Safe AI tooling for every developer

THE SITUATION

AI coding assistants became genuinely useful for operations work — if they could see our systems: deployments, dashboards, metrics. The naive path was every developer wiring assistants to internal tools with hand-made tokens: a security nightmare multiplying with every tool and every laptop.

WHAT I DID

I built the company's MCP gateway (MCP is the open protocol AI assistants use to call external tools): one stable, secure address per environment through which any assistant can reach our deployment system, dashboards, and metrics. Developers authenticate with the AWS identity they already have — no new tokens exist at all.

Behind the gateway, every backend is deliberately blunted: the deployment tool is read-only in production, the dashboard tool has writing disabled and only a safe subset of its capabilities exposed. Access for every developer is granted through our normal identity platform, in code.

Connecting a client is a few lines — the committed example our developers copy (here for OpenCode; Cursor uses the same command in its own config):

{
  "mcp": {
    "platform-tools-dev": {
      "type": "local",
      "command": [
        "uvx", "mcp-proxy-for-aws",
        "https://gateway.dev.example.com/mcp",
        "--service", "execute-api",
        "--region", "eu-west-1",
        "--profile", "development"
      ]
    }
  }
}

Same pattern for staging, operations, and production — only the URL and profile change. Rolled out to all four environments; our repositories now instruct AI agents to prefer the gateway over raw command-line access.

The gnarliest bug was cryptographic: requests are signed by the client for the public address, but the AWS service behind it requires a different signature — so the front door strips and re-signs every request in flight.

And when an upstream tool suddenly rejected all proxied traffic (a new security feature couldn't know our gateway hostname was legitimate), the fix required understanding exactly which protection layer was redundant behind our signing — and disabling only that one.

THE INTERESTING PART

The whole design is one stable door, many safe backends. The hard part wasn't just making the proxy work; it was making the security model obvious enough that the repository itself can tell developers how to use it.

WHAT IT CHANGED

Developers gained one governed path from AI assistants to operational tooling, using existing identity and backend restrictions instead of per-tool credentials on each laptop.