AWS coding assistant, Native OAuth
Amazon Q WordPress MCP. IDE plugin, or the CLI that became Kiro.
Amazon Q WordPress MCP setup now splits in two. The Amazon Q Developer IDE plugins add servers from the chat panel's tools icon and store them in default.json. The Q Developer CLI has been rebranded as Kiro CLI, which reads ~/.kiro/settings/mcp.json and still picks up a project's .amazonq folder. Both run OAuth for remote servers without a bridge.
Checked against Amazon Q's documentation on 29 September 2026, entries from GoBuildWP Free 1.18.6
{
"mcpServers": {
"gobuildwp-your-site-com": {
"url": "https://your-site.com/wp-json/mcp/wppilot-oauth"
}
}
}- IDE config
- ~/.aws/amazonq/default.json
- Kiro CLI config
- ~/.kiro/settings/mcp.json
- Legacy file
- mcp.json (read by default)
Inside Amazon Q
Knowing which Amazon Q you are configuring
The IDE plugin shows a Fix Configuration action when an entry fails to load, which usually means invalid JSON or a URL that does not answer. The server's tools appear under the tools icon with their permission setting beside each one.
In Kiro CLI, /mcp lists servers and their state, and /logdump --mcp collects logs including mcp.log for a support request. autoApprove on an entry, or /tools trust in a session, pre-approves tools; --trust-all-tools trusts everything and is a poor idea on a site you care about.
Kiro supports Client ID Metadata Documents through oauth.clientMetadataUrl paired with a pinned redirect URI, and falls back to dynamic registration otherwise. GoBuildWP accepts either, so the default entry works.
Signs it worked
- The IDE tools panel lists the WordPress tools
- No Fix Configuration prompt remains
- Kiro's /mcp shows the server connected
- Writes are still set to Ask
Connect screen
GoBuildWP's Amazon Q entry and the files that read it
GoBuildWP writes plain mcpServers entries that suit both products and names four files: ~/.kiro/settings/mcp.json and .kiro/settings/mcp.json for Kiro, ~/.aws/amazonq/mcp.json and .amazonq/mcp.json for Amazon Q. The OAuth entry is a url alone, and the client opens the browser itself; the token entry is url plus headers, Kiro's documented remote shape. The IDE plugins still read mcp.json for legacy reasons, through a useLegacyMcpJson setting that defaults to on.
| OAuth 2.1 | url alone. Amazon Q and Kiro both open a browser for OAuth themselves, so no Node.js is needed. |
|---|---|
| Access token | url and an Authorization header, with no type field. Kiro expands ${VAR} in headers once the variable is approved in its settings. |
| Application Password | The npx bridge with credentials in env. |
Endpoints on your site: /wp-json/mcp/wppilot-oauth for OAuth, /wp-json/mcp/wppilot for tokens and passwords. Through the optional GoBuildWP Cloud instead, every client uses https://app.gobuildwp.com/mcp with the server name gobuildwp, and a personal Cloud token is read from GOBUILDWP_TOKEN where the client supports environment variables.
{
"mcpServers": {
"gobuildwp-your-site-com": {
"url": "https://your-site.com/wp-json/mcp/wppilot",
"headers": {
"Authorization": "Bearer wpp_YOUR-ACCESS-TOKEN"
}
}
}
}Setup
Add WordPress to Amazon Q or Kiro
Use the IDE panel if you work in VS Code or JetBrains with the Q plugin, and Kiro's files if you work in the terminal.
IDE: open the tools panel
In the Amazon Q chat panel, choose the tools icon, then the plus sign. Pick http as the transport, enter the URL, add headers only for a token, and set a timeout; AWS suggests 60 seconds.
IDE: sign in
Save the server. For the OAuth URL, Amazon Q opens a browser page for your WordPress login.
IDE: set tool permissions
Each tool can be Ask, Always allow or Deny. Set the WordPress reads to Always allow and leave the rest on Ask.
Kiro CLI: edit the settings file
Add a remote entry with url to ~/.kiro/settings/mcp.json, or .kiro/settings/mcp.json for one workspace; the workspace file wins. Kiro reloads the file on save.
Kiro CLI: authenticate and trust
In a session, /mcp shows server state and /mcp auth runs the sign-in. /tools trust marks individual tools as trusted.
Verify the connection before allowing changes
Select Read Only explicitly; the default is Production Safe. Use a dedicated identity with manage_options on a single site, or superadmin on multisite. Match the named tool call, site URL and returned record ID against WordPress.
Use the gobuildwp-your-site-com MCP server in Amazon Q. Do not change anything.
1. Report the active GoBuildWP safety profile.
2. List the abilities this connection can see.
3. Call wppilot/get-site-settings and report the site URL and locale.
4. Call wppilot/list-content for the five newest pages,
then wppilot/get-content on one of them.
5. Name every ability you called and each WordPress ID you read.These setup instructions are not a recorded live-client test. Keep credentials out of repositories, logs and shared files.
First task
A first task for an AWS-minded workflow
Q is often used by people who run WordPress on AWS. This task checks the server side of the site and changes nothing.
Use the WordPress MCP server. Read only.
1. wppilot/system-status: PHP, database and cache.
2. wppilot/site-health-tests: anything critical.
3. wppilot/cron-list: overdue events.
4. Summarize the risks for someone hosting this on
EC2 or Lightsail.Troubleshooting
Amazon Q errors and their causes
| Symptom | Cause and fix |
|---|---|
| The IDE ignores mcp.json | useLegacyMcpJson has been turned off. Re-enable it, or add the server through the tools panel so it lands in default.json. |
| Kiro does not see the server from ~/.aws/amazonq | Kiro reads ~/.kiro/settings/mcp.json globally. Its migration copies the old file once; later edits to the old file are not picked up. A project's .amazonq folder is still read. |
| ${GOBUILDWP_TOKEN} is not expanded in Kiro | Kiro only expands variables approved in its Mcp Approved Env Vars setting. |
| Kiro rejects an http URL | Kiro requires HTTPS for remote servers, except on localhost. |
| npx bridge fails | Node.js is missing. On a public site use the url-only OAuth entry and let Q or Kiro run the sign-in; the bridge is only for Application Passwords and local sites. |
Related
Related guides
- Codex CLI: another terminal agent with per-tool approval modes
- VS Code: where the Q IDE plugin usually runs
- Troubleshooting: server-side checks for a failing connection
Amazon Q documentation read on 29 September 2026
Amazon Q and Kiro on a real site
Acting on what the health check found
The first task reports overdue cron events and critical Site Health results. The obvious follow-up is to let Q or Kiro fix them, and most of the fixes are not WordPress content at all, so it is worth knowing which ones the agent can safely do. On a staging copy, an overdue event can be run once with wppilot/cron-run, which behaves like wp-cron.php: it refuses an event that is not due yet and refuses while another run holds the cron lock. Whatever that hook does, such as sending emails or calling a payment provider, happens for real and is not something the change ledger can reverse.
Expired-only wppilot/transients-flush is narrower than clearing all transients, but cleanup is irreversible. Check the installed cache provider and expected rebuild effects before running it; clearing all needs confirmation. Findings about PHP versions, object caching or the database should be reviewed with whoever manages EC2 or Lightsail rather than worked around through an agent.
- "From wppilot/cron-list, which overdue events have no callbacks attached? Those usually belong to removed plugins. List them; do not delete them."
- "Run the overdue event with hook X once with wppilot/cron-run and report how long it took and any output."
Reaching a staging instance that is not public
Both the Q IDE plugins and Kiro CLI run on your machine, so unlike a web assistant they do not need the site to be open to the whole internet. A staging instance whose security group admits only your address can work, provided the machine running Q reaches it and the browser that opens for OAuth reaches the same hostname. Kiro insists on HTTPS for remote servers except on localhost, so a bare IP over plain HTTP will be rejected before WordPress is ever asked. If the GoBuildWP Connect screen sees the site as local, it gives the mcp-remote bridge for OAuth instead of the url-only entry; that route needs Node.js on your machine.
Kiro, the Q plugins and GoBuildWP Cloud
Kiro is on the list of apps that sign in to the optional GoBuildWP Cloud with OAuth: the Cloud link goes into Kiro's mcp.json as a url, and you choose which connected sites it may reach. For a token, Kiro's ${GOBUILDWP_TOKEN} form only expands once the variable is approved in its settings. Cloud does not list the Amazon Q IDE plugins by name, so treat Cloud from the plugins as untested and keep a direct url entry there until you have confirmed a sign-in completes.
FAQ
Amazon Q and Kiro questions
Is Amazon Q Developer CLI the same as Kiro CLI?
AWS rebranded the Q Developer CLI as Kiro CLI. The q and q chat commands keep working, and Kiro reads MCP servers from ~/.kiro/settings/mcp.json.
Do the Amazon Q IDE plugins still read ~/.aws/amazonq/mcp.json?
Yes, for legacy reasons, while useLegacyMcpJson is on (the default). New servers added in the UI go to default.json.
Does Amazon Q support OAuth for WordPress?
Yes. The IDE plugins open a browser for OAuth, and Kiro handles OAuth automatically with dynamic registration or client metadata.
Can Kiro run WordPress tools without asking?
With autoApprove or /tools trust, yes. Keep that to read abilities.
Connect Amazon Q, or Kiro, to WordPress.
Pick the IDE panel or Kiro's file, sign in without a bridge, and keep writes on Ask.