fix(mcp): pin mcp-proxy-for-aws and its floating AWS SDK deps

[mittalpk]

Fixes #255.

Root cause

mcp-proxy-for-aws@latest (via uvx) doesn't just re-check the top-level package on each launch — it re-resolves the entire dependency tree. mcp-proxy-for-aws declares botocore[crt]>=1.41.0 and boto3>=1.41.0 with no upper bound (checked its published metadata), and both AWS SDK packages release very frequently (multiple times a month). Whenever a newer botocore/boto3 release exists on PyPI at launch time, uv resolves a different set of packages and caches it as a brand-new environment — the old one is never cleaned up.

I verified this isn't just a top-level-version problem: even with mcp-proxy-for-aws pinned to an exact version and botocore/boto3 left unpinned, resolving at two different points in time (via uv's --exclude-newer, to simulate real time passing between sessions) produced two different botocore downloads and grew the cache from 141M to 205M. Fully pinning mcp-proxy-for-aws and botocore[crt]/boto3 together resolved successfully and stayed byte-for-byte stable (145M, no growth) across repeated invocations and across different simulated resolution windows.

This matches the reporter's observation: ~1,250 accumulated environments, 138GB, reclaimed by a manual uv cache clean.

Fix

Pinned mcp-proxy-for-aws to its current release (1.6.6) and added explicit --with botocore[crt]==1.43.93 / --with boto3==1.43.93 constraints, in the three plugins that invoke it directly: amazon-location-service, sagemaker-ai, aws-amplify.

The other five plugins (deploy-on-aws, aws-serverless, databases-on-aws, aws-transform, codebase-documentor-for-aws) invoke AWS's own first-party awslabs.*-mcp-server packages via @latest — a different package family with its own release cadence, not affected by this specific mechanism, and left untouched.

Tradeoff, flagged for maintainer judgment

This trades unbounded cache growth for a version that needs periodic manual bumping (mcp-proxy-for-aws, botocore, boto3) as new releases ship. I didn't see a Dependabot/Renovate config that tracks Python version strings embedded in .mcp.json args arrays — happy to add one if there's a preferred mechanism, but didn't want to introduce new tooling unprompted (per CLAUDE.md's "never add new dependencies without asking first").

How did you test it

This is an environment/config fix, not application logic, so there's no automated regression test to add — I verified the underlying uv caching mechanism directly:

• Confirmed mcp-proxy-for-aws's published dependency metadata (botocore[crt]>=1.41.0, boto3>=1.41.0, no upper bound).
• Reproduced the growth: pinned-top-level-only resolution at two different --exclude-newer cutoffs grew the cache (141M → 205M) with genuinely different botocore downloads each time.
• Verified the fix: the fully-pinned combination (mcp-proxy-for-aws==1.6.6 + botocore[crt]==1.43.93 + boto3==1.43.93) resolves successfully, runs correctly (confirmed --help output and a real stdio server startup against the actual endpoint URL), and produces zero cache growth across repeated invocations and across different simulated time windows.
• python3 -m json.tool on all 3 changed files: valid.
• npx ajv-cli validate -s schemas/mcp.schema.json -d 'plugins/**/.mcp.json': all 8 .mcp.json files (including the 3 changed ones) valid against the repo's own schema.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.

[Copilot]

🔵 Needs a closer look

Transitive dependencies such as awscrt remain unpinned, so cache growth can recur.

Pull request overview

Pins mcp-proxy-for-aws and AWS SDK dependencies in three MCP plugin configurations to reduce uvx cache growth.

Changes:

• Pins mcp-proxy-for-aws to 1.6.6.
• Pins botocore[crt] and boto3 to 1.43.93.
• Leaves unrelated AWS MCP packages unchanged.

File summaries

File	Description
plugins/sagemaker-ai/.mcp.json	Pins proxy and SDK dependencies.
plugins/aws-amplify/.mcp.json	Pins proxy and SDK dependencies.
plugins/amazon-location-service/.mcp.json	Pins proxy and SDK dependencies.

Review details

Suppressed comments (3)

plugins/amazon-location-service/.mcp.json:9

• These pins still leave the uvx environment non-reproducible: botocore[crt] resolves awscrt, and boto3/botocore resolve other ranged transitive dependencies. A future release of any of those packages will cause uv to create another cached environment, so the unbounded-cache problem can recur despite these three pins. Pin the complete resolved dependency set (ideally with a checked-in lock/requirements wrapper) or automate updates for every transitive dependency.

        "--with",
        "botocore[crt]==1.43.93",
        "--with",
        "boto3==1.43.93",
        "mcp-proxy-for-aws==1.6.6",

plugins/aws-amplify/.mcp.json:9

• These pins still leave the uvx environment non-reproducible: botocore[crt] resolves awscrt, and boto3/botocore resolve other ranged transitive dependencies. A future release of any of those packages will cause uv to create another cached environment, so the unbounded-cache problem can recur despite these three pins. Pin the complete resolved dependency set (ideally with a checked-in lock/requirements wrapper) or automate updates for every transitive dependency.

        "--with",
        "botocore[crt]==1.43.93",
        "--with",
        "boto3==1.43.93",
        "mcp-proxy-for-aws==1.6.6",

plugins/sagemaker-ai/.mcp.json:10

• These pins still leave the uvx environment non-reproducible: botocore[crt] resolves awscrt, and boto3/botocore resolve other ranged transitive dependencies. A future release of any of those packages will cause uv to create another cached environment, so the unbounded-cache problem can recur despite these three pins. Pin the complete resolved dependency set (ideally with a checked-in lock/requirements wrapper) or automate updates for every transitive dependency.

        "--with",
        "botocore[crt]==1.43.93",
        "--with",
        "boto3==1.43.93",
        "mcp-proxy-for-aws==1.6.6",

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

This pull request is now marked as stale because it hasn't seen activity for a while. Add a comment or it will be closed soon. If you wish to exclude this issue from being marked as stale, add the "backlog" label.

[mittalpk]

Still relevant: main still launches mcp-proxy-for-aws@latest in all three plugins and #255 is open. I can rebase and refresh the pinned versions whenever a maintainer is ready to look.