The Cognito war stories: four ways it breaks an MCP server, and the fix for each
If you are putting Amazon Cognito behind a remote MCP server, here are four specific ways it will break the connector before you ever reach your own code - each with the symptom, the reason, and the fix that got us through it. All four came out of one week of wiring an agent OAuth flow for cogDepot , and none of them are in the happy-path docs. None of this is competitively sensitive. It is just…
Four ways Amazon Cognito can break an MCP server, along with solutions for each issue:
1. Cognito rejects RFC 8707 resource indicators sent by MCP:
- When using an agent OAuth flow for Cognito, MCP sends access tokens with audience-bound parameters. However, Cognito does not support RFC 8707 and rejects requests with unrecognized parameters.
- This issue occurs at the first hop when the user is redirected to Cognito's /authorize endpoint, preventing the user from seeing the login box.
- The solution is to implement a thin, same-origin OAuth proxy in front of Cognito's /authorize and /token endpoints. The proxy should strip the resource parameter while preserving other necessary claims, such as code_challenge, to avoid breaking PKCE.
2. Cognito access tokens lack the aud claim:
- Access tokens issued by Cognito do not contain the aud claim, which is used for audience validation. This makes audience validation more challenging compared to ID tokens.
- MCP servers must validate that access tokens are issued specifically for them as the intended audience, as per RFC 8707 Section 2.
- To satisfy MCP requirements, audience validation should be implemented based on the client_id and token_use fields present in Cognito access tokens. Compare the client_id against the configured client and ensure token_use equals "access."
3. Managed Login v2 requires client branding styles:
- When switching to Managed Login (version-2 hosted UI) and configuring a new app client, users may encounter the error message "Login pages unavailable. Please contact an administrator."
- The issue arises because Managed Login will not render a login page for a client that lacks a branding style. Unlike the web client, which inherits a default style, the newly-added agent client does not have a branding style applied.
- The fix is to assign a branding style to every client, even if it is a near-clone of another client's style. In Terraform, this can be achieved using the awscc_cognito_managed_login_branding resource (or the equivalent v6 resource). Ensure the branding resource is configured for the agent client, providing a matching palette and logo assets.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
