Four ways Amazon Cognito breaks MCP server auth flows and how to fix them

·4 views

A developer building an OAuth flow for an MCP server discovered four undocumented integration failures between Amazon Cognito and the MCP authorization spec. The first issue arises because Cognito rejects RFC 8707 Resource Indicator parameters that spec-compliant MCP clients like Claude's connector send unconditionally, requiring a thin OAuth proxy to strip the unsupported parameter before requests reach Cognito. A second problem involves audience validation: unlike ID tokens, Cognito access tokens carry no 'aud' claim, so MCP servers must check the 'client_id' field combined with a 'token_use: access' assertion to satisfy the spec's audience requirement. All four issues stem from the friction between two specifications written independently, with none of the failure modes documented in Cognito's standard guides. The findings emerged from a single week of integration work and are shared to help other developers avoid the same hidden pitfalls.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Five Critical Agent Engineering Problems Every AI Developer Should Know

Developers building AI agents are increasingly encountering specific, recurring technical issues that go beyond theoretical questions about agent capabilities. A persistent bug in OpenAI's agent framework causes infinite tool-calling loops when tool_choice is set to required, and the fix requires upgrading to the patched openai-agents-python release rather than adding iteration caps. OpenAI's Assistants API, including its /v1/threads endpoint, is scheduled for full removal on August 26, 2026, with no automated migration tool provided for transferring thread history to the new Conversations format. Microsoft has placed AutoGen in maintenance mode, directing developers to its new Agent Framework — a typed, graph-based system that requires redrawing multi-agent workflows rather than simply translating existing code. Developers are urged to export thread data immediately, audit tool_choice settings, and begin porting Assistants API integrations, as deleted data and expired endpoints cannot be recovered after the deadline.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Pew Study: Google AI Summaries Linked to Nearly Half the Click-Through Rate

A Pew Research Center study of 900 U.S. adults found that Google searches displaying AI-generated summaries resulted in users clicking traditional result links only 8% of the time, compared to 15% when no summary was present. The analysis covered 68,879 Google searches conducted in March 2025 using real-world browsing data from KnowledgePanel Digital. Users were also more likely to end their browsing session after viewing a search page with an AI summary, at 26% versus 16% without one. About 58% of participants encountered at least one AI summary during the month, with the typical summary running around 67 words. The findings suggest that for publishers and businesses relying on search referrals, ranking in results may no longer reliably translate into site visits when the search page itself resolves the query.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Free 50-State US Probate Cost Calculator Using Astro and Tailwind CSS

A developer has launched US Probate Calculator, a free web tool that estimates statutory probate and estate settlement costs across all 50 US states. The tool covers state-specific legal frameworks including attorney fee caps, executor commissions, and court fees, drawing on statutes from states like California, New York, and Florida. Built with Astro and Tailwind CSS and hosted on Cloudflare Pages, the calculator runs entirely client-side, requiring no backend processing. This approach ensures user privacy by eliminating data tracking while also enabling fast load times globally. The tool is publicly accessible at usprobatecalculator.com with no paywalls or registration required.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why AI Agents Need a Durable Cancellation Protocol, Not Just a Stop Button

A simple stop button is insufficient for real-world AI agents, where work may already be queued, in-flight, or triggering external side effects at the moment cancellation is requested. Developers are advised to model cancellation as durable state using a defined run lifecycle: ACTIVE, CANCELLING, CANCELLED, COMPLETED, and UNKNOWN. A versioned cancel_version field stored in a database allows workers to validate whether a dispatch is still permitted, closing race conditions between operator actions and worker execution. Cancellation checks must be enforced at every boundary that can create work, including queue claims, tool dispatches, retries, and outbound deliveries, rather than only at the top of the agent loop. Ambiguous outcomes, such as when a worker process dies mid-request, should be recorded as UNKNOWN and reconciled via provider APIs rather than silently resolved into success or failure.

0 comments Read more at DEV Community