prometheus-remote-mcp-CDK

The architecture utilizes AWS Lambda, API Gateway, and Cognito, which are robust AWS services for security. JWT validation is handled by a dedicated Lambda authorizer. The core MCP Lambda processes requests using pydantic models, reducing common injection vulnerabilities. The primary security concern is the `update-mcp-config-cloudshell.sh` script, which retrieves and writes `CLIENT_SECRET` to a local `mcp-server-config.json` file. While intended for secure setup in CloudShell, this file needs to be securely managed and ideally deleted post-configuration to prevent exposure of credentials if the deployment environment is compromised. No direct 'eval' or obvious malicious patterns were found in the application logic; `jq` is used for safe JSON manipulation in scripts. IAM roles for Lambda accessing AMP are assumed to be properly configured by the CDK.