aws-agent-toolkit: accept AWS access keys as saved credentials (#23)

* Rename aws-core to aws-agent-toolkit and match the toolkit's auth model

The plugin is the Agent Toolkit for AWS, so name the card after it rather
than AWS Core. Credentials come from the standard AWS chain, and the
toolkit selects profiles via AWS_MCP_PROXY_PROFILES, so replace the
AWS_PROFILE entry and let both env values default to empty when the user
has saved nothing.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* Describe AWS_REGION as a fallback, not an override

Live-tested the config against the proxy. AWS_MCP_PROXY_PROFILES takes a
space-separated list and enables per-call switching via the aws_profile
tool parameter, and determine_aws_region() reads the profile's region
first and only falls back to AWS_REGION when the profile sets none, so
AWS_REGION does not override a profile region. Say both accurately.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* Accept AWS access keys as saved credentials

Users who have no shared config, SSO session or instance role had no way
to give the toolkit credentials through the plugin. Declare the three
standard env vars so keys can be supplied directly, in the ${NAME:-}
form: botocore gates the env provider on a truthy access key, so an
empty value falls through to the normal chain, while an unsubstituted
bare ${NAME} literal would count as a real key and shadow credentials
that were otherwise working.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: Brian Smitches <smitches@mac.lan>
Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Author: 3 people

plugins/aws-agent-toolkit/.devin-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "aws-agent-toolkit",
   "displayName": "Agent Toolkit for AWS",
-  "description": "Agent Toolkit for AWS: call AWS APIs, search AWS documentation, and follow curated AWS skills. Credentials resolve through the standard AWS chain (environment variables, shared config, SSO, instance roles); set AWS_MCP_PROXY_PROFILES to one or more profile names to pin the default profile and allow per-call switching, and AWS_REGION to supply a region when your profile does not set one.",
+  "description": "Agent Toolkit for AWS: call AWS APIs, search AWS documentation, and follow curated AWS skills. Credentials resolve through the standard AWS chain (environment variables, shared config, SSO, instance roles); set AWS_MCP_PROXY_PROFILES to one or more profile names to pin the default profile and allow per-call switching, and AWS_REGION to supply a region when your profile does not set one. To pass keys directly instead, set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY together (plus AWS_SESSION_TOKEN for temporary credentials); these take precedence over any profile.",
   "homepage": "https://aws.amazon.com/products/developer-tools/agent-toolkit-for-aws/",
   "repository": "https://github.com/aws/mcp-proxy-for-aws",
   "logo": "logo.svg",
@@ -16,8 +16,11 @@
         "https://aws-mcp.us-east-1.api.aws/mcp"
       ],
       "env": {
+        "AWS_ACCESS_KEY_ID": "${AWS_ACCESS_KEY_ID:-}",
         "AWS_MCP_PROXY_PROFILES": "${AWS_MCP_PROXY_PROFILES:-}",
-        "AWS_REGION": "${AWS_REGION:-}"
+        "AWS_REGION": "${AWS_REGION:-}",
+        "AWS_SECRET_ACCESS_KEY": "${AWS_SECRET_ACCESS_KEY:-}",
+        "AWS_SESSION_TOKEN": "${AWS_SESSION_TOKEN:-}"
       }
     }
   }