build1 publisher
AWS runs four JWT claim gates in one Lambda before an MCP tool call reaches its data
The pattern treats each MCP tool invocation on Amazon Quick as an access event and checks MFA, country, group-to-role mapping and tool permission against claims Entra ID puts in the token. Configuring the identity provider is most of the work.
Publishers:aws.amazon.com
Reality
- Evidence54
- Adoption
- Insufficient
- Hype gap+18
- Incentives82
- Confidence58