feat(mcp): MCP examples hub — Framework-hosted, custom hosting, and authentication

[czubocha]

Summary

An mcp/ hub for Model Context Protocol servers on AWS, in two families plus a shared client, so the directory answers both questions a reader arrives with: what is the shortest path to a deployed MCP server, and how do I hold it a different way.

Framework-hosted — the mcp property does the hosting:

Example	What it shows
minimal	Two files and one line of configuration: streaming endpoint, progress notifications, MCP Inspector, curl, and Claude Code against the raw endpoint
oauth-cognito	The zero-code gate — a user pool, scope, and machine-to-machine client declared in resources:, validated by API Gateway itself; plus the interactive browser-login walkthrough behind a root-mapped custom domain
oauth-authorizer	Bring your own verification in a Lambda authorizer (Auth0 here, any OIDC issuer works), with the request-shape rules that decide whether your function ever sees what it expects
oauth-in-module	The MCP SDK's own requireBearerAuth inside the module: specification-shaped challenges, scope-aware 403s, and the caller's identity in every tool

Custom hosting — mcp/custom serves one identical server through seven front doors (a hand-written Lambda adapter, Hono, Express and Fastify behind Lambda Web Adapter, API Gateway REST, a Function URL, and Bedrock AgentCore runtime and gateway), so the glue each approach costs is visible side by side. The two existing AgentCore MCP examples adopt the same server and client, so a reader comparing hosting choices is comparing like with like.

The hub README carries the client-capability matrix that applies to every example and a runnable script built on the official SDK client.

Notes for reviewers

• Each README is self-contained and shows real request/response output — the failure shapes as well as the working calls, since the failure shapes are what a reader actually meets first.
• Authentication examples pair with the Framework's authorizer and oauthDiscovery keys (feat(mcp): user-supplied authorizers and OAuth discovery for MCP servers serverless#13784) and say clearly which layer rejects what: API Gateway's bare 401/403 at the gateway, the specification's challenge only from the in-module gate.
• Where a client's behavior decides the outcome — browser login needing a root-mapped custom domain, an issuer needing dynamic client registration for a URL-only connection — the README states the requirement and the one command that tells you which side is refusing.

Verification

Every example was deployed and exercised command-for-command from its own README against real AWS — every documented curl, MCP Inspector call, and Claude Code invocation — then torn down, with the two factual corrections that surfaced folded back into the text. The interactive login and elicitation round trip were confirmed with a real client. node validate.js and the generated index are green.