MCP Server Lambda Function URLs — no API Gateway, no 29s timeout, response streaming

Why Function URLs instead of API Gateway

API Gateway has a hard 29-second integration timeout that cannot be extended. Lambda Function URLs do not have a separate gateway timeout — the only limit is the Lambda function timeout (up to 900 seconds / 15 minutes). This makes Function URLs the correct choice for any MCP server where tool calls may take longer than 29 seconds.

When API Gateway is still the right choice: multi-path routing (one Lambda per route), JWT authorizer against Cognito, per-route throttling, or WAF integration at the gateway layer. For a single-path MCP endpoint that needs long timeouts or SSE, Function URLs win.

Creating a Function URL with CDK

The CDK addFunctionUrl method attaches a Function URL to any Lambda function. Use invokeMode: RESPONSE_STREAM for SSE transport and authType: NONE for public MCP endpoints (add your own token-based auth inside the handler instead of relying on IAM SigV4 signing, which is impractical for third-party MCP clients).

import * as lambda from "aws-cdk-lib/aws-lambda";
import * as lambdaNodeJs from "aws-cdk-lib/aws-lambda-nodejs";
import { Duration } from "aws-cdk-lib";

const mcpFn = new lambdaNodeJs.NodejsFunction(this, "McpFunction", {
  entry: "src/lambda-mcp-handler.ts",
  handler: "handler",
  runtime: lambda.Runtime.NODEJS_22_X,
  timeout: Duration.minutes(5),    // up to 15 minutes — no gateway cap
  memorySize: 512,
  environment: {
    NODE_ENV: "production",
    MCP_TRANSPORT: "http",
  },
});

const fnUrl = mcpFn.addFunctionUrl({
  authType: lambda.FunctionUrlAuthType.NONE,   // public endpoint
  invokeMode: lambda.InvokeMode.RESPONSE_STREAM, // required for SSE
  cors: {
    allowedOrigins: ["*"],
    allowedHeaders: ["content-type", "authorization"],
    allowedMethods: [lambda.HttpMethod.POST, lambda.HttpMethod.GET],
  },
});

// Output the URL for use in CloudFront origin
new cdk.CfnOutput(this, "McpFunctionUrl", { value: fnUrl.url });

The generated URL has the form https://<id>.lambda-url.<region>.on.aws/. It is globally routable but not a custom domain — put CloudFront in front to serve it from your domain. See MCP Server CloudFront for the CloudFront configuration pattern; use CachingDisabled and compress: false on the MCP path.

Response streaming for SSE transport

Lambda's standard invocation model buffers the entire response in memory before returning it to the caller. RESPONSE_STREAM invoke mode changes this: the handler receives a ResponseStream writable stream and can write bytes incrementally, with Lambda flushing chunks to the client immediately. This is the mechanism that makes SSE transport work over Function URLs.

// src/lambda-mcp-handler.ts
import { streamifyResponse, ResponseStream } from "aws-lambda";
import { Server } from "@modelcontextprotocol/sdk/server/index.js";
import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";

export const handler = streamifyResponse(
  async (event: AWSLambda.APIGatewayProxyEventV2, responseStream: ResponseStream) => {
    // Set content-type for SSE
    const httpResponseMetadata = {
      statusCode: 200,
      headers: {
        "Content-Type": "text/event-stream",
        "Cache-Control": "no-cache",
        "X-Accel-Buffering": "no",
      },
    };
    // Write metadata first (required by streamifyResponse)
    responseStream = awslambda.HttpResponseStream.from(responseStream, httpResponseMetadata);

    const transport = new StreamableHTTPServerTransport({
      write: (data: string) => responseStream.write(data),
      end: () => responseStream.end(),
    });

    const server = new Server({ name: "my-mcp", version: "1.0.0" }, { capabilities: { tools: {} } });
    // ... register tools ...
    await server.connect(transport);
    await transport.handleRequest(event.body ?? "", event.headers);
  }
);

Cold start impact on SSE: the first request to a cold Lambda instance incurs an init duration (typically 300ms–1s for Node.js with the MCP SDK). During init, the SSE connection is not yet established — the client sees latency before the first event. Use Provisioned Concurrency to eliminate cold starts for latency-sensitive MCP deployments.

Concurrency model: one invocation per session

This is the most important architectural difference between Lambda and ECS for MCP hosting. On ECS Fargate, a single task with a Node.js event loop handles hundreds of concurrent SSE sessions through async I/O. On Lambda, each Function URL invocation handles exactly one HTTP request — one MCP session consumes one concurrent Lambda invocation for its entire lifetime.

# Check current concurrency usage
aws cloudwatch get-metric-statistics \
  --namespace AWS/Lambda \
  --metric-name ConcurrentExecutions \
  --dimensions Name=FunctionName,Value=McpFunction \
  --start-time $(date -u -d '1 hour ago' +%Y-%m-%dT%H:%M:%SZ) \
  --end-time $(date -u +%Y-%m-%dT%H:%M:%SZ) \
  --period 60 \
  --statistics Maximum

# Set reserved concurrency to prevent Lambda from starving other functions
aws lambda put-function-concurrency \
  --function-name McpFunction \
  --reserved-concurrent-executions 200

If your MCP deployment expects more than a few dozen concurrent sessions, ECS Fargate (one task, many sessions) or Lambda with Provisioned Concurrency (pre-warmed instances, but still one-per-request) is likely the better fit. Lambda Function URLs are ideal for low-to-medium concurrency MCP tools and for developer-facing endpoints where cold starts are tolerable.

Auth patterns for Function URLs

Lambda Function URLs support two auth types: IAM (requires SigV4 request signing — practical only for AWS-native callers) and NONE (public endpoint — implement your own token validation in the handler). Most MCP servers use NONE with application-layer auth.

// Application-layer bearer token validation in the Lambda handler
export const handler = streamifyResponse(async (event, responseStream) => {
  const authHeader = event.headers?.authorization ?? "";
  const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : null;

  if (!token || !isValidToken(token)) {
    const meta = { statusCode: 401, headers: { "Content-Type": "application/json" } };
    awslambda.HttpResponseStream.from(responseStream, meta);
    responseStream.write(JSON.stringify({ error: "Unauthorized" }));
    responseStream.end();
    return;
  }

  // Proceed with MCP session initialization
});

CORS configuration: set CORS on the Function URL configuration, not inside the handler. The Function URL layer handles OPTIONS preflight responses automatically when CORS is configured — returning a CORS response from inside the handler for a streaming invocation is error-prone because the preflight must complete before the stream begins.

Common failure modes