Amazon Bedrock AgentCore Gateway is a managed entry point for tools, services, and other capabilities that agents need to invoke. It standardizes discovery and invocation through Model Context Protocol, handles inbound and outbound authentication, can synchronize tool schemas from targets, and integrates with AgentCore Policy and Observability. The gateway is most useful when an organization wants one governed tool plane rather than letting every agent connect to internal systems independently.<\/p>\n
Within the Generative AI on AWS<\/a> architecture, Gateway is a control boundary between agent reasoning and external action. The model can decide that a capability is useful, but the gateway, identity, policy, and target service decide whether the call is allowed and how credentials are applied.<\/p>\n That separation reduces the blast radius of agent autonomy. A compromised or poorly instructed agent still has to pass through the controls around the tools it is trying to use.<\/p>\n AgentCore Gateway supports MCP operations that let clients discover capabilities and call tools through one endpoint. Current AWS documentation supports several MCP protocol revisions, including the 2026-07-28 stateless revision and earlier stateful revisions. Newer stateless MCP calls carry the protocol version with each request rather than depending on the older initialization handshake.<\/p>\n This matters operationally because the gateway can front targets that evolve at different speeds. The client sees a consistent managed endpoint while the platform team controls which MCP versions the gateway supports and which target capabilities are synchronized.<\/p>\n Tool standardization does not mean every target becomes identical. An OpenAPI service, Lambda-backed tool, MCP server, or another AgentCore resource can still have its own authorization and latency characteristics. Gateway provides the common discovery and invocation boundary.<\/p>\n AgentCore Gateway supports several outbound authorization patterns. AWS targets can use SigV4 with a gateway service role or, in supported cases, caller IAM credentials. OAuth targets can use client credentials for machine-to-machine access, authorization code for user-delegated access, or token exchange to preserve both user and agent identity downstream. API-key targets can use credentials managed through AgentCore Identity.<\/p>\n The choice should follow the target\u2019s trust model. A shared service that performs system-level work may be appropriate for machine identity. A user-owned SaaS account may require delegated OAuth consent. A high-sensitivity internal tool may need the downstream service to see the original caller identity rather than only a generic gateway role.<\/p>\n Amazon Bedrock AgentCore Identity<\/a> is the companion layer that manages those workload identities and credential providers.<\/p>\n For MCP server targets, Gateway can discover and cache tool capabilities from the server. AWS also supports providing a static MCP tool schema during target creation or update. Dynamic synchronization is useful when the MCP server is the source of truth, while a static schema can be useful when the organization wants the gateway contract to change only through reviewed configuration.<\/p>\n Either way, tool definitions are production interfaces. A target that adds a new tool or changes an input schema can affect model behavior because the available capabilities influence what the agent can choose. Synchronization should therefore be observed and reviewed rather than treated as harmless metadata refresh.<\/p>\n A deployment process should record which target version and tool schema were active when an agent release was evaluated.<\/p>\n A shared gateway can expose many tools, but each caller should not automatically receive all of them. AgentCore Policy can define which actions a caller is authorized to invoke, reducing the blast radius if one agent is compromised or misconfigured.<\/p>\n This is the agent equivalent of least privilege. An HR assistant may need employee-directory lookup but not infrastructure-deployment tools. A coding agent may need repository operations but not finance actions. The gateway should make those separations enforceable outside the prompt.<\/p>\n The existing IAM design for generative AI workloads<\/a> provides broader context: permissions should follow the action and resource, not the confidence of the model choosing them.<\/p>\n AgentCore Gateway supports interceptor patterns that can inspect or transform tool traffic. These controls can enforce authorization, enrich requests, redact sensitive data, or adapt schemas before the downstream target executes. That creates a deterministic security layer between model-generated tool arguments and the system that will act on them.<\/p>\n Interceptors should be narrow and auditable. A transformation that silently rewrites important business arguments can make incidents difficult to reconstruct. Security decisions, request changes, target latency, and downstream errors should be visible in logs and traces.<\/p>\n This is one reason Gateway integrates with AgentCore Observability. Tool governance is strongest when the organization can show both the authorization decision and the actual target outcome.<\/p>\n Centralization creates leverage, but it also creates a shared dependency. If many agents rely on one gateway, target synchronization, authorization providers, rate limits, and gateway health become part of all of those agents\u2019 service-level objectives.<\/p>\n Platform teams should monitor invocation volume, user errors, system errors, target latency, authorization failures, and synchronization state. An incident runbook should distinguish a gateway failure from a target failure so operators do not redeploy agents when the real problem is the tool plane.<\/p>\n Critical workloads may also need separate gateways to reduce blast radius across environments, business domains, or compliance boundaries.<\/p>\n Gateway solves authentication and protocol access, but it does not erase the network path to the target. Private services may require VPC connectivity, private endpoints, API Gateway, Lambda Function URLs, or another supported front door. The target must also support the authorization mechanism the gateway uses.<\/p>\nGateway exposes tools through a standardized MCP surface<\/h3>\n
Targets can use IAM, OAuth, token exchange, or API keys<\/h3>\n
Tool synchronization is part of the deployment lifecycle<\/h3>\n
Gateway policy should restrict callers to the smallest useful tool set<\/h3>\n
Interceptors can enforce and transform requests at the tool boundary<\/h3>\n
Gateway availability becomes part of every dependent agent\u2019s reliability<\/h3>\n
Private tools still need network architecture<\/h3>\n