Cognito Token Exchange for MCP Servers: Downscope a User's Token, Record the Agent in the act Claim, and Verify It at the API
Use Cognito token exchange so an MCP server trades a user's token for a read-only, single-audience token with an act claim, then make your API reject the rest.
Read the story