Documentation
Parity with upstream
How the aws-mcp-proxy CLI maps to aws/mcp-proxy-for-aws, flag by flag.
This project targets parity+ with aws/mcp-proxy-for-aws: match the upstream CLI where practical, then add features on top. The table below maps every upstream flag to its status here.
Supported matches upstreamAdded here beyond upstreamPlanned not yet implemented
CLI flags
| Upstream flag | Value | Status | Notes |
|---|---|---|---|
endpoint | URL | Supported | Required positional SigV4 MCP endpoint URL. |
--service | string | Supported | Inferred from the endpoint host when omitted. |
--profile | string | Supported | Repeatable; first is the default. Also reads AWS_MCP_PROXY_PROFILES / AWS_PROFILE. |
--region | string | Supported | Inferred from the endpoint or AWS_REGION when omitted. |
--metadata | key=value | Supported | Repeatable; injected into MCP requests. |
--read-only | flag | Supported | Disables tools that don’t advertise readOnlyHint=true. |
--retries | int | Supported | Default differs — see behavior differences. |
--log-level | enum | Supported | DEBUG / INFO / WARNING / ERROR / CRITICAL. |
--timeout | seconds | Supported | Total operation timeout. |
--connect-timeout | seconds | Supported | Connection timeout. |
--read-timeout | seconds | Supported | Read timeout. |
--write-timeout | seconds | Supported | Write timeout. |
--tool-timeout | seconds | Supported | Max seconds a tool call may run before cancellation. |
--skip-auth | flag | Supported | Send unsigned requests when credentials are unavailable. |
--disable-telemetry | flag | Supported | Disable telemetry in outbound user-agent data. |
--ca-bundle | path | Added here | Not in upstream. Trust an extra PEM bundle for TLS-intercepting corporate proxies without installing roots globally. Reads AWS_CA_BUNDLE. |
--help and --version are available on both.
Behavior differences
Where this proxy diverges from upstream, it leans toward resilience and convenience — the “+” in parity+:
- Retries default to 3, not 0. Upstream disables retries by default; this proxy retries transient upstream failures out of the box (pass
--retries 0to disable). - Service and region are inferred from the endpoint. The host is parsed to derive the SigV4 service and region — including
*.api.awsandbedrock-agentcoreforms — so--serviceand--regionare usually optional. - A managed CA bundle option.
--ca-bundle(orAWS_CA_BUNDLE) trusts an extra PEM bundle on top of the system roots, for corporate TLS interception, without modifying the machine’s global trust store.
This table reflects the upstream CLI as documented in aws/mcp-proxy-for-aws. Upstream remains canonical for flag semantics and signing behavior — when in doubt, defer to it.