/connect                    # interactive — asks what you're connecting to
/connect mcp                # MCP server setup
/connect lambda             # Lambda function as tools
/connect openapi            # OpenAPI schema as tools
/connect credential         # Add a credential for outbound auth

Your agent  ───→  Gateway  ───→  Lambda function / OpenAPI API / MCP server / Smithy model
             (agent calls tool)

Your app  ───→  AgentCore Runtime  (direct invoke_agent_runtime call)

undefined

The feature works with any target type (Lambda, OpenAPI, MCP, API Gateway, Smithy). Enable it per gateway — see the [Search for tools in your AgentCore gateway](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-using-mcp-semantic-search.html) docs for the exact API surface and framework-specific client code.

Rule of thumb: if a gateway has more than 20 tools, recommend enabling semantic search. For smaller catalogs, passing all tools directly is still fine.

undefined

undefined

undefined

Note: The CLI `--outbound-auth` flag supports `oauth` (2LO / client credentials) or `none` for MCP servers.

- **3-legged OAuth (`AUTHORIZATION_CODE` grant)** — user-delegated access — is supported by the API but has no CLI path. Configure via boto3 `create_gateway_target` with `OAuthCredentialProvider.grantType = "AUTHORIZATION_CODE"` and `defaultReturnUrl`. See [Connecting to an OAuth-protected MCP server using Authorization Code flow](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-target-MCPservers.html#gateway-target-MCPservers-auth-code-grant-flow).
- **IAM (SigV4)** for MCP servers hosted on AgentCore Runtime, another AgentCore Gateway, API Gateway, or Lambda Function URLs is configured via the AWS SDK/API (not the CLI) — use `CreateGatewayTarget` with `GATEWAY_IAM_ROLE` credential provider and an `iamCredentialProvider.service` value.
- **API key auth** is not supported for MCP server targets at the API level (the MCP target docs list only no-auth, OAuth, and IAM as strategies) — if the MCP server uses an API key, handle it in agent code directly (see Path D).

agentcore deploy -y
agentcore fetch access --name MyGateway

import os
import asyncio
from mcp import ClientSession
from mcp.client.streamable_http import streamablehttp_client

**For Strands**, pass gateway tools directly to the agent:

```python
from mcp.client.streamable_http import streamablehttp_client
from mcp import ClientSession
from strands import Agent
from bedrock_agentcore.runtime import BedrockAgentCoreApp
from model.load import load_model  # scaffolded by `agentcore create`

app = BedrockAgentCoreApp()
GATEWAY_URL = os.getenv("AGENTCORE_GATEWAY_MYGATEWAY_URL")

@app.entrypoint
def invoke(payload, context):
    if not GATEWAY_URL:
        # Local dev — run without gateway tools
        agent = Agent(model=load_model())
        return {"response": str(agent(payload.get("prompt", "")))}

    # Deployed — discover and use gateway tools
    tools = asyncio.run(get_gateway_tools())
    agent = Agent(
        model=load_model(),
        tools=tools,
    )
    return {"response": str(agent(payload.get("prompt", "")))}

if __name__ == "__main__":
    app.run()

from langchain_mcp_adapters.client import MultiServerMCPClient

@app.entrypoint
def agent_invocation(payload, context):
    if not GATEWAY_URL:
        tools = []
    else:
        # Use LangChain MCP adapter to get tools as LangChain-compatible tools
        client = MultiServerMCPClient({"gateway": {"url": GATEWAY_URL, "transport": "streamable_http"}})
        tools = asyncio.run(client.get_tools())

    llm_with_tools = llm.bind_tools(tools)
    # ... rest of your LangGraph graph ...

agentcore add gateway-target \
  --type lambda-function-arn \
  --name MyTools \
  --lambda-arn arn:aws:lambda:us-east-1:123456789012:function:my-tools \
  --tool-schema-file tools.json \
  --gateway MyGateway

{
  "inlinePayload": [
    {
      "name": "get_weather",
      "description": "Get current weather for a city",
      "inputSchema": {
        "type": "object",
        "properties": {
          "city": {"type": "string", "description": "City name"}
        },
        "required": ["city"]
      }
    }
  ]
}

undefined

**Auth is required** for OpenAPI targets — either `oauth` (client credentials or authorization code) or `api-key`.

⚠️ **Security note:** `--api-key` appears in shell history. Two safer options:

1. **Interactive prompt (recommended):** run `agentcore add credential --name MyAPIKey --type api-key` without `--api-key` — the CLI will prompt, and the value goes straight into the credential provider (Secrets Manager-backed) without hitting your shell history.
2. **Edit `agentcore.json` + `.env.local` for local dev only:** if you need the credential to work under `agentcore dev`, put the value in `agentcore/.env.local` (gitignored). This file is read by the local dev server only — it is **not** uploaded to runtime on deploy. The deployed runtime gets the value from the credential provider.

Do **not** try to ship a credential to the deployed runtime via environment variables — AgentCore Runtime env vars are not vault-backed. Register the credential once with `agentcore add credential` and reference it by name in the gateway target or in code (Path D).

---

undefined

⚠️ **Security note:** `--api-key` and `--client-secret` appear in shell history. Run the command without those flags to get an interactive prompt — the value goes straight into the credential provider without touching your shell history.

**For local dev only**, put the same value in `agentcore/.env.local` (gitignored) so `agentcore dev` can resolve the decorator locally. The deployed runtime ignores `.env.local` and fetches the secret from the credential provider at call time — **never** ship secrets as runtime environment variables.

from bedrock_agentcore.identity.auth import requires_api_key, requires_access_token

The decorator itself handles the token lifecycle — you don't need to make the function async just to use it. Parameters are keyword-only (`*, api_key: str` or `*, access_token: str`) — the decorator injects them.

**Local dev:** In `agentcore dev`, credentials are read from `agentcore/.env.local`. The decorator pattern works the same way locally and deployed.

---