# MCP Configuration for the Aurora DSQL Skill

This skill PREFERS direct `psql` execution (via [`scripts/psql-connect.sh`](../scripts/psql-connect.sh))
for ad-hoc DSQL queries, and the official **AWS MCP Server** for AWS knowledge lookups and AWS API
access.

## When to use which

| Need                                                | Use                                                                        |
|-----------------------------------------------------|----------------------------------------------------------------------------|
| Run an ad-hoc SELECT / DDL / DML against a cluster  | [`scripts/psql-connect.sh`](../scripts/psql-connect.sh)                    |
| Look up DSQL service limits, docs, or skills        | AWS MCP Server `aws___search_documentation` / `aws___read_documentation`   |
| Make an AWS API call (`dsql:`, `iam:`, etc.)        | AWS MCP Server `aws___call_aws`                                            |
| Run a sandboxed Python script that calls AWS APIs   | AWS MCP Server `aws___run_script`                                          |
| Application code (Python, JS, Java, Go, Rust, etc.) | The language-specific [DSQL Connector](https://docs.aws.amazon.com/aurora-dsql/latest/userguide/aws-sdks.html) |

## AWS MCP Server (recommended)

The AWS MCP Server is the canonical AWS knowledge + API integration for coding assistants. It
ships with knowledge tools (`aws___search_documentation`, `aws___read_documentation`,
`aws___recommend`, `aws___retrieve_skill`, `aws___list_regions`, `aws___get_regional_availability`)
and AWS API tools (`aws___call_aws`, `aws___run_script`, `aws___get_tasks`,
`aws___get_presigned_url`).

See [mcp-tools.md](mcp-tools.md) for the canonical surface and per-tool detail; the official tool
list lives at
[Understanding the MCP Server tools](https://docs.aws.amazon.com/aws-mcp/latest/userguide/understanding-mcp-server-tools.html).

**Setup:** Follow the official guide at
[Setting up the AWS MCP Server](https://docs.aws.amazon.com/aws-mcp/latest/userguide/getting-started-aws-mcp-server.html).
The setup steps differ per coding assistant (Claude Code, Gemini, Codex, Kiro, etc.) — defer to
the AWS docs page rather than caching invocation details here.

After installation, this skill will use `aws___search_documentation` to verify DSQL service limits
on demand (see the limit table in [SKILL.md](../SKILL.md#aws-knowledge-via-the-aws-mcp-server-optional)).

## Credential reminder

Whichever path you use:

- Tokens generated by `aws dsql generate-db-connect-auth-token` expire after 15 minutes — never
  persist them, regenerate per session
- Reserve `generate-db-connect-admin-auth-token` for cluster setup, role grants, and DDL; use
  the scoped variant for app workloads
- Always use `sslmode=verify-full` (or at minimum `require`) — DSQL rejects non-TLS connections

For end-to-end credential and connection guidance, see [authentication-guide.md](auth/authentication-guide.md).