Join an AgentCore Runtime hosted MCP server to Amazon Fast

Mannequin Context Protocol (MCP) servers enable basis fashions to entry exterior information and instruments, supporting standardized, safe entry to recordsdata, databases, and APIs. They provide AI brokers the flexibility to work together with real-world functions, cut back hallucinations with correct context, and supply stateful, multi-turn capabilities. Business-standard architectures rapidly developed and adopted MCP to energy agentic AI workflows.

Amazon Fast helps MCP integrations for autonomous execution, real-time information entry, and specialised AI sub-agent integrations. If you have already got an MCP server, you need to use this integration information to combine it with Amazon Fast. Should you don’t have an MCP server but, you need to use the AWS offered steering for deploying MCP servers on AWS, which follows AWS Nicely-Architected pillars. Relying in your use case, you’ve gotten a number of choices:

If in case you have your personal REST API or one working on Amazon API Gateway, you possibly can combine Amazon Fast instantly together with your API utilizing Amazon Bedrock AgentCore Gateway.
Should you desire a serverless structure and want solely the naked minimal execution functionality to your AI agent, you possibly can creator an AWS Lambda perform and combine with Amazon Fast utilizing AgentCore Gateway.
If you would like a completely managed serverless MCP server resolution with session isolation, prolonged execution time, persistent file techniques, built-in authentication, observability, enhanced payload, bidirectional streaming, and evaluations, you need to use AgentCore Runtime for MCP server internet hosting and join with Amazon Fast utilizing AgentCore Gateway.

On this submit, you’ll learn to deploy and host your MCP server in AgentCore Runtime and combine it with Amazon Fast, together with the conditions. With this sample, you promote reusability and keep away from duplication of AI instruments, so shoppers can reuse generally used instruments and brokers uncovered by an MCP server as an alternative of authoring them from scratch once more. Your clients get a approach to make use of your product inside Amazon Fast (chat brokers and workflows) with out constructing customized connectors for each use case.

Resolution overview

As of this writing, you need to use Amazon Fast in an online browser or the desktop app to work with a chat agent or Flows that present AI agent capabilities. To attach the AI agent with the MCP server for entry to extra instruments and sub-agent capabilities, you should combine the MCP server with Amazon Fast. The combination is dealt with by connectors on the Amazon Fast finish and AgentCore Gateway on the AgentCore finish. AgentCore Gateway and Runtime can be found in Amazon Bedrock AgentCore, a completely managed service for constructing generative AI functions. The authorization stream from Amazon Fast to AgentCore Gateway is known as Inbound Auth, and the stream from AgentCore Gateway to AgentCore Runtime is known as Outbound Auth. Inbound Auth handles authentication and authorizes the person to entry the MCP server. For Inbound Auth, we use Amazon Cognito for authorization wants, however you need to use one other identification supplier. Outbound Auth handles machine-to-machine authentication and authorization, and we use AgentCore Id, a complete identification and entry administration service purpose-built for AI brokers. The MCP protocol at the moment requires OAuth 2.0 because the authentication protocol, so Outbound Auth makes use of OAuth 2.0.

Stipulations

Earlier than you start, confirm that you just meet the next conditions to deploy the answer in your personal AWS account utilizing the step-by-step directions on this submit.

An AWS account.
Amazon Fast arrange with an Writer or increased subscription.
Permission to create AWS Id and Entry Administration (IAM) roles and insurance policies, and AWS sources for AgentCore, Amazon Cognito, and Amazon CloudWatch.
Primary information of AWS providers.
For the Amazon Bedrock AgentCore setup:
- Entry to a command-line setting with the AWS SDK and Python put in.
- Information of the AWS CLI and Python.
- Amazon Bedrock with entry enabled for Anthropic fashions.
To run this tutorial:
- Python 3.10+.
- AWS credentials configured.
- Amazon Bedrock AgentCore SDK.
- MCP (Mannequin Context Protocol) library.
- Operating Docker daemon.

Implementation steps

Observe these steps to go from a domestically authored MCP server to a completely built-in, authenticated device accessible inside your Amazon Fast chat agent.

Implement and deploy a pattern distant MCP server on AgentCore Runtime.
Combine the MCP server with AgentCore Gateway with inbound and outbound auth.
Register the MCP integration in Amazon Fast and combine together with your chat agent.
Check the MCP server integration inside Amazon Fast.
Clear up sources.

Step 1: Implement and deploy a distant MCP server on AgentCore Runtime

On this step, we deploy a pattern MCP server on AgentCore Runtime with primary dummy instruments. The detailed step-by-step code is on the market within the AgentCore samples pocket book on GitHub, and we cowl it at a excessive stage.

Create the challenge construction and recordsdata as follows:

Challenge construction

mcp_server_project/
├── mcp_server.py          # Fundamental MCP server code
├── necessities.txt       # Dependencies
└── __init__.py            # Python package deal marker

File: necessities.txt

mcp>=1.10.0
boto3
bedrock-agentcore
bedrock-agentcore-starter-toolkit>=0.1.21
strands-agents

Set up the necessities in your Python interpreter utilizing the next command:

uv venv sample-venv                   # Create Digital Atmosphere
supply sample-venv/bin/activate       # Activate Digital Atmosphere
uv pip set up -r necessities.txt    # Set up the dependencies

The next is a pattern bare-minimum code. For extra particulars on safe auth setup, see Constructing a safe auth code stream setup utilizing AgentCore Gateway with MCP shoppers. If you configure an AgentCore Runtime with the MCP protocol, the service expects MCP server containers to be accessible on the path 0.0.0.0:8000/mcp, which is the default path supported by most official MCP server SDKs.

File: sample_mcp_server.py

from mcp.server.fastmcp import FastMCP

mcp = FastMCP(host="0.0.0.0", stateless_http=True)

@mcp.device()
def getOrder() -> int:
    """Get an order"""
    return 123

@mcp.device()
def updateOrder(orderId: int) -> int:
    """Replace current order"""
    return 456

if __name__ == "__main__":
    mcp.run(transport="streamable-http")

The server makes use of FastMCP with stateless_http=True, which is required for AgentCore Runtime compatibility. This code does the next:

FastMCP: Creates an MCP server that may host your instruments.
@mcp.device(): Decorator that turns your Python capabilities into MCP instruments.
stateless_http=True: Required for AgentCore Runtime compatibility.

You may check your MCP server domestically utilizing a neighborhood MCP server shopper by following the Creating Native Testing Shopper and Testing Regionally sections within the pocket book.

Now, you might be able to deploy to AgentCore Runtime. You may deploy utilizing the Bedrock starter package from the terminal (described within the following steps) or by a Python script, as listed within the Launching MCP Server to AgentCore Runtime part within the pocket book. We use the AgentCore starter package on this tutorial.

Open your terminal with the present working listing set to your challenge listing, and configure your challenge for deployment. The configure command is interactive with self-explanatory steps. You may decide the defaults for this tutorial.

# Configure your AgentCore challenge
agentcore configure --entrypoint mcp_server.py --name simple_mcp_server

The configure command performs a number of key setup duties robotically. It generates a Dockerfile and .dockerignore file for containerizing your agent in order that your Python software runs constantly throughout totally different environments. Most significantly, it creates a .bedrock_agentcore.yaml configuration file that shops your agent’s runtime settings and deployment parameters.

The --entrypoint parameter specifies the Python file that accommodates your agent’s predominant logic. That is the file together with your @app.entrypoint adorned perform. The --name parameter assigns a novel identifier to your agent inside your AWS account, which is used for useful resource naming and administration throughout AWS providers.

After you configure the challenge, you possibly can provoke the deployment by working the next command.

You need to be capable to see the MCP server in Runtime now.

Step 2: Combine the MCP server with AgentCore Gateway with inbound and outbound auth

On this step, we configure AgentCore Gateway to behave because the safe bridge between Amazon Fast and your deployed MCP server. The inbound and outbound flows are arrange with advisable safety finest practices, together with end-to-end TLS that’s accessible out of the field. You may confer with the respective service documentation for customizations. This includes establishing an IAM position for the Gateway, configuring two Amazon Cognito person swimming pools to deal with Inbound Auth (authorizing requests from Amazon Fast) and Outbound Auth (authenticating calls to the MCP server by OAuth 2.0), and creating the Gateway endpoint. For programmatic setup, comply with the MCP server as a goal tutorial on GitHub.

Step 2a: Create an IAM position for AgentCore Gateway to imagine

Go to the AWS Administration Console, select IAM, after which select Create position. Choose Amazon Bedrock AgentCore because the use case.

You may connect the next inline IAM coverage in Permissions:

{
    "Model": "2012-10-17",
    "Assertion": [
        {
            "Sid": "MCPServerRuntimePermissions",
            "Effect": "Allow",
            "Action": [
                "bedrock-agentcore:InvokeAgentRuntime",
                "bedrock-agentcore:InvokeRegistryMcp",
                "secretsmanager:GetSecretValue"
            ],
            "Useful resource": [
                "arn:aws:bedrock-agentcore:::runtime/",
                "arn:aws:bedrock-agentcore:::runtime//runtime-endpoint/*"
        }
        ]
}

Use the pattern position identify agentcore-sample-mcpgateway-role (or decide your personal). For Useful resource, populate it with the runtime ARN of the MCP server deployed on AgentCore Runtime.

Step 2b: Create an Amazon Cognito person pool for inbound authorization to the Gateway

Navigate to Amazon Cognito and create a brand new person pool that serves because the Inbound authorization layer, validating requests from Amazon Fast earlier than they attain the Gateway.

Go to Amazon Cognito and select Create person pool.

Subsequent, configure the useful resource server to your person pool. Within the navigation pane, select Area beneath Branding, and create a brand new useful resource server to outline the protected customized scope invoke that the Gateway validates throughout authorization.

Preserve a observe of the next Inbound Auth particulars from the person pool created earlier, as a result of these are referenced in later steps:

Shopper ID and Shopper Secret: Within the navigation pane, select App Purchasers, after which choose your app shopper to view the credentials.
Discovery URL: https://cognito-idp.{REGION}.amazonaws.com/{gw_user_pool_id}/.well-known/openid-configuration

Step 2c: Create an Amazon Cognito person pool for outbound authorization

Navigate to Amazon Cognito and create a second person pool that serves because the Outbound authorization layer, so the Gateway can authenticate itself when making calls to the MCP server hosted on AgentCore Runtime.

Go to Amazon Cognito and select Create person pool.

Just like inbound authorization, create a useful resource server for outbound authorization and get the main points for the shopper ID, secret, and discovery URL with the protected customized scope invoke.

Preserve a observe of the next info accessible from the person pool for Outbound Auth that’s wanted later:

Shopper ID and Shopper Secret: Within the navigation pane, select App Purchasers, after which choose your app shopper to view the credentials.
Discovery URL: https://cognito-idp.{REGION}.amazonaws.com/{gw_user_pool_id}/.well-known/openid-configuration

Subsequent, create an OAuth credential supplier in AgentCore Id. Navigate to Amazon Bedrock AgentCore, select Id, after which select Add Outbound Auth and Create OAuth Shopper. Populate the shape with the Discovery URL, Shopper ID, and Shopper Secret from the app shopper created within the Outbound Auth Amazon Cognito person pool within the earlier step.

Step 2nd: Create the AgentCore Gateway

Navigate to Amazon Bedrock AgentCore, select Gateway, after which select Create Gateway. For this walkthrough, we identify it ac-gateway-mcp-server. For Inbound Auth, choose JWT because the authentication kind, select Use Present Id Supplier Configuration, and supply the Discovery URL and Shopper ID from the Inbound Auth Amazon Cognito person pool created in Step 2b.

Within the Permissions part, use the IAM position we created in Step 2a.

Below the Goal part, register your MCP server as a goal. Confirm that you choose OAuth Shopper because the authorization kind, as a result of the MCP protocol doesn’t help different authorization strategies at the moment. To construct the MCP endpoint URL, use the next template, changing encoded_agentcore_runtime_mcp_server_arn with the URL-encoded ARN of your MCP server deployed on AgentCore Runtime.

https://bedrock-agentcore.us-east-1.amazonaws.com/runtimes/{encoded_agentcore_runtime_mcp_server_arn}/invocations?qualifier=DEFAULT

For the Outbound Auth configuration, use the OAuth shopper that we created within the Outbound Auth part.

After the main points are crammed in, select Create Gateway, and await each the Gateway and its Goal to achieve a Prepared state earlier than continuing to the subsequent step.

Step 3: Register MCP integration in Amazon Fast

Navigate to Amazon Fast, select Connectors, after which select Create to your staff. Choose Mannequin Context Protocol (MCP) as the combination kind to start registering your newly created Gateway as an MCP integration.

Present a reputation and outline to your integration, together with the MCP Server Endpoint, which is the Useful resource URL of the AgentCore Gateway created in Step 2nd. For the connection kind, you even have the choice to decide on non-public VPC connectivity to limit the visibility of your MCP server over the community for higher safety.

On the Authenticate display screen, fill within the Inbound Auth particulars configured on the AgentCore Gateway in Step 2nd. You may choose the authentication kind based mostly in your use case. In case your use case is authenticating particular person customers, choose Person authentication. In case your use case is a extra systematic integration, then choose Service authentication. For this tutorial, we use Person authentication with Amazon Cognito. You may join your most popular identification supplier. Fill within the Shopper ID, Shopper Secret, Token URL, and Authorization URL particulars based mostly on the identification supplier chosen.

For the Token URL, use the next template. Word that the underscore within the person pool ID should be eliminated (for instance, us-west-2_qNBcTlLbR turns into us-west-2qNBcTlLbR). For the Authorize URL, use the identical URL however substitute token with authorize.

Token URL template:

https://{user_pool_id_without_underscore}.auth.{REGION}.amazoncognito.com/oauth2/token

After the main points are crammed in, select Create and Proceed, and evaluate your configuration. The display screen reveals solely listTools for now and syncs the instruments with the MCP server. The sync is full after the Motion is within the Obtainable state.

You need to see the instruments refreshed after the Motion is within the Obtainable or Prepared state.

Step 4: Check the MCP server integration inside Amazon Fast

You may select Check Motion APIs to confirm that your MCP instruments are accessible and functioning as anticipated.

After the combination is ready up, you possibly can add it as an Motion in your chat agent or Flows. The Actions integration permits your Fast agent or workflow to invoke MCP instruments. For this tutorial, we create one pattern chat agent. You may present extra context to the agent by linking a Area or importing recordsdata, however we skip that for now and focus solely on the MCP server integration.

Within the Actions part, select Hyperlink Actions and choose the Actions integration we created in Step 3.

You may then check the combination with the MCP server throughout the chat agent and launch the chat agent after validating the outcomes.

Step 5: Clear up

To keep away from incurring pointless prices, delete the sources created on this walkthrough within the reverse order of creation to be sure that dependencies are cleanly eliminated earlier than you delete the sources they depend on. You can too confer with the cleanup code within the tutorial pocket book on GitHub.

Delete the Amazon Fast chat agent or Stream.
Delete the Amazon Fast Motion.
Delete the AgentCore Gateway.
Delete the AgentCore Id sources.
Delete each the inbound and outbound auth Amazon Cognito person swimming pools.
Delete the AgentCore Runtime.
Delete the AgentCore Gateway IAM position.

Conclusion

On this submit, you discovered how Amazon Fast integrates with customized MCP servers hosted on Amazon Bedrock AgentCore Runtime. You walked by deploying a distant MCP server on AgentCore Runtime, securing it with inbound and outbound authentication utilizing Amazon Cognito and AgentCore Id, bridging it to Amazon Fast by AgentCore Gateway, and registering it as an Motion integration in Amazon Fast. This sample promotes reusability of AI instruments and brokers throughout your group, so groups can expose specialised capabilities by a standardized MCP interface and eat them instantly inside Amazon Fast chat brokers and Flows, with out constructing customized connectors for each use case.

For extra details about Amazon Fast and how one can get began, see the weblog submit Asserting Amazon Fast: your agentic teammate for answering questions and taking motion. For extra details about Amazon Bedrock AgentCore, see the weblog submit Introducing Amazon Bedrock AgentCore Gateway: Reworking enterprise AI agent device improvement.