MCP Lambda SAM

Model Context Protocol (MCP) implementation using AWS Lambda and SAM.

Overview

This project provides a serverless implementation of the Model Context Protocol, with two distinct interfaces:

1. System Configuration (Administrative):

   • Registration of MCP tools, resources, and prompts
   • IAM permission management
   • Infrastructure setup and configuration

2. System Usage (Client):

   • Establishing SSE connections
   • Sending commands
   • Receiving streaming responses

Architecture

Mermaid Diagram

You can visualize the system using this Mermaid syntax:

graph TD
  Client --> MCP[/"MCP Lambda\n(/sse & /message)"/]
  MCP -->|read/write| SessionTable[(Session Table)]
  MCP -->|query| RegistrationTable[(Registration Table)]
  MCP -->|invoke| RegisteredLambda["Registered Lambda Tool"]

  Admin[Administrator] --> RegistrationLambda[/"Registration Lambda\n(/register)"/]
  RegistrationLambda -->|write| RegistrationTable

• The MCP Lambda reads registrations from the Registration Table on startup and when handling requests.
• It uses the Session Table to persist session state.
• It invokes registered Lambda tools dynamically using the ARNs stored in the Registration Table.

System Configuration Guide (Administrators)

This section is for system administrators who need to configure and manage the MCP server.

Deployment

npx @markvp/mcp-lambda-sam deploy

The command will interactively prompt for administrative configuration:

• Stack name (for multiple instances)
• AWS Region
• VPC configuration (optional)

Permissions Overview

To access MCP endpoints, users and clients must have IAM permission to invoke the relevant Function URLs.

• Administrators: must be allowed to invoke the mcp-registration function URL
• Clients: must be allowed to invoke the mcp function URL

You can grant access using either an IAM policy or aws lambda add-permission (see below).

Assigning Permissions via AWS CLI

To grant permission to invoke the registration function URL:

aws lambda add-permission \
  --function-name  \
  --statement-id allow-registration \
  --action lambda:InvokeFunctionUrl \
  --principal "*" \
  --function-url-auth-type IAM

To grant permission to invoke the MCP function URL (SSE and message):

aws lambda add-permission \
  --function-name  \
  --statement-id allow-mcp \
  --action lambda:InvokeFunctionUrl \
  --principal "*" \
  --function-url-auth-type IAM

Replace and with the actual Lambda function names.

Registration API

Use these endpoints to manage MCP tools, resources, and prompts:

Register a New Tool

awscurl -X POST ${REGISTRATION_URL}/register \
  --region ap-southeast-2 \
  --service lambda \
  -H "Content-Type: application/json" \
  -d '{
    "type": "tool",
    "name": "example",