MCP cannot be integrated into Amazon Quick

Q&A
, ,
1

Hi everyone, I’m currently encountering two issues:

  1. After the QS (Quick Suite) system update, I want to integrate a public network MCP. During the step of using Federate for OAuth2 authorization verification, I’m getting an error saying the scope parameter is missing. I did not encounter this issue in the previous version.

  2. How to integrate a VPC-protected MCP with QS — I tried using the built-in VPC authentication, but it doesn’t seem to work properly.

Please provide me with some solutions. Thank you.

图片
图片1216×592 30.3 KB

2

Hi @housjun

Welcome to the Quick Suite community!

The error “invalid_scope” -“The ‘scope’ request parameter is required” is caused by a known behavior in the current Quick Suite MCP client.

Quick Suite determines OAuth2 scopes from the MCP server’s Protected Resource Metadata document (RFC 9728) rather than from the 401 WWW-Authenticate challenge. If the metadata document does not include the scopes_supported field, Quick Suite applies default scopes, which some authorization servers reject.

Regarding the VPC-protected MCP integration - Note: MCP integration supports remote servers only. HTTP streaming is preferred over Server-Sent Events (SSE). Local stdio connections and VPC connectivity are not supported.

Please refer to the following documentation this might be helpful for you.

3

Hi,

I meet the same issue now, which has not happened for the last version.

4

Before the Quick Suite upgrade, my integration method was working correctly. After the upgrade, MCP integration started failing with invalid_scope. I found that if I manually append the scope parameter to the authentication link that Quick Suite pops up, it works normally. So I’m confused about what I need to modify to fix this.

5

Hi @housjun

As per Amazon Quick MCP official documentation, Quick no longer extracts the scope parameter from the 401 WWW-Authenticate challenge (which is likely how it worked for you previously). Instead, it now reads scopes from your MCP server’s Protected Resource Metadata document (RFC 9728).

Please verify that your MCP server serves a Protected Resource Metadata document at, https://<your-mcp-server>/.well-known/oauth-protected-resource and include the scopes_supported field with the scopes your authorization server requires.

Example:

{
"resource": "https://<your-mcp-server>/",
"authorization_servers": ["https://<your-auth-server>/"],
"scopes_supported": ["read", "write", "openid"]
}

When the metadata does not specify supported scopes, Amazon Quick applies default scopes rather than omitting them. This behavior might cause authentication failures with servers that do not recognize the default scopes.