP servers that don't support DCR, gather the following information from yo -**Service authentication (Service-to-Service)** + * **Client ID** – The service client ID. @@ -105,0 +72 @@ For MCP servers that don't support DCR, gather the following information from yo + * **Client Secret** – The service client secret. @@ -107 +74 @@ For MCP servers that don't support DCR, gather the following information from yo -Gather the following information from your MCP server configuration: + * **Token URL** – The service token endpoint. @@ -109 +75,0 @@ Gather the following information from your MCP server configuration: - * **Client ID** \- Service client ID. @@ -111 +76,0 @@ Gather the following information from your MCP server configuration: - * **Client Secret** \- Service client secret. @@ -113 +77,0 @@ Gather the following information from your MCP server configuration: - * **Token URL** \- Service token endpoint. @@ -114,0 +79 @@ Gather the following information from your MCP server configuration: +**No authentication** @@ -116,0 +82 @@ Gather the following information from your MCP server configuration: +If the MCP server does not require authentication, no credentials are needed. Select this option for MCP servers that allow unauthenticated access. @@ -120 +86 @@ Gather the following information from your MCP server configuration: -After preparing your MCP server configuration and authentication credentials, follow these steps to create your MCP integration: +After you prepare your MCP server configuration and authentication credentials, create your MCP integration. @@ -124 +90 @@ After preparing your MCP server configuration and authentication credentials, fo - 2. Click **Add** (plus "+" button). + 2. Choose **Add**. @@ -126 +92 @@ After preparing your MCP server configuration and authentication credentials, fo - 3. On the Create Integration page, enter integration details: + 3. On the **Create Integration** page, enter the integration details: @@ -128 +94 @@ After preparing your MCP server configuration and authentication credentials, fo - * **Name** \- Descriptive name for your MCP integration. + * **Name** – A descriptive name for your MCP integration. @@ -130 +96 @@ After preparing your MCP server configuration and authentication credentials, fo - * **Description** (Optional) - Purpose of the integration. + * **Description** (Optional) – The purpose of the integration. @@ -132 +98 @@ After preparing your MCP server configuration and authentication credentials, fo - * **MCP server endpoint** \- URL of the MCP server. + * **MCP server endpoint** – The URL of the MCP server. @@ -134 +100 @@ After preparing your MCP server configuration and authentication credentials, fo - 4. Click **Next**. + 4. Choose **Next**. @@ -136 +102 @@ After preparing your MCP server configuration and authentication credentials, fo - 5. Select the authentication method (user or service). + 5. Select the authentication method (user, service, or no authentication). @@ -140 +106 @@ After preparing your MCP server configuration and authentication credentials, fo - 7. Select **Create and continue**. + 7. Choose **Create and continue**. @@ -144 +110 @@ After preparing your MCP server configuration and authentication credentials, fo - 9. Select **Next**. + 9. Choose **Next**. @@ -151,37 +117 @@ After preparing your MCP server configuration and authentication credentials, fo -After creating your MCP integration, a knowledge base is automatically created on completion of integration creation. - -## Manage knowledge bases - -After setting up your MCP integration, you can create and manage knowledge bases from your MCP data sources. - -### Edit existing knowledge bases - -You can modify your existing MCP knowledge bases: - - 1. In the Amazon Quick console, choose **Knowledge bases**. - - 2. Select your MCP knowledge base from the list. - - 3. Choose **Actions** , then choose **Edit knowledge base**. - - 4. Update your configuration settings as needed and choose **Save**. - - - - -### Create additional knowledge bases - -You can create multiple knowledge bases from the same MCP integration: - - 1. In the Amazon Quick console, choose **Integrations**. - - 2. Choose your existing MCP integration from the list. - - 3. Choose **Actions** , then choose **Create knowledge base**. - - 4. Configure your knowledge base settings and choose **Create**. - - - - -For detailed information about knowledge base configuration options, see [Common configuration settings](./knowledge-base-integrations.html#common-configuration-settings). +After you create your MCP integration, the available tools are discovered and registered as actions. @@ -195 +125 @@ After you configure authentication, review the MCP integration capabilities: - 2. Review the list of available actions and tasks provided by the MCP server.