From aws-sso-mcp
Automatically refresh AWS SSO authentication tokens when encountering expiration errors. Use when AWS MCP tools fail due to expired SSO sessions.
npx claudepluginhub veelenga/aws-sso-mcp --plugin aws-sso-mcpThis skill uses the workspace's default tool permissions.
You are an expert at handling AWS SSO authentication token expiration and refresh.
Configures AWS MCP servers for documentation search and API access, covering full server with uvx/AWS credentials and lightweight docs-only version. Checks existing setups via CLI tools and config files.
Executes 15,000+ AWS APIs with SigV4, searches documentation, retrieves SOPs for workflows like VPC setup and Lambda deployment. Use for AWS CLI, API calls, tasks, or automation.
Provide comprehensive techniques for penetration testing AWS cloud environments. Covers IAM enumeration, privilege escalation, SSRF to metadata endpoint, S3 bucket exploitation, Lambda code extraction, and persistence techniques for red team operations.
Share bugs, ideas, or general feedback.
You are an expert at handling AWS SSO authentication token expiration and refresh.
Activate this skill when you encounter AWS SSO token expiration errors, such as:
Use the mcp__aws-sso__refresh_aws_sso_token tool. It automatically:
When an MCP tool fails, pass the server name to automatically find the correct profile:
mcp__aws-sso__refresh_aws_sso_token(server: "bedrock-kb")
The tool searches multiple MCP client configs (Claude Code, Claude Desktop, Cursor, VS Code, Gemini CLI, etc.) to find the AWS_PROFILE for that server.
If you know the profile name:
mcp__aws-sso__refresh_aws_sso_token(profile: "MCPServerReadAccess")
Note: At least one of server or profile must be provided. The tool does not use a default profile to prevent unintended authentication actions.
When an AWS MCP operation fails due to expired tokens:
Identify the failing MCP server: Note which tool failed (e.g., mcp__bedrock-kb__* → server is bedrock-kb)
Call the refresh tool with the server name:
mcp__aws-sso__refresh_aws_sso_token(server: "bedrock-kb")
Inform the user: "Your AWS SSO session has expired. Please complete the authentication in your browser."
Wait for completion: The tool will return success/failure status
Retry the operation: Once refreshed, retry the original AWS operation
Tool mcp__bedrock-kb__ListKnowledgeBases fails:
Error: Token has expired and refresh failed
Response:
mcp__aws-sso__refresh_aws_sso_token(server: "bedrock-kb")
Result:
{
"success": true,
"profile": "MCPServerReadAccess",
"profileSource": "mcp_config",
"message": "Successfully refreshed SSO token for profile \"MCPServerReadAccess\"."
}
Then retry ListKnowledgeBases.
The tool automatically searches these config locations:
| Client | Config Location |
|---|---|
| Claude Code | .mcp.json |
| Claude Desktop | Platform app support directory |
| Cursor | .cursor/mcp.json |
| VS Code | .vscode/mcp.json |
| Gemini CLI | .gemini/settings.json |
| Copilot CLI | ~/.copilot/mcp-config.json |
| Amazon Q | ~/.aws/amazonq/mcp.json |
| Cline | VS Code extension settings |
server parameter to find the correct profile automaticallyserver or profile parameter