MCP server namespace not appearing in Connect AI Agent tools page after gateway registration

The fact that your tools default to RETURN_TO_CONTROL and the namespace dropdown is empty indicates a handshake failure during the discovery phase. Even with the gateway in READY status, Amazon Q Connect must be explicitly allowed to "read" the gateway metadata.

1. The Critical Gateway Resource Policy ("Missing Link")

The most common cause is that the AgentCore Gateway Resource Policy (not the IAM role) lacks permission for the Amazon Q Service Principal. Add this to your gateway:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "Service": "wisdom.amazonaws.com" },
    "Action": [
      "bedrock:GetAgentCoreGateway", 
      "bedrock:InvokeAgentCoreGateway"
    ],
    "Resource": "arn:aws:bedrock:REGION:ACCOUNT:agent-core-gateway/GATEWAY_ID"
  }]
}

2. Validate via CLI (Bypass Console Caching)

The Connect UI often suffers from aggressive metadata caching. Verify if the association exists at the API level:

aws qconnect list-integration-associations --assistant-id <YOUR_ASSISTANT_ID>

3. JWT Audience Precision

Check your Gateway logs in CloudWatch. If the aud (Audience) claim sent by Connect doesn't exactly match your allowedAudience (e.g., a trailing slash discrepancy), the gateway will reject the discovery request, resulting in an empty namespace.

I would try first: After updating the Resource Policy (Step 1), delete and re-add the third-party integration in the Connect console. This forces a fresh discovery call to the AgentCore Gateway.

Based on the setup you've described, there are a few key points that may help resolve the namespace visibility issue:

Gateway-to-Instance Association Requirement

When integrating an MCP server with Amazon Connect, only one instance can be associated with a given AgentCore Gateway, and that instance must have the gateway's Discovery URL configured in Bedrock AgentCore. Each gateway can only be used with one MCP server integration. The Discovery URL must follow the format [connect instance URL]/.well-known/openid-configuration, which you appear to have configured correctly.

Tool Allowlisting at the Agent Space Level

After registering an MCP server at the account level, you need to explicitly configure which tools from that server are available to specific agent configurations. This involves:

1. Selecting your AI agent configuration
2. Navigating to the capabilities or tools section
3. Adding the registered MCP server
4. Configuring tool access by either allowing all tools or selecting specific tools to allowlist

Without this explicit allowlisting step, the tools won't appear as available for the agent to use, even if the gateway integration shows as active.

Authentication and Authorization

Since you're using CUSTOM_JWT as the authorizer type, ensure that the authentication credentials are properly configured. If there are issues with authentication, you may need to deregister and re-register the server with updated credentials.

Propagation and Verification

While there isn't specific documentation about propagation delays, integration changes in Amazon Connect can sometimes take a few minutes to fully propagate. Additionally, verify that the security profile assigned to your AI agent has the necessary permissions for MCP tool invocation, not just the general Connect user permissions.

Tool Discovery

The gateway converts your Lambda functions into MCP-compatible tools, and these should be discoverable once the gateway is properly connected to your agent configuration. The fact that you're seeing the tools but without namespace information suggests the integration may be partially complete but missing the explicit tool allowlisting step at the agent level.

I'd recommend focusing on the tool allowlisting configuration within your specific AI agent setup, as this appears to be the missing link between having an active gateway integration and seeing the MCP namespace populated in your tools dropdown.
Sources
Connecting MCP Servers - AWS DevOps Agent
Enable AI agents to retrieve information and complete actions with MCP tools - Amazon Connect
Integrate an MCP server with Amazon Connect - Amazon Connect

I’m experiencing the same issue, and after extensive troubleshooting, I believe this is a bug.

First, during tool registration, the JWT token provided by Connect appears to be missing key claims. Connect JWTs contain only five claims: sub, iss, exp, iat, and jti.

What’s missing are several standard OAuth/OIDC claims:

aud (audience) — so allowed_audience in the authorizer cannot be matched client_id / azp (authorized party) — so allowed_clients cannot be matched scope — so allowed_scopes cannot be matched

Additionally, the sub claim is set to the Connect instance name. For example, if the Connect URL is: https://my-example-poc.my.connect.aws/.well-known/openid-configuration

then the sub value would be: my-example-poc.

As a workaround, a custom claim rule can be created, such as: sub EQUALS my-example-poc

This allows the exposed tools to appear in the Security Profiles, and they can then be assigned to the AI agent.

However, there is a second issue: when the AI agent attempts to call any of the MCP tools, the sub claim is set to CloverAgentAssistantService. Because this value differs from the one used in the custom rule, access to execute the tool is denied.