docs: add AWS MCP Server remote connection guide

app/en/operate/governance/remote-mcp-servers/_meta.tsx

@@ -28,6 +28,9 @@ const meta: MetaRecord = {
   splunk: {
     title: "Splunk",
   },
+  aws: {
+    title: "AWS",
+  },
 };
 
 export default meta;

app/en/operate/governance/remote-mcp-servers/aws/page.mdx

@@ -0,0 +1,116 @@
+---
+title: "Connect the AWS MCP Server"
+description: "Connect Arcade to the AWS-managed MCP Server using AWS Sign-In OAuth, with access governed entirely by IAM"
+---
+
+import { Callout, Steps } from "nextra/components";
+import { SignupLink } from "@/app/_components/analytics";
+
+# Connect the AWS MCP Server
+
+AWS hosts a managed **AWS MCP Server** that gives agents access to AWS APIs across thousands of operations, authorized through **AWS Sign-In** using the same identities, permissions, and governance model you already use with the AWS Management Console and CLI. This guide covers the Arcade-side setup for connecting it as a [remote MCP server](/operate/governance/remote-mcp-servers), plus the AWS settings that most commonly trip people up.
+
+<Callout type="info">
+  This guide is about connecting to the AWS MCP Server, not an Arcade
+  toolkit. Arcade doesn't ship an AWS toolkit today, so this remote server
+  is currently the only way to reach AWS APIs through Arcade. It's a fixed,
+  AWS-defined tool set, not something a customer can extend, so that
+  advantage goes away if Arcade ships a native toolkit for it later.
+</Callout>
+
+<Callout type="info">
+  The AWS-side steps below are sourced directly from [AWS's own OAuth
+  documentation](https://docs.aws.amazon.com/signin/latest/userguide/aws-mcp-server.html)
+  for this server.
+</Callout>
+
+AWS's setup is structurally closer to Atlassian than to the other guides in this section: the AWS MCP Server uses **OAuth 2.1 with Dynamic Client Registration (DCR)**, so Arcade registers itself as a client automatically. There's no manual OAuth app to create and no Client ID/Secret to copy. The administrative work is entirely about **which IAM identity authorizes the connection and what that identity is permitted to do**, because authorizing an agent grants it no additional AWS permissions. It acts strictly within the authorizing identity's existing IAM policies.
+
+<GuideOverview>
+<GuideOverview.Outcomes>
+
+Connect the AWS MCP Server to Arcade and use its tools in gateways and SDKs.
+
+</GuideOverview.Outcomes>
+
+<GuideOverview.Prerequisites>
+
+- An <SignupLink linkLocation="docs:remote-mcp-servers-aws">Arcade account</SignupLink>
+- An AWS account, and an IAM identity (user or role) you'll authorize the connection as
+- Permission to attach an IAM policy to that identity
+
+</GuideOverview.Prerequisites>
+
+<GuideOverview.YouWillLearn>
+
+- Which IAM permissions the authorizing identity needs, and why access is governed entirely by IAM
+- Register the remote server in Arcade without manually configuring OAuth credentials
+- Diagnose the most common setup mistakes from their error messages
+
+</GuideOverview.YouWillLearn>
+</GuideOverview>
+
+## Set up AWS
+
+Because access runs entirely through the authorizing identity's IAM permissions, setting up AWS mainly means granting that identity the permissions to complete the OAuth flow.
+
+- **Grant the authorizing identity the OAuth permissions.** Attach the AWS managed policy [`AWSMCPSignInOAuthAccessPolicy`](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMCPSignInOAuthAccessPolicy.html) to the IAM user or role you'll sign in as:
+
+  ```
+  aws iam attach-role-policy \
+    --role-name MyRole \
+    --policy-arn arn:aws:iam::aws:policy/AWSMCPSignInOAuthAccessPolicy
+  ```
+
+  This grants the two permissions the interactive OAuth flow needs: `signin:AuthorizeOAuth2Access` and `signin:CreateOAuth2Token`. (If you authorize as the account root user, no extra IAM permissions are required, but a scoped role is the better practice.)
+
+- **Understand what the authorized connection can actually do.** These two permissions only let the identity complete the OAuth handshake. They don't grant any AWS service access. Every tool call the AWS MCP Server makes afterward runs under the authorizing identity's own IAM policies. Whatever that identity can't do in the Console or CLI, it can't do through the MCP server either. Scope the authorizing role to exactly the AWS access you intend agents to have, since that role's policies *are* the access-control boundary for everything Arcade does here.
+
+- **Pick the region deliberately.** The AWS MCP Server endpoint and its OAuth resources are region-specific. Use the region where you intend to operate, and keep it consistent between the server URL and the authorizing session.
+
+<Callout type="info">
+  All OAuth activity (authorization requests, token issuance,
+  introspection, revocation, along with the OAuth client, redirect URI, and
+  originating sign-in session) is recorded in **AWS CloudTrail**, so
+  administrators can correlate downstream AWS API calls back to the
+  originating authorization. This is worth knowing for audit and incident
+  response.
+</Callout>
+
+## Configure the remote server in Arcade
+
+<Steps>
+
+### Register the server
+
+Go to the [MCP servers dashboard](https://app.arcade.dev/servers), click **Add Server**, choose **Remote MCP**, and enter a server ID and the AWS MCP Server endpoint for your region:
+
+```
+https://aws-mcp.<region>.api.aws/mcp
+```
+
+For example, `https://aws-mcp.us-west-2.api.aws/mcp`. The region in the URL should match the region of the identity and session you authorize with.
+
+### Configure OAuth2 authorization
+
+Open **Advanced settings → OAuth2 authorization** and **leave Client ID, Client Secret, Authorization URL, and Token URL empty.** This is the same guidance as Atlassian, and the opposite of the ECA-style providers: the AWS MCP Server supports Dynamic Client Registration, so Arcade registers a client and discovers the authorization server automatically on first connection. There's nothing to create on the AWS side to populate these fields, and there's no redirect URI to manually configure on an AWS OAuth app. The redirect URI is matched against AWS's DCR allowlist, not a per-account setting.
+
+### Authorize and confirm
+
+Save the server to open the authorization prompt. Sign in through AWS Sign-In as the IAM identity you scoped above and approve the authorization request. AWS Sign-In issues an access token (valid up to one hour, auto-refreshed via a rotating single-use refresh token while your session lasts), and the connection lists the tools that identity is permitted to reach.
+
+</Steps>
+
+## Troubleshooting
+
+- **"Agent cannot register as an OAuth client" during connection**: Arcade's redirect URI isn't on AWS Sign-In's DCR allowlist for this. Confirm `https://cloud.arcade.dev/api/v1/oauth/*` appears in [AWS's Supported Redirect URIs table](https://docs.aws.amazon.com/signin/latest/userguide/aws-mcp-server.html#aws-mcp-server-supported-redirect-uris). This is resolved on AWS's side, not through Arcade configuration.
+- **"Permission denied" when connecting**: the authorizing IAM identity is missing `signin:AuthorizeOAuth2Access` and/or `signin:CreateOAuth2Token`. Attach `AWSMCPSignInOAuthAccessPolicy` to that identity.
+- **The connection authorizes, but specific tool calls fail with access-denied errors**: the authorizing identity's own IAM policies don't permit that AWS action. This isn't an MCP or Arcade issue: authorizing the agent grants no permissions beyond what the identity already has. Broaden the role's IAM policies (deliberately) or re-authorize as an identity with the needed access.
+- **"Invalid target resource"**: the endpoint region or resource is off. Confirm the server URL uses the `https://aws-mcp.<region>.api.aws/mcp` pattern with a supported region.
+- **Access stops working after about an hour, and doesn't recover**: the refresh token has expired or been revoked. Re-authorize through the AWS Sign-In flow to obtain a fresh token.
+- **You need to immediately cut off an authorized connection**: revoking the refresh token stops new access tokens from being issued, but existing access tokens remain valid until they expire (up to an hour). For immediate containment, apply an IAM policy using the `aws:SignInSessionArn` condition key to deny requests tied to that sign-in session.
+
+## Next steps
+
+- [Create an MCP Gateway](/operate/governance/mcp-gateways/create-via-dashboard) to expose this server's tools.
+- [Connect to MCP clients](/get-started/mcp-clients).

app/en/operate/governance/remote-mcp-servers/page.mdx

@@ -175,7 +175,7 @@ Common settings include:
   height={ADVANCED_SETTINGS_HEIGHT}
 />
 
-Some remote servers need provider-specific setup beyond these generic settings. See [Connect a Salesforce Hosted MCP Server](/operate/governance/remote-mcp-servers/salesforce), [Connect a ServiceNow Hosted MCP Server](/operate/governance/remote-mcp-servers/servicenow), [Connect a Dynamics 365 Customer Service MCP Server](/operate/governance/remote-mcp-servers/dynamics-365-customer-service), [Connect a HubSpot Remote MCP Server](/operate/governance/remote-mcp-servers/hubspot), [Connect a Snowflake-Managed MCP Server](/operate/governance/remote-mcp-servers/snowflake), [Connect an Atlassian Remote MCP Server](/operate/governance/remote-mcp-servers/atlassian), [Connect a GitHub Remote MCP Server](/operate/governance/remote-mcp-servers/github), or [Connect a Splunk MCP Server](/operate/governance/remote-mcp-servers/splunk) for fully worked examples.
+Some remote servers need provider-specific setup beyond these generic settings. See [Connect a Salesforce Hosted MCP Server](/operate/governance/remote-mcp-servers/salesforce), [Connect a ServiceNow Hosted MCP Server](/operate/governance/remote-mcp-servers/servicenow), [Connect a Dynamics 365 Customer Service MCP Server](/operate/governance/remote-mcp-servers/dynamics-365-customer-service), [Connect a HubSpot Remote MCP Server](/operate/governance/remote-mcp-servers/hubspot), [Connect a Snowflake-Managed MCP Server](/operate/governance/remote-mcp-servers/snowflake), [Connect an Atlassian Remote MCP Server](/operate/governance/remote-mcp-servers/atlassian), [Connect a GitHub Remote MCP Server](/operate/governance/remote-mcp-servers/github), [Connect a Splunk MCP Server](/operate/governance/remote-mcp-servers/splunk), or [Connect the AWS MCP Server](/operate/governance/remote-mcp-servers/aws) for fully worked examples.
 
 ## Where the server's tools become available
 

public/llms.txt

@@ -1,4 +1,4 @@
-<!-- git-sha: 12103aadf4a50b2ff7450a56667459775ebb9261 generation-date: 2026-08-31T16:56:33.588Z -->
+<!-- git-sha: bb4cac004f374abe2e33dccc7237df0af1bc83ca generation-date: 2026-08-31T17:38:34.147Z -->
 
 # Arcade
 
@@ -113,6 +113,7 @@ Arcade docs serve two audiences. Start with the path that matches your goal:
 - [Connect a Splunk MCP Server](https://docs.arcade.dev/en/operate/governance/remote-mcp-servers/splunk): Documentation page
 - [Connect an Atlassian Remote MCP Server](https://docs.arcade.dev/en/operate/governance/remote-mcp-servers/atlassian): Documentation page
 - [Connect Arcade to your LLM](https://docs.arcade.dev/en/get-started/agent-frameworks/setup-arcade-with-your-llm-python): This documentation page guides users on how to connect Arcade to a Large Language Model (LLM) using Python by creating a "harness" that facilitates interaction between the user, the model, and various tools. Users will learn to set up an agent
+- [Connect the AWS MCP Server](https://docs.arcade.dev/en/operate/governance/remote-mcp-servers/aws): Documentation page
 - [Connect to MCP Clients](https://docs.arcade.dev/en/get-started/mcp-clients): This documentation page provides guidance on connecting Arcade MCP servers to various MCP-compatible clients and development environments, enabling users to enhance their agent workflows.
 - [Contact Us](https://docs.arcade.dev/en/resources/contact-us): This documentation page provides users with information on how to connect with the Arcade team for support through various channels. It aims to facilitate communication and assistance for users and their agents.
 - [Contextual Access](https://docs.arcade.dev/en/operate/governance/contextual-access): Documentation page