Connecting Claude Code to a Cognito MCP server — a pre-registered client ID, or headersHelper
Two ways to connect Claude Code to an MCP server on Bedrock AgentCore Runtime behind Amazon Cognito, which has no dynamic client registration.
Amazon Cognito
A GitHub Actions job that mints its own Cognito M2M token to test what it just deployed
GitHub OIDC gives CI an AWS identity, but a JWT-authorized MCP endpoint needs a second one: a Cognito client_credentials token read from terraform output.