This pattern deploys two AWS Lambda Web Functions. The first is a remote MCP server that speaks MCP over Streamable HTTP at /mcp. The second is a plain HTTP API with no MCP code, standing in for a service you already run.

The API's endpoint uses the IamAuth auth type, so Lambda only forwards requests signed with AWS Signature Version 4 by a principal that has lambda:InvokeWebFunctionEndpoint. The MCP server signs each request with its own execution role, whose policy allows invoking only that endpoint. Lambda removes the Authorization header after validating the signature, so the API code does no authentication of its own.

The MCP server exposes two tools. get_current_time runs in the MCP server. run_cpu_work calls the API, which runs 1-20 seconds of SHA-256 hashing and streams a JSON line every second. The MCP server relays each line to the MCP client as a progress notification over a Server-Sent Events stream, and a client cancel closes the backend connection and stops the work.

Running the CPU work in its own function keeps the MCP server responsive and lets each function scale on its own. The MCP server endpoint uses the ApplicationManaged auth type, which makes it public. Add authentication to it before using this pattern outside a demo.