@apono-io/mcp-aws 0.1.1

package/README.md

@@ -0,0 +1,16 @@
+# @apono-io/mcp-aws
+
+Apono MCP server for AWS with STS AssumeRole support.
+
+## Usage
+
+This server is launched automatically by the Apono CLI via `npx`. It reads the following environment variables:
+
+| Variable | Description |
+|---|---|
+| `AWS_ACCESS_KEY_ID` | Source IAM credentials — access key |
+| `AWS_SECRET_ACCESS_KEY` | Source IAM credentials — secret key |
+| `AWS_SESSION_TOKEN` | Source IAM credentials — session token |
+| `AWS_ROLE_ARN` | ARN of the role to assume via STS |
+
+It calls STS `AssumeRole`, then transparently proxies to the [awslabs AWS API MCP server](https://github.com/awslabs/mcp) using the assumed-role credentials.

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { run } from './run.js';
+run(process.env).catch((err) => {
+    process.stderr.write(`Unhandled error: ${String(err)}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/run.d.ts

@@ -0,0 +1,14 @@
+import { STSClient } from '@aws-sdk/client-sts';
+export interface AwsCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken: string;
+}
+export declare function validateEnv(env: NodeJS.ProcessEnv): {
+    credentials: AwsCredentials;
+    roleArn: string;
+    region: string;
+};
+export declare function assumeRole(sts: STSClient, roleArn: string): Promise<AwsCredentials>;
+export declare function run(env: NodeJS.ProcessEnv): Promise<void>;
+//# sourceMappingURL=run.d.ts.map

package/dist/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAqB,MAAM,qBAAqB,CAAC;AAUnE,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG;IACnD,WAAW,EAAE,cAAc,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB,CAgBA;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,cAAc,CAAC,CAgBzB;AAED,wBAAsB,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B/D"}

package/dist/run.js

@@ -0,0 +1,64 @@
+import { STSClient, AssumeRoleCommand } from '@aws-sdk/client-sts';
+import { spawn } from 'node:child_process';
+const REQUIRED_ENV = [
+    'AWS_ACCESS_KEY_ID',
+    'AWS_SECRET_ACCESS_KEY',
+    'AWS_SESSION_TOKEN',
+    'AWS_ROLE_ARN',
+];
+export function validateEnv(env) {
+    for (const key of REQUIRED_ENV) {
+        if (!env[key]) {
+            throw new Error(`Missing required environment variable: ${key}`);
+        }
+    }
+    return {
+        credentials: {
+            accessKeyId: env.AWS_ACCESS_KEY_ID,
+            secretAccessKey: env.AWS_SECRET_ACCESS_KEY,
+            sessionToken: env.AWS_SESSION_TOKEN,
+        },
+        roleArn: env.AWS_ROLE_ARN,
+        region: env.AWS_REGION ?? env.AWS_DEFAULT_REGION ?? 'us-east-1',
+    };
+}
+export async function assumeRole(sts, roleArn) {
+    const response = await sts.send(new AssumeRoleCommand({
+        RoleArn: roleArn,
+        RoleSessionName: `apono-mcp-aws-${Date.now()}`,
+    }));
+    const c = response.Credentials;
+    if (!c?.AccessKeyId || !c?.SecretAccessKey || !c?.SessionToken) {
+        throw new Error('STS response missing credentials fields');
+    }
+    return {
+        accessKeyId: c.AccessKeyId,
+        secretAccessKey: c.SecretAccessKey,
+        sessionToken: c.SessionToken,
+    };
+}
+export async function run(env) {
+    const { credentials, roleArn, region } = validateEnv(env);
+    const sts = new STSClient({ credentials, region });
+    const assumed = await assumeRole(sts, roleArn);
+    const child = spawn('uvx', ['awslabs.aws-api-mcp-server'], {
+        env: {
+            ...env,
+            AWS_ACCESS_KEY_ID: assumed.accessKeyId,
+            AWS_SECRET_ACCESS_KEY: assumed.secretAccessKey,
+            AWS_SESSION_TOKEN: assumed.sessionToken,
+        },
+        stdio: 'inherit',
+    });
+    for (const signal of ['SIGINT', 'SIGTERM']) {
+        process.on(signal, () => child.kill(signal));
+    }
+    child.on('exit', (code) => {
+        process.exit(code ?? 1);
+    });
+    child.on('error', (err) => {
+        process.stderr.write(`Error: Failed to spawn child process: ${String(err)}\n`);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=run.js.map

package/dist/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,MAAM,YAAY,GAAG;IACnB,mBAAmB;IACnB,uBAAuB;IACvB,mBAAmB;IACnB,cAAc;CACN,CAAC;AAQX,MAAM,UAAU,WAAW,CAAC,GAAsB;IAKhD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,OAAO;QACL,WAAW,EAAE;YACX,WAAW,EAAE,GAAG,CAAC,iBAAkB;YACnC,eAAe,EAAE,GAAG,CAAC,qBAAsB;YAC3C,YAAY,EAAE,GAAG,CAAC,iBAAkB;SACrC;QACD,OAAO,EAAE,GAAG,CAAC,YAAa;QAC1B,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,kBAAkB,IAAI,WAAW;KAChE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAc,EACd,OAAe;IAEf,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAC7B,IAAI,iBAAiB,CAAC;QACpB,OAAO,EAAE,OAAO;QAChB,eAAe,EAAE,iBAAiB,IAAI,CAAC,GAAG,EAAE,EAAE;KAC/C,CAAC,CACH,CAAC;IACF,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC;IAC/B,IAAI,CAAC,CAAC,EAAE,WAAW,IAAI,CAAC,CAAC,EAAE,eAAe,IAAI,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,YAAY,EAAE,CAAC,CAAC,YAAY;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,GAAsB;IAC9C,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAE1D,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAE/C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,4BAA4B,CAAC,EAAE;QACzD,GAAG,EAAE;YACH,GAAG,GAAG;YACN,iBAAiB,EAAE,OAAO,CAAC,WAAW;YACtC,qBAAqB,EAAE,OAAO,CAAC,eAAe;YAC9C,iBAAiB,EAAE,OAAO,CAAC,YAAY;SACxC;QACD,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IAEH,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAU,EAAE,CAAC;QACpD,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAmB,EAAE,EAAE;QACvC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@apono-io/mcp-aws",
+  "version": "0.1.1",
+  "description": "Apono MCP server for AWS with STS AssumeRole support",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "apono-mcp-aws": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "test": "vitest run",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@aws-sdk/client-sts": "^3.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.7.0",
+    "vitest": "^3.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "author": "Apono",
+  "license": "ISC"
+}