[Bug]: Integration with Amazon Quick Suite

[jperez-uturndata]

📝 What's the bug?

I am attempting to integrate the teamwork mcp server into amazon quick suite, but it appears its not functioning correctly. I am also not entirely sure if the domain needs to be whitelisted (if thats a thing), i am also not sure if it has to do with the type of authentication it is doing (perhaps its using dcr). With that being said, this is the payload amazon quick suite is sending

{
    "ActionConnectorId": "",
    "ActionConnectorParameters": {
        "McpParameters": {
            "McpServerEndPoint": "https://mcp.ai.teamwork.com",
            "AutoPublish": true
        }
    },
    "AuthenticationConfig": {
        "AuthenticationType": "OAUTH2_AUTHORIZATION_CODE",
        "AuthenticationMetadata": {
            "AuthorizationCodeGrantMetadata": {
                "BaseEndpoint": "https://mcp.ai.teamwork.com",
                "RedirectUrl": "https://us-east-1.quicksight.aws.amazon.com/sn/oauthcallback",
                "AuthorizationCodeGrantCredentialsSource": "DYNAMIC_REGISTRATION"
            }
        }
    },
    "Description": "teamwork mcp server",
    "Name": "teamworkmcp",
    "Type": "MODEL_CONTEXT_PROTOCOL"
}

So my question is, could there be some sort of whitelisting that needs to be added on teamwork or perhaps its not ready to integrate with amazon quick suite just yet.

Thanks :)

✅ What should happen?

.

❌ What actually happens?

This is the actual response thats being sent when adding the mcp server

{
    "Message": "One or more parameters are invalid. Please review your input",
    "RequestId": ""
}

🔄 How to reproduce

1. log in to amazon quick suite
2. Select integration on the nav menu thats on the left.
3. Click on Actions
4. Click Model Context Protocol
5. Enter https://mcp.ai.teamwork.com/ under MCP Server Endpoint
6. Next

💻 Code sample

🚨 Error message/output

🐹 Go version

N/A

📦 Server version

N/A

💻 Operating System

N/A

🔐 Authentication method

None

🌍 Environment

• This happens in a production environment
• This happens in a development environment
• This happens with a self-hosted Teamwork instance
• This happens with teamwork.com (cloud)
• This happens consistently (every time)
• This happens intermittently (sometimes)

📎 Additional context

No response

🔧 Troubleshooting checklist

• I have updated to the latest version of the server
• I have checked the API documentation at https://apidocs.teamwork.com/
• I have searched existing issues for similar problems
• I have verified my API token/credentials are valid

[rafaeljusto]

Hi @jperez-uturndata Thanks for your interest in integrating with the Teamwork.com MCP server!

Domains related to AWS QuickSight are now whitelisted, so you should be able to authenticate successfully using OAuth 2.0 DCR. Please give it a try and let me know if everything works as expected. 🙂

[jperez-uturndata]

Thanks @rafaeljusto.
I was able to continue but when i attempted to login via sso, i got this error

Invalid scope
The requested scope is invalid.

Please check your parameters and your app settings in the Developer Portal.

this is the payload when sending a request to https://<company>.teamwork.com/launchpad/v1/saml/auth.json?appAuth=true

{
    "samlauth": "",
    "iv": "",
    "redirect_uri": "https://us-east-1.quicksight.aws.amazon.com/sn/oauthcallback",
    "state": "",
    "client_id": "",
    "scope": [
        "mcp:stream",
        "openid"
    ],
    "install": false
}

and this was the response

{"errors":["requested scope does not match app scope"]}

Could this perhaps be an error on amazon quick suite?

[rafaeljusto]

It is indeed strange that AWS is sending this scope, as it does not align with the authorisation server metadata:
https://teamwork.com/.well-known/oauth-authorization-server

I’ll need to investigate this further and see if there’s a viable workaround.

[rafaeljusto]

@jperez-uturndata The only workaround is using the "Manual configuration" for the AWS QuickSuite MCP setup, with the following configuration:

Config	Value
Token URL	https://www.teamwork.com/launchpad/v1/token.json
Auth URL	https://www.teamwork.com/launchpad/login
Client ID	Check it in the Developer portal
Client Secret	Check it in the Developer portal
Redirect URL	Check it in the Developer portal

Where the Developer portal can be accessed with:

https://<company>.teamwork.com/developer

More info can be found here. Hopefully, AWS will fix this soon for their MCP client implementation and simplify this process.

[rafaeljusto]

Just to clarify, when you mentioned that you whitelisted, did you whitelist Amazon Quick Suite?

Hey @mminuturn , welcome! The following redirect URLs domains were whitelisted:

• us-east-2.quicksight.aws.amazon.com
• us-east-1.quicksight.aws.amazon.com
• us-west-2.quicksight.aws.amazon.com
• af-south-1.quicksight.aws.amazon.com
• ap-southeast-3.quicksight.aws.amazon.com
• ap-south-1.quicksight.aws.amazon.com
• ap-northeast-2.quicksight.aws.amazon.com
• ap-southeast-1.quicksight.aws.amazon.com
• ap-southeast-2.quicksight.aws.amazon.com
• ap-northeast-1.quicksight.aws.amazon.com
• ca-central-1.quicksight.aws.amazon.com
• cn-north-1.quicksight.amazonaws.cn
• eu-central-1.quicksight.aws.amazon.com
• eu-west-1.quicksight.aws.amazon.com
• eu-west-2.quicksight.aws.amazon.com
• eu-south-1.quicksight.aws.amazon.com
• eu-west-3.quicksight.aws.amazon.com
• eu-south-2.quicksight.aws.amazon.com
• eu-north-1.quicksight.aws.amazon.com
• eu-central-2.quicksight.aws.amazon.com
• sa-east-1.quicksight.aws.amazon.com
• quicksight.us-gov-west-1.amazonaws.com
• il-central-1.quicksight.aws.amazon.com
• me-central-1.quicksight.aws.amazon.com

That does match what was being described by Jose here ("RedirectUrl": "https://us-east-1.quicksight.aws.amazon.com/sn/oauthcallback"). From what I understood, once the domains were whitelisted, the problem changed to invalid scopes, which is unrelated to the whitelist.

[jperez-uturndata]

hey @rafaeljusto thanks for updating the mcp server.
I just tested it and there appears to be further issues.
After authentication, quick suite attempts to fetch the actions from

https://us-east-1.quicksight.aws.amazon.com/sn/qbsproxy/quicksight/actions/internal//connectors/MODEL_CONTEXT_PROTOCOL/actions?action-connector-id=&max-results=100&mbtc=

I get a 404 with a payload response of

{
    "Message": "Connector creation is not completed",
    "RequestId": "b3eeac1e-b872-4a3e-ae88-146330af07b3",
    "ResourceType": null
}

Just figured i would post it here for visibility.
Not sure if there is something on your end that you can see or inspect.
Please let me know if you need the action-connector-id or the mbtc value so you can trace it on your end.

Thanks!

[rafaeljusto]

Hey @jperez-uturndata , yeah, I saw the same testing here. I'm adding more logs as we speak to see if I can gather further information on the server side.

[jperez-uturndata]

thanks rafael, i sincerely appreciate you looking into this.

Also, not sure if this error message could perhaps be of help

{
    "Message": "Provided ActionConnectorId is not supported for list actions.",
    "RequestId": "d0109904-b7c4-4f40-907d-03bd27df4c49"
}

i receive this message when checking out the action connector usage.