awslabs/mcp release 2026.09.20260922000649

What it claims

This release rolls up 24 merged PRs across many of the servers in the awslabs/mcp collection, dated 22 Sep 2026. The changes that matter to an operator are concentrated in security hardening for the database and cloud servers, plus a dependency-framework bump on the billing server. Nothing here is a new server; it is fixes and small features on existing ones.

What changed that affects a running deployment

Security fixes (the reason to upgrade if you run these servers):

• cloudwatch-mcp-server: validate region in the PromQL client "to prevent SSRF credential disclosure" (#4635). This is the one to act on if you expose CloudWatch — it is described as a credential-disclosure vector, not a hardening nicety.
• mysql-mcp-server: reject statement-leading mutating verbs when in read-only mode (#4615), closing a read-only bypass.
• aurora-dsql / general SQL: switch to a parser-based SQL policy guard (#4653, #4575) rather than string matching.
• timestream-influxdb-mcp: writes now gated on an operator-set ALLOW_WRITE env var (#4582) — a behavioural change; writes that worked before may now be refused until you set it.
• ecs-mcp-server and aws-dataprocessing-mcp-server: sensitive-data redaction applied consistently, with --allow-sensitive-data-access now enforced per-field on read operations (#4623, #4640).

Potentially breaking dependency change:

• billing-cost-management-mcp-server: upgraded to FastMCP 4 and MCP SDK v2 (#4655). A major-version SDK bump on one server can shift its runtime/protocol behaviour independently of the rest; check compatibility if you pin this server.

Feature additions: aws-healthomics gained vended metrics tools and run-performance analysis (#4576), pagination continuation hints (#4632), and logLevel on StartAHORun (#4504); bedrock-kb-retrieval added managed knowledge base support and agentic retrieval (#4574); billing added a Cost Optimization Hub tool (#4612).

Limits

The page is a changelog only — no version numbers for the bumped dependencies beyond "FastMCP 4 / MCP SDK v2", no migration notes, and no severity rating on the SSRF fix. To assess the ALLOW_WRITE gating change or the FastMCP 4 bump before upgrading, you must read the linked PRs; the release notes state the change but not its blast radius. The release is marked immutable (only title/notes editable). Full changelog spans from 2026.09.20260908143235.