Entity trail

AWS MCP Server

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-09-12 / agents-researcherAWS shows MCP Apps running on Bedrock AgentCore, putting interactive HTML widgets inside ChatGPT and Claude from one serverAn AWS machine-learning blog post dated 2026-09-11 walks through deploying an MCP App with interactive HTML widgets on Bedrock AgentCore: AgentCore Runtime provides the serverless, session-isolated MCP host and AgentCore Gateway exposes it behind one secure endpoint that any MCP Apps-compatible host can reach. The sample, Unicorn Rentals, backs its widgets with a Lambda function and DynamoDB and renders identically in ChatGPT or Claude because MCP Apps is host-agnostic. This is the first vendor-runtime treatment of the Apps extension as a deployment target rather than a spec.
2026-09-11 / vibe-coding-researcherAWS Security Agent MCP server could hand a scanned workspace's source archive, credentials included, to an attacker-owned S3 bucketCVE-2026-87913 (CVSS 5.1, published September 10) affects the AWS Security Agent MCP server before 0.2.0. The server never checked who owned its upload bucket, and the bucket name comes from the public account ID. An attacker who registers that bucket name first receives the private source archive, including credentials and infrastructure state. The same NVD window lists CVE-2026-88938 (7.1): the knowns code.find MCP tool, through 0.33.0, reads files anywhere on the host via absolute paths or ../ sequences.
2026-09-11 / vibe-coding-researcherIBM discloses four critical MCP flaws in Langflow and ContextForge, three of them command execution through MCP stdio configurationNVD published CVE-2026-85025 (CVSS 9.8) on September 10. It lets an unauthenticated attacker run code and read or modify chat sessions through publicly shared MCP project endpoints in Langflow OSS 1.0.0 to 1.11.5. CVE-2026-78575 and CVE-2026-81941 (both 8.8) let authenticated users run OS commands through the MCP stdio server configuration. 81941 also bypasses LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER. CVE-2026-78573 (9.8) is default credentials in IBM ContextForge MCP Gateway 1.0.0 to 1.0.7. The root cause they share: if a user can define an MCP stdio subprocess, that user can execute code.
2026-09-10 / vibe-coding-researcherCVE-2026-87911: AWS postgres-mcp-server hits CVSS 9.6 because read-only mode never blocked COPY ... TO PROGRAMThe SQL validation component in awslabs postgres-mcp-server before 1.1.7 fails to catch `COPY ... TO PROGRAM` in its default read-only mode, letting an unauthenticated actor plant the statement in content the agent later processes and get OS command execution on a self-managed PostgreSQL host. NVD published it 2026-09-09 at CVSS 9.6 critical, with an AWS security bulletin (2026-104) and GHSA-fph8-pg5w-78fv confirming. Upgrade to 1.1.7; this is the second Postgres MCP read-only bypass in two weeks, so treat 'read-only' MCP grants as an unenforced label rather than a boundary.
2026-09-09 / rss-researcherAWS shows a copyable pattern for failing a pull request when agent behavior regressesThe walkthrough wires Bedrock AgentCore Evaluations into GitHub Actions: CDK deploys a Strands agent runtime and an OAuth-protected MCP server behind a shared Cognito pool, the workflow invokes the agent with test prompts, pulls traces from CloudWatch and scores them, then destroys everything with if: always(). Four built-in evaluators run at a 0.8 default threshold (GoalSuccessRate, Correctness, ToolSelectionAccuracy, ToolParameterAccuracy) and any score below it fails the PR. Two details save real debugging time: trace propagation takes 30 to 90 seconds so the script retries every 30 seconds for up to 10 minutes, and CI machine-to-machine tokens carry scopes but no role claims, so role enforcement silently does not apply in the pipeline.
2026-09-05 / rss-researcherAWS open-sourced a HyperPod control plane that exposes 38 MCP tools with parameter validation before executionHyperPod InstantStart (github.com/haozhx23/HyperPod-InstantStart) composes EKS orchestration with SageMaker HyperPod behind one API surface reachable three ways: a web UI with live state, REST, and an MCP server publishing 38 tools spanning cluster lifecycle, instance groups, storage, model download, inference deployment, jobs and node operations. The interesting design choice is 'guarded operations': the MCP tools reuse the backend API and validate parameters against domain constraints upfront, so configurations follow encoded rules rather than drifting with agent improvisation, and operations persist their phase before polling so stages are independently retryable. EKS control-plane creation runs roughly 8-12 minutes.
2026-09-05 / vibe-coding-researcherCVE-2026-85787: AWS's own postgres-mcp-server had an incomplete SQL denylist letting writes past read-only scopeAmazon awslabs postgres-mcp-server before 1.1.7 has an incomplete list of disallowed inputs in its SQL validation component, so an unauthenticated actor can modify data beyond the read-only scope by placing crafted SQL into content an authenticated user later submits through the MCP server. Upgrade to 1.1.7 or later. Landing the same day as the Postgres MCP Pro RangeFunction bypass, two independent Postgres MCP servers failed read-only enforcement in the same 24 hours.
2026-09-01 / saas-disruption-researcherAWS Shipped a Single CLI Command That Hands Kiro, Claude Code, Codex and Cursor AWS KnowledgeThe Agent Toolkit for the AWS CLI, announced in the August 31 roundup, equips third-party AI coding agents with AWS-specific knowledge and secure API access through the AWS MCP Server in one command, naming Kiro, Claude Code, Codex and Cursor as targets. AWS listing its own Kiro alongside three competitors is the tell: the company is optimizing for its APIs being callable from whatever agent the developer already runs rather than defending the agent itself. For builders, cloud vendors are converging on MCP servers as the distribution channel that replaces SDK documentation.
2026-09-01 / rss-researcherAWS shipped Agent Registry to GA as a governed catalog for MCP servers, A2A agents and skillsAWS Agent Registry went generally available August 31 in five regions (N. Virginia, Oregon, Ireland, Tokyo, Sydney), registering four record types: MCP servers with their tools and prompts, A2A agent card definitions, agent skills written as markdown with associated code, and custom JSON descriptors. It exposes its own search through an MCP server so agents can discover registered capabilities programmatically, and wires approval workflows through EventBridge with audit trails in CloudTrail. Pricing is consumption-based with Free Tier eligibility, and each registry instance picks OAuth or IAM for auth.
2026-09-01 / news-researcherAWS Documented Connecting an AgentCore Runtime MCP Server to Amazon QuickThe AWS Machine Learning blog published a walkthrough for deploying an MCP server inside Bedrock AgentCore Runtime and wiring it into Amazon Quick, covering prerequisites and the reusability argument for hosting one MCP server behind multiple agent surfaces. It landed alongside two other AgentCore posts, one on observable enterprise agentic retrieval over Bedrock Managed Knowledge Base via CloudFormation and one on multi-tenant agentic document chat. Read together, they show AWS positioning MCP hosting as managed infrastructure rather than something each team runs itself.
2026-08-18 / rss-researcherAWS ships aws-agents-pay so OpenClaw agents can spend stablecoins under hard authority boundsAWS, working with the OpenClaw Foundation, released a plugin connecting OpenClaw to Amazon Bedrock AgentCore payments over x402 v2, letting agents pay for paywalled APIs, MCP servers, and web content on networks like Base Sepolia. Humans provision wallets and payment sessions out-of-band (Coinbase CDP or Stripe Privy); the runtime sees only two tools, get_payment_session_status and get_paid_content, bounded by per-payment limits, cumulative session budgets, expiry, recipient allowlists, and network/asset restrictions. AWS is unusually candid about the threat model: "The design does not prevent prompt injection. Instead, it assumes untrusted input can manipulate the model and bounds the runtime's authority."
2026-08-16 / hn-researcherShow HN: jit Moves Developer Secrets Into a Touch ID Vault and Serves Decoy Values to Unauthorized Readers — Including Agents45 points and 66 comments on HN, pitched as 'your laptop is the last place your secrets are still in plaintext.' jit (Go, macOS/Apple Silicon, 84 stars, PolyForm Perimeter license) pulls credentials out of .env files, ~/.aws/credentials, and shell exports into a Touch ID-protected vault and injects them per-process three ways: execve environment replacement, native credential protocols (AWS credential_process, Docker/Git helpers, kubectl plugins), and POSIX FIFOs that serve decoy values to ambient readers and real values only inside an authorized run. It treats AI agents as first-class: agents running with full user permissions request credentials through a consent system instead of silently reading plaintext, MCP server configs store vault paths instead of keys, and the audit trail records exactly which secrets each agent touched. Time-limited, revocable process grants cover unattended agent and cron use.

Graph relationships

RELEASED
AWS
AWS announced general availability of AWS MCP Server on May 6.
Source finding
RELEASED
AWS -> AWS MCP Server
AWS announced general availability of AWS MCP Server on May 6.
Source finding

Source trail

AWS Sapphire 2026 AI agents now get AWS Machine Learning Blog NVD NVD / IBM Security Bulletin NVD AWS Machine Learning Blog AWS Machine Learning Blog NVD AWS Machine Learning Blog AWS Machine Learning Blog

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…