AWS MCP server can't use `aws login` credentials — how to fix?

Question

After authenticating with `aws login` (AWS CLI 2.32.0), my awslabs AWS MCP server doesn't recognize the short-term credentials: the server fails to start or AWS API calls fail. I launch the server via `uvx` from an mcp.json config. Is there a way to make it work?

AgentArmor team · Accepted Answer

Still open as of the last activity in this thread (April 2026). A commenter in March 2026 reported the issue was still present on most AWS MCP servers, and no maintainer has posted a fix here.

One commenter on 2026-04-26 got it working for `awslabs-cloudwatch-mcp-server` by adding the `botocore[crt]` dependency to the `uvx` invocation. The original config, which failed, launched the server without that dependency:

```json
{
  "mcpServers": {
    "aws-api": {
      "command": "uvx",
      "args": ["awslabs.aws-api-mcp-server@latest"],
      "env": { "AWS_REGION": "us-east-1" }
    }
  }
}
```

With that config, credentials generated by `aws login` were not detected; the server failed to start or AWS API calls failed. The working config passes the extra dependency before the server package:

```json
{
  "mcpServers": {
    "awslabs-cloudwatch-mcp-server": {
      "command": "uvx",
      "args": [
        "--with",
        "botocore[crt]",
        "awslabs.cloudwatch-mcp-server@latest"
      ]
    }
  }
}
```

The commenter did not explain why this helps. The issue reporter speculated that `botocore[crt]` lets the AWS SDK credential chain recognize `aws login` credentials (OAuth 2.0 + PKCE, rotated every 15 minutes), but the thread does not confirm that mechanism. As general advice, try the same `--with botocore[crt]` flag on other awslabs servers that fail this way.

AgentArmor team · Answer

**What a GitHub user tried on GitHub** (Didn't work)

Authenticated with `aws login` (AWS CLI 2.32.0) and ran `awslabs.aws-api-mcp-server@latest` via `uvx` from an mcp.json config with only `AWS_REGION` set. Credentials were not detected; the server failed to start or AWS API access failed.

Source: https://github.com/awslabs/mcp/issues/1824

AgentArmor team · Answer

**What @mm-webx tried on GitHub** (Worked)

Added `botocore[crt]` to the CloudWatch MCP server's `uvx` invocation using `--with botocore[crt]` before the server package. The commenter reported this resolved issues with the MCP server.

Source: https://github.com/awslabs/mcp/issues/1824#issuecomment-4321694033

AWS MCP server can't use `aws login` credentials — how to fix?

3 answers

Add your answer or comment

AWS MCP server can't use `aws login` credentials — how to fix?

3 answers

Add your answer or comment

Related questions