The AWS Partner Central API Reference was restructured. For more information about the supported API operations, see the AWS Partner Central API Reference.

Getting Started with the Partner Central Agent MCP Server

This guide walks you through setting up access to the Partner Central Agent MCP Server. The server supports two authentication methods: OAuth for browser-based sign-in and SigV4 for direct HTTPS access — no proxy or IDE plugin required.

Prerequisites

Before you begin, make sure you have:

For SigV4 authentication only

The following prerequisites apply only to SigV4 authentication.

Step 1: Configure authentication and connect

With the Partner Central Agent MCP Server, you can authenticate using OAuth for browser-based sign-in or SigV4 for direct HTTPS access. Choose the method that best fits your workflow. Your MCP client connects directly to the endpoint — no proxy layer or IDE plugin required.

Endpoint

https://partnercentral-agents-mcp.us-east-1.api.aws/mcp

The Partner Central Agent MCP Server is currently available in US East (N. Virginia) only. You can connect to this endpoint from any location.

Choosing an authentication method

Connect your MCP client

Choose a tab to view setup instructions for your preferred authentication method.

OAuth (simple)

With OAuth, you sign in using the same credentials you use for the AWS Management Console. When you first connect, your MCP client opens a browser window to AWS Sign-In. After you authenticate and authorize access, tokens refresh automatically in the background.

Note

Authorizing an agent does not grant it any additional AWS permissions. AWS evaluates every request against your IAM policies, service control policies, resource control policies, and permission boundaries.

Prerequisites

Grant OAuth sign-in permissions to your IAM role or user. You can attach the AWSMcpServiceActionsFullAccess managed policy, or add the signin:AuthorizeOAuth2Access and signin:CreateOAuth2Token actions to your IAM policy.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "signin:AuthorizeOAuth2Access",
                "signin:CreateOAuth2Token"
            ],
            "Resource": "*"
        }
    ]
}

Note

No explicit Allow for partnercentral:* actions is required for MCP protocol access. The MCP server grants protocol access by default to all authenticated AWS identities. The signin:* permissions above are only needed to enable the browser-based OAuth flow.

Configure your MCP client

Use one of the following clients to connect.

Claude Code CLI

Run the following command:

claude mcp add partnercentral --transport http https://partnercentral-agents-mcp.us-east-1.api.aws/mcp

Claude Desktop

Add as a remote MCP server with the following URL:

https://partnercentral-agents-mcp.us-east-1.api.aws/mcp

Kiro CLI (v3 or later)

Run the following command:

kiro-cli --v3 mcp add --name partnercentral --url https://partnercentral-agents-mcp.us-east-1.api.aws/mcp

Note

OAuth with the Partner Central Agent MCP Server requires Kiro CLI version 3 or later. Earlier versions do not support this flow.

Kiro IDE

Add as a remote MCP server with the following URL:

https://partnercentral-agents-mcp.us-east-1.api.aws/mcp

Amazon Quick

Create a connector and install it in Quick Desktop.

Part 1: Create the connector

Complete the following steps in Amazon Quick.

1. In the left panel of Amazon Quick, open Capabilities → Connectors.

2. Choose Create → Web Connectors. Quick web opens in your default browser.

3. Select the Create for your team tab, then choose Model Context Protocol.

4. Choose No, Create New and enter the following:

   Field	Value
   Name	Partner Central Agents
   Description	MCP to Partner Central Agents
   MCP server endpoint	https://partnercentral-agents-mcp.us-east-1.api.aws/mcp
   Connection type	Public network
   Auth connection type	Public network

5. Choose Next.

6. For Auth configuration, select Default OAuth app.

7. Choose Create and Continue. A browser popup opens to sign in with your Partner Central account — select your existing signed-in account.

8. After the popup closes, choose Next to reach the review section.

9. In the Publish section, select the aliases you want to share the connector with (including your own), or share with your entire organization.

Part 2: Connect in Quick Desktop

Install the connector in your desktop application.

1. In Quick Desktop, open Capabilities.

2. On the Connectors tab, choose Browse More and search for Partner Central Agents. It might take a few minutes to appear.

3. Choose Install.

Note

If your client is not listed, use the endpoint URL above. If tool calls fail due to credential errors, append ?oauth=initialize to the URL to explicitly trigger the OAuth sign-in flow.

SigV4 (advanced)

Use SigV4 to authenticate requests for custom MCP clients, headless agents, CI/CD pipelines, or automation scripts.

Prerequisites

Complete the following steps before connecting.

1. Install the AWS CLI.

2. Sign in and configure credentials: aws configure

3. Verify access: aws sts get-caller-identity

Note

No explicit IAM Allow is required for MCP protocol access. The MCP server grants access by default to all authenticated AWS identities. You only need valid AWS credentials that can sign requests.

Configure

Sign requests using AWS Signature Version 4 with the following parameters:

• Service name: partnercentral-agents-mcp

• Region: us-east-1

Example using awscurl:

awscurl --service partnercentral-agents-mcp --region us-east-1 \
  -X POST -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}' \
  "https://partnercentral-agents-mcp.us-east-1.api.aws/mcp"

Restricting MCP access

By default, all authenticated AWS identities have protocol access to the MCP server. To block MCP access for specific users or accounts, apply an explicit Deny on partnercentral:InvokeMcp:

{
    "Effect": "Deny",
    "Action": "partnercentral:InvokeMcp",
    "Resource": "*"
}

MCP protocol reference

This section describes the JSON-RPC protocol for custom MCP client implementations. If you are using Claude Code, Kiro, or Claude Desktop, your client handles these requests automatically.

The request and response format is identical for both OAuth and SigV4 authentication. The only difference is the HTTP authentication header: OAuth uses Authorization: Bearer <token>, while SigV4 uses AWS signature headers.

Initialize the MCP connection

Send an initialize request to establish the protocol:

{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
        "protocolVersion": "2025-03-26",
        "capabilities": {},
        "clientInfo": {
            "name": "my-partner-client",
            "version": "1.0.0"
        }
    }
}

Expected response:

{
    "jsonrpc": "2.0",
    "id": 1,
    "result": {
        "protocolVersion": "2025-03-26",
        "capabilities": {
            "tools": {
                "listChanged": false
            }
        },
        "serverInfo": {
            "name": "PartnerCentralAgentMCPServer",
            "version": "1.0.0"
        }
    }
}

List available tools

{
    "jsonrpc": "2.0",
    "id": 2,
    "method": "tools/list",
    "params": {}
}

Step 2: Grant data access permissions

When you connect to the MCP server, you have protocol access only. To perform Partner Central operations such as querying opportunities or managing funding, you need additional IAM permissions. The following sections describe how to attach policies and the available permission levels.

Attaching IAM policies

To attach a policy to your IAM identity using the AWS Management Console:

The permissions take effect immediately. You can attach multiple policies to the same identity.

Recommended: Use the managed policy

The simplest way to grant data access permissions is to attach the AWSPartnerCentralFullAccess managed policy to your IAM identity. This policy includes permissions for all Partner Central operations available through the MCP server.

For fine-grained control, use the custom policies in the following sections to grant only the specific actions your use case requires.

Data access permissions

To actually perform Partner Central operations through the agent, you need additional permissions based on your use case.

Opportunity management:

{
    "Effect": "Allow",
    "Action": [
        "partnercentral:List*",
        "partnercentral:Get*",
        "partnercentral:CreateOpportunity",
        "partnercentral:UpdateOpportunity",
        "partnercentral:SubmitOpportunity",
        "partnercentral:AssignOpportunity",
        "partnercentral:AssociateOpportunity",
        "partnercentral:DisassociateOpportunity"
    ],
    "Resource": "*"
}

Funding programs:

{
    "Effect": "Allow",
    "Action": [
        "partnercentral:ListBenefitAllocations",
        "partnercentral:ListBenefitApplications",
        "partnercentral:CreateBenefitApplication",
        "partnercentral:GetBenefitApplication",
        "partnercentral:UpdateBenefitApplication",
        "partnercentral:SubmitBenefitApplication",
        "partnercentral:AmendBenefitApplication",
        "partnercentral:CancelBenefitApplication",
        "partnercentral:RecallBenefitApplication",
        "partnercentral:AssociateBenefitApplicationResource",
        "partnercentral:DisassociateBenefitApplicationResource"
    ],
    "Resource": "*"
}

Marketplace access:

{
    "Effect": "Allow",
    "Action": [
        "aws-marketplace:DescribeEntity",
        "aws-marketplace:DescribeAgreement",
        "aws-marketplace:SearchAgreements",
        "aws-marketplace:ListEntities"
    ],
    "Resource": "*"
}

Partner Central Onboarding:

{
    "Effect": "Allow",
    "Action": [
        "partnercentral:ListPartners",
        "partnercentral:GetPartner",
        "partnercentral:GetProfileVisibility",
        "partnercentral:GetAllianceLeadContact",
        "partnercentral:GetProfileUpdateTask",
        "partnercentral:StartProfileUpdateTask",
        "partnercentral:CancelProfileUpdateTask",
        "partnercentral:PutProfileVisibility",
        "partnercentral:PutAllianceLeadContact",
        "partnercentral:SendEmailVerificationCode",
        "partnercentral:AssociateAwsTrainingCertificationEmailDomain",
        "partnercentral:DisassociateAwsTrainingCertificationEmailDomain",
        "partnercentral:GetAccountConnections",
        "partnercentral:GetConnectionInvitations",
        "partnercentral:CreateConnectionInvitation",
        "partnercentral:CancelConnectionInvitation",
        "partnercentral:RespondConnectionInvitation",
        "partnercentral:CancelConnection",
        "partnercentral:ManageConnectionPreferences"
    ],
    "Resource": "*"
}

For Marketplace seller setup, also add:

{
    "Effect": "Allow",
    "Action": [
        "aws-marketplace:ListEntities",
        "aws-marketplace:DescribeEntity",
        "aws-marketplace:DescribeChangeSet",
        "aws-marketplace:StartChangeSet"
    ],
    "Resource": "*"
}

For service-linked role management (Resale Authorizations/CPPO):

{
    "Effect": "Allow",
    "Action": [
        "iam:GetRole",
        "iam:CreateServiceLinkedRole"
    ],
    "Resource": "*"
}

Full access policy

For development and testing, you can combine all permissions into a single policy:

aws iam create-policy \
    --policy-name PartnerCentralAgentsFullAccess \
    --policy-document '{
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "partnercentral:List*",
                    "partnercentral:Get*",
                    "partnercentral:CreateOpportunity",
                    "partnercentral:UpdateOpportunity",
                    "partnercentral:SubmitOpportunity",
                    "partnercentral:AssignOpportunity",
                    "partnercentral:AssociateOpportunity",
                    "partnercentral:DisassociateOpportunity",
                    "partnercentral:CreateResourceSnapshot",
                    "partnercentral:CreateResourceSnapshotJob",
                    "partnercentral:StartResourceSnapshotJob",
                    "partnercentral:CreateEngagement",
                    "partnercentral:CreateEngagementInvitation",
                    "partnercentral:RejectEngagementInvitation",
                    "partnercentral:StartEngagementByAcceptingInvitationTask",
                    "partnercentral:StartEngagementFromOpportunityTask",
                    "partnercentral:CreateBenefitApplication",
                    "partnercentral:UpdateBenefitApplication",
                    "partnercentral:SubmitBenefitApplication",
                    "partnercentral:AmendBenefitApplication",
                    "partnercentral:CancelBenefitApplication",
                    "partnercentral:RecallBenefitApplication",
                    "partnercentral:AssociateBenefitApplicationResource",
                    "partnercentral:DisassociateBenefitApplicationResource",
                    "partnercentral:ListPartners",
                    "partnercentral:StartProfileUpdateTask",
                    "partnercentral:CancelProfileUpdateTask",
                    "partnercentral:PutProfileVisibility",
                    "partnercentral:PutAllianceLeadContact",
                    "partnercentral:SendEmailVerificationCode",
                    "partnercentral:AssociateAwsTrainingCertificationEmailDomain",
                    "partnercentral:DisassociateAwsTrainingCertificationEmailDomain",
                    "partnercentral:CreateConnectionInvitation",
                    "partnercentral:CancelConnectionInvitation",
                    "partnercentral:RespondConnectionInvitation",
                    "partnercentral:CancelConnection",
                    "partnercentral:ManageConnectionPreferences"
                ],
                "Resource": "*"
            },
            {
                "Effect": "Allow",
                "Action": [
                    "aws-marketplace:DescribeEntity",
                    "aws-marketplace:DescribeAgreement",
                    "aws-marketplace:SearchAgreements",
                    "aws-marketplace:ListEntities",
                    "aws-marketplace:DescribeChangeSet",
                    "aws-marketplace:StartChangeSet"
                ],
                "Resource": "*"
            },
            {
                "Effect": "Allow",
                "Action": [
                    "iam:GetRole",
                    "iam:CreateServiceLinkedRole"
                ],
                "Resource": "*"
            }
        ]
    }'

Read-only policy

For production environments or read-only use cases, restrict permissions to read operations:

aws iam create-policy \
    --policy-name PartnerCentralAgentReadOnly \
    --policy-document '{
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "partnercentral:List*",
                    "partnercentral:Get*"
                ],
                "Resource": "*"
            },
            {
                "Effect": "Allow",
                "Action": [
                    "aws-marketplace:DescribeEntity",
                    "aws-marketplace:DescribeAgreement",
                    "aws-marketplace:SearchAgreements",
                    "aws-marketplace:ListEntities",
                    "aws-marketplace:DescribeChangeSet"
                ],
                "Resource": "*"
            },
            {
                "Effect": "Allow",
                "Action": [
                    "iam:GetRole"
                ],
                "Resource": "*"
            }
        ]
    }'

Signing your calls with MCP header

When making requests to Partner Central agents MCP, we recommend including the custom MCP header using the following methods to help AWS identify the source of the client application, monitor usage, and audit performance. AWS uses this header to distinguish the type of client application making the call and to gather insights about the success rate of different client implementations.

Method 1: _meta field (programmatic/stateless MCP)

For code that directly constructs MCP tools/call requests, provide the _meta field on requests.

{
    "method": "tools/call",
    "params": {
        "name": "sendMessage",
        "arguments": {
            "content": [
                {
                    "type": "text",
                    "text": "List my open opportunities with expected close date in Q1 2026"
                }
            ],
            "catalog": "AWS"
        },
        "_meta": {
            "integrator": "<Integrator's Company Name / Direct>",
            "sourceProduct": "<Integrator's Application Name>"
        }
    }
}

Method 2: clientInfo (session-based custom agents)

For custom MCP clients establishing sessions, provide MCP header info inside the clientInfo field:

{
    "method": "initialize",
    "params": {
        "protocolVersion": "2024-11-05",
        "clientInfo": {
            "integrator": "<Integrator's Company Name / Direct>",
            "sourceProduct": "<Integrator's Application Name>"
        }
    }
}

Fields in clientInfo:

Method 3: URL parameter (hosted MCP only)

Only for hosted MCP clients where the integrator cannot modify protocol fields. Use the URL parameter:

Server URL: https://partnercentral-agents-mcp.us-east-1.api.aws/mcp?appId=<Integrator's Company Name / Direct>

Step 3: Verify your setup

Send a simple message to confirm everything is working. Use the Sandbox catalog for testing:

{
    "jsonrpc": "2.0",
    "id": 3,
    "method": "tools/call",
    "params": {
        "name": "sendMessage",
        "arguments": {
            "content": [
                {
                    "type": "text",
                    "text": "Hello, what can you help me with?"
                }
            ],
            "catalog": "Sandbox"
        }
    }
}

If you receive a response with "status": "complete" and a text reply from the agent, your setup is working correctly. The response will also include a sessionId that you can use for follow-up messages.

Step 4: Run your first tasks

Query your opportunities

{
    "jsonrpc": "2.0",
    "id": 4,
    "method": "tools/call",
    "params": {
        "name": "sendMessage",
        "arguments": {
            "sessionId": "session-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
            "content": [
                {
                    "type": "text",
                    "text": "List my open opportunities with expected revenue over $50K"
                }
            ],
            "catalog": "AWS"
        }
    }
}

Check funding eligibility

{
    "jsonrpc": "2.0",
    "id": 5,
    "method": "tools/call",
    "params": {
        "name": "sendMessage",
        "arguments": {
            "sessionId": "session-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
            "content": [
                {
                    "type": "text",
                    "text": "Am I eligible for MAP funding for opportunity O1234567890?"
                }
            ],
            "catalog": "AWS"
        }
    }
}

Retrieve session history

{
    "jsonrpc": "2.0",
    "id": 6,
    "method": "tools/call",
    "params": {
        "name": "getSession",
        "arguments": {
            "sessionId": "session-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
            "catalog": "AWS"
        }
    }
}

Partner onboarding

{
    "jsonrpc": "2.0",
    "id": 7,
    "method": "tools/call",
    "params": {
        "name": "sendMessage",
        "arguments": {
            "sessionId": "session-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
            "content": [
                {
                    "type": "text",
                    "text": "Help me onboard to Partner Central"
                }
            ],
            "catalog": "AWS"
        }
    }
}

Other onboarding tasks to try:

Security considerations

Troubleshooting

The following table lists common errors and their resolutions.

Next steps