AWS Cognito authentication server for Model Context Protocol
Aws Cognito MCP server exists for a simple reason — assistants are far more useful when they can act on Aws Cognito directly instead of describing what you should do. AWS Cognito authentication server for Model Context Protocol.
Once Aws Cognito is connected, these are the calls the assistant has available:
sign_up — Register a new usersign_up_confirm_code_from_email — Verify account with confirmation codesign_in — Authenticate a usersign_out — Sign out the current usergetCurrentUser — Get the current signed-in userreset_password_send_code — Request password reset codereset_password_veryify_code — Reset password with verification codechange_password — Change password for signed-in userrefresh_session — Refresh the authentication tokensupdate_user_attributes — Update user profile attributesdelete_user — Delete the current signed-in userresend_confirmation_code — Resend account verification codeThe server ships on npm as tsx, so your MCP client can launch it on demand — there is no separate build step. Add the server block to your client's configuration, restart it, and the tools register themselves.
You will need 2 environment variables: AWS_COGNITO_USER_POOL_ID, AWS_COGNITO_USER_POOL_CLIENT_ID. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.
This sits in the developer tooling group, where several servers overlap in what they claim to do but differ sharply once you actually set them up. Aws Cognito's toolset — sign_up, sign_up_confirm_code_from_email, sign_in and 11 more — is a fair guide to whether it matches your workflow. It is maintained by gitCarrot; worth a glance at recent repository activity before you build anything load-bearing on it.
This entry was verified against Aws Cognito's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.
| Tool | What it does |
|---|---|
| sign_up | Register a new user |
| sign_up_confirm_code_from_email | Verify account with confirmation code |
| sign_in | Authenticate a user |
| sign_out | Sign out the current user |
| getCurrentUser | Get the current signed-in user |
| reset_password_send_code | Request password reset code |
| reset_password_veryify_code | Reset password with verification code |
| change_password | Change password for signed-in user |
| refresh_session | Refresh the authentication tokens |
| update_user_attributes | Update user profile attributes |
| delete_user | Delete the current signed-in user |
| resend_confirmation_code | Resend account verification code |
| verify_software_token | Verify TOTP for MFA |
| Debugging | Since MCP servers communicate over stdio, debugging can be challenging. Use the MCP Inspector for better visibility: |
{
"mcpServers": {
"aws-cognito-mcp-server": {
"command": "/path/to/mcp-server-aws-cognito/build/index.js",
"env": {
"AWS_COGNITO_USER_POOL_ID": "your-user-pool-id",
"AWS_COGNITO_USER_POOL_CLIENT_ID": "your-app-client-id"
}
}
}
}Configuration as documented by the project. Restart the client after saving.
| Variable | Description | Required |
|---|---|---|
| AWS_COGNITO_USER_POOL_ID | Configuration value read at startup. | Optional |
| AWS_COGNITO_USER_POOL_CLIENT_ID | Configuration value read at startup. | Optional |
Kill hallucinated APIs — version-accurate, up-to-date library documentation injected straight into context.
Microsoft's official browser automation server — drive a real browser through the accessibility tree, no screenshots needed.
GitHub's official server — repos, issues, pull requests, Actions and code security, straight from your assistant.
Issue tracking at the speed of conversation — Linear's official hosted server with OAuth and zero install.
Local repository surgery — status, diffs, commits, branches and history for any repo on disk.
Timezone sanity for AI — current time anywhere and correct conversions, without the model doing date math.