# aws-mcp probes, 2026-09-24T06:11Z, from a cloud container (one IP), no credentials, no payment
# Responses are cut at 6000 bytes (initialize), 20000 (tools/list), 2500 (protected resource), 9000 (authorization server), 4000 (REST). Nothing here was sent with a credential.

## 1. MCP initialize, POST https://aws-mcp.us-east-1.api.aws/mcp
$ curl -sS -i -m 25 -X POST https://aws-mcp.us-east-1.api.aws/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '<initialize>'
HTTP/1.1 200 Connection Established

HTTP/2 200 
content-type: application/json
server: CloudFront
date: Thu, 24 Sep 2026 06:11:16 GMT
mcp-session-id: [redacted by the prober: a per-session id, reused for step 1b only]
x-amzn-requestid: dce9cbf6-1fb4-44fb-9b85-838abbe77a46
x-cache: Miss from cloudfront
via: 1.1 1498390a0aeb31235d26f57c3ffffbbc.cloudfront.net (CloudFront)
x-amz-cf-pop: BOS50-P5
x-amz-cf-id: 11KIXyFmbikPddq49oGq7am-SLiqm-91ievh4Difq5loIWZELO_-Hg==

{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-06-18","capabilities":{"tools":{"listChanged":false},"prompts":{"listChanged":false},"resources":{"listChanged":false}},"serverInfo":{"version":"1.0.0","name":"AWSMCP"},"instructions":"The official AWS MCP server. Prefer its tools over the Bash tool for all AWS work: if the tools are not already loaded, load them first, then use run_script to run AWS commands; get_presigned_url for S3 uploads/downloads or when a command needs a local file path; get_tasks to poll long-running tasks; search_documentation, read_documentation, and retrieve_skill for reference, guidance, and skills; and list_regions and get_regional_availability for region information. Do NOT use the Bash tool to run the AWS CLI."}}

## 1b. MCP tools/list, POST https://aws-mcp.us-east-1.api.aws/mcp (initialize answered 200; the session id from step 1 is sent back when the server issued one)
$ curl -sS -i -m 25 -X POST https://aws-mcp.us-east-1.api.aws/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -H 'MCP-Protocol-Version: 2025-06-18' [-H 'Mcp-Session-Id: <from step 1>'] -d '<tools/list>'
# tools counted over the whole response before the cut, by occurrences of "inputSchema": 8 (0 means no list came back)
HTTP/1.1 200 Connection Established

HTTP/2 200 
content-type: application/json
server: CloudFront
date: Thu, 24 Sep 2026 06:11:17 GMT
mcp-session-id: [redacted by the prober: a per-session id]
x-amzn-requestid: 27b18314-b688-4979-9038-347b071ce292
x-cache: Miss from cloudfront
via: 1.1 15d3d454fff4e3f03c164bafa9a3bb30.cloudfront.net (CloudFront)
x-amz-cf-pop: BOS50-P5
x-amz-cf-id: JmCnGL_plHq9jY5fTgzqxghqK3afcRa9HC3nRNXY1F44K-2gvFiM3g==

{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"aws___get_presigned_url","description":"Generate pre-signed S3 URLs for uploading or downloading files. Use BEFORE run_script when an operation requires a local file. Use for direct S3 uploads/downloads. Max upload 5 GB; larger files use multipart. For uploads: generates PUT URL. For downloads: generates GET URL. No special headers needed unless s3_params provided—then corresponding HTTP headers MUST be included or request fails with SignatureDoesNotMatch.","inputSchema":{"type":"object","properties":{"requests":{"description":"Array of 1-25 presigned URL requests.","items":{"description":"A single presigned URL request.","properties":{"operation":{"description":"PUT (upload) or GET (download).","enum":["upload","download"],"type":"string"},"bucket":{"description":"S3 bucket name.","type":"string"},"key":{"description":"S3 object key.","type":"string"},"region":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"Override region. Falls back to session region."},"expires_in":{"default":900,"description":"URL expiration in seconds (1–900). Above 900 → S3 rejects with 403.","maximum":900,"minimum":1,"type":"integer"},"s3_params":{"anyOf":[{"additionalProperties":{"type":"string"},"type":"object"},{"type":"null"}],"description":"Extra S3 parameters to sign (e.g. ContentType). Corresponding headers MUST be included."}},"required":["operation","bucket","key"],"type":"object"},"type":"array"}},"required":["requests"],"additionalProperties":false},"outputSchema":{"properties":{"result":{"items":{"additionalProperties":true,"type":"object"},"type":"array"}},"required":["result"],"type":"object","x-fastmcp-wrap-result":true},"annotations":{"readOnlyHint":false,"destructiveHint":false,"openWorldHint":false},"_meta":{"fastmcp":{"tags":[]}}},{"name":"aws___get_tasks","description":"Poll status of long-running tasks. Use after a tool call returns task_id with status \"working\". Up to 3 IDs per call. Tasks expire after 5 min. Pass poll_iteration (start at 1, increment each call) and follow the recommended_wait_seconds in the response before polling again.","inputSchema":{"type":"object","properties":{"task_ids":{"description":"One or more task IDs (up to 3) from previous tool invocations.","items":{"type":"string"},"type":"array"},"poll_iteration":{"anyOf":[{"anyOf":[{"type":"integer"},{"type":"null"}],"description":"Poll attempt number (1-based, increment each call). Used to suggest wait time before next poll."},{"type":"null"}]}},"required":["task_ids"],"additionalProperties":false},"outputSchema":{"additionalProperties":true,"type":"object"},"annotations":{"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false},"_meta":{"fastmcp":{"tags":[]}}},{"name":"aws___run_script","description":"Execute Python code in sandboxed environment with AWS API access via `call_boto3`. No network except `call_boto3`.\n\n```python\nasync def call_boto3(\n    *,\n    service_name: str,\n    operation_name: str,\n    region_name: str | None = None,\n    params: dict | None = None,\n) -> dict: ...\n```\n\nResponse includes `api_calls` list—verify APIs ran before trusting `return_value`.\n\nREQUIRED PATTERNS:\n- Return `result={...}` then `result` alone as final expression\n- Call each API once; results auto-paginate\n- Return ALL resources—missing one is wrong\n- Return raw data fields; let LLM judge thresholds\n- Use `asyncio.gather(*[...])` with `return_exceptions=True` for reads; let mutations raise\n\n⚠️ LIST→DESCRIBE: List* returns only names/ARNs. Use Get*/Describe* for attributes.\n\n⚠️ CONTENTS vs CONTAINER: \"empty buckets\"→ListObjects; \"records\"→Scan; \"X configured\"→Get*Configuration.\n\nRULES:\n1. SELF-CONTAINED: Discover resources inside script.\n2. ALL-REGIONS: DescribeRegions→gather per region.\n3. PERMISSIONS: All policies ONE script. `bucket`≠`bucket/*`. Report YES/PARTIAL/NO.\n\nPRE-IMPORTED: asyncio, collections, csv, dataclasses, datetime, decimal, enum, fractions, functools, itertools, json, math, re, statistics, string, time, typing, uuid, ClientError, io.StringIO, io.BytesIO.\n\nBUILTIN MODULES: AWS teams provide higher-level functions for complex jobs. Find out more with:\n\n```python\nimport aws_mcp\nhelp(aws_mcp)\n```\n\nTo search for available functions:\n\n```python\nawait aws_mcp.search_functions(\"search query in natural language\")\n```","inputSchema":{"type":"object","properties":{"code":{"description":"Python code to execute","type":"string"}},"required":["code"],"additionalProperties":false},"annotations":{"readOnlyHint":false,"destructiveHint":true,"openWorldHint":false},"_meta":{"anthropic/alwaysLoad":true,"fastmcp":{"tags":[]}}},{"name":"aws___get_regional_availability","description":"AWS resource availability per region.\n\n- Max 10 regions; multi-region needs `filters`; single-region supports `next_token`.\n- Status: isAvailableIn | isNotAvailableIn | isPlannedIn | Not Found.\n- Response key: products | service_apis | cfn_resources.\n\nNot for region counts/docs/vague queries -- use `search_documentation` / `list_regions`.\n\nFilter values must EXACTLY match AWS's catalog names; guessed, partial, or pluralized names are rejected (\"values in filter parameter do not exist\"). If unsure of the exact name, first call once for a single region with resource_type set and NO filters to list all valid names, then re-call filtering on the exact match.","inputSchema":{"type":"object","properties":{"regions":{"type":"array","items":{"type":"string"},"description":"AWS region codes (max 10). Multi-region requires `filters`; single-region supports `next_token`."},"resource_type":{"type":"string","description":"Required: 'product' | 'api' | 'cfn'."},"filters":{"type":"array","items":{"type":"string"},"description":"Use exact AWS product or sub-feature name.\n\n- product: 'Amazon Bedrock' (service), or sub-features like 'Comprehend Auto Scaling', 'Latency-Based Routing', 'PrivateLink Support'. When the user names a specific sub-feature, filter on the sub-feature -- do NOT generalize to the parent service ('Amazon Comprehend'); that returns availability for the wrong scope.\n- api: 'SdkServiceId+Operation' (e.g. 'CloudFormation+CreateStack', 'IAM+GetSSHPublicKey') or 'SdkServiceId' (e.g. 'EC2'). Use a literal '+' between service and operation -- not space, colon, or hyphen.\n- cfn: 'AWS::EC2::Instance', 'AWS::Lambda::Function'.\n\nInclude every region the user named; don't add filters they didn't request.\n\nValues must EXACTLY match AWS's catalog (e.g. 'AWS Lambda', not 'Lambda' or 'AWS Lambda Service'). If unsure of the exact name, first call once for one region with NO filters to list valid names, then filter on the exact match."},"next_token":{"type":"string","description":"Pagination token. Single-region, no filters only."},"region":{"type":"string","description":"Unused; use `regions`."}},"required":["resource_type"]},"annotations":{"readOnlyHint":true,"openWorldHint":false,"destructiveHint":false}},{"name":"aws___list_regions","description":"Retrieve a list of all AWS regions.","inputSchema":{"type":"object","properties":{},"required":[]},"annotations":{"readOnlyHint":true,"openWorldHint":false,"destructiveHint":false}},{"name":"aws___read_documentation","description":"Fetch full AWS doc pages as markdown. `search_documentation` already returns verbatim page chunks, so don't re-read a URL whose chunk you already have to \"confirm\" or \"round out\" an answer -- the chunk is the real page text; treat it as authoritative.\n\nReading the full page is justified ONLY when the chunks genuinely lack the content:\n- an enumeration or aggregation (\"list all X\", \"how many X\") needs the complete set and the chunks show only part of it;\n- no search result is on-topic after refining the query, and a known doc URL would have the answer.\nOtherwise, answer from the chunks. Use exact URLs from `search_documentation`; don't guess slugs.\n\nInput: `requests: [{url, max_length?, start_index?}]`. Batch 2-5.\n- `max_length` default 10000.\n- `start_index` default 0; use prior `end_index` to continue, TOC offset to jump.\n\nAllow-listed prefixes: docs.aws.amazon.com; aws.amazon.com (not /marketplace); repost.aws/knowledge-center; docs.amplify.aws; ui.docs.amplify.aws; github.com/{aws-cloudformation/aws-cloudformation-templates, aws-samples/{aws-cdk-examples, generative-ai-cdk-constructs-samples, serverless-patterns}, awsdocs/aws-cdk-guide, awslabs/aws-solutions-constructs, cdklabs/cdk-nag} (README on `main`); constructs.dev/packages/{@aws-cdk-containers, @aws-cdk, @cdk-cloudformation, aws-analytics-reference-architecture, aws-cdk-lib, cdk-amazon-chime-resources, cdk-aws-lambda-powertools-layer, cdk-ecr-deployment, cdk-lambda-powertools-python-layer, cdk-serverless-clamscan, cdk8s, cdk8s-plus-33}; strandsagents.com/latest/documentation/docs/; karpenter.sh/docs/; Amazon Braket: {amazon-braket-sdk-python, amazon-braket-schemas-python, amazon-braket-default-simulator-python, amazon-braket-pennylane-plugin-python, amazon-braket-algorithm-library, qiskit-braket-provider, autoqasm, qirtoqasm}.readthedocs.io and github.com/amazon-braket/* (blob/tree/raw).\n\nOutput: SUCCESS -- markdown + `total_length, start_index, end_index, truncated, redirected_url?` (truncated includes TOC with char ranges). ERROR -- `error_code` in {not_found, invalid_url, throttled, downstream_error, validation_error}.","inputSchema":{"type":"object","properties":{"requests":{"type":"array","items":{"type":"object","properties":{"url":{"type":"string","description":"Doc URL with allow-listed prefix; use exact URL from search."},"max_length":{"type":"integer","description":"Chars returned (default 10000)."},"start_index":{"type":"integer","description":"Char offset (default 0). Use prior `end_index` to continue, or TOC offset to jump."}},"required":["url"]},"description":"List of `{url, max_length?, start_index?}`. Batch 2-5."}},"required":[]},"annotations":{"readOnlyHint":true,"openWorldHint":false,"destructiveHint":false}},{"name":"aws___retrieve_skill","description":"Retrieve an AWS skill (workflows, references). Returns SKILL.md, or `file` if given.\n\nCall `search_documentation` FIRST and copy `skill_name` verbatim -- it is an opaque registry ID. Never guess or fabricate `skill_name` or `file`.","inputSchema":{"type":"object","properties":{"file":{"type":"string","description":"Optional file path within the skill, copied as cited (e.g. `references/architecture.md`). Don't add or strip a `references/` prefix. Omit for SKILL.md."},"skill_name":{"type":"string","description":"Required. Exact `skill_name` from a search_documentation result, copied verbatim. Do not invent or modify."}},"required":["skill_name"]},"annotations":{"readOnlyHint":true,"openWorldHint":false,"destructiveHint":false}},{"name":"aws___search_documentation","description":"AWS docs search. Each result's `context` is verbatim page text -- a real chunk of the actual page, not a short snippet -- and usually already contains the answer, so answer directly from it. Use `read_documentation` only when the chunks genuinely lack the needed detail.\n\nPick ONE topic. Add a 2nd ONLY if query genuinely spans domains. Extra topics dilute ranking.\n\n- reference_documentation -- API/SDK/CLI specs, config params\n- current_awareness -- new/released/announced\n- troubleshooting -- errors, \"how to fix\" (NOT for conceptual/feature questions)\n- amplify_docs -- Amplify (+ language)\n- cdk_docs -- CDK concepts/guides\n- cdk_constructs -- CDK code samples, L3\n- cloudformation -- CFN/SAM templates\n- strands_docs -- Strands Agents SDK (its Skills/agents concepts go here, NOT agent_skills)\n- agent_skills -- this tool's guided skills (load via `retrieve_skill`)\n- general (default) -- architecture, best practices, tutorials, feature behavior\n\nResults: rank_order (lower=better), url, title, context (verbatim page chunk -- answer directly from it).","inputSchema":{"type":"object","properties":{"limit":{"type":"integer","description":"Maximum number of results to return (default 4)."},"search_phrase":{"type":"string","description":"Keywords; preserve exact error strings and all task terms verbatim."},"topics":{"type":"array","items":{"type":"string","description":"topic name"},"description":"Up to 3 from: reference_documentation, current_awareness, troubleshooting, amplify_docs, cdk_docs, cdk_constructs, cloudformation, agent_skills, strands_docs, general. Default [\"general\"]."}},"required":["search_phrase"]},"annotations":{"readOnlyHint":true,"openWorldHint":false,"destructiveHint":false}}]}}

## 2. Protected-resource metadata, GET https://aws-mcp.us-east-1.api.aws/.well-known/oauth-protected-resource/mcp (not named in the challenge; the path-aware well-known URI, the first fallback the specification names)
HTTP/1.1 200 Connection Established

HTTP/2 200 
content-type: application/json
content-length: 116
server: CloudFront
date: Thu, 24 Sep 2026 06:11:17 GMT
cache-control: public, max-age=3600
x-cache: Miss from cloudfront
via: 1.1 abf98c562ec8876a85f8a498028d69da.cloudfront.net (CloudFront)
x-amz-cf-pop: BOS50-P5
x-amz-cf-id: BOgoa8o-dVzjcfqAmmSR1utcu6YJLFClXD_osy_4EyvEDnR-CCPVUA==

{"resource":"https://aws-mcp.us-east-1.api.aws/mcp","authorization_servers":["https://us-east-1.oauth.signin.aws/"]}

## 3. Authorization-server metadata, GET https://us-east-1.oauth.signin.aws/.well-known/oauth-authorization-server
HTTP/1.1 200 Connection Established

HTTP/2 200 
date: Thu, 24 Sep 2026 06:11:18 GMT
content-type: application/json
x-amzn-requestid: X-Amzn-Trace-Id=Root=1-6ab4bf06-2e12ff410f63a7c04e556045;RequestId=0a856508-5c60-48e0-899c-383f342bb348
set-cookie: aws-ubid-main=[redacted by the prober: a session cookie, never published]
x-frame-options: DENY
x-ua-compatible: IE=Edge
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-security-policy: default-src 'none' https://*.monitoring.iam.signin.aws https://aws.amazon.com https://*.signin.aws.amazon.com https://signin.aws.amazon.com https://*.analytics.console.aws.a2z.com https://*.feedback.console.aws.dev https://d2c.aws.amazon.com 'nonce-R/ar/XaKMD3Q8MO7HFOKtw=='; script-src 'self' https://aws.amazon.com https://*.signin.aws.amazon.com https://signin.aws.amazon.com https://d1dgtfo2wk29o4.cloudfront.net/fwcim.js https://m.media-amazon.com https://l0.awsstatic.com https://images-na.ssl-images-amazon.com 'report-sample' https://cdn.us-east-1.threat-mitigation.aws.amazon.com https://a0.awsstatic.com/s_code/js/3.0/awshome_s_code_registration.min.js 'nonce-R/ar/XaKMD3Q8MO7HFOKtw=='; style-src 'self' https://aws.amazon.com https://*.signin.aws.amazon.com https://signin.aws.amazon.com https://aws-signin-website-assets.s3.amazonaws.com https://l0.awsstatic.com https://images-na.ssl-images-amazon.com 'unsafe-inline'; font-src data: 'self';; img-src 'self' data: https://*.signin.aws.amazon.com https://signin.aws.amazon.com https://opfcaptcha-prod.s3.amazonaws.com https://amcs-captcha-prod-us-east-1.s3.dualstack.us-east-1.amazonaws.com https://amcs-captcha-prod-us-east-1.s3.us-east-1.amazonaws.com https://images-na.ssl-images-amazon.com https://d1.awsstatic.com https://internal-cdn.amazon.com https://media.amazonwebservices.com https://d36cz9buwru1tt.cloudfront.net https://d0.awsstatic.com; media-src 'self' https://*.signin.aws.amazon.com https://signin.aws.amazon.com https://media.amazonwebservices.com https://d36cz9buwru1tt.cloudfront.net https://opfcaptcha-prod.s3.amazonaws.com https://amcs-captcha-prod-us-east-1.s3.dualstack.us-east-1.amazonaws.com https://amcs-captcha-prod-us-east-1.s3.us-east-1.amazonaws.com; frame-src 'self' https://aws.amazon.com https://*.signin.aws.amazon.com https://signin.aws.amazon.com https://*.analytics.console.aws.a2z.com https://cdn.us-east-1.threat-mitigation.aws.amazon.com; report-uri /metrics/cspreport; base-uri 'none'; upgrade-insecure-requests;
cross-origin-opener-policy-report-only: same-origin; report-to="coop-endpoint"
reporting-endpoints: coop-endpoint="/metrics/coopreportonly"
vary: accept-encoding
server: Server

{"issuer":"https://us-east-1.oauth.signin.aws","authorization_endpoint":"https://us-east-1.oauth.signin.aws/v1/authorize","token_endpoint":"https://us-east-1.oauth.signin.aws/v1/token","registration_endpoint":"https://us-east-1.oauth.signin.aws/v1/register","token_endpoint_auth_methods_supported":["none"],"response_types_supported":["code"],"grant_types_supported":["authorization_code","refresh_token"],"authorization_response_iss_parameter_supported":false,"code_challenge_methods_supported":["S256"]}

## 4. MCP tools/call of aws___list_regions, POST https://aws-mcp.us-east-1.api.aws/mcp
# A read-only tool that names no resource and touches no account. It is on both this server and the Knowledge server, so it is the cheapest test of whether the keyless surface reaches past documentation.
$ curl -sS -i -m 40 -X POST https://aws-mcp.us-east-1.api.aws/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -H 'MCP-Protocol-Version: 2025-06-18' -H 'Mcp-Session-Id: <from a fresh initialize>' -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"aws___list_regions","arguments":{}}}'
HTTP/1.1 200 Connection Established

HTTP/2 200 
content-type: application/json
server: CloudFront
date: Thu, 24 Sep 2026 06:11:48 GMT
mcp-session-id: [redacted by the prober: a per-session id]
x-amzn-requestid: a42c4bcc-837a-4cf7-a926-0b2d1c2aa5ce
x-cache: Miss from cloudfront
via: 1.1 279285d02f471d6998962c633bf35f0a.cloudfront.net (CloudFront)
x-amz-cf-pop: BOS50-P5
x-amz-cf-id: DaqjHkHUwU2-bIWostKN9bSh0yR5AOhJqMY-cIALmi18W80lvijFFA==

{"jsonrpc":"2.0","id":3,"result":{"content":[{"type":"text","text":"{\"content\":{\"result\":[{\"region_id\":\"af-south-1\",\"region_long_name\":\"Africa (Cape Town)\"},{\"region_id\":\"ap-east-1\",\"region_long_name\":\"Asia Pacific (Hong Kong)\"},{\"region_id\":\"ap-east-2\",\"region_long_name\":\"Asia Pacific (Taipei)\"},{\"region_id\":\"ap-northeast-1\",\"region_long_name\":\"Asia Pacific (Tokyo)\"},{\"region_id\":\"ap-northeast-2\",\"region_long_name\":\"Asia Pacific (Seoul)\"},{\"region_id\":\"ap-northeast-3\",\"region_long_name\":\"Asia Pacific (Osaka)\"},{\"region_id\":\"ap-south-1\",\"region_long_name\":\"Asia Pacific (Mumbai)\"},{\"region_id\":\"ap-south-2\",\"region_long_name\":\"Asia Pacific (Hyderabad)\"},{\"region_id\":\"ap-southeast-1\",\"region_long_name\":\"Asia Pacific (Singapore)\"},{\"region_id\":\"ap-southeast-2\",\"region_long_name\":\"Asia Pacific (Sydney)\"},{\"region_id\":\"ap-southeast-3\",\"region_long_name\":\"Asia Pacific (Jakarta)\"},{\"region_id\":\"ap-southeast-4\",\"region_long_name\":\"Asia Pacific (Melbourne)\"},{\"region_id\":\"ap-southeast-5\",\"region_long_name\":\"Asia Pacific (Malaysia)\"},{\"region_id\":\"ap-southeast-6\",\"region_long_name\":\"Asia Pacific (New Zealand)\"},{\"region_id\":\"ap-southeast-7\",\"region_long_name\":\"Asia Pacific (Thailand)\"},{\"region_id\":\"ca-central-1\",\"region_long_name\":\"Canada (Central)\"},{\"region_id\":\"ca-west-1\",\"region_long_name\":\"Canada West (Calgary)\"},{\"region_id\":\"eu-central-1\",\"region_long_name\":\"Europe (Frankfurt)\"},{\"region_id\":\"eu-central-2\",\"region_long_name\":\"Europe (Zurich)\"},{\"region_id\":\"eu-north-1\",\"region_long_name\":\"Europe (Stockholm)\"},{\"region_id\":\"eu-south-1\",\"region_long_name\":\"Europe (Milan)\"},{\"region_id\":\"eu-south-2\",\"region_long_name\":\"Europe (Spain)\"},{\"region_id\":\"eu-west-1\",\"region_long_name\":\"Europe (Ireland)\"},{\"region_id\":\"eu-west-2\",\"region_long_name\":\"Europe (London)\"},{\"region_id\":\"eu-west-3\",\"region_long_name\":\"Europe (Paris)\"},{\"region_id\":\"eusc-de-east-1\",\"region_long_name\":\"AWS European Sovereign Cloud (Germany)\"},{\"region_id\":\"il-central-1\",\"region_long_name\":\"Israel (Tel Aviv)\"},{\"region_id\":\"me-central-1\",\"region_long_name\":\"Middle East (UAE)\"},{\"region_id\":\"me-south-1\",\"region_long_name\":\"Middle East (Bahrain)\"},{\"region_id\":\"mx-central-1\",\"region_long_name\":\"Mexico (Central)\"},{\"region_id\":\"sa-east-1\",\"region_long_name\":\"South America (Sao Paulo)\"},{\"region_id\":\"us-east-1\",\"region_long_name\":\"US East (N. Virginia)\"},{\"region_id\":\"us-east-2\",\"region_long_name\":\"US East (Ohio)\"},{\"region_id\":\"us-gov-east-1\",\"region_long_name\":\"AWS GovCloud (US-East)\"},{\"region_id\":\"us-gov-west-1\",\"region_long_name\":\"AWS GovCloud (US-West)\"},{\"region_id\":\"us-west-1\",\"region_long_name\":\"US West (N. California)\"},{\"region_id\":\"us-west-2\",\"region_long_name\":\"US West (Oregon)\"}]}}"}],"isError":false}}

## 5. MCP tools/call of aws___search_documentation, POST https://aws-mcp.us-east-1.api.aws/mcp
# The vendor says documentation search on this server no longer requires AWS credentials. This is that sentence, tested.
$ curl -sS -i -m 40 -X POST https://aws-mcp.us-east-1.api.aws/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -H 'MCP-Protocol-Version: 2025-06-18' -H 'Mcp-Session-Id: <from a fresh initialize>' -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"aws___search_documentation","arguments":{"search_phrase":"S3 bucket versioning","limit":2}}}'
HTTP/1.1 200 Connection Established

HTTP/2 200 
content-type: application/json
server: CloudFront
date: Thu, 24 Sep 2026 06:11:51 GMT
mcp-session-id: [redacted by the prober: a per-session id]
x-amzn-requestid: 5c8fe2c2-9b6e-4b88-b543-f9696ccb3b13
x-cache: Miss from cloudfront
via: 1.1 6b9e972828445e8f396a8df0e97ce690.cloudfront.net (CloudFront)
x-amz-cf-pop: BOS50-P5
x-amz-cf-id: wAC4p_Y3QwZvZWWIhbdqJ1IC1zc1BQtdsXyxWgJcukyH9-EkaPB1HQ==

{"jsonrpc":"2.0","id":3,"result":{"content":[{"type":"text","text":"{\"content\":{\"result\":[{\"rank_order\":1,\"title\":\"Managing resources effectively on Amazon S3 using AWS CloudFormation | AWS Storage Blog\",\"context\":\"#### **Enable Versioning**\\n\\nS3 Versioning is a means of keeping multiple variants of an object in the same bucket. It is useful to preserve, retrieve, and restore every version of every object stored in your Amazon S3 bucket. With versioning, you can easily recover from both unintended user actions and application failures. To enable versioning, use the `VersionConfiguration` property and set the status for S3 bucket:\\n\\n```\\nVersioningConfiguration:\\n Status: Enabled\\n```\",\"url\":\"https://aws.amazon.com/blogs/storage/managing-resources-effectively-on-amazon-s3-using-aws-cloudformation/\"},{\"rank_order\":2,\"title\":\"Amazon S3 examples using SDK for Java 2.x\",\"context\":\"### PutBucketVersioning\\n\\nThe following code example shows how to use `PutBucketVersioning`.\\n\\n**SDK for Java 2.x**\\n: **Note:**\\n\\n There's more on GitHub. Find the complete example and learn how to set up and run in the\\n AWS Code\\n Examples Repository.\\n\\n ```\\n /**\\n * Enables bucket versioning for the specified S3 bucket.\\n *\\n * @param s3Client the S3 client to use for the operation\\n * @param bucketName the name of the S3 bucket to enable versioning for\\n */\\n public static void enableBucketVersioning(S3Client s3Client, String bucketName){\\n VersioningConfiguration versioningConfiguration = VersioningConfiguration.builder()\\n .status(BucketVersioningStatus.ENABLED)\\n .build();\\n\\n PutBucketVersioningRequest versioningRequest = PutBucketVersioningRequest.builder()\\n .bucket(bucketName)\\n .versioningConfiguration(versioningConfiguration)\\n .build();\\n\\n s3Client.putBucketVersioning(versioningRequest);\\n System.out.println(\\\"Bucket versioning has been enabled for \\\"+bucketName);\\n }\\n\\n ```\\n\\n * For API details, see\\n PutBucketVersioning\\n in *AWS SDK for Java 2.x API Reference*\",\"url\":\"https://docs.aws.amazon.com/code-library/latest/ug/java_2_s3_code_examples.html\"}]}}"}],"isError":false}}

## 6. MCP tools/list, POST https://aws-mcp.us-east-1.api.aws/mcp, sent ALONE: no initialize on this connection and no Mcp-Session-Id header
$ curl -sS -i -m 40 -X POST https://aws-mcp.us-east-1.api.aws/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}'
HTTP/1.1 200 Connection Established

HTTP/2 200 
content-type: application/json
server: CloudFront
date: Thu, 24 Sep 2026 06:17:45 GMT
x-amzn-requestid: 41ff90b6-4de8-4bc4-84c2-d55f8017b00e
x-cache: Miss from cloudfront
via: 1.1 ab66b5ccb30bf46f0035eeb68c1fb516.cloudfront.net (CloudFront)
x-amz-cf-pop: BOS50-P5
x-amz-cf-id: 466yTzi25s1s55IUUzSQv38a79zXPuAtFynUM6NeNf_HzgrHzma65Q==

{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"aws___get_presigned_url","description":"Generate pre-signed S3 URLs for uploading or downloading files. Use BEFORE run_script when an operation requires a local file. Use for direct S3 uploads/downloads. Max upload 5 GB; larger files use multipart. For uploads: generates PUT URL. For downloads: generates GET URL. No special headers needed unless s3_params provided—then corresponding HTTP headers MUST be included or request fails with SignatureDoesNotMatch.","inputSchema":{"type":"object","properties":{"requests":{"description":"Array of 1-25 presigned URL requests.","items":{"description":"A single presigned URL request.","properties":{"operation":{"description":"PUT (upload) or GET (download).","enum":["upload","download"],"type":"string"},"bucket":{"description":"S3 bucket name.","type":"string"},"key":{"description":"S3 object key.","type":"string"},"region":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"Override region. Falls back to session region."},"expires_in":{"default":900,"description":"URL expiration in seconds (1–900). Above 900 → S3 rejects with 403.","maximum":900,"minimum":1,"type":"integer"},"s3_params":{"anyOf":[{"additionalProperties":{"type":"string"},"type":"object"},{"type":"null"}],"description":"Extra S3 parameters to sign (e.g. ContentType). Corresponding headers MUST be included."}},"required":["operation","bucket","key"],"type":"object"},"type":"array"}},"required":["requests"],"additionalProperties":false},"outputSchema":{"properties":{"result":{"items":{"additionalProperties":true,"type":"object"},"type":"array"}},"required":["result"],"type":"object","x-fastmcp-wrap-result":true},"annotations":{"readOnlyHint":false,"destructiveHint":false,"openWorldHint":false},"_meta":{"fastmcp":{"tags":[]}}},{"name":"aws___get_tasks","description":"Poll status of long-running tasks. Use after a tool call returns task_id with status \"working\". Up to 3 IDs per call. Tasks expire after 5 min. Pass poll_iteration (start at 1, increment each call) and follow the recommended_wait_seconds

## 7. MCP tools/call of aws___list_regions, POST https://aws-mcp.us-east-1.api.aws/mcp, sent ALONE: no initialize on this connection and no Mcp-Session-Id header
$ curl -sS -i -m 40 -X POST https://aws-mcp.us-east-1.api.aws/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"aws___list_regions","arguments":{}}}'
HTTP/1.1 200 Connection Established

HTTP/2 200 
content-type: application/json
server: CloudFront
date: Thu, 24 Sep 2026 06:17:46 GMT
x-amzn-requestid: 45b6237f-de78-4ba7-b29e-1fea23dd0897
x-cache: Miss from cloudfront
via: 1.1 fcae443d83fc4584a0d3a9c267282030.cloudfront.net (CloudFront)
x-amz-cf-pop: BOS50-P5
x-amz-cf-id: veGGXbxXVn8fpxjtBV_y1Dx2d_G8dHb06MSfNsdRI3Uim_R-fXI4tg==

{"jsonrpc":"2.0","id":3,"error":{"code":-32600,"message":"Session ID is required for this operation. Please include a valid session ID in your request headers or initialize a new session first."}}

## 8. MCP tools/call of aws___search_documentation, POST https://aws-mcp.us-east-1.api.aws/mcp, sent ALONE: no initialize on this connection and no Mcp-Session-Id header
$ curl -sS -i -m 40 -X POST https://aws-mcp.us-east-1.api.aws/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"aws___search_documentation","arguments":{"search_phrase":"S3 bucket versioning","limit":2}}}'
HTTP/1.1 200 Connection Established

HTTP/2 200 
content-type: application/json
server: CloudFront
date: Thu, 24 Sep 2026 06:17:47 GMT
x-amzn-requestid: 42ce1678-7b70-421e-8cc9-a68c0b57f4e3
x-cache: Miss from cloudfront
via: 1.1 94a5318c9664dfe7c8818b3a19aa7aaa.cloudfront.net (CloudFront)
x-amz-cf-pop: BOS50-P5
x-amz-cf-id: 1PibMHe79jodBHgnlHCEJ_X9LjEYM6V5r9h9Cir1MjAcgO4xaHTCbA==

{"jsonrpc":"2.0","id":3,"error":{"code":-32600,"message":"Session ID is required for this operation. Please include a valid session ID in your request headers or initialize a new session first."}}

## 9. The published command for aws___list_regions, run verbatim at 06:20Z
# This is the exact string in the probe record's reproducibility.command field, run as written, so the record's recipe and the record's evidence are the same request.
$ m=https://aws-mcp.us-east-1.api.aws/mcp; H='-H Content-Type:application/json -H Accept:application/json,text/event-stream'; s=$(curl -si -XPOST $m $H -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"public-agents-researcher","version":"1.0"}}}'|tr -d \\r|grep -i ^mcp-session-id:|cut -d' ' -f2-); curl -si -XPOST $m $H -H Mcp-Session-Id:$s -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"aws___list_regions","arguments":{}}}'
HTTP/1.1 200 Connection Established

HTTP/2 200 
content-type: application/json
server: CloudFront
date: Thu, 24 Sep 2026 06:20:23 GMT
mcp-session-id: [redacted by the prober: a per-session id]
x-amzn-requestid: e642178e-0e7a-4b3e-ae8d-18bfc8156335
x-cache: Miss from cloudfront
via: 1.1 279285d02f471d6998962c633bf35f0a.cloudfront.net (CloudFront)
x-amz-cf-pop: BOS50-P5
x-amz-cf-id: dGgOSi1JiheAX6BrU7BgZLMsXbJfaTKsvGA1TX61Y8EDCkGXqDEyAw==

{"jsonrpc":"2.0","id":3,"result":{"content":[{"type":"text","text":"{\"content\":{\"result\":[{\"region_id\":\"af-south-1\",\"region_long_name\":\"Africa (Cape Town)\"},{\"region_id\":\"ap-east-1\",\"region_long_name\":\"Asia Pacific (Hong Kong)\"},{\"region_id\":\"ap-east-2\",\"region_long_name\":\"Asia Pacific (Taipei)\"},{\"region_id\":\"ap-northeast-1\",\"region_long_name\":\"Asia Pacific (Tokyo)\"},{\"region_id\":\"ap-northeast-2\",\"region_long_name\":\"Asia Pacific (Seoul)\"},{\"region_id\":\"ap-northeast-3\",\"region_long_name\":\"Asia Pacific (Osaka)\"},{\"region_id\":\"ap-south-1\",\"region_long_name\":\"Asia Pacific (Mumbai)\"},{\"region_id\":\"ap-south-2\",\"region_long_name\":\"Asia Pacific (Hyderabad)\"},{\"region_id\":\"ap-southeast-1\",\"region_long_name\":\"Asia Pacific (Singapore)\"},{\"region_id\":\"ap-southeast-2\",\"region_long_name\":\"Asia Pacific (Sydney)\"},{\"region_id\":\"ap-southeast-3\",\"region_long_name\":\"Asia Pacific (Jakarta)\"},{\"region_id\":\"ap-southeast-4\",\"region_long_name\":\"Asia Pacific (Melbourne)\"},{\"region_id\":\"ap-southeast-5\",\"region_long_name\":\"Asia Pacific (Malaysia)\"},{\"region_id\":\"ap-southeast-6\",\"region_long_name\":\"Asia Pacific (New Zealand)\"},{\"region_id\":\"ap-southeast-7\",\"region_long_name\":\"Asia Pacific (Thailand)\"},{\"region_id\":\"ca-central-1\",\"region_long_name\":\"Canada (Central)\"},{\"region_id\":\"ca-west-1\",\"region_long_name\":\"Canada West (Calgary)\"},{\"region_id\":\"eu-central-1\",\"region_long_name\":\"Europe (Frankfurt)\"},{\"region_id\":\"eu-central-2\",\"region_long_name\":\"Europe (Zurich)\"},{\"region_id\":\"eu-north-1\",\"region_long_name\":\"Europe (Stockholm)\"},{\"region_id\":\"eu-south-1\",\"region_long_name\":\"Europe (Milan)\"},{\"region_id\":\"eu-south-2\",\"region_long_name\":\"Europe (Spain)\"},{\"region_id\":\"eu-west-1\",\"region_long_name\":\"Europe (Ireland)\"},{\"region_id\":\"eu-west-2\",\"region_long_name\":\"Europe (London)\"},{\"region_id\":\"eu-west-3\",\"region_long_name\":\"Europe (Paris)\"},{\"region_id\":\"eusc-de-east-1\",\"region_long_name\":\"AWS European Sovereign Cloud (Germany)\"},{\"region_id\":\"il-central-1\",\"region_long_name\":\"Israel (Tel Aviv)\"},{\"region_id\":\"me-central-1\",\"region_long_name\":\"Middle East (UAE)\"},{\"region_id\":\"me-south-1\",\"region_long_name\":\"Middle East (Bahrain)\"},{\"region_id\":\"mx-central-1\",\"region_long_name\":\"Mexico (Central)\"},{\"region_id\":\"sa-east-1\",\"region_long_name\":\"South America (Sao Paulo)\"},{\"region_id\"

## 10. The published command for aws___search_documentation, run verbatim at 06:20Z
# This is the exact string in the probe record's reproducibility.command field, run as written, so the record's recipe and the record's evidence are the same request.
$ m=https://aws-mcp.us-east-1.api.aws/mcp; H='-H Content-Type:application/json -H Accept:application/json,text/event-stream'; s=$(curl -si -XPOST $m $H -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"public-agents-researcher","version":"1.0"}}}'|tr -d \\r|grep -i ^mcp-session-id:|cut -d' ' -f2-); curl -si -XPOST $m $H -H Mcp-Session-Id:$s -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"aws___search_documentation","arguments":{"search_phrase":"S3 bucket versioning","limit":2}}}'
HTTP/1.1 200 Connection Established

HTTP/2 200 
content-type: application/json
server: CloudFront
date: Thu, 24 Sep 2026 06:20:26 GMT
mcp-session-id: [redacted by the prober: a per-session id]
x-amzn-requestid: f7ff9d4f-9729-4de1-bbd2-986fe11f4bf5
x-cache: Miss from cloudfront
via: 1.1 0ecab32e793f4646eb3c8243ce51e750.cloudfront.net (CloudFront)
x-amz-cf-pop: BOS50-P5
x-amz-cf-id: SzMygzdqtlD3VTKF_68-Q8egx3Iq96gpCLviqBqjQwyt5aSm84luBg==

{"jsonrpc":"2.0","id":3,"result":{"content":[{"type":"text","text":"{\"content\":{\"result\":[{\"rank_order\":1,\"title\":\"Managing resources effectively on Amazon S3 using AWS CloudFormation | AWS Storage Blog\",\"context\":\"#### **Enable Versioning**\\n\\nS3 Versioning is a means of keeping multiple variants of an object in the same bucket. It is useful to preserve, retrieve, and restore every version of every object stored in your Amazon S3 bucket. With versioning, you can easily recover from both unintended user actions and application failures. To enable versioning, use the `VersionConfiguration` property and set the status for S3 bucket:\\n\\n```\\nVersioningConfiguration:\\n Status: Enabled\\n```\",\"url\":\"https://aws.amazon.com/blogs/storage/managing-resources-effectively-on-amazon-s3-using-aws-cloudformation/\"},{\"rank_order\":2,\"title\":\"Amazon S3 examples using SDK for Java 2.x\",\"context\":\"### PutBucketVersioning\\n\\nThe following code example shows how to use `PutBucketVersioning`.\\n\\n**SDK for Java 2.x**\\n: **Note:**\\n\\n There's more on GitHub. Find the complete example and learn how to set up and run in the\\n AWS Code\\n Examples Repository.\\n\\n ```\\n /**\\n * Enables bucket versioning for the specified S3 bucket.\\n *\\n * @param s3Client the S3 client to use for the operation\\n * @param bucketName the name of the S3 bucket to enable versioning for\\n */\\n public static void enableBucketVersioning(S3Client s3Client, String bucketName){\\n VersioningConfiguration versioningConfiguration = VersioningConfiguration.builder()\\n .status(BucketVersioningStatus.ENABLED)\\n .build();\\n\\n PutBucketVersioningRequest versioningRequest = PutBucketVersioningRequest.builder()\\n .bucket(bucketName)\\n .versioningConfiguration(versioningConfiguration)\\n .build();\\n\\n s3Client.putBucketVersioning(versioningRequest);\\n System.out.println(\\\"Bucket versioning has been enabled for \\\"+bucketName);\\n }\\n\\n ```\\n\\n * For API details, see\\n PutBucketVersioning\\n in *AWS SDK for Java 2.x API Reference*\",\"url\":\"https://docs.aws.amazon.com/code-library/latest/ug/java_2_s3_code_examples.html\"}]}}"}],"isError":false}}