snare / auth flow test

Signs you in via Cognito hosted UI → Identity Center SAML → Cognito, then invokes the auth_success tool on the CloudTrail MCP with the resulting access token. Result appears on the callback page.

This UI never touches AWS APIs directly. It uses authorization_code + PKCE as a public OAuth client and sends the resulting Bearer token to the MCP just like any legitimate consumer.