Join an AgentCore Runtime hosted MCP server to Amazon Fast

Mannequin Context Protocol (MCP) servers permit basis fashions to entry exterior knowledge and instruments, supporting standardized, safe entry to information, databases, and APIs. They provide AI brokers the flexibility to work together with real-world functions, cut back hallucinations with correct context, and provide stateful, multi-turn capabilities. Trade-standard architectures shortly advanced and adopted MCP to energy agentic AI workflows.

Amazon Fast helps MCP integrations for autonomous execution, real-time knowledge entry, and specialised AI sub-agent integrations. If you have already got an MCP server, you should utilize this integration information to combine it with Amazon Fast. In case you should not have an MCP server but, you should utilize the AWS offered steerage for deploying MCP servers on AWS, which follows AWS Properly-Architected pillars. Relying in your use case, you’ve got a number of choices:

• In case you have your individual REST API or one operating on Amazon API Gateway, you possibly can combine Amazon Fast straight together with your API utilizing Amazon Bedrock AgentCore Gateway.
• In case you want a serverless structure and wish solely the naked minimal execution functionality to your AI agent, you possibly can writer an AWS Lambda perform and combine with Amazon Fast utilizing AgentCore Gateway.
• In order for you a completely managed serverless MCP server answer with session isolation, prolonged execution time, persistent file programs, built-in authentication, observability, enhanced payload, bidirectional streaming, and evaluations, you should utilize AgentCore Runtime for MCP server internet hosting and join with Amazon Fast utilizing AgentCore Gateway.

On this publish, you’ll learn to deploy and host your MCP server in AgentCore Runtime and combine it with Amazon Fast, together with the stipulations. With this sample, you promote reusability and keep away from duplication of AI instruments, so shoppers can reuse generally used instruments and brokers uncovered by means of an MCP server as a substitute of authoring them from scratch once more. Your prospects get a approach to make use of your product inside Amazon Fast (chat brokers and workflows) with out constructing customized connectors for each use case.

Resolution overview

As of this writing, you should utilize Amazon Fast in an internet browser or the desktop app to work with a chat agent or Flows that present AI agent capabilities. To attach the AI agent with the MCP server for entry to further instruments and sub-agent capabilities, it’s worthwhile to combine the MCP server with Amazon Fast. The mixing is dealt with by means of connectors on the Amazon Fast finish and AgentCore Gateway on the AgentCore finish. AgentCore Gateway and Runtime can be found in Amazon Bedrock AgentCore, a completely managed service for constructing generative AI functions. The authorization circulate from Amazon Fast to AgentCore Gateway is known as Inbound Auth, and the circulate from AgentCore Gateway to AgentCore Runtime is known as Outbound Auth. Inbound Auth handles authentication and authorizes the consumer to entry the MCP server. For Inbound Auth, we use Amazon Cognito for authorization wants, however you should utilize one other id supplier. Outbound Auth handles machine-to-machine authentication and authorization, and we use AgentCore Id, a complete id and entry administration service purpose-built for AI brokers. The MCP protocol at present requires OAuth 2.0 because the authentication protocol, so Outbound Auth makes use of OAuth 2.0.

Conditions

Earlier than you start, confirm that you simply meet the next stipulations to deploy the answer in your individual AWS account utilizing the step-by-step directions on this publish.

• An AWS account.
• Amazon Fast arrange with an Creator or larger subscription.
• Permission to create AWS Id and Entry Administration (IAM) roles and insurance policies, and AWS assets for AgentCore, Amazon Cognito, and Amazon CloudWatch.
• Fundamental information of AWS providers.
• For the Amazon Bedrock AgentCore setup:
  • Entry to a command-line atmosphere with the AWS SDK and Python put in.
  • Data of the AWS CLI and Python.
  • Amazon Bedrock with entry enabled for Anthropic fashions.
• To run this tutorial:
  • Python 3.10+.
  • AWS credentials configured.
  • Amazon Bedrock AgentCore SDK.
  • MCP (Mannequin Context Protocol) library.
  • Operating Docker daemon.

Implementation steps

Comply with these steps to go from a domestically authored MCP server to a completely built-in, authenticated software accessible inside your Amazon Fast chat agent.

1. Implement and deploy a pattern distant MCP server on AgentCore Runtime.
2. Combine the MCP server with AgentCore Gateway with inbound and outbound auth.
3. Register the MCP integration in Amazon Fast and combine together with your chat agent.
4. Take a look at the MCP server integration inside Amazon Fast.
5. Clear up assets.

Step 1: Implement and deploy a distant MCP server on AgentCore Runtime

On this step, we deploy a pattern MCP server on AgentCore Runtime with fundamental dummy instruments. The detailed step-by-step code is out there within the AgentCore samples notebook on GitHub, and we cowl it at a excessive degree.

Create the undertaking construction and information as follows:

Undertaking construction

mcp_server_project/
├── mcp_server.py          # Essential MCP server code
├── necessities.txt       # Dependencies
└── __init__.py            # Python package deal marker

File: necessities.txt

mcp>=1.10.0
boto3
bedrock-agentcore
bedrock-agentcore-starter-toolkit>=0.1.21
strands-agents

Set up the necessities in your Python interpreter utilizing the next command:

uv venv sample-venv                   # Create Digital Surroundings
supply sample-venv/bin/activate       # Activate Digital Surroundings
uv pip set up -r necessities.txt    # Set up the dependencies

The next is a pattern bare-minimum code. For extra particulars on safe auth setup, see Constructing a safe auth code circulate setup utilizing AgentCore Gateway with MCP shoppers. Whenever you configure an AgentCore Runtime with the MCP protocol, the service expects MCP server containers to be accessible on the path 0.0.0.0:8000/mcp, which is the default path supported by most official MCP server SDKs.

File: sample_mcp_server.py

from mcp.server.fastmcp import FastMCP

mcp = FastMCP(host="0.0.0.0", stateless_http=True)

@mcp.software()
def getOrder() -> int:
    """Get an order"""
    return 123

@mcp.software()
def updateOrder(orderId: int) -> int:
    """Replace present order"""
    return 456

if __name__ == "__main__":
    mcp.run(transport="streamable-http")

The server makes use of FastMCP with stateless_http=True, which is required for AgentCore Runtime compatibility. This code does the next:

• FastMCP: Creates an MCP server that may host your instruments.
• @mcp.software(): Decorator that turns your Python features into MCP instruments.
• stateless_http=True: Required for AgentCore Runtime compatibility.

You possibly can check your MCP server domestically utilizing a neighborhood MCP server shopper by following the Creating Native Testing Consumer and Testing Regionally sections within the pocket book.

Now, you’re able to deploy to AgentCore Runtime. You possibly can deploy utilizing the Bedrock starter equipment from the terminal (described within the following steps) or by means of a Python script, as listed within the Launching MCP Server to AgentCore Runtime part within the pocket book. We use the AgentCore starter equipment on this tutorial.

Open your terminal with the present working listing set to your undertaking listing, and configure your undertaking for deployment. The configure command is interactive with self-explanatory steps. You possibly can choose the defaults for this tutorial.

# Configure your AgentCore undertaking
agentcore configure --entrypoint mcp_server.py --name simple_mcp_server

The configure command performs a number of key setup duties robotically. It generates a Dockerfile and .dockerignore file for containerizing your agent in order that your Python software runs constantly throughout completely different environments. Most significantly, it creates a .bedrock_agentcore.yaml configuration file that shops your agent’s runtime settings and deployment parameters.

The --entrypoint parameter specifies the Python file that accommodates your agent’s essential logic. That is the file together with your @app.entrypoint adorned perform. The --name parameter assigns a novel identifier to your agent inside your AWS account, which is used for useful resource naming and administration throughout AWS providers.

After you configure the undertaking, you possibly can provoke the deployment by operating the next command.

It is best to be capable of see the MCP server in Runtime now.

Step 2: Combine the MCP server with AgentCore Gateway with inbound and outbound auth

On this step, we configure AgentCore Gateway to behave because the safe bridge between Amazon Fast and your deployed MCP server. The inbound and outbound flows are arrange with advisable safety greatest practices, together with end-to-end TLS that’s accessible out of the field. You possibly can confer with the respective service documentation for customizations. This includes establishing an IAM position for the Gateway, configuring two Amazon Cognito consumer swimming pools to deal with Inbound Auth (authorizing requests from Amazon Fast) and Outbound Auth (authenticating calls to the MCP server by means of OAuth 2.0), and creating the Gateway endpoint. For programmatic setup, observe the MCP server as a target tutorial on GitHub.

Step 2a: Create an IAM position for AgentCore Gateway to imagine

Go to the AWS Administration Console, select IAM, after which select Create position. Choose Amazon Bedrock AgentCore because the use case.

You possibly can connect the next inline IAM coverage in Permissions:

{
    "Model": "2012-10-17",
    "Assertion": [
        {
            "Sid": "MCPServerRuntimePermissions",
            "Effect": "Allow",
            "Action": [
                "bedrock-agentcore:InvokeAgentRuntime",
                "bedrock-agentcore:InvokeRegistryMcp",
                "secretsmanager:GetSecretValue"
            ],
            "Useful resource": [
                "arn:aws:bedrock-agentcore:<REGION>:<ACCOUNT_ID>:runtime/<RUNTIME_ID>",
                "arn:aws:bedrock-agentcore:<REGION>:<ACCOUNT_ID>:runtime/<RUNTIME_ID>/runtime-endpoint/*"
        }
        ]
}

Use the pattern position identify agentcore-sample-mcpgateway-role (or choose your individual). For Useful resource, populate it with the runtime ARN of the MCP server deployed on AgentCore Runtime.

Step 2b: Create an Amazon Cognito consumer pool for inbound authorization to the Gateway

Navigate to Amazon Cognito and create a brand new consumer pool that serves because the Inbound authorization layer, validating requests from Amazon Fast earlier than they attain the Gateway.

Go to Amazon Cognito and select Create consumer pool.

Subsequent, configure the useful resource server to your consumer pool. Within the navigation pane, select Area underneath Branding, and create a brand new useful resource server to outline the protected customized scope invoke that the Gateway validates throughout authorization.

Hold a word of the next Inbound Auth particulars from the consumer pool created earlier, as a result of these are referenced in later steps:

• Consumer ID and Consumer Secret: Within the navigation pane, select App Shoppers, after which choose your app shopper to view the credentials.
• Discovery URL: https://cognito-idp.{REGION}.amazonaws.com/{gw_user_pool_id}/.well-known/openid-configuration

Step 2c: Create an Amazon Cognito consumer pool for outbound authorization

Navigate to Amazon Cognito and create a second consumer pool that serves because the Outbound authorization layer, so the Gateway can authenticate itself when making calls to the MCP server hosted on AgentCore Runtime.

Go to Amazon Cognito and select Create consumer pool.

Just like inbound authorization, create a useful resource server for outbound authorization and get the main points for the shopper ID, secret, and discovery URL with the protected customized scope invoke.

Hold a word of the next data accessible from the consumer pool for Outbound Auth that’s wanted later:

• Consumer ID and Consumer Secret: Within the navigation pane, select App Shoppers, after which choose your app shopper to view the credentials.
• Discovery URL: https://cognito-idp.{REGION}.amazonaws.com/{gw_user_pool_id}/.well-known/openid-configuration

Subsequent, create an OAuth credential supplier in AgentCore Id. Navigate to Amazon Bedrock AgentCore, select Id, after which select Add Outbound Auth and Create OAuth Consumer. Populate the shape with the Discovery URL, Consumer ID, and Consumer Secret from the app shopper created within the Outbound Auth Amazon Cognito consumer pool within the earlier step.

Step 2nd: Create the AgentCore Gateway

Navigate to Amazon Bedrock AgentCore, select Gateway, after which select Create Gateway. For this walkthrough, we identify it ac-gateway-mcp-server. For Inbound Auth, choose JWT because the authentication sort, select Use Current Id Supplier Configuration, and supply the Discovery URL and Consumer ID from the Inbound Auth Amazon Cognito consumer pool created in Step 2b.

Within the Permissions part, use the IAM position we created in Step 2a.

Underneath the Goal part, register your MCP server as a goal. Confirm that you choose OAuth Consumer because the authorization sort, as a result of the MCP protocol doesn’t assist different authorization strategies at the moment. To construct the MCP endpoint URL, use the next template, changing encoded_agentcore_runtime_mcp_server_arn with the URL-encoded ARN of your MCP server deployed on AgentCore Runtime.

https://bedrock-agentcore.us-east-1.amazonaws.com/runtimes/{encoded_agentcore_runtime_mcp_server_arn}/invocations?qualifier=DEFAULT

For the Outbound Auth configuration, use the OAuth shopper that we created within the Outbound Auth part.

After the main points are stuffed in, select Create Gateway, and await each the Gateway and its Goal to succeed in a Prepared state earlier than continuing to the following step.

Step 3: Register MCP integration in Amazon Fast

Navigate to Amazon Fast, select Connectors, after which select Create to your crew. Choose Mannequin Context Protocol (MCP) as the mixing sort to start registering your newly created Gateway as an MCP integration.

Present a reputation and outline to your integration, together with the MCP Server Endpoint, which is the Useful resource URL of the AgentCore Gateway created in Step 2nd. For the connection sort, you even have the choice to decide on non-public VPC connectivity to limit the visibility of your MCP server over the community for higher safety.

On the Authenticate display screen, fill within the Inbound Auth particulars configured on the AgentCore Gateway in Step 2nd. You possibly can choose the authentication sort based mostly in your use case. In case your use case is authenticating particular person customers, choose Person authentication. In case your use case is a extra systematic integration, then choose Service authentication. For this tutorial, we use Person authentication with Amazon Cognito. You possibly can join your most popular id supplier. Fill within the Consumer ID, Consumer Secret, Token URL, and Authorization URL particulars based mostly on the id supplier chosen.

For the Token URL, use the next template. Word that the underscore within the consumer pool ID have to be eliminated (for instance, us-west-2_qNBcTlLbR turns into us-west-2qNBcTlLbR). For the Authorize URL, use the identical URL however substitute token with authorize.

Token URL template:

https://{user_pool_id_without_underscore}.auth.{REGION}.amazoncognito.com/oauth2/token

After the main points are stuffed in, select Create and Proceed, and assessment your configuration. The display screen reveals solely listTools for now and syncs the instruments with the MCP server. The sync is full after the Motion is within the Obtainable state.

It is best to see the instruments refreshed after the Motion is within the Obtainable or Prepared state.

Step 4: Take a look at the MCP server integration inside Amazon Fast

You possibly can select Take a look at Motion APIs to confirm that your MCP instruments are accessible and functioning as anticipated.

After the mixing is about up, you possibly can add it as an Motion in your chat agent or Flows. The Actions integration permits your Fast agent or workflow to invoke MCP instruments. For this tutorial, we create one pattern chat agent. You possibly can present extra context to the agent by linking a House or importing information, however we skip that for now and focus solely on the MCP server integration.

Within the Actions part, select Hyperlink Actions and choose the Actions integration we created in Step 3.

You possibly can then check the mixing with the MCP server inside the chat agent and launch the chat agent after validating the outcomes.

Step 5: Clear up

To keep away from incurring pointless prices, delete the assets created on this walkthrough within the reverse order of creation to make it possible for dependencies are cleanly eliminated earlier than you delete the assets they depend on. You too can confer with the cleanup code within the tutorial notebook on GitHub.

• Delete the Amazon Fast chat agent or Move.
• Delete the Amazon Fast Motion.
• Delete the AgentCore Gateway.
• Delete the AgentCore Id assets.
• Delete each the inbound and outbound auth Amazon Cognito consumer swimming pools.
• Delete the AgentCore Runtime.
• Delete the AgentCore Gateway IAM position.

Conclusion

On this publish, you discovered how Amazon Fast integrates with customized MCP servers hosted on Amazon Bedrock AgentCore Runtime. You walked by means of deploying a distant MCP server on AgentCore Runtime, securing it with inbound and outbound authentication utilizing Amazon Cognito and AgentCore Id, bridging it to Amazon Fast by means of AgentCore Gateway, and registering it as an Motion integration in Amazon Fast. This sample promotes reusability of AI instruments and brokers throughout your group, so groups can expose specialised capabilities by means of a standardized MCP interface and eat them straight inside Amazon Fast chat brokers and Flows, with out constructing customized connectors for each use case.

For extra details about Amazon Fast and how one can get began, see the weblog publish Asserting Amazon Fast: your agentic teammate for answering questions and taking motion. For extra details about Amazon Bedrock AgentCore, see the weblog publish Introducing Amazon Bedrock AgentCore Gateway: Reworking enterprise AI agent software improvement.

In regards to the authors