# Share What Amazon Q Developer Produced — A Link, Not a Chat Pane

Canonical: https://commareports.com/agents/share-amazon-q-output
Published: 2026-09-09

> Amazon Q writes the upgrade plan, the IAM review, the cost analysis — into a CLI session or an IDE pane nobody else can open. Publish it to a URL your team can read and comment on.

# Share what Amazon Q Developer produced

Amazon Q is at its best on the jobs that produce a document: transform this
Java 8 service and tell me what changed, review these IAM policies and list the
over-broad ones, explain where this bill went. The answer arrives in a CLI
session or a side panel, formatted nicely, on your machine.

Everyone who needs it is somewhere else. The platform team wants the
transformation summary. Security wants the IAM findings. Finance wants the cost
breakdown, and finance does not have a console login — nor should they need one
to read a table.

## Let Q publish it

Attach Comma's [MCP server](/mcp) in `.amazonq/mcp.json` for the workspace (or
in `~/.aws/amazonq/mcp.json` for every project) with a
[scoped token](/docs/api-tokens), then write the standing rule once:

```md
<!-- .amazonq/rules/publish-reports.md -->

When you finish something a human needs to read — a transformation summary, an
IAM or security review, a cost analysis, an upgrade plan — publish it to Comma
as an HTML report and reply with the URL. Do not paste the whole document into
the chat.

The report id is in `.comma-report-id`. Update that report rather than creating
a new one.
```

After that, "review our IAM policies" ends with a link that security can open,
comment on, and come back to next quarter.

## Why a report and not a pane

- **No AWS account required to read it.** The audience for a cost review or a
  migration plan reaches well past the people with console access.
- **It renders.** The file-by-file transformation table stays a table; the
  policy diff stays aligned. Markup is stored verbatim and served in a
  sandboxed iframe.
- **Comments land on the finding.** "This role is used by the batch job, don't
  narrow it yet" stays attached to that row — see
  [commenting on HTML](/comment-on-html).
- **Q can read the replies** over the same MCP server, so the follow-up prompt
  is "address the open comments" — see
  [letting an agent respond to comments](/agents/let-an-agent-respond-to-comments).
- **Reruns keep the URL.** A quarterly IAM review that updates one report id
  gives you a revision history of your own posture, at a link you can bookmark.

## Worth knowing

- **Publish private first.** An IAM review lists your roles; a cost analysis
  lists your spend. Start private and widen deliberately — see
  [sharing & access control](/docs/sharing).
- **Scope the token down.** `reports:write` only, unless you want replies. See
  [scoped tokens for AI agents](/agents/scoped-tokens-for-ai-agents).
- **HTML body: 5 MB**, and a transformation summary over a large codebase can
  get long. Publish the summary and link the full log rather than inlining it.
- **Nothing re-executes.** Scheduled refreshes are [routines](/docs/routines) —
  a monthly posture review that is current when you open it, rather than one
  somebody remembers to run.

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Attach the MCP server →](/mcp)**

### Related

- [Where should my agent post?](/agents/where-should-my-agent-post)
- [Share what Kiro produced](/agents/share-kiro-output) ·
  [Share a security scan report](/share-security-scan-report)
- [Monthly compliance digest](/features/routines/monthly-compliance-digest) ·
  [The API](/docs/api)