From 3d23a4024b63a8f68464945c837fc0dbbe8b64f4 Mon Sep 17 00:00:00 2001 From: mashagua <993498039@qq.com> Date: Sun, 25 Oct 2026 17:57:48 +0800 Subject: [PATCH 1/3] feat(registry): add AWS MCP service --- entries/aws-mcp/catalog-metadata.v1.json | 118 +++++++++++++++++++++++ entries/aws-mcp/install.md | 49 ++++++++++ entries/aws-mcp/manifest.json | 59 ++++++++++++ entries/aws-mcp/review.md | 64 ++++++++++++ entries/aws-mcp/usage.md | 72 ++++++++++++++ manifest.json | 4 +- scripts/catalog/validator.test.mjs | 4 +- 7 files changed, 366 insertions(+), 4 deletions(-) create mode 100644 entries/aws-mcp/catalog-metadata.v1.json create mode 100644 entries/aws-mcp/install.md create mode 100644 entries/aws-mcp/manifest.json create mode 100644 entries/aws-mcp/review.md create mode 100644 entries/aws-mcp/usage.md diff --git a/entries/aws-mcp/catalog-metadata.v1.json b/entries/aws-mcp/catalog-metadata.v1.json new file mode 100644 index 0000000..e6ec6b2 --- /dev/null +++ b/entries/aws-mcp/catalog-metadata.v1.json @@ -0,0 +1,118 @@ +{ + "$schema": "../../schemas/catalog-metadata.v1.schema.json", + "schemaVersion": 1, + "identity": { + "kind": "service", + "id": "aws-mcp" + }, + "presentation": { + "defaultLocale": "zh-CN", + "i18n": { + "zh-CN": { + "name": "AWS MCP", + "summary": "AWS 托管 MCP 服务的本地代理入口：固定代理 1.7.0，需 Python 3.10–3.14、uv/uvx 与自行配置的 AWS 凭据和 IAM 权限；默认只读，云资源费用另计。", + "description": "通过 AWS 官方 MCP Proxy 的本地 stdio 进程连接 AWS 托管 MCP 服务，远端使用 HTTPS 与 SigV4。条目的 1.7.0 是代理包版本，不是托管服务版本，也不固定远端工具清单；未填写工具数量。CLI 包及实际代理代码包均固定到发布 wheel 的 HTTPS URL 和 SHA-256。其余依赖遵循 CLI 包内的精确版本约束，这不是全部依赖的逐字节安全认证。\n\n需自行准备 Python >=3.10,<3.15、uv/uvx、网络和所选 AWS 身份的有效凭据、最小 IAM 权限；使用 AWS CLI 登录流程时还需相应 CLI。安装不会登录 AWS、创建账户、授予权限、安装配套技能或接入其他宿主。启动前由用户在私有配置中确认账户、Profile 与操作区域；不收集或公开密钥。缺工具、凭据、权限或连接时说明阻碍，在相应外部调用前停止，不能编造成功结果。\n\n默认连接 us-east-1 MCP 端点，操作默认区域也显式设为 us-east-1；端点区域和资源操作区域是两件事，均须用户确认。默认启用代理 --read-only，只保留远端标注 readOnlyHint=true 的工具并限制相应调用；写入或未标注的工具、以及包含混合操作的 API 工具可能不可用。这不是 IAM 安全边界，也不保证读操作没有费用。默认关闭代理可选遥测，不关闭向 AWS 发送工具参数、认证及 AWS 审计日志。\n\n本条目选择 SigV4 代理方案；AWS 同时提供的直接 OAuth 连接不是本条目默认安装流程。公开文档和服务信息可匿名访问，不代表能操作账户资源；未经用户授权，不切到匿名 --skip-auth、申请更高权限或移除只读模式来绕过错误。创建/删除资源、改 IAM、上传数据、发消息、切流和付费操作须先明确授权、范围及成本。请求参数与被访问数据按 AWS 服务条款和组织的数据处理要求进入 AWS。\n\n代理源码为 Apache-2.0；AWS 托管服务与资源适用独立条款。AWS 文档称工具包/MCP 服务本身无额外费用，所访问或创建的云资源、模型、存储、流量、日志及第三方服务仍可能计费。社区独立收录，维护者未验证，无上游背书。平台列表来自上游 OS Independent 声明和通用 Python wheel，不代表本轮跨平台实测。仅核验来源、制品、许可、参数和目录合同；未执行上游代码，未做 AWS 登录、真实 MCP 握手、工具调用、DesireCore 安装或桌面 GUI 验收。" + }, + "en-US": { + "name": "AWS MCP", + "summary": "Local proxy entry for the managed AWS MCP Server, pinned to proxy 1.7.0. Requires Python 3.10–3.14, uv/uvx and separately configured AWS credentials/IAM access; read-only by default, with separate cloud resource charges.", + "description": "Connect to the managed AWS MCP Server through the official AWS MCP Proxy as a local stdio process, using HTTPS and SigV4 upstream. Version 1.7.0 refers to the proxy packages, not the managed service or its evolving tool inventory. No tool count is claimed. Both the CLI wrapper and implementation wheels are pinned by HTTPS URL and SHA-256. Other dependencies follow the wrapper’s exact version constraints; this is not a byte-level security certification of the full dependency closure.\n\nSeparately provide Python >=3.10,<3.15, uv/uvx, network access, valid credentials for the selected AWS identity and least-privilege IAM permissions. An AWS CLI sign-in workflow also needs its compatible CLI. Installation does not sign in, create accounts, grant permissions, install companion skills or configure other hosts. Before starting, have the user confirm the account, profile and operational Region in private configuration; never collect or publish keys. Report missing tools, credentials, permissions or connectivity and stop before the affected external call rather than fabricating success.\n\nThe default MCP endpoint and explicit operational Region are both us-east-1; these are separate settings requiring user confirmation. Default --read-only keeps tools annotated readOnlyHint=true and restricts corresponding calls. Write-capable, unannotated or mixed-operation API tools may therefore be unavailable. This does not replace IAM or guarantee cost-free reads. Optional proxy telemetry is disabled; AWS request data, authentication and audit logging are not disabled.\n\nThis listing selects the SigV4 proxy route, not AWS’s separate direct OAuth connection. Anonymous documentation/service lookup does not establish permission to operate on account resources. Do not switch to --skip-auth, elevate permissions or remove read-only mode to work around a failure without authorization. Resource creation/deletion, IAM changes, uploads, messaging, traffic changes and paid operations require explicit scope and cost authorization. Request parameters and accessed data are subject to AWS terms and organizational data-handling requirements.\n\nThe proxy source is Apache-2.0; AWS services and resources have separate terms. AWS documents no additional charge for the toolkit/MCP service itself, while resources, models, storage, traffic, logs and third-party providers may still incur charges. Independent community listing, unverified maintainers, no upstream endorsement. Platform metadata reflects upstream OS Independent classification and universal wheels, not cross-platform testing. Review covers provenance, artifacts, licensing, arguments and catalog contracts only: no upstream code, AWS login, live MCP handshake/tool call, DesireCore installation or desktop GUI was exercised." + } + }, + "tags": [ + "aws", + "mcp", + "cloud", + "sigv4", + "documentation" + ] + }, + "release": { + "state": "known", + "version": "1.7.0", + "versionScheme": "semver" + }, + "timestamps": { + "catalogUpdatedAt": { + "state": "known", + "value": "2026-10-25", + "precision": "day" + }, + "releasePublishedAt": { + "state": "known", + "value": "2026-09-15T11:20:51Z", + "precision": "second" + }, + "reviewedAt": { + "state": "known", + "value": "2026-10-25", + "precision": "day" + }, + "upstreamObservedAt": { + "state": "known", + "value": "2026-10-25", + "precision": "day" + } + }, + "provenance": { + "content": { + "kind": "package", + "url": "https://pypi.org/project/mcp-proxy-for-aws-cli/1.7.0/", + "ref": "1.7.0", + "sha256": "75f990fc5cab688bba31b67fb6a01832b64f7f097c94503877012c6595f0836e" + } + }, + "governance": { + "availability": "installable", + "stewardship": "community", + "license": { + "state": "known", + "value": "Apache-2.0", + "evidencePath": "mcp_proxy_for_aws_cli-1.7.0.dist-info/licenses/LICENSE" + }, + "redistribution": "allowed", + "listingMaintainer": { + "name": "mashagua", + "url": "https://github.com/mashagua", + "verified": false + }, + "upstreamMaintainer": { + "name": "Amazon Web Services", + "url": "https://github.com/aws/mcp-proxy-for-aws", + "verified": false + }, + "branding": { + "relationship": "independent-listing", + "nameUsage": "nominative", + "logoStatus": "not-used" + }, + "compliance": { + "licenseEvidencePath": "mcp_proxy_for_aws_cli-1.7.0.dist-info/licenses/LICENSE", + "noticePath": "mcp_proxy_for_aws_cli-1.7.0.dist-info/licenses/NOTICE", + "reviewedRef": "1.7.0", + "reviewedAt": "2026-10-25", + "reviewedBy": "mashagua", + "upstreamEndorsed": false + } + }, + "compatibility": { + "platforms": { + "state": "known", + "values": [ + "macos", + "windows", + "linux" + ] + } + }, + "spec": { + "kind": "service", + "protocol": "mcp", + "authType": "unknown", + "capabilities": [ + "aws_documentation", + "aws_service_reference", + "iam_authenticated_access" + ] + } +} diff --git a/entries/aws-mcp/install.md b/entries/aws-mcp/install.md new file mode 100644 index 0000000..5fb3ddc --- /dev/null +++ b/entries/aws-mcp/install.md @@ -0,0 +1,49 @@ +# AWS MCP 安装 / Installation + +这是 AWS 托管 MCP 服务的 **SigV4 本地代理**入口，不是把 AWS 服务部署到本机。`1.7.0` 指 `mcp-proxy-for-aws-cli` 和 `mcp-proxy-for-aws` 的代理版本，远端服务不由此固定版本。配套 [AWS 技能合集 PR](https://github.com/desirecore/market/pull/226) 单独安装，不是本服务的硬依赖。 + +This entry connects to the managed AWS MCP Server through a local SigV4 proxy. Version `1.7.0` identifies the two proxy distributions, not the remote service. The companion skill collection is optional and acquired separately. + +## 安装前确认 / Before installation + +- 自行准备 Python `>=3.10,<3.15`、uv/uvx 和兼容 stdio 的 DesireCore 客户端；首次获取依赖需要访问 PyPI 与 files.pythonhosted.org，运行需要访问选定 AWS HTTPS 端点。不要自动升级 Python、uv 或客户端。 +- 请求用户在本机私有配置中选择 AWS 身份、Profile、账户与资源操作区域。优先使用现有 SSO/临时凭据和最小权限角色，不申请 root/AdministratorAccess，也不索取密钥、会话 token、凭据文件或完整身份输出到对话。已有凭据不代表用户授权此次使用。 +- 本条目不自动安装 AWS CLI 或发起登录。若用户选择 `aws login`，该流程另需 AWS CLI >=2.32.0；已有 SSO 流程无需因此更换。登录、刷新会话或附加 IAM 策略必须先取得相应授权，不能把命令写成隐含安装步骤。 +- 默认连接 `https://aws-mcp.us-east-1.api.aws/mcp`，资源操作默认区域通过 `AWS_REGION=us-east-1` 元数据明确指定。端点所在区域不等于资源所在区域；开始前说明并确认二者，按官方区域清单调整用户私有连接配置。 +- AWS 的直接远端 OAuth 接入是另一条方案；本条目不宣称已验证 DesireCore 的 AWS OAuth 联调，不在安装中改写其他客户端配置。 + +Provide Python 3.10–3.14, uv/uvx, a compatible stdio host and network access. Have the user select the identity, profile, account and operational Region privately before using existing credentials. Prefer temporary/SSO credentials and least privilege; never request credential files or keys in chat. Do not automatically install/upgrade tools, sign in, refresh sessions, alter IAM or replace unrelated configurations. The optional `aws login` workflow requires AWS CLI >=2.32.0. Endpoint and operational Regions are distinct. Direct OAuth is not the selected or tested flow here. + +## 固定制品 / Pinned artifacts + +| 发布包 / Distribution | 文件 / File | SHA-256 | +| --- | --- | --- | +| `mcp-proxy-for-aws-cli==1.7.0` | `mcp_proxy_for_aws_cli-1.7.0-py3-none-any.whl`（7321 字节 / bytes） | `75f990fc5cab688bba31b67fb6a01832b64f7f097c94503877012c6595f0836e` | +| `mcp-proxy-for-aws==1.7.0` | `mcp_proxy_for_aws-1.7.0-py3-none-any.whl`（45971 字节 / bytes） | `d7e6c8f45ef89303cb48822e25f91c0234bb28ee987ebb56615cd16a5d044a1b` | + +下载 URL 与带摘要的默认参数见 [usage.md](usage.md) 和 manifest；默认使用 `uvx --from --with mcp-proxy-for-aws-cli ...`。CLI 只是元数据包装包；`--with` 同时固定实际代码包，不能只校验包装包后就声称代码也已校验。 + +`uvx` 在隔离的缓存环境中准备依赖，不是系统级安装。`#sha256=` 是交给 uv 的下载校验信息；摘要不匹配必须失败，不改用无摘要 URL、浮动版本或 `latest`。若宿主或 uv 不支持本条目参数，停止并报告兼容性问题，不静默改写受治理的定义。CLI 的其余 84 条运行依赖声明使用精确版本及条件标记；本记录没有逐个审核它们的所有平台制品或证明无漏洞。 + +The launch definition pins both the metadata-only CLI wrapper and actual implementation wheels by URL and SHA-256. uv prepares an isolated cached environment and checks the URL hashes. A mismatch or unsupported launch contract must stop installation, with no unhashed/latest fallback. The wrapper declares 84 exact-version runtime requirements with environment markers; this review is not a byte-level audit or vulnerability certification of all platform-specific dependency artifacts. + +## 登记与连接验证 / Registration and verification + +1. 通过当前 DesireCore 提供的受治理服务安装/连接流程，使用本次操作携带的精确目录来源与快照。读取该快照的 manifest、sidecar、本说明与 usage，不替换整个 MCP 配置，也不凭裸 `aws-mcp` ID 吸收其他来源的安装。 +2. 先确认 uvx/Python 可用、用户批准的凭据配置已就绪，以及账户、操作区域、只读范围与费用边界。缺失时说明缺失项并停止；不要通过读取或上传凭据来“验证”。若客户端需要定位 uvx，使用本机解析出的真实绝对路径，不把本机路径写回公共目录。 +3. 使用 manifest 中完全一致的 command/args 启动；默认保留 `--read-only` 与 `--disable-telemetry`，没有 `--skip-auth`。不要在验证连接时调用资源创建、删除、上传、发消息或费用相关工具。 +4. 由 MCP 宿主完成 `initialize`、`notifications/initialized`、`tools/list`（包括分页），检查实际响应、错误和断开清理。工具数量以本次真实返回为准，不预填或伪造。依赖准备完成、进程已启动、握手完成及某项业务可用是不同事实；只按实际结果登记当前客户端支持的安装/连接回执，不预写“已安装/就绪”。 +5. 版本信息按已核验发行包元数据确认，不假设代理提供 `--version` 命令。此版本的 argparse 没有通用 `--version` 开关，不能用不存在的参数判定安装失败。真实账户工具调用需另有对应任务与授权，不能用创建资源作为连通性探针。 + +Use DesireCore’s governed service workflow with the exact source and snapshot. Confirm tools and privately approved credentials before launch. Keep the catalog definition intact and preserve unrelated connections. Verify MCP initialization and the complete tool list, then record only observations actually made; preparing dependencies or starting a process is not readiness. No tool count is predeclared. Read package metadata for version confirmation rather than assuming a nonexistent `--version` option. A business operation needs its own authorized task. + +## 升级与卸载 / Update and removal + +- 升级需重新核对两个发布包及适用依赖、摘要、许可证、参数和兼容性，再更新目录；不自动跟随远端或包的 latest，也不把托管服务更新冒充本地代理升级。 +- 卸载先停止并移除这一来源/服务的受治理连接，再按客户端支持的流程移除本条目拥有的安装记录或独立环境。不要删除共享 uv 缓存、AWS CLI、其他宿主连接、`~/.aws`、SSO 会话或用户云资源；凭据撤销和云资源清理是需单独授权的操作。 + +Updates require a fresh review of both artifacts, dependencies and launch compatibility. Removal stops this exact connection and handles only its owned records/environment. Preserve shared caches, other hosts, credentials and cloud resources; revocation and cloud cleanup require separate authorization. + +代理为 Apache-2.0；AWS 账户、API、资源及第三方依赖的条款与费用独立，详见 usage。**本轮只做来源、许可与目录检查，未执行上游代码、AWS 登录、真实握手、工具调用或 DesireCore GUI 验收。** + +The proxy is Apache-2.0; AWS and third-party terms/charges are separate. This review did not execute upstream code, sign in to AWS, perform a live handshake/tool call or exercise DesireCore GUI installation. diff --git a/entries/aws-mcp/manifest.json b/entries/aws-mcp/manifest.json new file mode 100644 index 0000000..8a6b992 --- /dev/null +++ b/entries/aws-mcp/manifest.json @@ -0,0 +1,59 @@ +{ + "id": "aws-mcp", + "name": "AWS MCP", + "type": "mcp", + "version": "1.7.0", + "author": "Amazon Web Services", + "description": "AWS 托管 MCP 服务的本地代理入口：固定代理 1.7.0，需 Python 3.10–3.14、uv/uvx 与自行配置的 AWS 凭据和 IAM 权限；默认只读，云资源费用另计。", + "tags": [ + "aws", + "mcp", + "cloud", + "sigv4", + "documentation" + ], + "icon": "cloud", + "platformSupport": [ + "macos", + "windows", + "linux" + ], + "capabilities": [ + "aws_documentation", + "aws_service_reference", + "iam_authenticated_access" + ], + "install": { + "method": "uvx", + "packageName": "mcp-proxy-for-aws-cli", + "command": "uvx", + "args": [ + "--from", + "mcp-proxy-for-aws-cli @ https://files.pythonhosted.org/packages/5d/ec/2faa62a1c8186966d73b4d3069d7098f08e1891b2f5141dd7bcf135c3561/mcp_proxy_for_aws_cli-1.7.0-py3-none-any.whl#sha256=75f990fc5cab688bba31b67fb6a01832b64f7f097c94503877012c6595f0836e", + "--with", + "mcp-proxy-for-aws @ https://files.pythonhosted.org/packages/73/df/04a7dba8d3ed744daff2783b220e9239969f0e0714266c52f0ced8d4ebf2/mcp_proxy_for_aws-1.7.0-py3-none-any.whl#sha256=d7e6c8f45ef89303cb48822e25f91c0234bb28ee987ebb56615cd16a5d044a1b", + "mcp-proxy-for-aws-cli", + "https://aws-mcp.us-east-1.api.aws/mcp", + "--read-only", + "--disable-telemetry", + "--metadata", + "AWS_REGION=us-east-1" + ] + }, + "connection": { + "transport": "stdio", + "command": "uvx", + "args": [ + "--from", + "mcp-proxy-for-aws-cli @ https://files.pythonhosted.org/packages/5d/ec/2faa62a1c8186966d73b4d3069d7098f08e1891b2f5141dd7bcf135c3561/mcp_proxy_for_aws_cli-1.7.0-py3-none-any.whl#sha256=75f990fc5cab688bba31b67fb6a01832b64f7f097c94503877012c6595f0836e", + "--with", + "mcp-proxy-for-aws @ https://files.pythonhosted.org/packages/73/df/04a7dba8d3ed744daff2783b220e9239969f0e0714266c52f0ced8d4ebf2/mcp_proxy_for_aws-1.7.0-py3-none-any.whl#sha256=d7e6c8f45ef89303cb48822e25f91c0234bb28ee987ebb56615cd16a5d044a1b", + "mcp-proxy-for-aws-cli", + "https://aws-mcp.us-east-1.api.aws/mcp", + "--read-only", + "--disable-telemetry", + "--metadata", + "AWS_REGION=us-east-1" + ] + } +} diff --git a/entries/aws-mcp/review.md b/entries/aws-mcp/review.md new file mode 100644 index 0000000..d028c3b --- /dev/null +++ b/entries/aws-mcp/review.md @@ -0,0 +1,64 @@ +# AWS MCP 收录核验 / Listing review + +审核日期：2026-10-25；收录维护者：mashagua。独立 community 条目，维护者不标为 verified，`upstreamEndorsed=false`。AWS 名称仅用于指称来源，使用通用 cloud 图标，不复制 AWS 标志。`installable` 表示符合目录来源和治理条件，不等于已安装、连接就绪、账户已授权或通过安全认证。 + +Reviewed on 2026-10-25 by mashagua. Independent community listing, unverified maintainers, no upstream endorsement, nominative naming and a generic icon. Installable catalog evidence is not installation, readiness, account permission or software safety certification. + +## 制品与许可 / Artifacts and license + +| 项目 / Item | 证据 / Evidence | +| --- | --- | +| CLI 发行包 / CLI distribution | [PyPI 1.7.0 元数据](https://pypi.org/pypi/mcp-proxy-for-aws-cli/1.7.0/json) | +| CLI wheel | [固定下载 / fixed download](https://files.pythonhosted.org/packages/5d/ec/2faa62a1c8186966d73b4d3069d7098f08e1891b2f5141dd7bcf135c3561/mcp_proxy_for_aws_cli-1.7.0-py3-none-any.whl) | +| CLI wheel SHA-256 | `75f990fc5cab688bba31b67fb6a01832b64f7f097c94503877012c6595f0836e`，7321 字节 / bytes | +| CLI 上传时间 / uploaded | `2026-09-15T11:20:51.587229Z`；sidecar 以秒精度保存 | +| 实现包 / implementation | [PyPI 1.7.0 元数据](https://pypi.org/pypi/mcp-proxy-for-aws/1.7.0/json) | +| 实现 wheel / implementation wheel | [固定下载 / fixed download](https://files.pythonhosted.org/packages/73/df/04a7dba8d3ed744daff2783b220e9239969f0e0714266c52f0ced8d4ebf2/mcp_proxy_for_aws-1.7.0-py3-none-any.whl) | +| 实现 wheel SHA-256 | `d7e6c8f45ef89303cb48822e25f91c0234bb28ee987ebb56615cd16a5d044a1b`，45971 字节 / bytes | +| 上游发布代码 / release source | tag `v1.7.0`，提交 [`22f1b3f8b7c4ef37112114b4af3d6c5a6c0a83bb`](https://github.com/aws/mcp-proxy-for-aws/tree/22f1b3f8b7c4ef37112114b4af3d6c5a6c0a83bb) | + +实际下载两个 wheel，分别核对其 SHA-256、大小和 PyPI 元数据；只用 ZIP 读取发行元数据和相关源文件，未导入或执行包。CLI 的 entry point 为 `mcp-proxy-for-aws-cli = mcp_proxy_for_aws.server:main`；它本身没有 Python 实现模块，由固定 `mcp-proxy-for-aws==1.7.0` 提供。启动参数的 `--from` 与 `--with` 分别使用上述两份带 `#sha256=` 的固定 URL。 + +Sidecar 的 `provenance.content.url` 是版本化 PyPI 包身份，不是主页 HTML 的摘要；`sha256` 对应所列 CLI wheel 字节。内容根为 wheel ZIP 根，因此许可证与通知路径分别为： + +- `mcp_proxy_for_aws_cli-1.7.0.dist-info/licenses/LICENSE` +- `mcp_proxy_for_aws_cli-1.7.0.dist-info/licenses/NOTICE` + +这两个文件已读取，分别与发布提交根 LICENSE/NOTICE 字节相同，许可证为 Apache-2.0。实现包也保留相应声明。`compliance.reviewedRef` 与 `provenance.content.ref` 都是 `1.7.0`，审核日期与 timestamps 一致。v1.7.0 发布代码中的 `cli.py`、`middleware/tool_filter.py` 与实现 wheel 对应文件也逐字节相同。不要用后续 main 分支代码替代发布包事实。 + +Both wheels were downloaded and matched their PyPI SHA-256/size metadata. They were inspected as ZIP data without import or execution. The wrapper entry point delegates to the pinned implementation. The sidecar hash identifies the CLI wheel, while the implementation hash is additionally enforced in the launch definition and recorded here. License evidence paths are relative to the wheel archive root; its Apache-2.0 LICENSE/NOTICE match the release source. Ref-bound review and release argument/filter files were checked against published bytes, not assumed from current main. + +CLI 元数据有 84 条带精确版本、部分带平台条件的运行依赖声明。固定版本不等于审核全部第三方制品、PyPI 账户、签名或供应链证明；本轮没有完成那些验证。依赖、Python 和 uv 各适用其许可；Apache-2.0 不授予 AWS 托管服务或其他商业服务使用权。仓库不复制发行包、Python 实现、SDK、凭据或本机验收原始数据。 + +The wrapper declares 84 exact-version runtime requirements, some conditional. This does not verify every dependency artifact, publisher, signature or supply-chain attestation. External dependencies retain their own licenses; Apache-2.0 does not license AWS services. No runtime artifacts or credentials are vendored. + +## 参数、认证和行为 / Arguments, authentication and behavior + +- 固定发行包实际支持 `--read-only`、`--disable-telemetry`、`--metadata` 和 `--profile`；它没有通用 `--version` 开关。参数代码仅静态检查，未实际运行。 +- `--read-only` 按远端 `readOnlyHint=true` 过滤工具列表，并在具有 FastMCP 上下文的调用路径检查注解；不能作为 IAM 策略、服务端授权或完整沙箱保证。远端工具注解与清单可能变化，故不登记工具数量，不承诺所有只读 AWS API 都可经此模式调用。 +- 本地 stdio 与远端 AWS 认证是两层。本条目实际选择 SigV4，不能把 stdio 无独立 API key 解读为 AWS 匿名访问。当前 sidecar 的 authType 枚举没有 SigV4，因此保留 `unknown` 并在双语描述和安装/使用说明中准确披露；不冒充 `none`、Bearer 或已验收的 OAuth，也不为单条登记修改 Schema。 +- 上游另有匿名文档检索和直接 OAuth 流程；默认参数既不加 `--skip-auth`，也不配置 OAuth，用户须先在私有环境确认凭据。缺凭据或权限时停止，不自动改认证方式、扩大 IAM 权限或移除只读模式。 +- `--disable-telemetry` 只关闭代理可选遥测，不阻止 HTTPS 数据流、AWS 认证、CloudTrail 或服务监控。默认 MCP 端点与操作区域均明确为 us-east-1，二者作用不同，使用前须确认。 + +The release supports the declared flags, but no generic --version option. Read-only behavior depends on upstream annotations and is not an IAM/security boundary. Local stdio and remote authentication are separate. The schema has no SigV4 enum, so authType remains unknown with explicit textual disclosure rather than a false none/Bearer/OAuth claim. There is no anonymous or permission-elevation fallback. Optional proxy telemetry suppression does not suppress AWS data transfer or audit logging. + +## 官方接入与服务条款 / Official setup and terms + +- [AWS MCP 设置、认证方案、端点与区域](https://docs.aws.amazon.com/agent-toolkit/latest/userguide/getting-started-aws-mcp-server.html) +- [AWS MCP 能力与文档查询边界](https://docs.aws.amazon.com/agent-toolkit/latest/userguide/mcp-server.html) +- [IAM 认证与最小权限](https://docs.aws.amazon.com/agent-toolkit/latest/userguide/security-iam.html) +- [IAM 工作机制](https://docs.aws.amazon.com/agent-toolkit/latest/userguide/security_iam_service-with-iam.html) +- [官方端点与配额](https://docs.aws.amazon.com/general/latest/gr/aws-mcp.html) +- [工具包计费说明](https://docs.aws.amazon.com/agent-toolkit/latest/userguide/what-is-agent-toolkit.html) +- [AWS Customer Agreement](https://aws.amazon.com/agreement/) 与 [AWS Service Terms](https://aws.amazon.com/service-terms/) +- [uv 工具运行与来源说明](https://docs.astral.sh/uv/guides/tools/) + +于审核日读取官方文档；这些持续更新的远端服务页面不代表固定后端软件。AWS 文档称工具包/MCP 服务没有额外费用，云资源使用仍按标准定价计费，不能宣传为所有操作免费。需遵守账户/组织的合同、区域、配额、数据处理与授权要求；安装本条目不会提供它们。 + +Official service documentation was checked on the review date, but does not pin the managed backend. No additional toolkit/MCP fee does not make all resource usage free. Account/organization terms, regions, quotas, data handling and authorization remain prerequisites. + +## 验证边界 / Validation scope + +本轮执行目录/Schema/sidecar 校验、直接相关的单文件校验器测试及制品/参数一致性检查；未执行上游 Python 代码、AWS 登录、凭据读取、真实 MCP 握手或 tools/list、业务工具调用、DesireCore 安装、桌面 GUI 或跨平台功能测试。未运行本地全量测试或全量 typecheck。本条目不声称业务可用性或完整安全认证。 + +Validation covers catalog/schema/sidecar contracts, a directly relevant single-file validator test and artifact/argument consistency. No upstream Python execution, AWS sign-in/credential access, live MCP initialization/tool listing, business tool call, DesireCore installation/GUI or cross-platform acceptance was performed. No local full suite or full typecheck was run. Runtime readiness and complete security certification are not claimed. diff --git a/entries/aws-mcp/usage.md b/entries/aws-mcp/usage.md new file mode 100644 index 0000000..b5a53bf --- /dev/null +++ b/entries/aws-mcp/usage.md @@ -0,0 +1,72 @@ +# AWS MCP 使用 / Usage + +先阅读 [安装说明](install.md) 和 [来源核验](review.md)。本条目通过 AWS 官方代理连接托管服务；它不是本地 AWS 模拟器，不包含账户、云资源、配套技能或其他宿主插件。默认只读模式不保证所有账户 API 都可用。 + +Read installation and review notes first. This is a proxy to a managed service, not a local AWS emulator, account, cloud deployment, skill bundle or host plugin. Default read-only mode does not guarantee availability of every account API. + +## 默认连接定义 / Default connection + +```json +{ + "transport": "stdio", + "command": "uvx", + "args": [ + "--from", + "mcp-proxy-for-aws-cli @ https://files.pythonhosted.org/packages/5d/ec/2faa62a1c8186966d73b4d3069d7098f08e1891b2f5141dd7bcf135c3561/mcp_proxy_for_aws_cli-1.7.0-py3-none-any.whl#sha256=75f990fc5cab688bba31b67fb6a01832b64f7f097c94503877012c6595f0836e", + "--with", + "mcp-proxy-for-aws @ https://files.pythonhosted.org/packages/73/df/04a7dba8d3ed744daff2783b220e9239969f0e0714266c52f0ced8d4ebf2/mcp_proxy_for_aws-1.7.0-py3-none-any.whl#sha256=d7e6c8f45ef89303cb48822e25f91c0234bb28ee987ebb56615cd16a5d044a1b", + "mcp-proxy-for-aws-cli", + "https://aws-mcp.us-east-1.api.aws/mcp", + "--read-only", + "--disable-telemetry", + "--metadata", + "AWS_REGION=us-east-1" + ] +} +``` + +上方 command/args 与本目录 manifest 的 install 和 connection 一致，两个 wheel 都通过 URL 摘要固定。由 DesireCore 管理时使用其服务安装/连接流程和精确目录来源，不把示例直接写入其他客户端，也不覆盖现有配置。本机 uvx 的绝对路径、用户 Profile、账户与区域属于私有运行配置，不写入公共目录。 + +The definition matches both install and connection in the manifest, pinning both wheels by URL hash. Use DesireCore’s governed service flow and exact catalog source; do not overwrite other clients or existing configurations. Absolute executable paths, profiles, accounts and user-selected Regions belong to private runtime configuration. + +本地 stdio 不要求填写 API key，但远端使用用户选择的 AWS 身份做 SigV4。启动前先让用户确认可用的本地凭据链，例如其已授权的 AWS Profile/SSO；不要自动读取凭据内容、遍历其他账户或把身份输出粘贴到对话。凭据过期、IAM 拒绝或服务不可达时，报告具体阻碍并停止受影响操作，不通过去掉只读、换账户、附加管理员权限或改认证方式来制造“成功”。 + +Local stdio does not require an API key field, but the upstream request is SigV4-authenticated with the identity the user selects. Confirm the approved credential chain privately before starting. Do not read credential contents, enumerate unrelated accounts or paste identity output into chat. Report expired credentials, access denial and connectivity errors without changing accounts, permissions or authentication to manufacture success. + +## 区域、能力与只读范围 / Region and read-only scope + +- `https://aws-mcp.us-east-1.api.aws/mcp` 选择 MCP 服务端点；`--metadata AWS_REGION=us-east-1` 选择 AWS 操作默认区域。访问其他区域资源前需用户确认并调整私有配置，不能因为宿主在某地就猜测资源区域。端点替换以 [AWS 官方端点清单](https://docs.aws.amazon.com/general/latest/gr/aws-mcp.html) 为准。 +- `--read-only` 依据远端的 `readOnlyHint=true` 展示工具并限制相应调用；未标注、可写或混合 API 工具可能被排除。读操作也可能产生资源或服务费用。此模式不能代替 IAM 最小权限和宿主工具审批，不是对远端工具实现的安全证明。 +- 默认不传 `--skip-auth`。AWS 支持公开文档查询以及另一套直接 OAuth 接入，但这不等于本条目无需凭据即可操作账户，也不意味着本轮验收了 OAuth。仅当用户明确选择其他方案并完成客户端兼容性检查后，才在私有配置中调整，不静默降级。 +- 远端工具清单会变化，需实际 `initialize`、`notifications/initialized` 和 `tools/list`（含分页）后才能得知本次能力。进程启动、工具被列出、IAM 允许和业务执行成功分别验证；不要把某一步成功泛化成全部成功。 +- `--disable-telemetry` 关闭代理的可选遥测，不会关闭到 AWS 的 HTTPS、认证、请求参数传输或 AWS 审计日志。CloudTrail/CloudWatch 等实际采集、保留和费用按账户配置与服务要求核对。 + +The endpoint Region and operational default Region are distinct. Confirm both rather than guessing from host location. Read-only annotation filtering may exclude mixed-operation tools and does not replace IAM, host consent or cost review. Anonymous documentation and direct OAuth are separate flows, not implicit fallbacks. Discover actual capabilities after initialization and paginated tool listing. Process startup, tool discovery, permission and task success are separate checks. Disabling optional proxy telemetry does not disable AWS traffic, authentication or audit logging. + +## 可提出的需求示例 / Example requests + +以下是用户可提出的任务，不是安装后自动执行的操作；需以本次实际发现的只读工具为准，工具缺失时说明并停止： + +- “查找 Lambda 超时排查的 AWS 官方文档，列出依据，先不要访问我的账户。” +- “对照官方服务资料解释 S3 与 EFS 的适用场景，只给建议，不创建资源。” +- “先说明完成我这个任务需要哪些 AWS 账户权限、区域和可能的费用；暂不调用账户 API。” + +These are optional user requests, not automatic actions: find official Lambda timeout guidance without account access; compare S3 and EFS without provisioning; or explain required permissions, Regions and likely charges before any account API call. Use only tools actually available in this connection and report missing capabilities. + +如要创建/删除资源、调整 IAM、上传数据、发送消息、切换流量、执行脚本或产生费用，先确认目标、授权、影响范围、成本和恢复/清理方案，再根据任务核对依赖与权限。不得为绕过默认限制直接去掉 `--read-only`；需要写能力时先让用户明确授权并使用宿主支持的受治理配置流程。不得以连接检查为由执行这些动作。 + +Provisioning/deletion, IAM changes, uploads, messaging, traffic changes, script execution and chargeable work require explicit target/scope/cost/recovery authorization and per-task dependency checks. Do not silently remove read-only mode. Use the host’s governed configuration flow if authorized write capability is needed; connection checks alone never authorize these operations. + +## 条款、成本和数据边界 / Terms, costs and data handling + +代理采用 Apache-2.0，不包含 AWS 或第三方服务的使用许可。根据 [AWS 工具包计费说明](https://docs.aws.amazon.com/agent-toolkit/latest/userguide/what-is-agent-toolkit.html)，工具包/MCP 服务本身没有额外费用；资源、API 使用引起的资源成本、模型、存储、流量、日志和第三方服务仍可能收费，按各服务价格、配额及用户合同核对。不承诺所有查询、只读调用或所谓免费额度都免费。 + +The Apache-2.0 proxy license does not license AWS or other services. AWS documents no additional toolkit/MCP service charge, while resource use, models, storage, traffic, logging and external providers can still incur their applicable costs and quotas. Do not promise that every read or free-tier usage is free. + +请求参数、业务内容及操作可能传到 AWS，并进入相应服务或组织配置的日志；DesireCore 宿主模型的数据处理边界也需遵守。仅处理用户授权的账户和数据；不得将凭据、私有账户信息、资源标识、业务数据或完整日志提交到公共目录、PR 或截图。适用 [AWS Customer Agreement](https://aws.amazon.com/agreement/)、[AWS Service Terms](https://aws.amazon.com/service-terms/)、组织合同与各依赖许可。 + +Request parameters and business content can reach AWS and configured logs; the host model’s data boundary also applies. Operate only on authorized accounts/data. Never publish credentials, private account/resource identifiers, business data or raw logs in the catalog, PR or screenshots. AWS agreements, organizational terms and dependency licenses remain applicable. + +本次未执行上游代码、读取 AWS 凭据、登录、真实握手或业务工具调用，也未做 DesireCore GUI/跨平台验收。来源与目录核验记录见 [review.md](review.md)；不能把这些记录当作你的连接或业务已验证。 + +This listing review did not execute upstream code, read credentials, sign in, perform a live handshake/tool call or test DesireCore GUI/cross-platform functionality. Catalog evidence does not establish readiness for your connection or task. diff --git a/manifest.json b/manifest.json index 5a4586e..c1e4a1d 100644 --- a/manifest.json +++ b/manifest.json @@ -8,10 +8,10 @@ "repository": "https://github.com/desirecore/registry", "lastUpdated": "2026-10-25", "stats": { - "totalEntries": 25, + "totalEntries": 26, "dockerApps": 8, "nativeApps": 2, - "mcpServices": 9, + "mcpServices": 10, "httpApis": 5, "externalIntegrations": 1 }, diff --git a/scripts/catalog/validator.test.mjs b/scripts/catalog/validator.test.mjs index 4e72969..0aa15d5 100644 --- a/scripts/catalog/validator.test.mjs +++ b/scripts/catalog/validator.test.mjs @@ -208,10 +208,10 @@ test('当前 v4.2 条目保持可读，原生应用与既有 App/Service 具备 httpApis: report.counts.httpApis, externalIntegrations: report.counts.externalIntegrations, }, { - totalEntries: 25, + totalEntries: 26, dockerApps: 8, nativeApps: 2, - mcpServices: 9, + mcpServices: 10, httpApis: 5, externalIntegrations: 1, }) From 7313ea778bfe9ea484cde45300eede44765c8b26 Mon Sep 17 00:00:00 2001 From: mashagua <993498039@qq.com> Date: Sun, 25 Oct 2026 18:17:16 +0800 Subject: [PATCH 2/3] fix(registry): keep AWS MCP package provenance compatible with client --- entries/aws-mcp/catalog-metadata.v1.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/entries/aws-mcp/catalog-metadata.v1.json b/entries/aws-mcp/catalog-metadata.v1.json index e6ec6b2..b3af182 100644 --- a/entries/aws-mcp/catalog-metadata.v1.json +++ b/entries/aws-mcp/catalog-metadata.v1.json @@ -57,7 +57,7 @@ "provenance": { "content": { "kind": "package", - "url": "https://pypi.org/project/mcp-proxy-for-aws-cli/1.7.0/", + "url": "https://pypi.org/project/mcp-proxy-for-aws-cli/", "ref": "1.7.0", "sha256": "75f990fc5cab688bba31b67fb6a01832b64f7f097c94503877012c6595f0836e" } From 1947d65a94cd8398022dd81cb32e1e3c2d34fa26 Mon Sep 17 00:00:00 2001 From: mashagua <993498039@qq.com> Date: Sun, 25 Oct 2026 18:35:19 +0800 Subject: [PATCH 3/3] docs(registry): record AWS MCP runtime and desktop acceptance boundaries --- entries/aws-mcp/catalog-metadata.v1.json | 4 ++-- entries/aws-mcp/install.md | 4 ++-- entries/aws-mcp/review.md | 24 +++++++++++++++++------- 3 files changed, 21 insertions(+), 11 deletions(-) diff --git a/entries/aws-mcp/catalog-metadata.v1.json b/entries/aws-mcp/catalog-metadata.v1.json index b3af182..6c85004 100644 --- a/entries/aws-mcp/catalog-metadata.v1.json +++ b/entries/aws-mcp/catalog-metadata.v1.json @@ -11,12 +11,12 @@ "zh-CN": { "name": "AWS MCP", "summary": "AWS 托管 MCP 服务的本地代理入口：固定代理 1.7.0，需 Python 3.10–3.14、uv/uvx 与自行配置的 AWS 凭据和 IAM 权限；默认只读，云资源费用另计。", - "description": "通过 AWS 官方 MCP Proxy 的本地 stdio 进程连接 AWS 托管 MCP 服务，远端使用 HTTPS 与 SigV4。条目的 1.7.0 是代理包版本，不是托管服务版本，也不固定远端工具清单；未填写工具数量。CLI 包及实际代理代码包均固定到发布 wheel 的 HTTPS URL 和 SHA-256。其余依赖遵循 CLI 包内的精确版本约束，这不是全部依赖的逐字节安全认证。\n\n需自行准备 Python >=3.10,<3.15、uv/uvx、网络和所选 AWS 身份的有效凭据、最小 IAM 权限；使用 AWS CLI 登录流程时还需相应 CLI。安装不会登录 AWS、创建账户、授予权限、安装配套技能或接入其他宿主。启动前由用户在私有配置中确认账户、Profile 与操作区域；不收集或公开密钥。缺工具、凭据、权限或连接时说明阻碍，在相应外部调用前停止，不能编造成功结果。\n\n默认连接 us-east-1 MCP 端点，操作默认区域也显式设为 us-east-1；端点区域和资源操作区域是两件事，均须用户确认。默认启用代理 --read-only，只保留远端标注 readOnlyHint=true 的工具并限制相应调用；写入或未标注的工具、以及包含混合操作的 API 工具可能不可用。这不是 IAM 安全边界，也不保证读操作没有费用。默认关闭代理可选遥测，不关闭向 AWS 发送工具参数、认证及 AWS 审计日志。\n\n本条目选择 SigV4 代理方案；AWS 同时提供的直接 OAuth 连接不是本条目默认安装流程。公开文档和服务信息可匿名访问，不代表能操作账户资源；未经用户授权，不切到匿名 --skip-auth、申请更高权限或移除只读模式来绕过错误。创建/删除资源、改 IAM、上传数据、发消息、切流和付费操作须先明确授权、范围及成本。请求参数与被访问数据按 AWS 服务条款和组织的数据处理要求进入 AWS。\n\n代理源码为 Apache-2.0；AWS 托管服务与资源适用独立条款。AWS 文档称工具包/MCP 服务本身无额外费用，所访问或创建的云资源、模型、存储、流量、日志及第三方服务仍可能计费。社区独立收录，维护者未验证，无上游背书。平台列表来自上游 OS Independent 声明和通用 Python wheel，不代表本轮跨平台实测。仅核验来源、制品、许可、参数和目录合同；未执行上游代码，未做 AWS 登录、真实 MCP 握手、工具调用、DesireCore 安装或桌面 GUI 验收。" + "description": "通过 AWS 官方 MCP Proxy 的本地 stdio 进程连接 AWS 托管 MCP 服务，远端使用 HTTPS 与 SigV4。条目的 1.7.0 是代理包版本，不是托管服务版本，也不固定远端工具清单；未填写工具数量。CLI 包及实际代理代码包均固定到发布 wheel 的 HTTPS URL 和 SHA-256。其余依赖遵循 CLI 包内的精确版本约束，这不是全部依赖的逐字节安全认证。\n\n需自行准备 Python >=3.10,<3.15、uv/uvx、网络和所选 AWS 身份的有效凭据、最小 IAM 权限；使用 AWS CLI 登录流程时还需相应 CLI。安装不会登录 AWS、创建账户、授予权限、安装配套技能或接入其他宿主。启动前由用户在私有配置中确认账户、Profile 与操作区域；不收集或公开密钥。缺工具、凭据、权限或连接时说明阻碍，在相应外部调用前停止，不能编造成功结果。\n\n默认连接 us-east-1 MCP 端点，操作默认区域也显式设为 us-east-1；端点区域和资源操作区域是两件事，均须用户确认。默认启用代理 --read-only，只保留远端标注 readOnlyHint=true 的工具并限制相应调用；写入或未标注的工具、以及包含混合操作的 API 工具可能不可用。这不是 IAM 安全边界，也不保证读操作没有费用。默认关闭代理可选遥测，不关闭向 AWS 发送工具参数、认证及 AWS 审计日志。\n\n本条目选择 SigV4 代理方案；AWS 同时提供的直接 OAuth 连接不是本条目默认安装流程。公开文档和服务信息可匿名访问，不代表能操作账户资源；未经用户授权，不切到匿名 --skip-auth、申请更高权限或移除只读模式来绕过错误。创建/删除资源、改 IAM、上传数据、发消息、切流和付费操作须先明确授权、范围及成本。请求参数与被访问数据按 AWS 服务条款和组织的数据处理要求进入 AWS。\n\n代理源码为 Apache-2.0；AWS 托管服务与资源适用独立条款。AWS 文档称工具包/MCP 服务本身无额外费用，所访问或创建的云资源、模型、存储、流量、日志及第三方服务仍可能计费。社区独立收录，维护者未验证，无上游背书。平台列表来自上游 OS Independent 声明和通用 Python wheel，不代表本轮跨平台实测。已在 macOS 隔离环境运行固定 Python 代理：默认签名模式在空凭据下明确返回缺凭据错误；另行授权的匿名只读测试变体完成 MCP 握手、发现 6 个工具并实际检索和读取公开文档。DesireCore 10.0.187 已验证目录展示和接入入口，并通过正常配置 API 将单独匿名变体接入测试 Agent，实际发现 6 个工具；真实对话经工具审批调用文档检索成功。默认签名接入未完成，停止安装任务后资源卡片仍将 installing 记录标为“已安装”的显示问题未修复；不代表账户业务验收。未读取真实 AWS 凭据、登录、调用账户业务、创建资源或进行 Windows/Linux 实测。" }, "en-US": { "name": "AWS MCP", "summary": "Local proxy entry for the managed AWS MCP Server, pinned to proxy 1.7.0. Requires Python 3.10–3.14, uv/uvx and separately configured AWS credentials/IAM access; read-only by default, with separate cloud resource charges.", - "description": "Connect to the managed AWS MCP Server through the official AWS MCP Proxy as a local stdio process, using HTTPS and SigV4 upstream. Version 1.7.0 refers to the proxy packages, not the managed service or its evolving tool inventory. No tool count is claimed. Both the CLI wrapper and implementation wheels are pinned by HTTPS URL and SHA-256. Other dependencies follow the wrapper’s exact version constraints; this is not a byte-level security certification of the full dependency closure.\n\nSeparately provide Python >=3.10,<3.15, uv/uvx, network access, valid credentials for the selected AWS identity and least-privilege IAM permissions. An AWS CLI sign-in workflow also needs its compatible CLI. Installation does not sign in, create accounts, grant permissions, install companion skills or configure other hosts. Before starting, have the user confirm the account, profile and operational Region in private configuration; never collect or publish keys. Report missing tools, credentials, permissions or connectivity and stop before the affected external call rather than fabricating success.\n\nThe default MCP endpoint and explicit operational Region are both us-east-1; these are separate settings requiring user confirmation. Default --read-only keeps tools annotated readOnlyHint=true and restricts corresponding calls. Write-capable, unannotated or mixed-operation API tools may therefore be unavailable. This does not replace IAM or guarantee cost-free reads. Optional proxy telemetry is disabled; AWS request data, authentication and audit logging are not disabled.\n\nThis listing selects the SigV4 proxy route, not AWS’s separate direct OAuth connection. Anonymous documentation/service lookup does not establish permission to operate on account resources. Do not switch to --skip-auth, elevate permissions or remove read-only mode to work around a failure without authorization. Resource creation/deletion, IAM changes, uploads, messaging, traffic changes and paid operations require explicit scope and cost authorization. Request parameters and accessed data are subject to AWS terms and organizational data-handling requirements.\n\nThe proxy source is Apache-2.0; AWS services and resources have separate terms. AWS documents no additional charge for the toolkit/MCP service itself, while resources, models, storage, traffic, logs and third-party providers may still incur charges. Independent community listing, unverified maintainers, no upstream endorsement. Platform metadata reflects upstream OS Independent classification and universal wheels, not cross-platform testing. Review covers provenance, artifacts, licensing, arguments and catalog contracts only: no upstream code, AWS login, live MCP handshake/tool call, DesireCore installation or desktop GUI was exercised." + "description": "Connect to the managed AWS MCP Server through the official AWS MCP Proxy as a local stdio process, using HTTPS and SigV4 upstream. Version 1.7.0 refers to the proxy packages, not the managed service or its evolving tool inventory. No tool count is claimed. Both the CLI wrapper and implementation wheels are pinned by HTTPS URL and SHA-256. Other dependencies follow the wrapper’s exact version constraints; this is not a byte-level security certification of the full dependency closure.\n\nSeparately provide Python >=3.10,<3.15, uv/uvx, network access, valid credentials for the selected AWS identity and least-privilege IAM permissions. An AWS CLI sign-in workflow also needs its compatible CLI. Installation does not sign in, create accounts, grant permissions, install companion skills or configure other hosts. Before starting, have the user confirm the account, profile and operational Region in private configuration; never collect or publish keys. Report missing tools, credentials, permissions or connectivity and stop before the affected external call rather than fabricating success.\n\nThe default MCP endpoint and explicit operational Region are both us-east-1; these are separate settings requiring user confirmation. Default --read-only keeps tools annotated readOnlyHint=true and restricts corresponding calls. Write-capable, unannotated or mixed-operation API tools may therefore be unavailable. This does not replace IAM or guarantee cost-free reads. Optional proxy telemetry is disabled; AWS request data, authentication and audit logging are not disabled.\n\nThis listing selects the SigV4 proxy route, not AWS’s separate direct OAuth connection. Anonymous documentation/service lookup does not establish permission to operate on account resources. Do not switch to --skip-auth, elevate permissions or remove read-only mode to work around a failure without authorization. Resource creation/deletion, IAM changes, uploads, messaging, traffic changes and paid operations require explicit scope and cost authorization. Request parameters and accessed data are subject to AWS terms and organizational data-handling requirements.\n\nThe proxy source is Apache-2.0; AWS services and resources have separate terms. AWS documents no additional charge for the toolkit/MCP service itself, while resources, models, storage, traffic, logs and third-party providers may still incur charges. Independent community listing, unverified maintainers, no upstream endorsement. Platform metadata reflects upstream OS Independent classification and universal wheels, not cross-platform testing. An isolated macOS run executed the pinned Python proxy: default signed mode failed explicitly without credentials; a separately authorized anonymous read-only variant initialized MCP, discovered six tools and searched/read public documentation. DesireCore 10.0.187 catalog and task entry points were exercised; a separate public variant was registered to a test Agent through the normal configuration API, exposing six tools, and its real chat invoked documentation search through normal approval. Default signed installation remains incomplete. A resource-card label still describes an installing record as installed after task cancellation; that UI issue is not fixed. AWS account readiness is not established. No real AWS credentials, sign-in, account operation, resource creation or Windows/Linux execution was used." } }, "tags": [ diff --git a/entries/aws-mcp/install.md b/entries/aws-mcp/install.md index 5fb3ddc..f8c10dd 100644 --- a/entries/aws-mcp/install.md +++ b/entries/aws-mcp/install.md @@ -44,6 +44,6 @@ Use DesireCore’s governed service workflow with the exact source and snapshot. Updates require a fresh review of both artifacts, dependencies and launch compatibility. Removal stops this exact connection and handles only its owned records/environment. Preserve shared caches, other hosts, credentials and cloud resources; revocation and cloud cleanup require separate authorization. -代理为 Apache-2.0；AWS 账户、API、资源及第三方依赖的条款与费用独立，详见 usage。**本轮只做来源、许可与目录检查，未执行上游代码、AWS 登录、真实握手、工具调用或 DesireCore GUI 验收。** +代理为 Apache-2.0；AWS 账户、API、资源及第三方依赖的条款与费用独立，详见 usage。**macOS 补测已运行固定代理，完成独立公开模式握手、工具发现和文档检索/读取，并检查 DesireCore 目录与接入入口；完整集成和账户业务不在这些通过项内，详见 review.md。** -The proxy is Apache-2.0; AWS and third-party terms/charges are separate. This review did not execute upstream code, sign in to AWS, perform a live handshake/tool call or exercise DesireCore GUI installation. +The proxy is Apache-2.0; AWS and third-party terms/charges are separate. The macOS follow-up executed the pinned proxy for independent public-mode initialization, tool discovery and document search/read, and checked DesireCore catalog/task entry points. Complete client integration and AWS account operations are separate, unverified claims; see review.md. diff --git a/entries/aws-mcp/review.md b/entries/aws-mcp/review.md index d028c3b..bd513ca 100644 --- a/entries/aws-mcp/review.md +++ b/entries/aws-mcp/review.md @@ -17,16 +17,16 @@ Reviewed on 2026-10-25 by mashagua. Independent community listing, unverified ma | 实现 wheel SHA-256 | `d7e6c8f45ef89303cb48822e25f91c0234bb28ee987ebb56615cd16a5d044a1b`，45971 字节 / bytes | | 上游发布代码 / release source | tag `v1.7.0`，提交 [`22f1b3f8b7c4ef37112114b4af3d6c5a6c0a83bb`](https://github.com/aws/mcp-proxy-for-aws/tree/22f1b3f8b7c4ef37112114b4af3d6c5a6c0a83bb) | -实际下载两个 wheel，分别核对其 SHA-256、大小和 PyPI 元数据；只用 ZIP 读取发行元数据和相关源文件，未导入或执行包。CLI 的 entry point 为 `mcp-proxy-for-aws-cli = mcp_proxy_for_aws.server:main`；它本身没有 Python 实现模块，由固定 `mcp-proxy-for-aws==1.7.0` 提供。启动参数的 `--from` 与 `--with` 分别使用上述两份带 `#sha256=` 的固定 URL。 +实际下载两个 wheel，分别核对其 SHA-256、大小和 PyPI 元数据；初始静态审查只用 ZIP 读取发行元数据和相关源文件，未导入或执行包；后续运行补测见文末。CLI 的 entry point 为 `mcp-proxy-for-aws-cli = mcp_proxy_for_aws.server:main`；它本身没有 Python 实现模块，由固定 `mcp-proxy-for-aws==1.7.0` 提供。启动参数的 `--from` 与 `--with` 分别使用上述两份带 `#sha256=` 的固定 URL。 -Sidecar 的 `provenance.content.url` 是版本化 PyPI 包身份，不是主页 HTML 的摘要；`sha256` 对应所列 CLI wheel 字节。内容根为 wheel ZIP 根，因此许可证与通知路径分别为： +Sidecar 的 `provenance.content.url` 使用 PyPI 包主页标识包身份，版本由 `ref=1.7.0` 单独固定，不是主页 HTML 的摘要；`sha256` 对应所列 CLI wheel 字节。内容根为 wheel ZIP 根，因此许可证与通知路径分别为： - `mcp_proxy_for_aws_cli-1.7.0.dist-info/licenses/LICENSE` - `mcp_proxy_for_aws_cli-1.7.0.dist-info/licenses/NOTICE` 这两个文件已读取，分别与发布提交根 LICENSE/NOTICE 字节相同，许可证为 Apache-2.0。实现包也保留相应声明。`compliance.reviewedRef` 与 `provenance.content.ref` 都是 `1.7.0`，审核日期与 timestamps 一致。v1.7.0 发布代码中的 `cli.py`、`middleware/tool_filter.py` 与实现 wheel 对应文件也逐字节相同。不要用后续 main 分支代码替代发布包事实。 -Both wheels were downloaded and matched their PyPI SHA-256/size metadata. They were inspected as ZIP data without import or execution. The wrapper entry point delegates to the pinned implementation. The sidecar hash identifies the CLI wheel, while the implementation hash is additionally enforced in the launch definition and recorded here. License evidence paths are relative to the wheel archive root; its Apache-2.0 LICENSE/NOTICE match the release source. Ref-bound review and release argument/filter files were checked against published bytes, not assumed from current main. +Both wheels were downloaded and matched their PyPI SHA-256/size metadata. The initial static review inspected ZIP data without import or execution; subsequent runtime acceptance is recorded below. The wrapper entry point delegates to the pinned implementation. The sidecar hash identifies the CLI wheel, while the implementation hash is additionally enforced in the launch definition and recorded here. License evidence paths are relative to the wheel archive root; its Apache-2.0 LICENSE/NOTICE match the release source. Ref-bound review and release argument/filter files were checked against published bytes, not assumed from current main. CLI 元数据有 84 条带精确版本、部分带平台条件的运行依赖声明。固定版本不等于审核全部第三方制品、PyPI 账户、签名或供应链证明；本轮没有完成那些验证。依赖、Python 和 uv 各适用其许可；Apache-2.0 不授予 AWS 托管服务或其他商业服务使用权。仓库不复制发行包、Python 实现、SDK、凭据或本机验收原始数据。 @@ -34,7 +34,7 @@ The wrapper declares 84 exact-version runtime requirements, some conditional. Th ## 参数、认证和行为 / Arguments, authentication and behavior -- 固定发行包实际支持 `--read-only`、`--disable-telemetry`、`--metadata` 和 `--profile`；它没有通用 `--version` 开关。参数代码仅静态检查，未实际运行。 +- 固定发行包实际支持 `--read-only`、`--disable-telemetry`、`--metadata` 和 `--profile`；它没有通用 `--version` 开关。初始审查仅静态检查参数；后续 macOS 补测实际运行了该启动定义。 - `--read-only` 按远端 `readOnlyHint=true` 过滤工具列表，并在具有 FastMCP 上下文的调用路径检查注解；不能作为 IAM 策略、服务端授权或完整沙箱保证。远端工具注解与清单可能变化，故不登记工具数量，不承诺所有只读 AWS API 都可经此模式调用。 - 本地 stdio 与远端 AWS 认证是两层。本条目实际选择 SigV4，不能把 stdio 无独立 API key 解读为 AWS 匿名访问。当前 sidecar 的 authType 枚举没有 SigV4，因此保留 `unknown` 并在双语描述和安装/使用说明中准确披露；不冒充 `none`、Bearer 或已验收的 OAuth，也不为单条登记修改 Schema。 - 上游另有匿名文档检索和直接 OAuth 流程；默认参数既不加 `--skip-auth`，也不配置 OAuth，用户须先在私有环境确认凭据。缺凭据或权限时停止，不自动改认证方式、扩大 IAM 权限或移除只读模式。 @@ -57,8 +57,18 @@ The release supports the declared flags, but no generic --version option. Read-o Official service documentation was checked on the review date, but does not pin the managed backend. No additional toolkit/MCP fee does not make all resource usage free. Account/organization terms, regions, quotas, data handling and authorization remain prerequisites. -## 验证边界 / Validation scope +## macOS 补测 / macOS runtime acceptance (2026-10-25) -本轮执行目录/Schema/sidecar 校验、直接相关的单文件校验器测试及制品/参数一致性检查；未执行上游 Python 代码、AWS 登录、凭据读取、真实 MCP 握手或 tools/list、业务工具调用、DesireCore 安装、桌面 GUI 或跨平台功能测试。未运行本地全量测试或全量 typecheck。本条目不声称业务可用性或完整安全认证。 +- 在独立 Python 3.12.13、uv 0.11.2 环境使用本条目的真实 uvx 定义；两份 wheel 仍按 URL 与 SHA-256 固定，实际安装 76 个符合本平台条件的包。 +- 显式空 AWS config/credentials、空登录缓存、禁用 IMDS，子进程环境采用白名单；没有读取真实 AWS 凭据或登录账户。 +- 默认签名定义在 initialize 阶段明确返回 `No AWS credentials available`，这是缺凭据负向用例通过，不是 SigV4 授权成功。 +- 在仅本轮独立测试变体中加 `--skip-auth`，继续保留 `--read-only`、`--disable-telemetry`；initialize 和完整 tools/list 成功，真实返回 6 个唯一工具。以 `AWS Lambda function timeout troubleshooting` 检索，返回 3 条公开结果，并成功读取其中一篇 AWS re:Post 文档；两次调用 `isError=false`。未调用账户业务工具。 +- DesireCore 10.0.187 的独立 macOS GUI 实测发现并修正了包身份 URL 兼容性：当前 dev 会把版本化 PyPI URL 的 `/1.7.0/` 一并当成包名，真实一致性函数返回 `acquisition.source` 不匹配。改用包主页后同一函数通过，真实客户端从“仅收录”恢复“可接入”，可选择本机并发起带精确来源/快照的接入任务。`ref`、审核版本、两个 wheel URL/摘要和默认认证参数均未放宽。 +- 另通过正在运行的 DesireCore 实例真实 `/api/mcp/test-connection` owner 复验：默认空凭据返回 HTTP 500 和明确缺凭据信息；匿名只读变体返回 HTTP 200、`status=connected`、6 个工具。该临时连接测试由真实客户端后端执行，不是 mock，也没有手写安装锁或成功状态；持久登记、宿主任务的完整安装及账户业务需分别验收。未进行 AWS 登录、真实凭据读取、账户业务、资源创建或 Windows/Linux 实测；没有运行本地全量测试或全量 typecheck。直接相关校验器单文件 16 项通过，目录校验通过。 +- 单独匿名测试变体经正常 `/api/agents/:id/mcp-servers` owner 接入测试 Agent；实际工具组装返回 6 个 MCP 工具。随后在真实 GUI 对话指定公开文档查询，经过正常工具审批完成调用；运行回执显示 `DiscoverTools` 和真实 MCP 查询均 success，返回 3 条 URL 与独立探针一致。这是匿名变体的客户端集成通过，不是默认 SigV4 账户接入通过。 +- 仍有明确 GUI 限制：市场安装委派任务在准备阶段停止后，持久记录仍是 `status=installing`，资源卡片的来源标签却显示“已安装”，详情为“离线”。实际点击“测试连接”能显示缺凭据错误；没有把这一默认安装记为成功。此主仓库显示/任务收尾问题不在本目录 PR 中修复。 -Validation covers catalog/schema/sidecar contracts, a directly relevant single-file validator test and artifact/argument consistency. No upstream Python execution, AWS sign-in/credential access, live MCP initialization/tool listing, business tool call, DesireCore installation/GUI or cross-platform acceptance was performed. No local full suite or full typecheck was run. Runtime readiness and complete security certification are not claimed. + +The pinned proxy was executed on isolated macOS/Python 3.12.13 with uv 0.11.2 and 76 platform-applicable packages. Explicit empty AWS credential/config/login-cache paths and disabled IMDS prevented use of real AWS credentials. Default signed initialization reported missing credentials as expected. A separate, authorized unsigned read-only variant initialized, discovered six unique tools, searched public Lambda documentation and read one returned document, with both calls returning `isError=false`. No account operations were invoked. + +A real DesireCore 10.0.187 catalog test exposed the versioned-PyPI-URL identity mismatch also present in current dev. Using the package homepage plus the unchanged version ref and wheel hashes restored the connectable entry and exact-source task launch. The running DesireCore instance’s real MCP connection-test owner also returned the expected missing-credentials failure in default mode and HTTP 200 / connected / six tools for the temporary public variant. A separate public test variant was then registered to an Agent through the normal configuration owner. Its six tools were assembled by the real runtime, and a GUI chat performed the approved MCP search with a successful tool audit and three matching public URLs. Default signed installation is still incomplete: a stopped installation leaves an installing record whose Resources origin label says installed, while details remain offline; the real test-connection button correctly displays the missing-credentials error. That main-repository UI/lifecycle limitation is not fixed by this catalog PR. No SigV4 account access, all-tool readiness, security certification or Windows/Linux acceptance is claimed. The directly related validator file passed 16 tests and catalog validation passed; no full test suite or full typecheck ran.