This is a significant change and your analysis of the cross-account implications is spot on. The OAuth proxy removal means teams can no longer rely on a single intermediary to handle the token exchange and session management for MCP tools. Every tool that needs access to a different AWS account now has to either carry its own OAuth configuration or the orchestrator has to manage multiple credential sets explicitly. The credential scoping question is the real headache. Without the proxy as the enforcement point, you need a way to say tool X can read account A but not write to account B across the same MCP connection. That level of granularity is hard to achieve with static IAM roles or pre-configured access keys. What makes this interesting for MCP architecture is that it pushes the credential problem to the session layer. If the MCP session itself carries a scoped identity with verifiable permissions, you can enforce least-privilege access without needing a proxy. The session becomes the security boundary instead of the transport layer. Solid writeup on a topic that will affect a lot of teams.