MCP server definitions using AWS auth now validate that:
aws_access_key_idandaws_secret_access_keymust be set together (not one without the other).aws_session_tokenrequiresaws_access_key_idandaws_secret_access_keyto be present.
Empty-string values are also now rejected (fields require min(1) length). Clear error messages are surfaced on config parse.
Evidence
AWS credential pair refinements (search for "aws_access_key_id and aws_secret_access_key must be set together")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.