Model Context Protocol (MCP) integration

An MCP server endpoint with appropriate access.

Authentication credentials for the MCP server, if required. For more information, see Prepare MCP server setup and authentication.

An Amazon Quick Enterprise subscription.

If you are connecting to a private MCP server, an active Amazon Quick VPC connection that has network access to the MCP server. For more information, see Configuring VPC connections in Amazon Quick Sight.

Connector passes discovery but fails at publish with Creation failed – This error usually means that one or more tool definitions in your MCP server's tools/list response contain an invalid inputSchema. Amazon Quick validates each tool's inputSchema against JSON Schema Draft 7 or later during the publish phase.

The most common cause is the deprecated Draft 3 syntax, where required is a boolean inside a property definition (for example, "required": true). In JSON Schema Draft 7 and later, required must be an array of property names at the schema root, as a sibling of properties.

Update your tool definitions to use the correct format and redeploy your MCP server. After you redeploy, delete the failed connector and create a new one to retrigger discovery and publish.

The following example shows the incorrect Draft 3 syntax:

{
  "type": "object",
  "properties": {
    "logNumber": {
      "type": "string",
      "description": "The permit log number",
      "required": true
    }
  }
}

The following example shows the correct Draft 7 syntax:

{
  "type": "object",
  "properties": {
    "logNumber": {
      "type": "string",
      "description": "The permit log number"
    }
  },
  "required": ["logNumber"]
}

Some MCP framework libraries and code generators emit Draft 3 syntax by default. Check your framework documentation for the option that selects the JSON Schema output version. You can also validate your schemas with any JSON Schema Draft 7 validator before you deploy. For more information about inputSchema requirements, see Tools in the Model Context Protocol specification.

You might also notice that connector creation hangs for two to five minutes before it fails. The elapsed time reflects internal retries during the publish phase, not a network timeout. The fix is the same: check your tool inputSchema definitions for JSON Schema Draft 7 compliance.

VPC connection is not listed in the Connection type dropdown, or MCP creation fails immediately after you select it – The VPC connection might appear in the dropdown before provisioning is complete. Wait until the VPC connection shows as available on the Amazon Quick admin page before you create an MCP integration against it. For more information, see Configuring VPC connections in Amazon Quick Sight.

MCP creation fails because the MCP server hostname cannot be resolved – Amazon Quick does not use the default VPC DNS resolver for MCP integrations. You must populate the DNS resolver endpoints field on the VPC connection with Route 53 Resolver inbound endpoint IP addresses that can resolve your MCP server hostname. This requirement applies to both private hostnames and to public hostnames that you want to resolve to a private address from within the VPC, such as endpoints fronted by Amazon PrivateLink or a Route 53 private hosted zone. Without these resolver endpoints, the MCP server hostname cannot be resolved and integration creation fails. For more information, see Configuring VPC connections in Amazon Quick Sight.

MCP server is unreachable from the VPC connection – Traffic from Amazon Quick to your MCP server originates from the subnets that you selected during VPC connection setup. Confirm that route tables, network ACLs, and security groups allow traffic between those subnets and the MCP server endpoint. For general VPC networking guidance, see Configuring VPC connections in Amazon Quick Sight.

Authentication fails when you use a private MCP server – When you connect to a private MCP server through a VPC connection, the OAuth endpoints used by the MCP server must still be reachable over the public internet. This applies to both user authentication (authorization and token endpoints) and service authentication (token endpoint). Private OAuth providers are not supported. Confirm that the OAuth URLs that your MCP server returns in its protected resource metadata resolve over the public internet.

AADSTS9010010 – the v2.0 endpoint rejects the resource parameter – Amazon Quick sends a resource parameter on OAuth requests as required by the MCP specification (RFC 8707). The Entra ID v2.0 endpoint rejects requests that include both a resource parameter and scope values. To resolve this error, configure your app registration to use the Entra ID v1.0 OAuth endpoints and set accessTokenAcceptedVersion to 2 in the app manifest.

AADSTS90009 – application requests a token for itself – When you use user authentication (authorization code flow) and the OAuth client and the MCP resource resolve to the same Entra ID application, Entra ID blocks the request. Create two separate app registrations: one client app for Amazon Quick and one resource app for the MCP server. This issue does not affect service authentication (client credentials flow), where a single app registration works.

MCP operations have a fixed 60-second timeout. Operations that exceed this limit automatically fail with an HTTP 424 error.

For MCP servers that you reach through a VPC connection, the OAuth endpoints used by the MCP server must be reachable over the public internet. This applies to both user authentication and service authentication. Private OAuth providers are not supported.

Custom HTTP headers are not supported in MCP operations. Only standard system headers are transmitted.

Tool lists remain static after initial registration. To pick up server-side tool changes, you must delete the integration and recreate it.

Connector creation might fail if the Amazon Quick callback URI is not allow-listed by third-party providers.

Server connectivity issues result in immediate failure without retry attempts.

Step-up authorization is not supported. If an MCP server requires additional scopes after the initial authorization (HTTP 403 with insufficient_scope), then you must re-authorize the entire connection. Incremental permission upgrades are not available.

Scope handling has the following limitations:

Only Dynamic Client Registration (DCR) is supported for automatic client registration. Client ID Metadata Documents are not supported.

Well-known URI discovery uses the server root path only. Path-specific metadata locations (path-insertion discovery) are not supported. This limitation might prevent discovery of servers that serve metadata only at path-specific URIs.