fix(config): make AWS_MCP_APP_CONFIG optional in Wrangler configs (#175)

README.md

@@ -306,7 +306,7 @@ Default cache TTLs:
 
 The cache is optional for local development and tests. If the binding is absent, tools run without caching.
 
-**Application profiles** use a separate optional KV binding (`AWS_MCP_APP_CONFIG`) for saved operational context. Profiles are not required for `/mcp` or generic AWS tools. See [`docs/application-profiles.md`](docs/application-profiles.md) for schema details, [`docs/aws-tools.md`](docs/aws-tools.md) for direct generic tools, and [`docs/application-profiles.md#cli-workflow`](docs/application-profiles.md#cli-workflow) for `pnpm app-profile:*` commands.
+**Application profiles** use a separate optional KV binding (`AWS_MCP_APP_CONFIG`) for saved operational context. Application profiles are optional — do not configure `AWS_MCP_APP_CONFIG` unless you use the application-ops profile workflow. Profiles are not required for `/mcp` or generic AWS tools. See [`docs/application-profiles.md`](docs/application-profiles.md) for schema details, [`docs/aws-tools.md`](docs/aws-tools.md) for direct generic tools, and [`docs/application-profiles.md#cli-workflow`](docs/application-profiles.md#cli-workflow) for `pnpm app-profile:*` commands.
 
 **Cost Explorer billing estimates:** Non-cached `ce:GetCostAndUsage` requests are estimated at approximately **US$ 0.01** per live API call. Cached responses report `estimatedCostUsd: 0` and do not make a new Cost Explorer request. These values are approximate gateway estimates only — final AWS billing is determined by your AWS account usage and pricing.
 

docs/application-profiles.md

@@ -37,7 +37,9 @@ Workflow:
 
 ## KV binding
 
-Add a **separate** KV namespace from `AWS_MCP_CACHE`:
+Application profiles are optional. Do not configure `AWS_MCP_APP_CONFIG` unless you use the application-ops profile workflow.
+
+When you need profiles, add a **separate** KV namespace from `AWS_MCP_CACHE`:
 
 ```jsonc
 {
@@ -168,7 +170,7 @@ Use the repo-managed scripts to validate and publish profiles without editing KV
 Prerequisites:
 
 - `pnpm install`
-- `AWS_MCP_APP_CONFIG` binding in your Wrangler config
+- `AWS_MCP_APP_CONFIG` binding in your Wrangler config (required for profile CLI only — not for gateway deploy)
 - `AWS_ALLOWED_REGIONS` in Wrangler `vars` (used for region validation)
 
 Validate a local profile file (metadata-only output):

docs/deployment.md

@@ -241,7 +241,9 @@ If the KV binding is absent, all tool calls proceed without caching. This is acc
 
 ### Optional application profile KV
 
-Application profiles are optional operational context stored in a **separate** KV namespace from `AWS_MCP_CACHE`.
+Application profiles are optional. Do not configure `AWS_MCP_APP_CONFIG` unless you use the application-ops profile workflow.
+
+Profiles are optional operational context stored in a **separate** KV namespace from `AWS_MCP_CACHE`. You can add this binding later without code changes when you need profile-driven tools or the `app-profile:*` CLI.
 
 Create the namespace:
 

scripts/app-profiles/lib/wrangler-config.test.ts

@@ -6,7 +6,12 @@ describe("wrangler config loader", () => {
     const config = loadAppProfileCliConfig("wrangler.example.jsonc");
     expect(config.allowedRegions).toEqual(["us-east-1", "sa-east-1"]);
     expect(config.indexKey).toBe("app-profiles/index.json");
-    expect(config.hasAppConfigBinding).toBe(true);
+    expect(config.hasAppConfigBinding).toBe(false);
+  });
+
+  it("does not require AWS_MCP_APP_CONFIG binding in wrangler.jsonc", () => {
+    const config = loadAppProfileCliConfig("wrangler.jsonc");
+    expect(config.hasAppConfigBinding).toBe(false);
   });
 
   it("parses jsonc comments and trailing commas", () => {

src/config/env.test.ts

@@ -227,6 +227,23 @@ describe("validateEnv", () => {
     expect(result.config.AWS_MCP_APP_CONFIG).toBe(appConfig);
   });
 
+  it("succeeds without AWS_MCP_APP_CONFIG when application-ops pack is enabled", () => {
+    const env = {
+      AWS_ACCESS_KEY_ID: "key",
+      AWS_SECRET_ACCESS_KEY: "secret",
+      AWS_REGION: "us-east-1",
+      AWS_ALLOWED_REGIONS: "us-east-1",
+      MCP_AUTH_TOKEN: "token",
+      AWS_MCP_ENABLED_TOOL_PACKS: "core,application-ops",
+    };
+
+    const result = validateEnv(env) as EnvValidationSuccess;
+
+    expect(result.valid).toBe(true);
+    expect(result.config.AWS_MCP_APP_CONFIG).toBeUndefined();
+    expect(result.config.toolExposure.enabledToolPacks.has("application-ops")).toBe(true);
+  });
+
   it("uses custom AWS_MCP_APP_PROFILE_INDEX_KEY when provided", () => {
     const env = {
       AWS_ACCESS_KEY_ID: "key",

wrangler.example.jsonc

@@ -48,13 +48,13 @@
 			"id": "<your-kv-namespace-id>",
 			"remote": true
 		},
-		// Optional — application profiles only; gateway and generic AWS tools work without this binding.
-		// Remove this block entirely if you do not use the application-ops pack.
-		{
-			"binding": "AWS_MCP_APP_CONFIG",
-			"id": "<your-app-config-kv-namespace-id>",
-			"remote": true
-		}
+		// Optional — application profiles only. Generic AWS tools work without this binding.
+		// Add when using application-ops profiles or app-profile:* CLI commands:
+		// {
+		//   "binding": "AWS_MCP_APP_CONFIG",
+		//   "id": "<your-app-config-kv-namespace-id>",
+		//   "remote": true
+		// }
 	],
 	"observability": {
 		"enabled": true,

wrangler.jsonc

@@ -46,11 +46,6 @@
 			"binding": "AWS_MCP_CACHE",
 			"id": "<your-kv-namespace-id>",
 			"remote": true
-		},
-		{
-			"binding": "AWS_MCP_APP_CONFIG",
-			"id": "<your-app-config-kv-namespace-id>",
-			"remote": true
 		}
 	],
 	"observability": {