AgentCore Gateway->MCP Server

For your first question, yes, you can use Amazon Bedrock AgentCore Gateway to provide MCP authorization to tools in your MCP server. The Gateway implements the Model Context Protocol (MCP) and provides a standardized way for agents to discover and invoke tools. Each Gateway must have an attached OAuth authorizer, and if you don't already have an OAuth authorization server, you can create one using Amazon Cognito. The Gateway would serve as the MCP entry point, making your tools available through the MCP server URL. This would allow MCP clients (like Claude Desktop) to access your tools through the Gateway.

When setting up the Gateway, you would:

1. Create tools using schemas like OpenAPI specifications or JSON schemas
2. Create a Gateway endpoint with inbound authorization to control access
3. Add targets to your Gateway that define how requests are routed to specific tools
4. Connect your MCP client to the Gateway endpoint

Regarding your second question, if you choose not to use Gateway and instead write your own MCP server with FastMCP's auth capabilities to deploy in Bedrock AgentCore, the documentation doesn't specifically address whether it would support discovery endpoints like /.well-known/oauth-protected-resource. The available information focuses on Gateway's implementation of MCP and its OAuth authorization requirements, rather than custom MCP server implementations within AgentCore. For this specific use case, you might need to consult AWS support or additional documentation.
Sources
Using a Gateway with MCP - Amazon Bedrock AgentCore
Setting up a Amazon Bedrock AgentCore Gateway - Amazon Bedrock AgentCore
Creating your Gateway - Amazon Bedrock AgentCore
Core concepts for Amazon Bedrock AgentCore Gateway - Amazon Bedrock AgentCore

Hello,

[1] If I host a MCP server in Agentcore runtime, can I use Agentcore Gateway to provide MCP authorization to the tools in the MCP server? (Would I be able to tools from a MCP Client like Claude Desktop)

Please allow me to inform you that currently AgentCore Gateway only supports Lambda functions, HTTP(s) endpoints described via OpenAPI or Smithy.

[2] if I don't use Gateway, can I write the MCP server with FastMCP's auth capabilities(Remote OAuth, OAuth Proxy, etc) and deploy it in Bedrock AgentCore, would it allow calls to discovery endpoints like (/.well-known/oauth-protected-resource etc).

I would like to inform you that you do not need to add auth to your code, you can leverage AgentRuntime authorization configuration as described in the doc [1]. It does not have to be Cognito, any OAuth provider would work.

I kindly request you to please stay updated through these blogs:

What's New with AWS - https://aws.amazon.com/new/

AWS News Blog - https://aws.amazon.com/blogs/aws/

If you have any questions or would like more details about this feature or roadmap, please reach out to AWS Support, and we would be happy to assist you further.

—References—

[1] https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-mcp.html#runtime-mcp-deploy-aws

[2] Creating support cases and case management: https://docs.aws.amazon.com/awssupport/latest/user/case-management.html#creating-a-support-casehttps://docs.aws.amazon.com/awssupport/latest/user/case-management.html#creating-a-support-case