Join an AgentCore Runtime hosted MCP server to Amazon Fast

Mannequin Context Protocol (MCP) servers permit basis fashions to entry exterior information and instruments, supporting standardized, safe entry to information, databases, and APIs. They provide AI brokers the power to work together with real-world functions, scale back hallucinations with correct context, and provide stateful, multi-turn capabilities. Business-standard architectures shortly advanced and adopted MCP to energy agentic AI workflows.

Amazon Fast helps MCP integrations for autonomous execution, real-time information entry, and specialised AI sub-agent integrations. If you have already got an MCP server, you should use this integration information to combine it with Amazon Fast. For those who would not have an MCP server but, you should use the AWS supplied steering for deploying MCP servers on AWS, which follows AWS Nicely-Architected pillars. Relying in your use case, you have got a number of choices:

You probably have your personal REST API or one working on Amazon API Gateway, you possibly can combine Amazon Fast instantly together with your API utilizing Amazon Bedrock AgentCore Gateway.
For those who favor a serverless structure and want solely the naked minimal execution functionality in your AI agent, you possibly can writer an AWS Lambda operate and combine with Amazon Fast utilizing AgentCore Gateway.
If you’d like a completely managed serverless MCP server resolution with session isolation, prolonged execution time, persistent file programs, built-in authentication, observability, enhanced payload, bidirectional streaming, and evaluations, you should use AgentCore Runtime for MCP server internet hosting and join with Amazon Fast utilizing AgentCore Gateway.

On this submit, you’ll discover ways to deploy and host your MCP server in AgentCore Runtime and combine it with Amazon Fast, together with the stipulations. With this sample, you promote reusability and keep away from duplication of AI instruments, so purchasers can reuse generally used instruments and brokers uncovered by means of an MCP server as a substitute of authoring them from scratch once more. Your prospects get a means to make use of your product inside Amazon Fast (chat brokers and workflows) with out constructing customized connectors for each use case.

Answer overview

As of this writing, you should use Amazon Fast in an online browser or the desktop app to work with a chat agent or Flows that present AI agent capabilities. To attach the AI agent with the MCP server for entry to extra instruments and sub-agent capabilities, it is advisable to combine the MCP server with Amazon Fast. The combination is dealt with by means of connectors on the Amazon Fast finish and AgentCore Gateway on the AgentCore finish. AgentCore Gateway and Runtime can be found in Amazon Bedrock AgentCore, a completely managed service for constructing generative AI functions. The authorization circulate from Amazon Fast to AgentCore Gateway is known as Inbound Auth, and the circulate from AgentCore Gateway to AgentCore Runtime is known as Outbound Auth. Inbound Auth handles authentication and authorizes the person to entry the MCP server. For Inbound Auth, we use Amazon Cognito for authorization wants, however you should use one other identification supplier. Outbound Auth handles machine-to-machine authentication and authorization, and we use AgentCore Id, a complete identification and entry administration service purpose-built for AI brokers. The MCP protocol presently requires OAuth 2.0 because the authentication protocol, so Outbound Auth makes use of OAuth 2.0.

Conditions

Earlier than you start, confirm that you just meet the next stipulations to deploy the answer in your personal AWS account utilizing the step-by-step directions on this submit.

An AWS account.
Amazon Fast arrange with an Creator or increased subscription.
Permission to create AWS Id and Entry Administration (IAM) roles and insurance policies, and AWS sources for AgentCore, Amazon Cognito, and Amazon CloudWatch.
Fundamental data of AWS providers.
For the Amazon Bedrock AgentCore setup:

Entry to a command-line atmosphere with the AWS SDK and Python put in.
Data of the AWS CLI and Python.
Amazon Bedrock with entry enabled for Anthropic fashions.

To run this tutorial:

Python 3.10+.
AWS credentials configured.
Amazon Bedrock AgentCore SDK.
MCP (Mannequin Context Protocol) library.
Working Docker daemon.

Implementation steps

Observe these steps to go from a domestically authored MCP server to a completely built-in, authenticated instrument accessible inside your Amazon Fast chat agent.

Implement and deploy a pattern distant MCP server on AgentCore Runtime.
Combine the MCP server with AgentCore Gateway with inbound and outbound auth.
Register the MCP integration in Amazon Fast and combine together with your chat agent.
Check the MCP server integration inside Amazon Fast.
Clear up sources.

Step 1: Implement and deploy a distant MCP server on AgentCore Runtime

On this step, we deploy a pattern MCP server on AgentCore Runtime with primary dummy instruments. The detailed step-by-step code is obtainable within the AgentCore samples pocket book on GitHub, and we cowl it at a excessive stage.

Create the venture construction and information as follows:

Undertaking construction

mcp_server_project/
├── mcp_server.py # Predominant MCP server code
├── necessities.txt # Dependencies
└── __init__.py # Python bundle marker

File: necessities.txt

mcp>=1.10.0
boto3
bedrock-agentcore
bedrock-agentcore-starter-toolkit>=0.1.21
strands-agents

Set up the necessities in your Python interpreter utilizing the next command:

The next is a pattern bare-minimum code. For extra particulars on safe auth setup, see Constructing a safe auth code circulate setup utilizing AgentCore Gateway with MCP purchasers. If you configure an AgentCore Runtime with the MCP protocol, the service expects MCP server containers to be accessible on the path 0.0.0.0:8000/mcp, which is the default path supported by most official MCP server SDKs.

File: sample_mcp_server.py

The server makes use of FastMCP with stateless_http=True, which is required for AgentCore Runtime compatibility. This code does the next:

FastMCP: Creates an MCP server that may host your instruments.
@mcp.instrument(): Decorator that turns your Python features into MCP instruments.
stateless_http=True: Required for AgentCore Runtime compatibility.

You’ll be able to check your MCP server domestically utilizing a neighborhood MCP server consumer by following the Creating Native Testing Shopper and Testing Domestically sections within the pocket book.

Now, you’re able to deploy to AgentCore Runtime. You’ll be able to deploy utilizing the Bedrock starter equipment from the terminal (described within the following steps) or by means of a Python script, as listed within the Launching MCP Server to AgentCore Runtime part within the pocket book. We use the AgentCore starter equipment on this tutorial.

Open your terminal with the present working listing set to your venture listing, and configure your venture for deployment. The configure command is interactive with self-explanatory steps. You’ll be able to decide the defaults for this tutorial.

The configure command performs a number of key setup duties routinely. It generates a Dockerfile and .dockerignore file for containerizing your agent in order that your Python software runs constantly throughout totally different environments. Most significantly, it creates a .bedrock_agentcore.yaml configuration file that shops your agent’s runtime settings and deployment parameters.

The –entrypoint parameter specifies the Python file that incorporates your agent’s predominant logic. That is the file together with your @app.entrypoint adorned operate. The –name parameter assigns a singular identifier to your agent inside your AWS account, which is used for useful resource naming and administration throughout AWS providers.

After you configure the venture, you possibly can provoke the deployment by working the next command.

You need to be capable of see the MCP server in Runtime now.

Step 2: Combine the MCP server with AgentCore Gateway with inbound and outbound auth

On this step, we configure AgentCore Gateway to behave because the safe bridge between Amazon Fast and your deployed MCP server. The inbound and outbound flows are arrange with advisable safety finest practices, together with end-to-end TLS that’s accessible out of the field. You’ll be able to seek advice from the respective service documentation for customizations. This entails organising an IAM function for the Gateway, configuring two Amazon Cognito person swimming pools to deal with Inbound Auth (authorizing requests from Amazon Fast) and Outbound Auth (authenticating calls to the MCP server by means of OAuth 2.0), and creating the Gateway endpoint. For programmatic setup, observe the MCP server as a goal tutorial on GitHub.

Step 2a: Create an IAM function for AgentCore Gateway to imagine

Go to the AWS Administration Console, select IAM, after which select Create function. Choose Amazon Bedrock AgentCore because the use case.

You’ll be able to connect the next inline IAM coverage in Permissions:

Use the pattern function title agentcore-sample-mcpgateway-role (or decide your personal). For Useful resource, populate it with the runtime ARN of the MCP server deployed on AgentCore Runtime.

Step 2b: Create an Amazon Cognito person pool for inbound authorization to the Gateway

Navigate to Amazon Cognito and create a brand new person pool that serves because the Inbound authorization layer, validating requests from Amazon Fast earlier than they attain the Gateway.

Go to Amazon Cognito and select Create person pool.

Subsequent, configure the useful resource server in your person pool. Within the navigation pane, select Area below Branding, and create a brand new useful resource server to outline the protected customized scope invoke that the Gateway validates throughout authorization.

Preserve a be aware of the next Inbound Auth particulars from the person pool created earlier, as a result of these are referenced in later steps:

Shopper ID and Shopper Secret: Within the navigation pane, select App Shoppers, after which choose your app consumer to view the credentials.
Discovery URL: https://cognito-idp.{REGION}.amazonaws.com/{gw_user_pool_id}/.well-known/openid-configuration

Step 2c: Create an Amazon Cognito person pool for outbound authorization

Navigate to Amazon Cognito and create a second person pool that serves because the Outbound authorization layer, so the Gateway can authenticate itself when making calls to the MCP server hosted on AgentCore Runtime.

Go to Amazon Cognito and select Create person pool.

Just like inbound authorization, create a useful resource server for outbound authorization and get the small print for the consumer ID, secret, and discovery URL with the protected customized scope invoke.

Preserve a be aware of the next data accessible from the person pool for Outbound Auth that’s wanted later:

Shopper ID and Shopper Secret: Within the navigation pane, select App Shoppers, after which choose your app consumer to view the credentials.
Discovery URL: https://cognito-idp.{REGION}.amazonaws.com/{gw_user_pool_id}/.well-known/openid-configuration

Subsequent, create an OAuth credential supplier in AgentCore Id. Navigate to Amazon Bedrock AgentCore, select Id, after which select Add Outbound Auth and Create OAuth Shopper. Populate the shape with the Discovery URL, Shopper ID, and Shopper Secret from the app consumer created within the Outbound Auth Amazon Cognito person pool within the earlier step.

Step second: Create the AgentCore Gateway

Navigate to Amazon Bedrock AgentCore, select Gateway, after which select Create Gateway. For this walkthrough, we title it ac-gateway-mcp-server. For Inbound Auth, choose JWT because the authentication sort, select Use Current Id Supplier Configuration, and supply the Discovery URL and Shopper ID from the Inbound Auth Amazon Cognito person pool created in Step 2b.

Within the Permissions part, use the IAM function we created in Step 2a.

Underneath the Goal part, register your MCP server as a goal. Confirm that you choose OAuth Shopper because the authorization sort, as a result of the MCP protocol doesn’t help different authorization strategies right now. To construct the MCP endpoint URL, use the next template, changing encoded_agentcore_runtime_mcp_server_arn with the URL-encoded ARN of your MCP server deployed on AgentCore Runtime.

https://bedrock-agentcore.us-east-1.amazonaws.com/runtimes/{encoded_agentcore_runtime_mcp_server_arn}/invocations?qualifier=DEFAULT

For the Outbound Auth configuration, use the OAuth consumer that we created within the Outbound Auth part.

After the small print are crammed in, select Create Gateway, and watch for each the Gateway and its Goal to achieve a Prepared state earlier than continuing to the subsequent step.

Step 3: Register MCP integration in Amazon Fast

Navigate to Amazon Fast, select Connectors, after which select Create in your workforce. Choose Mannequin Context Protocol (MCP) as the combination sort to start registering your newly created Gateway as an MCP integration.

Present a reputation and outline in your integration, together with the MCP Server Endpoint, which is the Useful resource URL of the AgentCore Gateway created in Step second. For the connection sort, you even have the choice to decide on personal VPC connectivity to limit the visibility of your MCP server over the community for higher safety.

On the Authenticate display screen, fill within the Inbound Auth particulars configured on the AgentCore Gateway in Step second. You’ll be able to choose the authentication sort based mostly in your use case. In case your use case is authenticating particular person customers, choose Person authentication. In case your use case is a extra systematic integration, then choose Service authentication. For this tutorial, we use Person authentication with Amazon Cognito. You’ll be able to join your most popular identification supplier. Fill within the Shopper ID, Shopper Secret, Token URL, and Authorization URL particulars based mostly on the identification supplier chosen.

For the Token URL, use the next template. Observe that the underscore within the person pool ID have to be eliminated (for instance, us-west-2_qNBcTlLbR turns into us-west-2qNBcTlLbR). For the Authorize URL, use the identical URL however exchange token with authorize.

Token URL template:

https://{user_pool_id_without_underscore}.auth.{REGION}.amazoncognito.com/oauth2/token

After the small print are crammed in, select Create and Proceed, and evaluation your configuration. The display screen reveals solely listTools for now and syncs the instruments with the MCP server. The sync is full after the Motion is within the Out there state.

You need to see the instruments refreshed after the Motion is within the Out there or Prepared state.

Step 4: Check the MCP server integration inside Amazon Fast

You’ll be able to select Check Motion APIs to confirm that your MCP instruments are accessible and functioning as anticipated.

After the combination is ready up, you possibly can add it as an Motion in your chat agent or Flows. The Actions integration permits your Fast agent or workflow to invoke MCP instruments. For this tutorial, we create one pattern chat agent. You’ll be able to present extra context to the agent by linking a House or importing information, however we skip that for now and focus solely on the MCP server integration.

Within the Actions part, select Hyperlink Actions and choose the Actions integration we created in Step 3.

You’ll be able to then check the combination with the MCP server inside the chat agent and launch the chat agent after validating the outcomes.

Step 5: Clear up

To keep away from incurring pointless prices, delete the sources created on this walkthrough within the reverse order of creation to ensure that dependencies are cleanly eliminated earlier than you delete the sources they depend on. You can too seek advice from the cleanup code within the tutorial pocket book on GitHub.

Delete the Amazon Fast chat agent or Stream.
Delete the Amazon Fast Motion.
Delete the AgentCore Gateway.
Delete the AgentCore Id sources.
Delete each the inbound and outbound auth Amazon Cognito person swimming pools.
Delete the AgentCore Runtime.
Delete the AgentCore Gateway IAM function.

Conclusion

On this submit, you discovered how Amazon Fast integrates with customized MCP servers hosted on Amazon Bedrock AgentCore Runtime. You walked by means of deploying a distant MCP server on AgentCore Runtime, securing it with inbound and outbound authentication utilizing Amazon Cognito and AgentCore Id, bridging it to Amazon Fast by means of AgentCore Gateway, and registering it as an Motion integration in Amazon Fast. This sample promotes reusability of AI instruments and brokers throughout your group, so groups can expose specialised capabilities by means of a standardized MCP interface and eat them instantly inside Amazon Fast chat brokers and Flows, with out constructing customized connectors for each use case.

For extra details about Amazon Fast and how one can get began, see the weblog submit Asserting Amazon Fast: your agentic teammate for answering questions and taking motion. For extra details about Amazon Bedrock AgentCore, see the weblog submit Introducing Amazon Bedrock AgentCore Gateway: Remodeling enterprise AI agent instrument growth.

Concerning the authors