Connecting Claude Code to a Cognito MCP server — a pre-registered client ID, or headersHelper
Two ways to connect Claude Code to an MCP server on Bedrock AgentCore Runtime behind Amazon Cognito, which has no dynamic client registration.
AgentCore
A GitHub Actions job that mints its own Cognito M2M token to test what it just deployed
GitHub OIDC gives CI an AWS identity, but a JWT-authorized MCP endpoint needs a second one: a Cognito client_credentials token read from terraform output.
Deploying an MCP server on Bedrock AgentCore — Cognito OAuth, and a benchmark that lied
Deploying a Python MCP server on Bedrock AgentCore with Cognito OAuth: the IAM action that is not InvokeModel, and a 225x benchmark that was really 2.3x.