mcp-lambda-sam/template.yaml at main · markvp/mcp-lambda-sam · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: MCP Lambda Layer

Parameters:
  VpcEnabled:
    Type: String
    AllowedValues:
      - "true"
      - "false"
    Default: "false"
    Description: Enable VPC support for Lambda functions
  VpcId:
    Type: String
    Description: VPC ID for Lambda functions
    Default: ""
  SubnetIds:
    Type: CommaDelimitedList
    Description: List of subnet IDs for Lambda functions
    Default: ""
  StackIdentifier:
    Type: String
    Description: Unique identifier for this MCP server instance
    Default: default

Metadata:
  AWS::ServerlessRepo::Application:
    Name: mcp-lambda-sam
    Description: Model Context Protocol implementation using AWS Serverless Application Model (SAM)
    Author: Mark van Proctor
    SpdxLicenseId: MIT
    SemanticVersion: 1.1.0
    LicenseUrl: LICENSE
    ReadmeUrl: README.md
    Labels:
      - mcp
      - lambda
      - serverless
      - modelcontextprotocol
      - aws
      - sam
      - agenticAI
      - cursor
      - claude
    HomePageUrl: https://github.com/markvp/mcp-lambda-sam
    SourceCodeUrl: https://github.com/markvp/mcp-lambda-sam

Conditions:
  UseVpc:
    Fn::Equals:
      - !Ref VpcEnabled
      - "true"

Resources:
  RegistrationTable:
    Type: AWS::Serverless::SimpleTable
    Properties:
      TableName: !Sub ${StackIdentifier}-mcp-registrations
      PrimaryKey:
        Name: id
        Type: String

  SessionTable:
    Type: AWS::Serverless::SimpleTable
    Properties:
      TableName: !Sub ${StackIdentifier}-mcp-sessions
      PrimaryKey:
        Name: sessionId
        Type: String

  LambdaSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Condition: UseVpc
    Properties:
      GroupDescription: Security group for MCP Lambda functions
      VpcId: !Ref VpcId

  LambdaSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Condition: UseVpc
    Properties:
      GroupId: !Ref LambdaSecurityGroup
      IpProtocol: "-1"
      SourceSecurityGroupId: !Ref LambdaSecurityGroup

  McpFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${StackIdentifier}-mcp
      CodeUri: dist/lambdas/mcp
      Handler: index.handler
      Runtime: nodejs20.x
      Timeout: 300
      Policies:
        - AWSLambdaBasicExecutionRole
        - AWSLambdaVPCAccessExecutionRole
        - DynamoDBReadPolicy:
            TableName: !Ref RegistrationTable
        - DynamoDBCrudPolicy:
            TableName: !Ref SessionTable
      Environment:
        Variables:
          REGISTRATION_TABLE_NAME: !Ref RegistrationTable
          SESSION_TABLE_NAME: !Ref SessionTable
      VpcConfig: !If
        - UseVpc
        - SubnetIds: !Ref SubnetIds
          SecurityGroupIds:
            - !Ref LambdaSecurityGroup
        - !Ref AWS::NoValue
      FunctionUrlConfig:
        AuthType: AWS_IAM
        InvokeMode: RESPONSE_STREAM
        Cors:
          AllowOrigins:
            - "*"
          AllowMethods:
            - GET
            - POST
          AllowHeaders:
            - Content-Type

  RegistrationFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${StackIdentifier}-mcp-registration
      CodeUri: dist/lambdas/registration
      Handler: index.handler
      Runtime: nodejs20.x
      Environment:
        Variables:
          REGISTRATION_TABLE_NAME: !Ref RegistrationTable
          MCP_FUNCTION_NAME: !Ref McpFunction
      Policies:
        - VPCAccessPolicy: {}
        - DynamoDBCrudPolicy:
            TableName: !Ref RegistrationTable
        - !Ref McpModifyPermissionsPolicy
      VpcConfig: !If
        - UseVpc
        - SubnetIds: !Ref SubnetIds
          SecurityGroupIds:
            - !Ref LambdaSecurityGroup
        - !Ref AWS::NoValue
      FunctionUrlConfig:
        AuthType: AWS_IAM
        Cors:
          AllowOrigins:
            - "*"
          AllowMethods:
            - GET
            - POST
            - PUT
            - DELETE
          AllowHeaders:
            - Content-Type

  McpModifyPermissionsPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub ${StackIdentifier}-mcp-modify-permissions
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - lambda:AddPermission
              - lambda:RemovePermission
            Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${McpFunction}

Outputs:
  McpFunctionUrl:
    Description: MCP Function URL
    Value: !GetAtt McpFunctionUrl.FunctionUrl
  RegistrationFunctionUrl:
    Description: Registration Function URL
    Value: !GetAtt RegistrationFunctionUrl.FunctionUrl