[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-agents-connect":3,"mdc-lvexz3-key":35,"related-org-aws-agents-connect":4545,"related-repo-aws-agents-connect":4708},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":24,"repoUrl":25,"updatedAt":26,"license":27,"forks":28,"topics":29,"repo":30,"sourceUrl":33,"mdContent":34},"agents-connect","connect agents to external services","Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies. Handles gateway setup, target types, outbound auth (OAuth, API key, IAM), credentials, and Cedar policy authoring. Triggers on: \"connect to API\", \"add gateway\", \"connect to MCP server\", \"Lambda tools\", \"OpenAPI\", \"gateway target\", \"Cedar policy\", \"restrict tools\", \"policy engine\", \"gateway auth error\", \"store API key\", \"outbound credential\", \"env var API key\", \"API key None after deploy\", \"credential not available after deploy\", \"should this be a gateway target\", \"give my agent tools\", \"add tools to agent\". Not for inbound auth (who can call your agent) — use agents-harden. Not for debugging agent behavior — use agents-debug. Not for VPC networking errors (agent can't reach APIs due to VPC) — use agents-build. Not for creating or hosting a new MCP server project — use agents-get-started.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"aws","AWS (Amazon)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Agents","agents","tag",{"name":17,"slug":18,"type":15},"Authentication","authentication",{"name":20,"slug":21,"type":15},"API Development","api-development",{"name":23,"slug":8,"type":15},"AWS",1822,"https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws","2026-07-16T06:00:38.866147",null,157,[],{"repoUrl":25,"stars":24,"forks":28,"topics":31,"description":32},[],"Official, AWS-supported MCP servers, skills, and plugins to help AI agents build on AWS","https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws\u002Ftree\u002FHEAD\u002Fplugins\u002Faws-agents\u002Fskills\u002Fagents-connect","---\nname: agents-connect\ndescription: >\n  Use when connecting your agent to external APIs, tools, or services via\n  Gateway, or restricting tool access with Cedar policies. Handles gateway\n  setup, target types, outbound auth (OAuth, API key, IAM), credentials,\n  and Cedar policy authoring. Triggers on: \"connect to API\", \"add gateway\",\n  \"connect to MCP server\", \"Lambda tools\", \"OpenAPI\", \"gateway target\",\n  \"Cedar policy\", \"restrict tools\", \"policy engine\", \"gateway auth error\",\n  \"store API key\", \"outbound credential\", \"env var API key\", \"API key None\n  after deploy\", \"credential not available after deploy\",\n  \"should this be a gateway target\", \"give my agent tools\",\n  \"add tools to agent\".\n  Not for inbound auth (who can call your agent) — use agents-harden.\n  Not for debugging agent behavior — use agents-debug.\n  Not for VPC networking errors (agent can't reach APIs due to VPC) — use\n  agents-build. Not for creating or hosting a new MCP server project — use\n  agents-get-started.\nallowed-tools: Read Grep Glob Bash\nmetadata:\n  type: skill\n  version: \"1.0.0\"\n  author: aws-agentcore\n  requires-cli: \">=0.9.0\"\n---\n\n# connect\n\nGive your AgentCore agent access to external APIs, tools, and services via the AgentCore Gateway — and control what it can access with Cedar policies.\n\n## When to use\n\n- You want your agent to call an external API or MCP server\n- You want to expose Lambda functions as agent tools\n- You have an OpenAPI spec you want to turn into agent tools\n- Your agent needs credentials to call an external service\n- You want to restrict which tools your agent can call (Cedar policies)\n- You want role-based or amount-based access control on tool calls\n- A gateway connection, tool call, or policy authorization is failing\n\nFor adding Cedar policies to control tool access, load [`references\u002Fpolicy.md`](references\u002Fpolicy.md).\n\n## Input\n\n`$ARGUMENTS` is optional:\n\n```\n\u002Fconnect                    # interactive — asks what you're connecting to\n\u002Fconnect mcp                # MCP server setup\n\u002Fconnect lambda             # Lambda function as tools\n\u002Fconnect openapi            # OpenAPI schema as tools\n\u002Fconnect credential         # Add a credential for outbound auth\n```\n\n## Process\n\n### Step 0: Verify CLI version\n\nRun `agentcore --version`. This skill requires v0.9.0 or later. If the version is older, tell the developer to run `agentcore update` before proceeding.\n\n### Step 1: Read the project\n\nRead `agentcore\u002Fagentcore.json` to understand:\n\n- What framework the project uses\n- What gateways and targets are already configured (in the `agentCoreGateways` array)\n\n**If no project context:** Ask what they're trying to connect to and proceed with the appropriate pattern.\n\n### Step 2: Identify what they're connecting to\n\nAsk (or infer from `$ARGUMENTS`):\n\n> \"What are you connecting your agent to?\n>\n> 1. An external MCP server (e.g., a third-party tool provider)\n> 2. A Lambda function you've written\n> 3. An API with an OpenAPI spec\n> 4. An AWS API Gateway REST API\n> 5. An external service with no OpenAPI spec, MCP server, or Lambda in front of it — and you can't add one\"\n\n**Options 1–4 front the service as a Gateway target.** This is the default path: the gateway handles outbound auth via its credential providers (so the agent code never sees the secret), the tool becomes discoverable over MCP, and policy engines can authorize or deny calls at the edge. Pick the target type that matches the service.\n\n**Option 5 is Path D** — register a credential and call the API directly from agent code. This is the fallback when fronting isn't practical; the skill walks through when it's appropriate and when it isn't.\n\n---\n\n## Default: prefer a Gateway target over direct API calls in code\n\nBefore jumping into paths, set expectations. Most \"my agent needs to call X\" requests land on a Gateway target — not on `httpx` inside the entrypoint.\n\n**Why Gateway is the default:**\n\n- **Credential injection at the edge.** Gateway's credential providers (OAuth, API key, IAM) attach auth to the outbound request. The agent code calls `session.call_tool(...)` — it never touches the secret. Agent code that does `client = openai.OpenAI(api_key=...)` is one leaked prompt \u002F log line \u002F traceback away from exfiltrating the key.\n- **Discoverable tool catalog.** Tools are listed by the MCP server; the framework (Strands, LangGraph, etc.) binds them automatically. Adding a tool is an `agentcore add gateway-target` + redeploy, not a code change.\n- **Policy enforcement.** Cedar policies can authorize or deny tool calls per principal, per tool, per argument value. This is impossible when tool calls are buried in `httpx.post(...)` inside agent code.\n- **Semantic search.** Once the catalog has 20+ tools, `x_amz_bedrock_agentcore_search` selects the relevant ones per turn.\n\n**When a direct API call in agent code is the right answer:**\n\n| Situation | Why Gateway isn't right | What to do |\n|---|---|---|\n| Streaming\u002Fbidirectional protocol (SSE with live output, WebSockets, WebRTC, long-polling) | Gateway's MCP transport doesn't front those yet | Direct call, Path D |\n| Latency hot path where the MCP hop is measurable and the trade-off is accepted | Extra network hop | Direct call, Path D, with measurement to back the decision |\n| Vendor proprietary protocol \u002F binary SDK | No HTTP surface for Gateway to front | Use the vendor SDK directly, Path D for any secrets |\n| Calling another agent via A2A | A2A is HTTP-by-design and has its own auth model | [`agents-build\u002Freferences\u002Fmulti-agent.md`](..\u002Fagents-build\u002Freferences\u002Fmulti-agent.md), not a Gateway target |\n| AWS service SDK (S3, DynamoDB, SQS, etc.) the runtime already has IAM for | No auth value in fronting — adds hops | Direct boto3 call with the runtime's execution role |\n\nFor **every other case**, recommend a Gateway target. If the developer insists on a direct call, ask which of the five situations above applies. If none, steer them back to a Gateway target.\n\n**Triage heuristic:**\n\n- Service has an MCP server → Path A\n- Service is a Lambda function you control → Path B\n- Service has an OpenAPI spec (or you can generate one — FastAPI, ASP.NET, Spring, etc. generate OpenAPI automatically) → Path C\n- Service is already fronted by API Gateway → Path C (`--type api-gateway`)\n- None of the above and you can't add one → Path D\n\n---\n\n## What Gateway is — and what it isn't\n\nBefore choosing a target type, get the mental model right. Most Gateway confusion comes from having it flipped.\n\n**Gateway hosts tools for your agent to call.** The direction is:\n\n```\nYour agent  ───→  Gateway  ───→  Lambda function \u002F OpenAPI API \u002F MCP server \u002F Smithy model\n             (agent calls tool)\n```\n\nThe agent is the client. The Gateway fronts a catalog of tools. Each tool is a Gateway target (Lambda, OpenAPI, MCP server, API Gateway, Smithy).\n\n**Gateway is not an inbound reverse proxy for your agent.** If you're building an app that needs to invoke your agent, the app does not go through a Gateway. The direction is:\n\n```\nYour app  ───→  AgentCore Runtime  (direct invoke_agent_runtime call)\n```\n\nThe app signs the invocation with IAM SigV4 or presents a JWT. See [`agents-build\u002Freferences\u002Fintegrate.md`](..\u002Fagents-build\u002Freferences\u002Fintegrate.md) for the app-side patterns.\n\n### When you're confused about which direction you need\n\nAsk: **who is calling whom?**\n\n- \"My agent needs to look up weather data\" → agent is calling a tool → **Gateway target** (this skill, Paths A\u002FB\u002FC)\n- \"My FastAPI app needs to call my agent\" → app is calling the agent → **direct invocation** (not Gateway; use [`agents-build\u002Freferences\u002Fintegrate.md`](..\u002Fagents-build\u002Freferences\u002Fintegrate.md))\n- \"My agent needs to fetch data from my FastAPI app\" → agent is calling the app as a tool → **Gateway target** with the app exposed as an OpenAPI or REST target (Path C with your FastAPI's `\u002Fopenapi.json`)\n\nIf you catch yourself configuring a Gateway target whose endpoint is `bedrock-agentcore.\u003Cregion>.amazonaws.com` or pointing at your own runtime's URL, stop — you have the flow inverted.\n\n### What target type fits your tool\n\n| What the tool is | Target type | Notes |\n|---|---|---|\n| MCP server (third-party or your own) | `mcp-server` | Most common for MCP tool catalogs |\n| AWS Lambda function you wrote | `lambda-function-arn` | Uses IAM auth automatically |\n| HTTP API with an OpenAPI spec | `open-api-schema` | FastAPI's built-in `\u002Fopenapi.json` works |\n| AWS API Gateway REST API | `api-gateway` | For APIs already fronted by API Gateway |\n| AWS service with a Smithy model | `smithy-model` | Direct AWS service integration |\n\nYour tool doesn't naturally have an OpenAPI spec and isn't an MCP server or Lambda? Either wrap it in a Lambda (simplest), generate an OpenAPI spec for it (FastAPI does this automatically), or front it with API Gateway.\n\n---\n\n### Step 3: Navigate the auth matrix\n\n**This is the most common source of errors.** The auth options depend on the target type, and the CLI exposes only a subset of what the API\u002FSDK support.\n\n| What you're connecting to | CLI `--type` | Outbound auth via CLI | Additional options via API\u002FSDK |\n|---|---|---|---|\n| External MCP server | `mcp-server` | `none`, `oauth` (2LO only) | OAuth 3LO (`AUTHORIZATION_CODE`); IAM (SigV4) |\n| Lambda function | `lambda-function-arn` | `none` (default — direct invoke via gateway role), `oauth` (2LO) for OAuth-protected downstreams | OAuth 3LO |\n| OpenAPI spec | `open-api-schema` | `oauth` (2LO), `api-key` (required — no `none`) | OAuth 3LO |\n| AWS API Gateway | `api-gateway` | `none`, `api-key` | IAM (`GATEWAY_IAM_ROLE`) |\n| Smithy model | `smithy-model` | `oauth` (2LO) | IAM; OAuth 3LO |\n\n**Two OAuth grant types, not one.** The CLI's `--outbound-auth oauth` only configures **2-legged OAuth** (client credentials \u002F M2M). If the service requires **3-legged OAuth** (`AUTHORIZATION_CODE` grant, user-delegated access), there is no CLI flag — you must configure the target via boto3 \u002F the AWS SDK. See the [CreateGatewayTarget docs](https:\u002F\u002Fdocs.aws.amazon.com\u002Fbedrock-agentcore\u002Flatest\u002Fdevguide\u002Fgateway-building-adding-targets-authorization.html) for the `OAuthCredentialProvider` with `grantType: AUTHORIZATION_CODE` and `defaultReturnUrl`. 3LO applies to MCP, Lambda, OpenAPI, and Smithy targets. Call this out up front — developers who need 3LO will otherwise burn a round-trip trying CLI flags that don't exist.\n\n**IAM (SigV4) for MCP servers** is configured via the AWS SDK\u002FAPI (`CreateGatewayTarget` with `GATEWAY_IAM_ROLE` credential provider + `iamCredentialProvider.service`), not the CLI. It requires the MCP server to be hosted behind an AWS service that natively verifies SigV4: AgentCore Runtime, AgentCore Gateway, Amazon API Gateway, or Lambda Function URLs. ALB or direct EC2 endpoints do not verify SigV4 — use OAuth there instead. ([MCP server target auth strategies](https:\u002F\u002Fdocs.aws.amazon.com\u002Fbedrock-agentcore\u002Flatest\u002Fdevguide\u002Fgateway-target-MCPservers.html#gateway-target-MCPservers-considerations))\n\n**API key auth for MCP server targets is not supported at the API level** — not just a CLI gap. The [MCP server targets docs](https:\u002F\u002Fdocs.aws.amazon.com\u002Fbedrock-agentcore\u002Flatest\u002Fdevguide\u002Fgateway-target-MCPservers.html#gateway-target-MCPservers-considerations) list only \"No authorization, OAuth, and IAM\" as supported authorization strategies for MCP targets. If the MCP server uses an API key (a common pattern for third-party MCP providers), handle it in agent code via Path D.\n\n**Auth options change.** If the matrix above doesn't match what the CLI accepts, check the current CLI help (`agentcore add gateway-target --help`) and the AWS docs — auth support per target type evolves across releases. If the `awsknowledge` MCP server is available, search for \"AgentCore CreateGatewayTarget\" to get the current API parameters.\n\n**CLI vs. API for gateway auth:** The CLI covers `none`, `oauth` (2LO), and `api-key`. For IAM (SigV4) and 3-legged OAuth, use boto3 directly — the examples are in the Path A section below. The general pattern: create the gateway and target via CLI, deploy, then apply the advanced auth config via boto3 if the CLI doesn't support it.\n\nTell the developer which auth option applies to their target type before generating any commands.\n\n### When your gateway has many tools, let the model search for them\n\nOnce a gateway has more than a handful of tools — roughly 20+ — passing every tool definition to the model on every turn wastes tokens and degrades accuracy. The model does better when it sees only the tools relevant to the current request.\n\nAgentCore Gateway has a built-in semantic search tool for exactly this. Your agent calls a single MCP tool named `x_amz_bedrock_agentcore_search` with a natural-language query, and the gateway returns the most relevant tools from its catalog. The agent then invokes the returned tools normally.\n\nIf a developer is considering building their own tool-selection layer with Bedrock Knowledge Bases, a vector store, or custom embeddings — stop them. The gateway already does this, evaluated against curated relevance criteria, with no infrastructure to manage.\n\nUsage pattern (the agent calls this the same way it calls any other gateway tool):\n\n```python\n# Via the MCP client, as a tool call\nresult = await session.call_tool(\n    \"x_amz_bedrock_agentcore_search\",\n    arguments={\"query\": \"find tools related to processing refunds\"}\n)\n# result.content lists the most relevant tools — the agent then invokes them\n```\n\nThe feature works with any target type (Lambda, OpenAPI, MCP, API Gateway, Smithy). Enable it per gateway — see the [Search for tools in your AgentCore gateway](https:\u002F\u002Fdocs.aws.amazon.com\u002Fbedrock-agentcore\u002Flatest\u002Fdevguide\u002Fgateway-using-mcp-semantic-search.html) docs for the exact API surface and framework-specific client code.\n\nRule of thumb: if a gateway has more than 20 tools, recommend enabling semantic search. For smaller catalogs, passing all tools directly is still fine.\n\n### Passing custom headers from the caller to the agent\n\nIf the developer needs callers to send custom HTTP headers (tenant IDs, correlation IDs, protocol-specific headers like `A2A-Version`, tracing headers, idempotency keys), the runtime's default is to strip most headers before they reach agent code. Load [`agents-build\u002Freferences\u002Frequest-headers.md`](..\u002Fagents-build\u002Freferences\u002Frequest-headers.md) for the allowlist configuration and prefix pattern.\n\nThis is about inbound calls to your agent, not outbound calls to tools — but developers hit it often enough that it's worth mentioning here.\n\n---\n\n## Path A: MCP server\n\n### Add a gateway (if none exists)\n\n> [!WARNING]\n> Never deploy a gateway without inbound authentication to production. A gateway with\n> no authorizer exposes all connected tools (Lambda, MCP, OpenAPI) to any caller who\n> knows the URL — functionally equivalent to --authorizer-type NONE on the runtime.\n> Always use --authorizer-type CUSTOM_JWT or AWS_IAM for production gateways.\n> The no-auth form (agentcore add gateway --name X) is for local testing only.\n\n```bash\n# Development (no inbound auth — for testing only)\nagentcore add gateway --name MyGateway\n\n# Production (JWT inbound auth)\nagentcore add gateway \\\n  --name MyGateway \\\n  --authorizer-type CUSTOM_JWT \\\n  --discovery-url https:\u002F\u002Fyour-idp.example.com\u002F.well-known\u002Fopenid-configuration \\\n  --allowed-audience my-api \\\n  --allowed-clients my-client-id\n```\n\n### Add the MCP server as a target\n\n```bash\n# No outbound auth (public MCP server)\nagentcore add gateway-target \\\n  --type mcp-server \\\n  --name WeatherTools \\\n  --endpoint https:\u002F\u002Fmcp.example.com\u002Fmcp \\\n  --gateway MyGateway\n\n# OAuth outbound auth (2-legged — client credentials \u002F M2M)\nagentcore add gateway-target \\\n  --type mcp-server \\\n  --name WeatherTools \\\n  --endpoint https:\u002F\u002Fmcp.example.com\u002Fmcp \\\n  --gateway MyGateway \\\n  --outbound-auth oauth \\\n  --oauth-client-id your-client-id \\\n  --oauth-client-secret your-client-secret \\\n  --oauth-discovery-url https:\u002F\u002Fauth.example.com\u002F.well-known\u002Fopenid-configuration \\\n  --oauth-scopes read,write\n```\n\nNote: The CLI `--outbound-auth` flag supports `oauth` (2LO \u002F client credentials) or `none` for MCP servers.\n\n- **3-legged OAuth (`AUTHORIZATION_CODE` grant)** — user-delegated access — is supported by the API but has no CLI path. Configure via boto3 `create_gateway_target` with `OAuthCredentialProvider.grantType = \"AUTHORIZATION_CODE\"` and `defaultReturnUrl`. See [Connecting to an OAuth-protected MCP server using Authorization Code flow](https:\u002F\u002Fdocs.aws.amazon.com\u002Fbedrock-agentcore\u002Flatest\u002Fdevguide\u002Fgateway-target-MCPservers.html#gateway-target-MCPservers-auth-code-grant-flow).\n- **IAM (SigV4)** for MCP servers hosted on AgentCore Runtime, another AgentCore Gateway, API Gateway, or Lambda Function URLs is configured via the AWS SDK\u002FAPI (not the CLI) — use `CreateGatewayTarget` with `GATEWAY_IAM_ROLE` credential provider and an `iamCredentialProvider.service` value.\n- **API key auth** is not supported for MCP server targets at the API level (the MCP target docs list only no-auth, OAuth, and IAM as strategies) — if the MCP server uses an API key, handle it in agent code directly (see Path D).\n\n### Deploy and get the gateway URL\n\n```bash\nagentcore deploy -y\nagentcore fetch access --name MyGateway\n```\n\nThe gateway URL is injected as `AGENTCORE_GATEWAY_\u003CNAME>_URL` after deploy.\n\n### Generate gateway client code\n\n**Framework-agnostic MCP client:**\n\n```python\nimport os\nimport asyncio\nfrom mcp import ClientSession\nfrom mcp.client.streamable_http import streamablehttp_client\n\n# Injected by AgentCore after deploy. Format: AGENTCORE_GATEWAY_\u003CUPPERCASENAME>_URL\nGATEWAY_URL = os.getenv(\"AGENTCORE_GATEWAY_MYGATEWAY_URL\")\n\nasync def get_gateway_tools():\n    \"\"\"Discover tools from the gateway. Returns empty list if not deployed.\"\"\"\n    if not GATEWAY_URL:\n        return []\n    async with streamablehttp_client(GATEWAY_URL) as (read, write, _):\n        async with ClientSession(read, write) as session:\n            await session.initialize()\n            result = await session.list_tools()\n            return result.tools\n\nasync def call_gateway_tool(tool_name: str, arguments: dict):\n    \"\"\"Call a specific tool through the gateway.\"\"\"\n    if not GATEWAY_URL:\n        raise RuntimeError(\"Gateway not available in local dev — deploy first\")\n    async with streamablehttp_client(GATEWAY_URL) as (read, write, _):\n        async with ClientSession(read, write) as session:\n            await session.initialize()\n            return await session.call_tool(tool_name, arguments)\n```\n\n**For Strands**, pass gateway tools directly to the agent:\n\n```python\nfrom mcp.client.streamable_http import streamablehttp_client\nfrom mcp import ClientSession\nfrom strands import Agent\nfrom bedrock_agentcore.runtime import BedrockAgentCoreApp\nfrom model.load import load_model  # scaffolded by `agentcore create`\n\napp = BedrockAgentCoreApp()\nGATEWAY_URL = os.getenv(\"AGENTCORE_GATEWAY_MYGATEWAY_URL\")\n\n@app.entrypoint\ndef invoke(payload, context):\n    if not GATEWAY_URL:\n        # Local dev — run without gateway tools\n        agent = Agent(model=load_model())\n        return {\"response\": str(agent(payload.get(\"prompt\", \"\")))}\n\n    # Deployed — discover and use gateway tools\n    tools = asyncio.run(get_gateway_tools())\n    agent = Agent(\n        model=load_model(),\n        tools=tools,\n    )\n    return {\"response\": str(agent(payload.get(\"prompt\", \"\")))}\n\nif __name__ == \"__main__\":\n    app.run()\n```\n\n**For LangGraph**, add gateway tools to the tool node:\n\n```python\nfrom langchain_mcp_adapters.client import MultiServerMCPClient\n\n@app.entrypoint\ndef agent_invocation(payload, context):\n    if not GATEWAY_URL:\n        tools = []\n    else:\n        # Use LangChain MCP adapter to get tools as LangChain-compatible tools\n        client = MultiServerMCPClient({\"gateway\": {\"url\": GATEWAY_URL, \"transport\": \"streamable_http\"}})\n        tools = asyncio.run(client.get_tools())\n\n    llm_with_tools = llm.bind_tools(tools)\n    # ... rest of your LangGraph graph ...\n```\n\n---\n\n## Path B: Lambda function as tools\n\n```bash\nagentcore add gateway-target \\\n  --type lambda-function-arn \\\n  --name MyTools \\\n  --lambda-arn arn:aws:lambda:us-east-1:123456789012:function:my-tools \\\n  --tool-schema-file tools.json \\\n  --gateway MyGateway\n```\n\nThe `tools.json` defines the tool schemas:\n\n```json\n{\n  \"inlinePayload\": [\n    {\n      \"name\": \"get_weather\",\n      \"description\": \"Get current weather for a city\",\n      \"inputSchema\": {\n        \"type\": \"object\",\n        \"properties\": {\n          \"city\": {\"type\": \"string\", \"description\": \"City name\"}\n        },\n        \"required\": [\"city\"]\n      }\n    }\n  ]\n}\n```\n\n**Auth:** Lambda targets use IAM role auth automatically — no `--outbound-auth` flag. The gateway's execution role needs `lambda:InvokeFunction` on the Lambda ARN.\n\nUse the same MCP client code from Path A to call the tools.\n\n---\n\n## Path C: OpenAPI spec as tools\n\n```bash\n# From a local file (api-key auth)\nagentcore add credential --name MyAPIKey --api-key sk-...\n\nagentcore add gateway-target \\\n  --type open-api-schema \\\n  --name MyAPI \\\n  --schema specs\u002Fapi.json \\\n  --gateway MyGateway \\\n  --outbound-auth api-key \\\n  --credential-name MyAPIKey\n```\n\n**Auth is required** for OpenAPI targets — either `oauth` (client credentials or authorization code) or `api-key`.\n\n⚠️ **Security note:** `--api-key` appears in shell history. Two safer options:\n\n1. **Interactive prompt (recommended):** run `agentcore add credential --name MyAPIKey --type api-key` without `--api-key` — the CLI will prompt, and the value goes straight into the credential provider (Secrets Manager-backed) without hitting your shell history.\n2. **Edit `agentcore.json` + `.env.local` for local dev only:** if you need the credential to work under `agentcore dev`, put the value in `agentcore\u002F.env.local` (gitignored). This file is read by the local dev server only — it is **not** uploaded to runtime on deploy. The deployed runtime gets the value from the credential provider.\n\nDo **not** try to ship a credential to the deployed runtime via environment variables — AgentCore Runtime env vars are not vault-backed. Register the credential once with `agentcore add credential` and reference it by name in the gateway target or in code (Path D).\n\n---\n\n## Path D: Credentials for use in agent code\n\nFor calling APIs directly in agent code (not through a gateway target).\n\n### Before you reach for Path D, check if it's actually the right path\n\nPath D is the **fallback**, not the starting point. For most external services, a Gateway target (Paths A–C) is safer and less code. Before generating Path D code, confirm one of these applies:\n\n- The service uses a streaming\u002Fbidirectional protocol Gateway doesn't front (SSE with live output, WebSockets, WebRTC)\n- It's a measurably latency-critical hot path and the team has accepted the trade-off\n- The client is a vendor binary SDK with no HTTP surface\n- It's an AWS service SDK where the runtime's execution role already has IAM permissions (in which case: use the SDK directly — no credential registration needed)\n- The developer has a specific blocker (e.g., the service ships an OpenAI-shaped API the vendor's SDK wraps, and rebuilding the SDK call as a Gateway target would be a regression)\n\nIf none of those applies, route back to Path A\u002FB\u002FC:\n\n> \"Before we wire up a credential for direct use in agent code, can we front this as a Gateway target instead? Gateway injects the credential at the edge — your agent code never touches the secret — and the tool becomes policy-enforceable. If SERVICE has an OpenAPI spec, MCP server, or Lambda function in front of it, Path C \u002F A \u002F B is the better fit. Which one applies?\"\n\nOnly continue into the rest of Path D when the developer confirms a legitimate reason Gateway won't work.\n\n### Register the credential\n\n```bash\n# API key\nagentcore add credential --name OpenAI --api-key sk-...\n\n# OAuth (machine-to-machine)\nagentcore add credential \\\n  --name MyOAuthProvider \\\n  --type oauth \\\n  --discovery-url https:\u002F\u002Fidp.example.com\u002F.well-known\u002Fopenid-configuration \\\n  --client-id my-client-id \\\n  --client-secret my-client-secret \\\n  --scopes read,write\n```\n\n⚠️ **Security note:** `--api-key` and `--client-secret` appear in shell history. Run the command without those flags to get an interactive prompt — the value goes straight into the credential provider without touching your shell history.\n\n**For local dev only**, put the same value in `agentcore\u002F.env.local` (gitignored) so `agentcore dev` can resolve the decorator locally. The deployed runtime ignores `.env.local` and fetches the secret from the credential provider at call time — **never** ship secrets as runtime environment variables.\n\n### Use credentials in agent code\n\nUse the `@requires_api_key` or `@requires_access_token` decorators — they handle token caching and refresh automatically. The decorators work with both sync and async functions:\n\n```python\nfrom bedrock_agentcore.identity.auth import requires_api_key, requires_access_token\n\n# Sync function — decorator injects the fetched key via keyword arg\n@requires_api_key(provider_name=\"OpenAI\")\ndef call_openai(prompt: str, *, api_key: str) -> str:\n    import openai\n    client = openai.OpenAI(api_key=api_key)\n    response = client.chat.completions.create(\n        model=\"gpt-4o\",\n        messages=[{\"role\": \"user\", \"content\": prompt}]\n    )\n    return response.choices[0].message.content\n\n# Async function — same decorator, async def\n@requires_access_token(\n    provider_name=\"MyOAuthProvider\",\n    scopes=[\"read\", \"write\"],\n    auth_flow=\"M2M\",\n)\nasync def call_my_api(data: dict, *, access_token: str) -> dict:\n    import httpx\n    async with httpx.AsyncClient() as client:\n        response = await client.post(\n            \"https:\u002F\u002Fapi.example.com\u002Fendpoint\",\n            headers={\"Authorization\": f\"Bearer {access_token}\"},\n            json=data,\n        )\n        return response.json()\n```\n\nThe decorator itself handles the token lifecycle — you don't need to make the function async just to use it. Parameters are keyword-only (`*, api_key: str` or `*, access_token: str`) — the decorator injects them.\n\n**Local dev:** In `agentcore dev`, credentials are read from `agentcore\u002F.env.local`. The decorator pattern works the same way locally and deployed.\n\n---\n\n## Local dev gap\n\n> [!WARNING]\n> Gateway URLs (AGENTCORE_GATEWAY_*_URL) are only available after deploy.\n> In agentcore dev, these env vars are not set. Always check before using:\n>\n> ```python\n> GATEWAY_URL = os.getenv(\"AGENTCORE_GATEWAY_MYGATEWAY_URL\")\n> if not GATEWAY_URL:\n>     # run without gateway tools in local dev\n> ```\n>\n> Never assume the gateway is available locally.\n\n---\n\n## Troubleshooting\n\n**\"mcp-server target doesn't support api-key auth\"**\nCorrect — API key auth is not supported for MCP server targets at the API level ([MCP target auth strategies](https:\u002F\u002Fdocs.aws.amazon.com\u002Fbedrock-agentcore\u002Flatest\u002Fdevguide\u002Fgateway-target-MCPservers.html#gateway-target-MCPservers-considerations)). Options: OAuth (2LO or 3LO), IAM (for MCP servers hosted on AgentCore Runtime, API Gateway, or Lambda Function URLs), or Path D — manage the credential in agent code and call the MCP server directly.\n\n**\"I need 3LO \u002F authorization-code OAuth but `--outbound-auth oauth` doesn't ask for a return URL\"**\nThe CLI only configures 2LO (client credentials). 3-legged OAuth requires boto3 — call `create_gateway_target` with `credentialProviderType: OAUTH`, `grantType: AUTHORIZATION_CODE`, and `defaultReturnUrl`. See [Connecting to an OAuth-protected MCP server using Authorization Code flow](https:\u002F\u002Fdocs.aws.amazon.com\u002Fbedrock-agentcore\u002Flatest\u002Fdevguide\u002Fgateway-target-MCPservers.html#gateway-target-MCPservers-auth-code-grant-flow).\n\n**\"api-gateway target doesn't support oauth\"**\nUse `api-key` or `none` for API Gateway targets.\n\n**Gateway URL not set after deploy**\nRun `agentcore fetch access --name MyGateway` to get the URL. Check `agentcore status --type gateway` to verify the gateway is deployed.\n\n**Tool calls failing with auth errors**\nCheck `agentcore logs --runtime MyAgent --since 1h --level error` for the specific error. Common causes: expired OAuth token, wrong credential name, IAM permission missing.\n\n**\"Adding gateway to existing agent\" workaround**\nThe CLI recommends creating a throwaway agent to copy gateway client code. This skill generates the code directly — no workaround needed.\n\n**MCP clients (Claude Desktop, claude.ai) can't auto-connect to Gateway**\nAgentCore Gateway does not currently implement the MCP OAuth spec endpoints (RFC 8414 OAuth Authorization Server Metadata, RFC 7591 Dynamic Client Registration). MCP clients that expect to auto-discover OAuth config and register themselves — like Claude Desktop and claude.ai — cannot connect without manual credential configuration. The workaround is to manually obtain the Cognito `client_id` and `client_secret` and enter them in the MCP client's advanced settings. This is a platform limitation, not a config error.\n\n## Output\n\n- A clear recommendation on **Gateway target vs direct API call**, grounded in the five cases where direct is legitimate\n- CLI commands to set up the gateway and target (or to register the credential, if Path D is the right call)\n- Framework-specific gateway client code\n- Credential setup (avoiding shell history exposure, never stored in runtime env vars)\n- Local dev gap handling\n",{"data":36,"body":43},{"name":4,"description":6,"allowed-tools":37,"metadata":38},"Read Grep Glob Bash",{"type":39,"version":40,"author":41,"requires-cli":42},"skill","1.0.0","aws-agentcore",">=0.9.0",{"type":44,"children":45},"root",[46,54,60,67,107,125,131,142,154,160,167,188,194,207,228,239,245,257,295,305,315,319,325,338,346,429,437,570,582,590,626,629,635,640,650,659,664,674,683,700,706,716,770,783,789,933,938,941,947,957,1198,1271,1311,1329,1355,1385,1390,1396,1401,1413,1418,1423,1488,1502,1507,1513,1538,1543,1546,1552,1558,1571,1742,1748,2028,2055,2144,2150,2199,2212,2218,2226,2442,2452,2659,2669,2776,2779,2785,2888,2901,3298,3323,3328,3331,3337,3506,3529,3549,3626,3645,3648,3654,3659,3665,3677,3705,3710,3718,3723,3729,3903,3926,3964,3970,3991,4220,4240,4264,4267,4273,4320,4323,4329,4347,4396,4419,4445,4463,4473,4498,4504,4539],{"type":47,"tag":48,"props":49,"children":51},"element","h1",{"id":50},"connect",[52],{"type":53,"value":50},"text",{"type":47,"tag":55,"props":56,"children":57},"p",{},[58],{"type":53,"value":59},"Give your AgentCore agent access to external APIs, tools, and services via the AgentCore Gateway — and control what it can access with Cedar policies.",{"type":47,"tag":61,"props":62,"children":64},"h2",{"id":63},"when-to-use",[65],{"type":53,"value":66},"When to use",{"type":47,"tag":68,"props":69,"children":70},"ul",{},[71,77,82,87,92,97,102],{"type":47,"tag":72,"props":73,"children":74},"li",{},[75],{"type":53,"value":76},"You want your agent to call an external API or MCP server",{"type":47,"tag":72,"props":78,"children":79},{},[80],{"type":53,"value":81},"You want to expose Lambda functions as agent tools",{"type":47,"tag":72,"props":83,"children":84},{},[85],{"type":53,"value":86},"You have an OpenAPI spec you want to turn into agent tools",{"type":47,"tag":72,"props":88,"children":89},{},[90],{"type":53,"value":91},"Your agent needs credentials to call an external service",{"type":47,"tag":72,"props":93,"children":94},{},[95],{"type":53,"value":96},"You want to restrict which tools your agent can call (Cedar policies)",{"type":47,"tag":72,"props":98,"children":99},{},[100],{"type":53,"value":101},"You want role-based or amount-based access control on tool calls",{"type":47,"tag":72,"props":103,"children":104},{},[105],{"type":53,"value":106},"A gateway connection, tool call, or policy authorization is failing",{"type":47,"tag":55,"props":108,"children":109},{},[110,112,123],{"type":53,"value":111},"For adding Cedar policies to control tool access, load ",{"type":47,"tag":113,"props":114,"children":116},"a",{"href":115},"references\u002Fpolicy.md",[117],{"type":47,"tag":118,"props":119,"children":121},"code",{"className":120},[],[122],{"type":53,"value":115},{"type":53,"value":124},".",{"type":47,"tag":61,"props":126,"children":128},{"id":127},"input",[129],{"type":53,"value":130},"Input",{"type":47,"tag":55,"props":132,"children":133},{},[134,140],{"type":47,"tag":118,"props":135,"children":137},{"className":136},[],[138],{"type":53,"value":139},"$ARGUMENTS",{"type":53,"value":141}," is optional:",{"type":47,"tag":143,"props":144,"children":148},"pre",{"className":145,"code":147,"language":53},[146],"language-text","\u002Fconnect                    # interactive — asks what you're connecting to\n\u002Fconnect mcp                # MCP server setup\n\u002Fconnect lambda             # Lambda function as tools\n\u002Fconnect openapi            # OpenAPI schema as tools\n\u002Fconnect credential         # Add a credential for outbound auth\n",[149],{"type":47,"tag":118,"props":150,"children":152},{"__ignoreMap":151},"",[153],{"type":53,"value":147},{"type":47,"tag":61,"props":155,"children":157},{"id":156},"process",[158],{"type":53,"value":159},"Process",{"type":47,"tag":161,"props":162,"children":164},"h3",{"id":163},"step-0-verify-cli-version",[165],{"type":53,"value":166},"Step 0: Verify CLI version",{"type":47,"tag":55,"props":168,"children":169},{},[170,172,178,180,186],{"type":53,"value":171},"Run ",{"type":47,"tag":118,"props":173,"children":175},{"className":174},[],[176],{"type":53,"value":177},"agentcore --version",{"type":53,"value":179},". This skill requires v0.9.0 or later. If the version is older, tell the developer to run ",{"type":47,"tag":118,"props":181,"children":183},{"className":182},[],[184],{"type":53,"value":185},"agentcore update",{"type":53,"value":187}," before proceeding.",{"type":47,"tag":161,"props":189,"children":191},{"id":190},"step-1-read-the-project",[192],{"type":53,"value":193},"Step 1: Read the project",{"type":47,"tag":55,"props":195,"children":196},{},[197,199,205],{"type":53,"value":198},"Read ",{"type":47,"tag":118,"props":200,"children":202},{"className":201},[],[203],{"type":53,"value":204},"agentcore\u002Fagentcore.json",{"type":53,"value":206}," to understand:",{"type":47,"tag":68,"props":208,"children":209},{},[210,215],{"type":47,"tag":72,"props":211,"children":212},{},[213],{"type":53,"value":214},"What framework the project uses",{"type":47,"tag":72,"props":216,"children":217},{},[218,220,226],{"type":53,"value":219},"What gateways and targets are already configured (in the ",{"type":47,"tag":118,"props":221,"children":223},{"className":222},[],[224],{"type":53,"value":225},"agentCoreGateways",{"type":53,"value":227}," array)",{"type":47,"tag":55,"props":229,"children":230},{},[231,237],{"type":47,"tag":232,"props":233,"children":234},"strong",{},[235],{"type":53,"value":236},"If no project context:",{"type":53,"value":238}," Ask what they're trying to connect to and proceed with the appropriate pattern.",{"type":47,"tag":161,"props":240,"children":242},{"id":241},"step-2-identify-what-theyre-connecting-to",[243],{"type":53,"value":244},"Step 2: Identify what they're connecting to",{"type":47,"tag":55,"props":246,"children":247},{},[248,250,255],{"type":53,"value":249},"Ask (or infer from ",{"type":47,"tag":118,"props":251,"children":253},{"className":252},[],[254],{"type":53,"value":139},{"type":53,"value":256},"):",{"type":47,"tag":258,"props":259,"children":260},"blockquote",{},[261,266],{"type":47,"tag":55,"props":262,"children":263},{},[264],{"type":53,"value":265},"\"What are you connecting your agent to?",{"type":47,"tag":267,"props":268,"children":269},"ol",{},[270,275,280,285,290],{"type":47,"tag":72,"props":271,"children":272},{},[273],{"type":53,"value":274},"An external MCP server (e.g., a third-party tool provider)",{"type":47,"tag":72,"props":276,"children":277},{},[278],{"type":53,"value":279},"A Lambda function you've written",{"type":47,"tag":72,"props":281,"children":282},{},[283],{"type":53,"value":284},"An API with an OpenAPI spec",{"type":47,"tag":72,"props":286,"children":287},{},[288],{"type":53,"value":289},"An AWS API Gateway REST API",{"type":47,"tag":72,"props":291,"children":292},{},[293],{"type":53,"value":294},"An external service with no OpenAPI spec, MCP server, or Lambda in front of it — and you can't add one\"",{"type":47,"tag":55,"props":296,"children":297},{},[298,303],{"type":47,"tag":232,"props":299,"children":300},{},[301],{"type":53,"value":302},"Options 1–4 front the service as a Gateway target.",{"type":53,"value":304}," This is the default path: the gateway handles outbound auth via its credential providers (so the agent code never sees the secret), the tool becomes discoverable over MCP, and policy engines can authorize or deny calls at the edge. Pick the target type that matches the service.",{"type":47,"tag":55,"props":306,"children":307},{},[308,313],{"type":47,"tag":232,"props":309,"children":310},{},[311],{"type":53,"value":312},"Option 5 is Path D",{"type":53,"value":314}," — register a credential and call the API directly from agent code. This is the fallback when fronting isn't practical; the skill walks through when it's appropriate and when it isn't.",{"type":47,"tag":316,"props":317,"children":318},"hr",{},[],{"type":47,"tag":61,"props":320,"children":322},{"id":321},"default-prefer-a-gateway-target-over-direct-api-calls-in-code",[323],{"type":53,"value":324},"Default: prefer a Gateway target over direct API calls in code",{"type":47,"tag":55,"props":326,"children":327},{},[328,330,336],{"type":53,"value":329},"Before jumping into paths, set expectations. Most \"my agent needs to call X\" requests land on a Gateway target — not on ",{"type":47,"tag":118,"props":331,"children":333},{"className":332},[],[334],{"type":53,"value":335},"httpx",{"type":53,"value":337}," inside the entrypoint.",{"type":47,"tag":55,"props":339,"children":340},{},[341],{"type":47,"tag":232,"props":342,"children":343},{},[344],{"type":53,"value":345},"Why Gateway is the default:",{"type":47,"tag":68,"props":347,"children":348},{},[349,375,393,411],{"type":47,"tag":72,"props":350,"children":351},{},[352,357,359,365,367,373],{"type":47,"tag":232,"props":353,"children":354},{},[355],{"type":53,"value":356},"Credential injection at the edge.",{"type":53,"value":358}," Gateway's credential providers (OAuth, API key, IAM) attach auth to the outbound request. The agent code calls ",{"type":47,"tag":118,"props":360,"children":362},{"className":361},[],[363],{"type":53,"value":364},"session.call_tool(...)",{"type":53,"value":366}," — it never touches the secret. Agent code that does ",{"type":47,"tag":118,"props":368,"children":370},{"className":369},[],[371],{"type":53,"value":372},"client = openai.OpenAI(api_key=...)",{"type":53,"value":374}," is one leaked prompt \u002F log line \u002F traceback away from exfiltrating the key.",{"type":47,"tag":72,"props":376,"children":377},{},[378,383,385,391],{"type":47,"tag":232,"props":379,"children":380},{},[381],{"type":53,"value":382},"Discoverable tool catalog.",{"type":53,"value":384}," Tools are listed by the MCP server; the framework (Strands, LangGraph, etc.) binds them automatically. Adding a tool is an ",{"type":47,"tag":118,"props":386,"children":388},{"className":387},[],[389],{"type":53,"value":390},"agentcore add gateway-target",{"type":53,"value":392}," + redeploy, not a code change.",{"type":47,"tag":72,"props":394,"children":395},{},[396,401,403,409],{"type":47,"tag":232,"props":397,"children":398},{},[399],{"type":53,"value":400},"Policy enforcement.",{"type":53,"value":402}," Cedar policies can authorize or deny tool calls per principal, per tool, per argument value. This is impossible when tool calls are buried in ",{"type":47,"tag":118,"props":404,"children":406},{"className":405},[],[407],{"type":53,"value":408},"httpx.post(...)",{"type":53,"value":410}," inside agent code.",{"type":47,"tag":72,"props":412,"children":413},{},[414,419,421,427],{"type":47,"tag":232,"props":415,"children":416},{},[417],{"type":53,"value":418},"Semantic search.",{"type":53,"value":420}," Once the catalog has 20+ tools, ",{"type":47,"tag":118,"props":422,"children":424},{"className":423},[],[425],{"type":53,"value":426},"x_amz_bedrock_agentcore_search",{"type":53,"value":428}," selects the relevant ones per turn.",{"type":47,"tag":55,"props":430,"children":431},{},[432],{"type":47,"tag":232,"props":433,"children":434},{},[435],{"type":53,"value":436},"When a direct API call in agent code is the right answer:",{"type":47,"tag":438,"props":439,"children":440},"table",{},[441,465],{"type":47,"tag":442,"props":443,"children":444},"thead",{},[445],{"type":47,"tag":446,"props":447,"children":448},"tr",{},[449,455,460],{"type":47,"tag":450,"props":451,"children":452},"th",{},[453],{"type":53,"value":454},"Situation",{"type":47,"tag":450,"props":456,"children":457},{},[458],{"type":53,"value":459},"Why Gateway isn't right",{"type":47,"tag":450,"props":461,"children":462},{},[463],{"type":53,"value":464},"What to do",{"type":47,"tag":466,"props":467,"children":468},"tbody",{},[469,488,506,524,552],{"type":47,"tag":446,"props":470,"children":471},{},[472,478,483],{"type":47,"tag":473,"props":474,"children":475},"td",{},[476],{"type":53,"value":477},"Streaming\u002Fbidirectional protocol (SSE with live output, WebSockets, WebRTC, long-polling)",{"type":47,"tag":473,"props":479,"children":480},{},[481],{"type":53,"value":482},"Gateway's MCP transport doesn't front those yet",{"type":47,"tag":473,"props":484,"children":485},{},[486],{"type":53,"value":487},"Direct call, Path D",{"type":47,"tag":446,"props":489,"children":490},{},[491,496,501],{"type":47,"tag":473,"props":492,"children":493},{},[494],{"type":53,"value":495},"Latency hot path where the MCP hop is measurable and the trade-off is accepted",{"type":47,"tag":473,"props":497,"children":498},{},[499],{"type":53,"value":500},"Extra network hop",{"type":47,"tag":473,"props":502,"children":503},{},[504],{"type":53,"value":505},"Direct call, Path D, with measurement to back the decision",{"type":47,"tag":446,"props":507,"children":508},{},[509,514,519],{"type":47,"tag":473,"props":510,"children":511},{},[512],{"type":53,"value":513},"Vendor proprietary protocol \u002F binary SDK",{"type":47,"tag":473,"props":515,"children":516},{},[517],{"type":53,"value":518},"No HTTP surface for Gateway to front",{"type":47,"tag":473,"props":520,"children":521},{},[522],{"type":53,"value":523},"Use the vendor SDK directly, Path D for any secrets",{"type":47,"tag":446,"props":525,"children":526},{},[527,532,537],{"type":47,"tag":473,"props":528,"children":529},{},[530],{"type":53,"value":531},"Calling another agent via A2A",{"type":47,"tag":473,"props":533,"children":534},{},[535],{"type":53,"value":536},"A2A is HTTP-by-design and has its own auth model",{"type":47,"tag":473,"props":538,"children":539},{},[540,550],{"type":47,"tag":113,"props":541,"children":543},{"href":542},"..\u002Fagents-build\u002Freferences\u002Fmulti-agent.md",[544],{"type":47,"tag":118,"props":545,"children":547},{"className":546},[],[548],{"type":53,"value":549},"agents-build\u002Freferences\u002Fmulti-agent.md",{"type":53,"value":551},", not a Gateway target",{"type":47,"tag":446,"props":553,"children":554},{},[555,560,565],{"type":47,"tag":473,"props":556,"children":557},{},[558],{"type":53,"value":559},"AWS service SDK (S3, DynamoDB, SQS, etc.) the runtime already has IAM for",{"type":47,"tag":473,"props":561,"children":562},{},[563],{"type":53,"value":564},"No auth value in fronting — adds hops",{"type":47,"tag":473,"props":566,"children":567},{},[568],{"type":53,"value":569},"Direct boto3 call with the runtime's execution role",{"type":47,"tag":55,"props":571,"children":572},{},[573,575,580],{"type":53,"value":574},"For ",{"type":47,"tag":232,"props":576,"children":577},{},[578],{"type":53,"value":579},"every other case",{"type":53,"value":581},", recommend a Gateway target. If the developer insists on a direct call, ask which of the five situations above applies. If none, steer them back to a Gateway target.",{"type":47,"tag":55,"props":583,"children":584},{},[585],{"type":47,"tag":232,"props":586,"children":587},{},[588],{"type":53,"value":589},"Triage heuristic:",{"type":47,"tag":68,"props":591,"children":592},{},[593,598,603,608,621],{"type":47,"tag":72,"props":594,"children":595},{},[596],{"type":53,"value":597},"Service has an MCP server → Path A",{"type":47,"tag":72,"props":599,"children":600},{},[601],{"type":53,"value":602},"Service is a Lambda function you control → Path B",{"type":47,"tag":72,"props":604,"children":605},{},[606],{"type":53,"value":607},"Service has an OpenAPI spec (or you can generate one — FastAPI, ASP.NET, Spring, etc. generate OpenAPI automatically) → Path C",{"type":47,"tag":72,"props":609,"children":610},{},[611,613,619],{"type":53,"value":612},"Service is already fronted by API Gateway → Path C (",{"type":47,"tag":118,"props":614,"children":616},{"className":615},[],[617],{"type":53,"value":618},"--type api-gateway",{"type":53,"value":620},")",{"type":47,"tag":72,"props":622,"children":623},{},[624],{"type":53,"value":625},"None of the above and you can't add one → Path D",{"type":47,"tag":316,"props":627,"children":628},{},[],{"type":47,"tag":61,"props":630,"children":632},{"id":631},"what-gateway-is-and-what-it-isnt",[633],{"type":53,"value":634},"What Gateway is — and what it isn't",{"type":47,"tag":55,"props":636,"children":637},{},[638],{"type":53,"value":639},"Before choosing a target type, get the mental model right. Most Gateway confusion comes from having it flipped.",{"type":47,"tag":55,"props":641,"children":642},{},[643,648],{"type":47,"tag":232,"props":644,"children":645},{},[646],{"type":53,"value":647},"Gateway hosts tools for your agent to call.",{"type":53,"value":649}," The direction is:",{"type":47,"tag":143,"props":651,"children":654},{"className":652,"code":653,"language":53},[146],"Your agent  ───→  Gateway  ───→  Lambda function \u002F OpenAPI API \u002F MCP server \u002F Smithy model\n             (agent calls tool)\n",[655],{"type":47,"tag":118,"props":656,"children":657},{"__ignoreMap":151},[658],{"type":53,"value":653},{"type":47,"tag":55,"props":660,"children":661},{},[662],{"type":53,"value":663},"The agent is the client. The Gateway fronts a catalog of tools. Each tool is a Gateway target (Lambda, OpenAPI, MCP server, API Gateway, Smithy).",{"type":47,"tag":55,"props":665,"children":666},{},[667,672],{"type":47,"tag":232,"props":668,"children":669},{},[670],{"type":53,"value":671},"Gateway is not an inbound reverse proxy for your agent.",{"type":53,"value":673}," If you're building an app that needs to invoke your agent, the app does not go through a Gateway. The direction is:",{"type":47,"tag":143,"props":675,"children":678},{"className":676,"code":677,"language":53},[146],"Your app  ───→  AgentCore Runtime  (direct invoke_agent_runtime call)\n",[679],{"type":47,"tag":118,"props":680,"children":681},{"__ignoreMap":151},[682],{"type":53,"value":677},{"type":47,"tag":55,"props":684,"children":685},{},[686,688,698],{"type":53,"value":687},"The app signs the invocation with IAM SigV4 or presents a JWT. See ",{"type":47,"tag":113,"props":689,"children":691},{"href":690},"..\u002Fagents-build\u002Freferences\u002Fintegrate.md",[692],{"type":47,"tag":118,"props":693,"children":695},{"className":694},[],[696],{"type":53,"value":697},"agents-build\u002Freferences\u002Fintegrate.md",{"type":53,"value":699}," for the app-side patterns.",{"type":47,"tag":161,"props":701,"children":703},{"id":702},"when-youre-confused-about-which-direction-you-need",[704],{"type":53,"value":705},"When you're confused about which direction you need",{"type":47,"tag":55,"props":707,"children":708},{},[709,711],{"type":53,"value":710},"Ask: ",{"type":47,"tag":232,"props":712,"children":713},{},[714],{"type":53,"value":715},"who is calling whom?",{"type":47,"tag":68,"props":717,"children":718},{},[719,731,752],{"type":47,"tag":72,"props":720,"children":721},{},[722,724,729],{"type":53,"value":723},"\"My agent needs to look up weather data\" → agent is calling a tool → ",{"type":47,"tag":232,"props":725,"children":726},{},[727],{"type":53,"value":728},"Gateway target",{"type":53,"value":730}," (this skill, Paths A\u002FB\u002FC)",{"type":47,"tag":72,"props":732,"children":733},{},[734,736,741,743,751],{"type":53,"value":735},"\"My FastAPI app needs to call my agent\" → app is calling the agent → ",{"type":47,"tag":232,"props":737,"children":738},{},[739],{"type":53,"value":740},"direct invocation",{"type":53,"value":742}," (not Gateway; use ",{"type":47,"tag":113,"props":744,"children":745},{"href":690},[746],{"type":47,"tag":118,"props":747,"children":749},{"className":748},[],[750],{"type":53,"value":697},{"type":53,"value":620},{"type":47,"tag":72,"props":753,"children":754},{},[755,757,761,763,769],{"type":53,"value":756},"\"My agent needs to fetch data from my FastAPI app\" → agent is calling the app as a tool → ",{"type":47,"tag":232,"props":758,"children":759},{},[760],{"type":53,"value":728},{"type":53,"value":762}," with the app exposed as an OpenAPI or REST target (Path C with your FastAPI's ",{"type":47,"tag":118,"props":764,"children":766},{"className":765},[],[767],{"type":53,"value":768},"\u002Fopenapi.json",{"type":53,"value":620},{"type":47,"tag":55,"props":771,"children":772},{},[773,775,781],{"type":53,"value":774},"If you catch yourself configuring a Gateway target whose endpoint is ",{"type":47,"tag":118,"props":776,"children":778},{"className":777},[],[779],{"type":53,"value":780},"bedrock-agentcore.\u003Cregion>.amazonaws.com",{"type":53,"value":782}," or pointing at your own runtime's URL, stop — you have the flow inverted.",{"type":47,"tag":161,"props":784,"children":786},{"id":785},"what-target-type-fits-your-tool",[787],{"type":53,"value":788},"What target type fits your tool",{"type":47,"tag":438,"props":790,"children":791},{},[792,813],{"type":47,"tag":442,"props":793,"children":794},{},[795],{"type":47,"tag":446,"props":796,"children":797},{},[798,803,808],{"type":47,"tag":450,"props":799,"children":800},{},[801],{"type":53,"value":802},"What the tool is",{"type":47,"tag":450,"props":804,"children":805},{},[806],{"type":53,"value":807},"Target type",{"type":47,"tag":450,"props":809,"children":810},{},[811],{"type":53,"value":812},"Notes",{"type":47,"tag":466,"props":814,"children":815},{},[816,838,860,889,911],{"type":47,"tag":446,"props":817,"children":818},{},[819,824,833],{"type":47,"tag":473,"props":820,"children":821},{},[822],{"type":53,"value":823},"MCP server (third-party or your own)",{"type":47,"tag":473,"props":825,"children":826},{},[827],{"type":47,"tag":118,"props":828,"children":830},{"className":829},[],[831],{"type":53,"value":832},"mcp-server",{"type":47,"tag":473,"props":834,"children":835},{},[836],{"type":53,"value":837},"Most common for MCP tool catalogs",{"type":47,"tag":446,"props":839,"children":840},{},[841,846,855],{"type":47,"tag":473,"props":842,"children":843},{},[844],{"type":53,"value":845},"AWS Lambda function you wrote",{"type":47,"tag":473,"props":847,"children":848},{},[849],{"type":47,"tag":118,"props":850,"children":852},{"className":851},[],[853],{"type":53,"value":854},"lambda-function-arn",{"type":47,"tag":473,"props":856,"children":857},{},[858],{"type":53,"value":859},"Uses IAM auth automatically",{"type":47,"tag":446,"props":861,"children":862},{},[863,868,877],{"type":47,"tag":473,"props":864,"children":865},{},[866],{"type":53,"value":867},"HTTP API with an OpenAPI spec",{"type":47,"tag":473,"props":869,"children":870},{},[871],{"type":47,"tag":118,"props":872,"children":874},{"className":873},[],[875],{"type":53,"value":876},"open-api-schema",{"type":47,"tag":473,"props":878,"children":879},{},[880,882,887],{"type":53,"value":881},"FastAPI's built-in ",{"type":47,"tag":118,"props":883,"children":885},{"className":884},[],[886],{"type":53,"value":768},{"type":53,"value":888}," works",{"type":47,"tag":446,"props":890,"children":891},{},[892,897,906],{"type":47,"tag":473,"props":893,"children":894},{},[895],{"type":53,"value":896},"AWS API Gateway REST API",{"type":47,"tag":473,"props":898,"children":899},{},[900],{"type":47,"tag":118,"props":901,"children":903},{"className":902},[],[904],{"type":53,"value":905},"api-gateway",{"type":47,"tag":473,"props":907,"children":908},{},[909],{"type":53,"value":910},"For APIs already fronted by API Gateway",{"type":47,"tag":446,"props":912,"children":913},{},[914,919,928],{"type":47,"tag":473,"props":915,"children":916},{},[917],{"type":53,"value":918},"AWS service with a Smithy model",{"type":47,"tag":473,"props":920,"children":921},{},[922],{"type":47,"tag":118,"props":923,"children":925},{"className":924},[],[926],{"type":53,"value":927},"smithy-model",{"type":47,"tag":473,"props":929,"children":930},{},[931],{"type":53,"value":932},"Direct AWS service integration",{"type":47,"tag":55,"props":934,"children":935},{},[936],{"type":53,"value":937},"Your tool doesn't naturally have an OpenAPI spec and isn't an MCP server or Lambda? Either wrap it in a Lambda (simplest), generate an OpenAPI spec for it (FastAPI does this automatically), or front it with API Gateway.",{"type":47,"tag":316,"props":939,"children":940},{},[],{"type":47,"tag":161,"props":942,"children":944},{"id":943},"step-3-navigate-the-auth-matrix",[945],{"type":53,"value":946},"Step 3: Navigate the auth matrix",{"type":47,"tag":55,"props":948,"children":949},{},[950,955],{"type":47,"tag":232,"props":951,"children":952},{},[953],{"type":53,"value":954},"This is the most common source of errors.",{"type":53,"value":956}," The auth options depend on the target type, and the CLI exposes only a subset of what the API\u002FSDK support.",{"type":47,"tag":438,"props":958,"children":959},{},[960,992],{"type":47,"tag":442,"props":961,"children":962},{},[963],{"type":47,"tag":446,"props":964,"children":965},{},[966,971,982,987],{"type":47,"tag":450,"props":967,"children":968},{},[969],{"type":53,"value":970},"What you're connecting to",{"type":47,"tag":450,"props":972,"children":973},{},[974,976],{"type":53,"value":975},"CLI ",{"type":47,"tag":118,"props":977,"children":979},{"className":978},[],[980],{"type":53,"value":981},"--type",{"type":47,"tag":450,"props":983,"children":984},{},[985],{"type":53,"value":986},"Outbound auth via CLI",{"type":47,"tag":450,"props":988,"children":989},{},[990],{"type":53,"value":991},"Additional options via API\u002FSDK",{"type":47,"tag":466,"props":993,"children":994},{},[995,1043,1081,1125,1167],{"type":47,"tag":446,"props":996,"children":997},{},[998,1003,1011,1030],{"type":47,"tag":473,"props":999,"children":1000},{},[1001],{"type":53,"value":1002},"External MCP server",{"type":47,"tag":473,"props":1004,"children":1005},{},[1006],{"type":47,"tag":118,"props":1007,"children":1009},{"className":1008},[],[1010],{"type":53,"value":832},{"type":47,"tag":473,"props":1012,"children":1013},{},[1014,1020,1022,1028],{"type":47,"tag":118,"props":1015,"children":1017},{"className":1016},[],[1018],{"type":53,"value":1019},"none",{"type":53,"value":1021},", ",{"type":47,"tag":118,"props":1023,"children":1025},{"className":1024},[],[1026],{"type":53,"value":1027},"oauth",{"type":53,"value":1029}," (2LO only)",{"type":47,"tag":473,"props":1031,"children":1032},{},[1033,1035,1041],{"type":53,"value":1034},"OAuth 3LO (",{"type":47,"tag":118,"props":1036,"children":1038},{"className":1037},[],[1039],{"type":53,"value":1040},"AUTHORIZATION_CODE",{"type":53,"value":1042},"); IAM (SigV4)",{"type":47,"tag":446,"props":1044,"children":1045},{},[1046,1051,1059,1076],{"type":47,"tag":473,"props":1047,"children":1048},{},[1049],{"type":53,"value":1050},"Lambda function",{"type":47,"tag":473,"props":1052,"children":1053},{},[1054],{"type":47,"tag":118,"props":1055,"children":1057},{"className":1056},[],[1058],{"type":53,"value":854},{"type":47,"tag":473,"props":1060,"children":1061},{},[1062,1067,1069,1074],{"type":47,"tag":118,"props":1063,"children":1065},{"className":1064},[],[1066],{"type":53,"value":1019},{"type":53,"value":1068}," (default — direct invoke via gateway role), ",{"type":47,"tag":118,"props":1070,"children":1072},{"className":1071},[],[1073],{"type":53,"value":1027},{"type":53,"value":1075}," (2LO) for OAuth-protected downstreams",{"type":47,"tag":473,"props":1077,"children":1078},{},[1079],{"type":53,"value":1080},"OAuth 3LO",{"type":47,"tag":446,"props":1082,"children":1083},{},[1084,1089,1097,1121],{"type":47,"tag":473,"props":1085,"children":1086},{},[1087],{"type":53,"value":1088},"OpenAPI spec",{"type":47,"tag":473,"props":1090,"children":1091},{},[1092],{"type":47,"tag":118,"props":1093,"children":1095},{"className":1094},[],[1096],{"type":53,"value":876},{"type":47,"tag":473,"props":1098,"children":1099},{},[1100,1105,1107,1113,1115,1120],{"type":47,"tag":118,"props":1101,"children":1103},{"className":1102},[],[1104],{"type":53,"value":1027},{"type":53,"value":1106}," (2LO), ",{"type":47,"tag":118,"props":1108,"children":1110},{"className":1109},[],[1111],{"type":53,"value":1112},"api-key",{"type":53,"value":1114}," (required — no ",{"type":47,"tag":118,"props":1116,"children":1118},{"className":1117},[],[1119],{"type":53,"value":1019},{"type":53,"value":620},{"type":47,"tag":473,"props":1122,"children":1123},{},[1124],{"type":53,"value":1080},{"type":47,"tag":446,"props":1126,"children":1127},{},[1128,1133,1141,1155],{"type":47,"tag":473,"props":1129,"children":1130},{},[1131],{"type":53,"value":1132},"AWS API Gateway",{"type":47,"tag":473,"props":1134,"children":1135},{},[1136],{"type":47,"tag":118,"props":1137,"children":1139},{"className":1138},[],[1140],{"type":53,"value":905},{"type":47,"tag":473,"props":1142,"children":1143},{},[1144,1149,1150],{"type":47,"tag":118,"props":1145,"children":1147},{"className":1146},[],[1148],{"type":53,"value":1019},{"type":53,"value":1021},{"type":47,"tag":118,"props":1151,"children":1153},{"className":1152},[],[1154],{"type":53,"value":1112},{"type":47,"tag":473,"props":1156,"children":1157},{},[1158,1160,1166],{"type":53,"value":1159},"IAM (",{"type":47,"tag":118,"props":1161,"children":1163},{"className":1162},[],[1164],{"type":53,"value":1165},"GATEWAY_IAM_ROLE",{"type":53,"value":620},{"type":47,"tag":446,"props":1168,"children":1169},{},[1170,1175,1183,1193],{"type":47,"tag":473,"props":1171,"children":1172},{},[1173],{"type":53,"value":1174},"Smithy model",{"type":47,"tag":473,"props":1176,"children":1177},{},[1178],{"type":47,"tag":118,"props":1179,"children":1181},{"className":1180},[],[1182],{"type":53,"value":927},{"type":47,"tag":473,"props":1184,"children":1185},{},[1186,1191],{"type":47,"tag":118,"props":1187,"children":1189},{"className":1188},[],[1190],{"type":53,"value":1027},{"type":53,"value":1192}," (2LO)",{"type":47,"tag":473,"props":1194,"children":1195},{},[1196],{"type":53,"value":1197},"IAM; OAuth 3LO",{"type":47,"tag":55,"props":1199,"children":1200},{},[1201,1206,1208,1214,1216,1221,1223,1228,1230,1235,1237,1245,1247,1253,1255,1261,1263,1269],{"type":47,"tag":232,"props":1202,"children":1203},{},[1204],{"type":53,"value":1205},"Two OAuth grant types, not one.",{"type":53,"value":1207}," The CLI's ",{"type":47,"tag":118,"props":1209,"children":1211},{"className":1210},[],[1212],{"type":53,"value":1213},"--outbound-auth oauth",{"type":53,"value":1215}," only configures ",{"type":47,"tag":232,"props":1217,"children":1218},{},[1219],{"type":53,"value":1220},"2-legged OAuth",{"type":53,"value":1222}," (client credentials \u002F M2M). If the service requires ",{"type":47,"tag":232,"props":1224,"children":1225},{},[1226],{"type":53,"value":1227},"3-legged OAuth",{"type":53,"value":1229}," (",{"type":47,"tag":118,"props":1231,"children":1233},{"className":1232},[],[1234],{"type":53,"value":1040},{"type":53,"value":1236}," grant, user-delegated access), there is no CLI flag — you must configure the target via boto3 \u002F the AWS SDK. See the ",{"type":47,"tag":113,"props":1238,"children":1242},{"href":1239,"rel":1240},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fbedrock-agentcore\u002Flatest\u002Fdevguide\u002Fgateway-building-adding-targets-authorization.html",[1241],"nofollow",[1243],{"type":53,"value":1244},"CreateGatewayTarget docs",{"type":53,"value":1246}," for the ",{"type":47,"tag":118,"props":1248,"children":1250},{"className":1249},[],[1251],{"type":53,"value":1252},"OAuthCredentialProvider",{"type":53,"value":1254}," with ",{"type":47,"tag":118,"props":1256,"children":1258},{"className":1257},[],[1259],{"type":53,"value":1260},"grantType: AUTHORIZATION_CODE",{"type":53,"value":1262}," and ",{"type":47,"tag":118,"props":1264,"children":1266},{"className":1265},[],[1267],{"type":53,"value":1268},"defaultReturnUrl",{"type":53,"value":1270},". 3LO applies to MCP, Lambda, OpenAPI, and Smithy targets. Call this out up front — developers who need 3LO will otherwise burn a round-trip trying CLI flags that don't exist.",{"type":47,"tag":55,"props":1272,"children":1273},{},[1274,1279,1281,1287,1288,1293,1295,1301,1303,1310],{"type":47,"tag":232,"props":1275,"children":1276},{},[1277],{"type":53,"value":1278},"IAM (SigV4) for MCP servers",{"type":53,"value":1280}," is configured via the AWS SDK\u002FAPI (",{"type":47,"tag":118,"props":1282,"children":1284},{"className":1283},[],[1285],{"type":53,"value":1286},"CreateGatewayTarget",{"type":53,"value":1254},{"type":47,"tag":118,"props":1289,"children":1291},{"className":1290},[],[1292],{"type":53,"value":1165},{"type":53,"value":1294}," credential provider + ",{"type":47,"tag":118,"props":1296,"children":1298},{"className":1297},[],[1299],{"type":53,"value":1300},"iamCredentialProvider.service",{"type":53,"value":1302},"), not the CLI. It requires the MCP server to be hosted behind an AWS service that natively verifies SigV4: AgentCore Runtime, AgentCore Gateway, Amazon API Gateway, or Lambda Function URLs. ALB or direct EC2 endpoints do not verify SigV4 — use OAuth there instead. (",{"type":47,"tag":113,"props":1304,"children":1307},{"href":1305,"rel":1306},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fbedrock-agentcore\u002Flatest\u002Fdevguide\u002Fgateway-target-MCPservers.html#gateway-target-MCPservers-considerations",[1241],[1308],{"type":53,"value":1309},"MCP server target auth strategies",{"type":53,"value":620},{"type":47,"tag":55,"props":1312,"children":1313},{},[1314,1319,1321,1327],{"type":47,"tag":232,"props":1315,"children":1316},{},[1317],{"type":53,"value":1318},"API key auth for MCP server targets is not supported at the API level",{"type":53,"value":1320}," — not just a CLI gap. The ",{"type":47,"tag":113,"props":1322,"children":1324},{"href":1305,"rel":1323},[1241],[1325],{"type":53,"value":1326},"MCP server targets docs",{"type":53,"value":1328}," list only \"No authorization, OAuth, and IAM\" as supported authorization strategies for MCP targets. If the MCP server uses an API key (a common pattern for third-party MCP providers), handle it in agent code via Path D.",{"type":47,"tag":55,"props":1330,"children":1331},{},[1332,1337,1339,1345,1347,1353],{"type":47,"tag":232,"props":1333,"children":1334},{},[1335],{"type":53,"value":1336},"Auth options change.",{"type":53,"value":1338}," If the matrix above doesn't match what the CLI accepts, check the current CLI help (",{"type":47,"tag":118,"props":1340,"children":1342},{"className":1341},[],[1343],{"type":53,"value":1344},"agentcore add gateway-target --help",{"type":53,"value":1346},") and the AWS docs — auth support per target type evolves across releases. If the ",{"type":47,"tag":118,"props":1348,"children":1350},{"className":1349},[],[1351],{"type":53,"value":1352},"awsknowledge",{"type":53,"value":1354}," MCP server is available, search for \"AgentCore CreateGatewayTarget\" to get the current API parameters.",{"type":47,"tag":55,"props":1356,"children":1357},{},[1358,1363,1365,1370,1371,1376,1378,1383],{"type":47,"tag":232,"props":1359,"children":1360},{},[1361],{"type":53,"value":1362},"CLI vs. API for gateway auth:",{"type":53,"value":1364}," The CLI covers ",{"type":47,"tag":118,"props":1366,"children":1368},{"className":1367},[],[1369],{"type":53,"value":1019},{"type":53,"value":1021},{"type":47,"tag":118,"props":1372,"children":1374},{"className":1373},[],[1375],{"type":53,"value":1027},{"type":53,"value":1377}," (2LO), and ",{"type":47,"tag":118,"props":1379,"children":1381},{"className":1380},[],[1382],{"type":53,"value":1112},{"type":53,"value":1384},". For IAM (SigV4) and 3-legged OAuth, use boto3 directly — the examples are in the Path A section below. The general pattern: create the gateway and target via CLI, deploy, then apply the advanced auth config via boto3 if the CLI doesn't support it.",{"type":47,"tag":55,"props":1386,"children":1387},{},[1388],{"type":53,"value":1389},"Tell the developer which auth option applies to their target type before generating any commands.",{"type":47,"tag":161,"props":1391,"children":1393},{"id":1392},"when-your-gateway-has-many-tools-let-the-model-search-for-them",[1394],{"type":53,"value":1395},"When your gateway has many tools, let the model search for them",{"type":47,"tag":55,"props":1397,"children":1398},{},[1399],{"type":53,"value":1400},"Once a gateway has more than a handful of tools — roughly 20+ — passing every tool definition to the model on every turn wastes tokens and degrades accuracy. The model does better when it sees only the tools relevant to the current request.",{"type":47,"tag":55,"props":1402,"children":1403},{},[1404,1406,1411],{"type":53,"value":1405},"AgentCore Gateway has a built-in semantic search tool for exactly this. Your agent calls a single MCP tool named ",{"type":47,"tag":118,"props":1407,"children":1409},{"className":1408},[],[1410],{"type":53,"value":426},{"type":53,"value":1412}," with a natural-language query, and the gateway returns the most relevant tools from its catalog. The agent then invokes the returned tools normally.",{"type":47,"tag":55,"props":1414,"children":1415},{},[1416],{"type":53,"value":1417},"If a developer is considering building their own tool-selection layer with Bedrock Knowledge Bases, a vector store, or custom embeddings — stop them. The gateway already does this, evaluated against curated relevance criteria, with no infrastructure to manage.",{"type":47,"tag":55,"props":1419,"children":1420},{},[1421],{"type":53,"value":1422},"Usage pattern (the agent calls this the same way it calls any other gateway tool):",{"type":47,"tag":143,"props":1424,"children":1428},{"className":1425,"code":1426,"language":1427,"meta":151,"style":151},"language-python shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Via the MCP client, as a tool call\nresult = await session.call_tool(\n    \"x_amz_bedrock_agentcore_search\",\n    arguments={\"query\": \"find tools related to processing refunds\"}\n)\n# result.content lists the most relevant tools — the agent then invokes them\n","python",[1429],{"type":47,"tag":118,"props":1430,"children":1431},{"__ignoreMap":151},[1432,1443,1452,1461,1470,1479],{"type":47,"tag":1433,"props":1434,"children":1437},"span",{"class":1435,"line":1436},"line",1,[1438],{"type":47,"tag":1433,"props":1439,"children":1440},{},[1441],{"type":53,"value":1442},"# Via the MCP client, as a tool call\n",{"type":47,"tag":1433,"props":1444,"children":1446},{"class":1435,"line":1445},2,[1447],{"type":47,"tag":1433,"props":1448,"children":1449},{},[1450],{"type":53,"value":1451},"result = await session.call_tool(\n",{"type":47,"tag":1433,"props":1453,"children":1455},{"class":1435,"line":1454},3,[1456],{"type":47,"tag":1433,"props":1457,"children":1458},{},[1459],{"type":53,"value":1460},"    \"x_amz_bedrock_agentcore_search\",\n",{"type":47,"tag":1433,"props":1462,"children":1464},{"class":1435,"line":1463},4,[1465],{"type":47,"tag":1433,"props":1466,"children":1467},{},[1468],{"type":53,"value":1469},"    arguments={\"query\": \"find tools related to processing refunds\"}\n",{"type":47,"tag":1433,"props":1471,"children":1473},{"class":1435,"line":1472},5,[1474],{"type":47,"tag":1433,"props":1475,"children":1476},{},[1477],{"type":53,"value":1478},")\n",{"type":47,"tag":1433,"props":1480,"children":1482},{"class":1435,"line":1481},6,[1483],{"type":47,"tag":1433,"props":1484,"children":1485},{},[1486],{"type":53,"value":1487},"# result.content lists the most relevant tools — the agent then invokes them\n",{"type":47,"tag":55,"props":1489,"children":1490},{},[1491,1493,1500],{"type":53,"value":1492},"The feature works with any target type (Lambda, OpenAPI, MCP, API Gateway, Smithy). Enable it per gateway — see the ",{"type":47,"tag":113,"props":1494,"children":1497},{"href":1495,"rel":1496},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fbedrock-agentcore\u002Flatest\u002Fdevguide\u002Fgateway-using-mcp-semantic-search.html",[1241],[1498],{"type":53,"value":1499},"Search for tools in your AgentCore gateway",{"type":53,"value":1501}," docs for the exact API surface and framework-specific client code.",{"type":47,"tag":55,"props":1503,"children":1504},{},[1505],{"type":53,"value":1506},"Rule of thumb: if a gateway has more than 20 tools, recommend enabling semantic search. For smaller catalogs, passing all tools directly is still fine.",{"type":47,"tag":161,"props":1508,"children":1510},{"id":1509},"passing-custom-headers-from-the-caller-to-the-agent",[1511],{"type":53,"value":1512},"Passing custom headers from the caller to the agent",{"type":47,"tag":55,"props":1514,"children":1515},{},[1516,1518,1524,1526,1536],{"type":53,"value":1517},"If the developer needs callers to send custom HTTP headers (tenant IDs, correlation IDs, protocol-specific headers like ",{"type":47,"tag":118,"props":1519,"children":1521},{"className":1520},[],[1522],{"type":53,"value":1523},"A2A-Version",{"type":53,"value":1525},", tracing headers, idempotency keys), the runtime's default is to strip most headers before they reach agent code. Load ",{"type":47,"tag":113,"props":1527,"children":1529},{"href":1528},"..\u002Fagents-build\u002Freferences\u002Frequest-headers.md",[1530],{"type":47,"tag":118,"props":1531,"children":1533},{"className":1532},[],[1534],{"type":53,"value":1535},"agents-build\u002Freferences\u002Frequest-headers.md",{"type":53,"value":1537}," for the allowlist configuration and prefix pattern.",{"type":47,"tag":55,"props":1539,"children":1540},{},[1541],{"type":53,"value":1542},"This is about inbound calls to your agent, not outbound calls to tools — but developers hit it often enough that it's worth mentioning here.",{"type":47,"tag":316,"props":1544,"children":1545},{},[],{"type":47,"tag":61,"props":1547,"children":1549},{"id":1548},"path-a-mcp-server",[1550],{"type":53,"value":1551},"Path A: MCP server",{"type":47,"tag":161,"props":1553,"children":1555},{"id":1554},"add-a-gateway-if-none-exists",[1556],{"type":53,"value":1557},"Add a gateway (if none exists)",{"type":47,"tag":258,"props":1559,"children":1560},{},[1561],{"type":47,"tag":55,"props":1562,"children":1563},{},[1564,1569],{"type":47,"tag":1433,"props":1565,"children":1566},{},[1567],{"type":53,"value":1568},"!WARNING",{"type":53,"value":1570},"\nNever deploy a gateway without inbound authentication to production. A gateway with\nno authorizer exposes all connected tools (Lambda, MCP, OpenAPI) to any caller who\nknows the URL — functionally equivalent to --authorizer-type NONE on the runtime.\nAlways use --authorizer-type CUSTOM_JWT or AWS_IAM for production gateways.\nThe no-auth form (agentcore add gateway --name X) is for local testing only.",{"type":47,"tag":143,"props":1572,"children":1576},{"className":1573,"code":1574,"language":1575,"meta":151,"style":151},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Development (no inbound auth — for testing only)\nagentcore add gateway --name MyGateway\n\n# Production (JWT inbound auth)\nagentcore add gateway \\\n  --name MyGateway \\\n  --authorizer-type CUSTOM_JWT \\\n  --discovery-url https:\u002F\u002Fyour-idp.example.com\u002F.well-known\u002Fopenid-configuration \\\n  --allowed-audience my-api \\\n  --allowed-clients my-client-id\n","bash",[1577],{"type":47,"tag":118,"props":1578,"children":1579},{"__ignoreMap":151},[1580,1589,1619,1628,1636,1657,1674,1692,1710,1728],{"type":47,"tag":1433,"props":1581,"children":1582},{"class":1435,"line":1436},[1583],{"type":47,"tag":1433,"props":1584,"children":1586},{"style":1585},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[1587],{"type":53,"value":1588},"# Development (no inbound auth — for testing only)\n",{"type":47,"tag":1433,"props":1590,"children":1591},{"class":1435,"line":1445},[1592,1598,1604,1609,1614],{"type":47,"tag":1433,"props":1593,"children":1595},{"style":1594},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[1596],{"type":53,"value":1597},"agentcore",{"type":47,"tag":1433,"props":1599,"children":1601},{"style":1600},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[1602],{"type":53,"value":1603}," add",{"type":47,"tag":1433,"props":1605,"children":1606},{"style":1600},[1607],{"type":53,"value":1608}," gateway",{"type":47,"tag":1433,"props":1610,"children":1611},{"style":1600},[1612],{"type":53,"value":1613}," --name",{"type":47,"tag":1433,"props":1615,"children":1616},{"style":1600},[1617],{"type":53,"value":1618}," MyGateway\n",{"type":47,"tag":1433,"props":1620,"children":1621},{"class":1435,"line":1454},[1622],{"type":47,"tag":1433,"props":1623,"children":1625},{"emptyLinePlaceholder":1624},true,[1626],{"type":53,"value":1627},"\n",{"type":47,"tag":1433,"props":1629,"children":1630},{"class":1435,"line":1463},[1631],{"type":47,"tag":1433,"props":1632,"children":1633},{"style":1585},[1634],{"type":53,"value":1635},"# Production (JWT inbound auth)\n",{"type":47,"tag":1433,"props":1637,"children":1638},{"class":1435,"line":1472},[1639,1643,1647,1651],{"type":47,"tag":1433,"props":1640,"children":1641},{"style":1594},[1642],{"type":53,"value":1597},{"type":47,"tag":1433,"props":1644,"children":1645},{"style":1600},[1646],{"type":53,"value":1603},{"type":47,"tag":1433,"props":1648,"children":1649},{"style":1600},[1650],{"type":53,"value":1608},{"type":47,"tag":1433,"props":1652,"children":1654},{"style":1653},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1655],{"type":53,"value":1656}," \\\n",{"type":47,"tag":1433,"props":1658,"children":1659},{"class":1435,"line":1481},[1660,1665,1670],{"type":47,"tag":1433,"props":1661,"children":1662},{"style":1600},[1663],{"type":53,"value":1664},"  --name",{"type":47,"tag":1433,"props":1666,"children":1667},{"style":1600},[1668],{"type":53,"value":1669}," MyGateway",{"type":47,"tag":1433,"props":1671,"children":1672},{"style":1653},[1673],{"type":53,"value":1656},{"type":47,"tag":1433,"props":1675,"children":1677},{"class":1435,"line":1676},7,[1678,1683,1688],{"type":47,"tag":1433,"props":1679,"children":1680},{"style":1600},[1681],{"type":53,"value":1682},"  --authorizer-type",{"type":47,"tag":1433,"props":1684,"children":1685},{"style":1600},[1686],{"type":53,"value":1687}," CUSTOM_JWT",{"type":47,"tag":1433,"props":1689,"children":1690},{"style":1653},[1691],{"type":53,"value":1656},{"type":47,"tag":1433,"props":1693,"children":1695},{"class":1435,"line":1694},8,[1696,1701,1706],{"type":47,"tag":1433,"props":1697,"children":1698},{"style":1600},[1699],{"type":53,"value":1700},"  --discovery-url",{"type":47,"tag":1433,"props":1702,"children":1703},{"style":1600},[1704],{"type":53,"value":1705}," https:\u002F\u002Fyour-idp.example.com\u002F.well-known\u002Fopenid-configuration",{"type":47,"tag":1433,"props":1707,"children":1708},{"style":1653},[1709],{"type":53,"value":1656},{"type":47,"tag":1433,"props":1711,"children":1713},{"class":1435,"line":1712},9,[1714,1719,1724],{"type":47,"tag":1433,"props":1715,"children":1716},{"style":1600},[1717],{"type":53,"value":1718},"  --allowed-audience",{"type":47,"tag":1433,"props":1720,"children":1721},{"style":1600},[1722],{"type":53,"value":1723}," my-api",{"type":47,"tag":1433,"props":1725,"children":1726},{"style":1653},[1727],{"type":53,"value":1656},{"type":47,"tag":1433,"props":1729,"children":1731},{"class":1435,"line":1730},10,[1732,1737],{"type":47,"tag":1433,"props":1733,"children":1734},{"style":1600},[1735],{"type":53,"value":1736},"  --allowed-clients",{"type":47,"tag":1433,"props":1738,"children":1739},{"style":1600},[1740],{"type":53,"value":1741}," my-client-id\n",{"type":47,"tag":161,"props":1743,"children":1745},{"id":1744},"add-the-mcp-server-as-a-target",[1746],{"type":53,"value":1747},"Add the MCP server as a target",{"type":47,"tag":143,"props":1749,"children":1751},{"className":1573,"code":1750,"language":1575,"meta":151,"style":151},"# No outbound auth (public MCP server)\nagentcore add gateway-target \\\n  --type mcp-server \\\n  --name WeatherTools \\\n  --endpoint https:\u002F\u002Fmcp.example.com\u002Fmcp \\\n  --gateway MyGateway\n\n# OAuth outbound auth (2-legged — client credentials \u002F M2M)\nagentcore add gateway-target \\\n  --type mcp-server \\\n  --name WeatherTools \\\n  --endpoint https:\u002F\u002Fmcp.example.com\u002Fmcp \\\n  --gateway MyGateway \\\n  --outbound-auth oauth \\\n  --oauth-client-id your-client-id \\\n  --oauth-client-secret your-client-secret \\\n  --oauth-discovery-url https:\u002F\u002Fauth.example.com\u002F.well-known\u002Fopenid-configuration \\\n  --oauth-scopes read,write\n",[1752],{"type":47,"tag":118,"props":1753,"children":1754},{"__ignoreMap":151},[1755,1763,1783,1800,1816,1833,1845,1852,1860,1879,1894,1910,1926,1942,1960,1978,1996,2014],{"type":47,"tag":1433,"props":1756,"children":1757},{"class":1435,"line":1436},[1758],{"type":47,"tag":1433,"props":1759,"children":1760},{"style":1585},[1761],{"type":53,"value":1762},"# No outbound auth (public MCP server)\n",{"type":47,"tag":1433,"props":1764,"children":1765},{"class":1435,"line":1445},[1766,1770,1774,1779],{"type":47,"tag":1433,"props":1767,"children":1768},{"style":1594},[1769],{"type":53,"value":1597},{"type":47,"tag":1433,"props":1771,"children":1772},{"style":1600},[1773],{"type":53,"value":1603},{"type":47,"tag":1433,"props":1775,"children":1776},{"style":1600},[1777],{"type":53,"value":1778}," gateway-target",{"type":47,"tag":1433,"props":1780,"children":1781},{"style":1653},[1782],{"type":53,"value":1656},{"type":47,"tag":1433,"props":1784,"children":1785},{"class":1435,"line":1454},[1786,1791,1796],{"type":47,"tag":1433,"props":1787,"children":1788},{"style":1600},[1789],{"type":53,"value":1790},"  --type",{"type":47,"tag":1433,"props":1792,"children":1793},{"style":1600},[1794],{"type":53,"value":1795}," mcp-server",{"type":47,"tag":1433,"props":1797,"children":1798},{"style":1653},[1799],{"type":53,"value":1656},{"type":47,"tag":1433,"props":1801,"children":1802},{"class":1435,"line":1463},[1803,1807,1812],{"type":47,"tag":1433,"props":1804,"children":1805},{"style":1600},[1806],{"type":53,"value":1664},{"type":47,"tag":1433,"props":1808,"children":1809},{"style":1600},[1810],{"type":53,"value":1811}," WeatherTools",{"type":47,"tag":1433,"props":1813,"children":1814},{"style":1653},[1815],{"type":53,"value":1656},{"type":47,"tag":1433,"props":1817,"children":1818},{"class":1435,"line":1472},[1819,1824,1829],{"type":47,"tag":1433,"props":1820,"children":1821},{"style":1600},[1822],{"type":53,"value":1823},"  --endpoint",{"type":47,"tag":1433,"props":1825,"children":1826},{"style":1600},[1827],{"type":53,"value":1828}," https:\u002F\u002Fmcp.example.com\u002Fmcp",{"type":47,"tag":1433,"props":1830,"children":1831},{"style":1653},[1832],{"type":53,"value":1656},{"type":47,"tag":1433,"props":1834,"children":1835},{"class":1435,"line":1481},[1836,1841],{"type":47,"tag":1433,"props":1837,"children":1838},{"style":1600},[1839],{"type":53,"value":1840},"  --gateway",{"type":47,"tag":1433,"props":1842,"children":1843},{"style":1600},[1844],{"type":53,"value":1618},{"type":47,"tag":1433,"props":1846,"children":1847},{"class":1435,"line":1676},[1848],{"type":47,"tag":1433,"props":1849,"children":1850},{"emptyLinePlaceholder":1624},[1851],{"type":53,"value":1627},{"type":47,"tag":1433,"props":1853,"children":1854},{"class":1435,"line":1694},[1855],{"type":47,"tag":1433,"props":1856,"children":1857},{"style":1585},[1858],{"type":53,"value":1859},"# OAuth outbound auth (2-legged — client credentials \u002F M2M)\n",{"type":47,"tag":1433,"props":1861,"children":1862},{"class":1435,"line":1712},[1863,1867,1871,1875],{"type":47,"tag":1433,"props":1864,"children":1865},{"style":1594},[1866],{"type":53,"value":1597},{"type":47,"tag":1433,"props":1868,"children":1869},{"style":1600},[1870],{"type":53,"value":1603},{"type":47,"tag":1433,"props":1872,"children":1873},{"style":1600},[1874],{"type":53,"value":1778},{"type":47,"tag":1433,"props":1876,"children":1877},{"style":1653},[1878],{"type":53,"value":1656},{"type":47,"tag":1433,"props":1880,"children":1881},{"class":1435,"line":1730},[1882,1886,1890],{"type":47,"tag":1433,"props":1883,"children":1884},{"style":1600},[1885],{"type":53,"value":1790},{"type":47,"tag":1433,"props":1887,"children":1888},{"style":1600},[1889],{"type":53,"value":1795},{"type":47,"tag":1433,"props":1891,"children":1892},{"style":1653},[1893],{"type":53,"value":1656},{"type":47,"tag":1433,"props":1895,"children":1897},{"class":1435,"line":1896},11,[1898,1902,1906],{"type":47,"tag":1433,"props":1899,"children":1900},{"style":1600},[1901],{"type":53,"value":1664},{"type":47,"tag":1433,"props":1903,"children":1904},{"style":1600},[1905],{"type":53,"value":1811},{"type":47,"tag":1433,"props":1907,"children":1908},{"style":1653},[1909],{"type":53,"value":1656},{"type":47,"tag":1433,"props":1911,"children":1913},{"class":1435,"line":1912},12,[1914,1918,1922],{"type":47,"tag":1433,"props":1915,"children":1916},{"style":1600},[1917],{"type":53,"value":1823},{"type":47,"tag":1433,"props":1919,"children":1920},{"style":1600},[1921],{"type":53,"value":1828},{"type":47,"tag":1433,"props":1923,"children":1924},{"style":1653},[1925],{"type":53,"value":1656},{"type":47,"tag":1433,"props":1927,"children":1929},{"class":1435,"line":1928},13,[1930,1934,1938],{"type":47,"tag":1433,"props":1931,"children":1932},{"style":1600},[1933],{"type":53,"value":1840},{"type":47,"tag":1433,"props":1935,"children":1936},{"style":1600},[1937],{"type":53,"value":1669},{"type":47,"tag":1433,"props":1939,"children":1940},{"style":1653},[1941],{"type":53,"value":1656},{"type":47,"tag":1433,"props":1943,"children":1945},{"class":1435,"line":1944},14,[1946,1951,1956],{"type":47,"tag":1433,"props":1947,"children":1948},{"style":1600},[1949],{"type":53,"value":1950},"  --outbound-auth",{"type":47,"tag":1433,"props":1952,"children":1953},{"style":1600},[1954],{"type":53,"value":1955}," oauth",{"type":47,"tag":1433,"props":1957,"children":1958},{"style":1653},[1959],{"type":53,"value":1656},{"type":47,"tag":1433,"props":1961,"children":1963},{"class":1435,"line":1962},15,[1964,1969,1974],{"type":47,"tag":1433,"props":1965,"children":1966},{"style":1600},[1967],{"type":53,"value":1968},"  --oauth-client-id",{"type":47,"tag":1433,"props":1970,"children":1971},{"style":1600},[1972],{"type":53,"value":1973}," your-client-id",{"type":47,"tag":1433,"props":1975,"children":1976},{"style":1653},[1977],{"type":53,"value":1656},{"type":47,"tag":1433,"props":1979,"children":1981},{"class":1435,"line":1980},16,[1982,1987,1992],{"type":47,"tag":1433,"props":1983,"children":1984},{"style":1600},[1985],{"type":53,"value":1986},"  --oauth-client-secret",{"type":47,"tag":1433,"props":1988,"children":1989},{"style":1600},[1990],{"type":53,"value":1991}," your-client-secret",{"type":47,"tag":1433,"props":1993,"children":1994},{"style":1653},[1995],{"type":53,"value":1656},{"type":47,"tag":1433,"props":1997,"children":1999},{"class":1435,"line":1998},17,[2000,2005,2010],{"type":47,"tag":1433,"props":2001,"children":2002},{"style":1600},[2003],{"type":53,"value":2004},"  --oauth-discovery-url",{"type":47,"tag":1433,"props":2006,"children":2007},{"style":1600},[2008],{"type":53,"value":2009}," https:\u002F\u002Fauth.example.com\u002F.well-known\u002Fopenid-configuration",{"type":47,"tag":1433,"props":2011,"children":2012},{"style":1653},[2013],{"type":53,"value":1656},{"type":47,"tag":1433,"props":2015,"children":2017},{"class":1435,"line":2016},18,[2018,2023],{"type":47,"tag":1433,"props":2019,"children":2020},{"style":1600},[2021],{"type":53,"value":2022},"  --oauth-scopes",{"type":47,"tag":1433,"props":2024,"children":2025},{"style":1600},[2026],{"type":53,"value":2027}," read,write\n",{"type":47,"tag":55,"props":2029,"children":2030},{},[2031,2033,2039,2041,2046,2048,2053],{"type":53,"value":2032},"Note: The CLI ",{"type":47,"tag":118,"props":2034,"children":2036},{"className":2035},[],[2037],{"type":53,"value":2038},"--outbound-auth",{"type":53,"value":2040}," flag supports ",{"type":47,"tag":118,"props":2042,"children":2044},{"className":2043},[],[2045],{"type":53,"value":1027},{"type":53,"value":2047}," (2LO \u002F client credentials) or ",{"type":47,"tag":118,"props":2049,"children":2051},{"className":2050},[],[2052],{"type":53,"value":1019},{"type":53,"value":2054}," for MCP servers.",{"type":47,"tag":68,"props":2056,"children":2057},{},[2058,2104,2134],{"type":47,"tag":72,"props":2059,"children":2060},{},[2061,2073,2075,2081,2082,2088,2089,2094,2096,2103],{"type":47,"tag":232,"props":2062,"children":2063},{},[2064,2066,2071],{"type":53,"value":2065},"3-legged OAuth (",{"type":47,"tag":118,"props":2067,"children":2069},{"className":2068},[],[2070],{"type":53,"value":1040},{"type":53,"value":2072}," grant)",{"type":53,"value":2074}," — user-delegated access — is supported by the API but has no CLI path. Configure via boto3 ",{"type":47,"tag":118,"props":2076,"children":2078},{"className":2077},[],[2079],{"type":53,"value":2080},"create_gateway_target",{"type":53,"value":1254},{"type":47,"tag":118,"props":2083,"children":2085},{"className":2084},[],[2086],{"type":53,"value":2087},"OAuthCredentialProvider.grantType = \"AUTHORIZATION_CODE\"",{"type":53,"value":1262},{"type":47,"tag":118,"props":2090,"children":2092},{"className":2091},[],[2093],{"type":53,"value":1268},{"type":53,"value":2095},". See ",{"type":47,"tag":113,"props":2097,"children":2100},{"href":2098,"rel":2099},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fbedrock-agentcore\u002Flatest\u002Fdevguide\u002Fgateway-target-MCPservers.html#gateway-target-MCPservers-auth-code-grant-flow",[1241],[2101],{"type":53,"value":2102},"Connecting to an OAuth-protected MCP server using Authorization Code flow",{"type":53,"value":124},{"type":47,"tag":72,"props":2105,"children":2106},{},[2107,2112,2114,2119,2120,2125,2127,2132],{"type":47,"tag":232,"props":2108,"children":2109},{},[2110],{"type":53,"value":2111},"IAM (SigV4)",{"type":53,"value":2113}," for MCP servers hosted on AgentCore Runtime, another AgentCore Gateway, API Gateway, or Lambda Function URLs is configured via the AWS SDK\u002FAPI (not the CLI) — use ",{"type":47,"tag":118,"props":2115,"children":2117},{"className":2116},[],[2118],{"type":53,"value":1286},{"type":53,"value":1254},{"type":47,"tag":118,"props":2121,"children":2123},{"className":2122},[],[2124],{"type":53,"value":1165},{"type":53,"value":2126}," credential provider and an ",{"type":47,"tag":118,"props":2128,"children":2130},{"className":2129},[],[2131],{"type":53,"value":1300},{"type":53,"value":2133}," value.",{"type":47,"tag":72,"props":2135,"children":2136},{},[2137,2142],{"type":47,"tag":232,"props":2138,"children":2139},{},[2140],{"type":53,"value":2141},"API key auth",{"type":53,"value":2143}," is not supported for MCP server targets at the API level (the MCP target docs list only no-auth, OAuth, and IAM as strategies) — if the MCP server uses an API key, handle it in agent code directly (see Path D).",{"type":47,"tag":161,"props":2145,"children":2147},{"id":2146},"deploy-and-get-the-gateway-url",[2148],{"type":53,"value":2149},"Deploy and get the gateway URL",{"type":47,"tag":143,"props":2151,"children":2153},{"className":1573,"code":2152,"language":1575,"meta":151,"style":151},"agentcore deploy -y\nagentcore fetch access --name MyGateway\n",[2154],{"type":47,"tag":118,"props":2155,"children":2156},{"__ignoreMap":151},[2157,2174],{"type":47,"tag":1433,"props":2158,"children":2159},{"class":1435,"line":1436},[2160,2164,2169],{"type":47,"tag":1433,"props":2161,"children":2162},{"style":1594},[2163],{"type":53,"value":1597},{"type":47,"tag":1433,"props":2165,"children":2166},{"style":1600},[2167],{"type":53,"value":2168}," deploy",{"type":47,"tag":1433,"props":2170,"children":2171},{"style":1600},[2172],{"type":53,"value":2173}," -y\n",{"type":47,"tag":1433,"props":2175,"children":2176},{"class":1435,"line":1445},[2177,2181,2186,2191,2195],{"type":47,"tag":1433,"props":2178,"children":2179},{"style":1594},[2180],{"type":53,"value":1597},{"type":47,"tag":1433,"props":2182,"children":2183},{"style":1600},[2184],{"type":53,"value":2185}," fetch",{"type":47,"tag":1433,"props":2187,"children":2188},{"style":1600},[2189],{"type":53,"value":2190}," access",{"type":47,"tag":1433,"props":2192,"children":2193},{"style":1600},[2194],{"type":53,"value":1613},{"type":47,"tag":1433,"props":2196,"children":2197},{"style":1600},[2198],{"type":53,"value":1618},{"type":47,"tag":55,"props":2200,"children":2201},{},[2202,2204,2210],{"type":53,"value":2203},"The gateway URL is injected as ",{"type":47,"tag":118,"props":2205,"children":2207},{"className":2206},[],[2208],{"type":53,"value":2209},"AGENTCORE_GATEWAY_\u003CNAME>_URL",{"type":53,"value":2211}," after deploy.",{"type":47,"tag":161,"props":2213,"children":2215},{"id":2214},"generate-gateway-client-code",[2216],{"type":53,"value":2217},"Generate gateway client code",{"type":47,"tag":55,"props":2219,"children":2220},{},[2221],{"type":47,"tag":232,"props":2222,"children":2223},{},[2224],{"type":53,"value":2225},"Framework-agnostic MCP client:",{"type":47,"tag":143,"props":2227,"children":2229},{"className":1425,"code":2228,"language":1427,"meta":151,"style":151},"import os\nimport asyncio\nfrom mcp import ClientSession\nfrom mcp.client.streamable_http import streamablehttp_client\n\n# Injected by AgentCore after deploy. Format: AGENTCORE_GATEWAY_\u003CUPPERCASENAME>_URL\nGATEWAY_URL = os.getenv(\"AGENTCORE_GATEWAY_MYGATEWAY_URL\")\n\nasync def get_gateway_tools():\n    \"\"\"Discover tools from the gateway. Returns empty list if not deployed.\"\"\"\n    if not GATEWAY_URL:\n        return []\n    async with streamablehttp_client(GATEWAY_URL) as (read, write, _):\n        async with ClientSession(read, write) as session:\n            await session.initialize()\n            result = await session.list_tools()\n            return result.tools\n\nasync def call_gateway_tool(tool_name: str, arguments: dict):\n    \"\"\"Call a specific tool through the gateway.\"\"\"\n    if not GATEWAY_URL:\n        raise RuntimeError(\"Gateway not available in local dev — deploy first\")\n    async with streamablehttp_client(GATEWAY_URL) as (read, write, _):\n        async with ClientSession(read, write) as session:\n            await session.initialize()\n            return await session.call_tool(tool_name, arguments)\n",[2230],{"type":47,"tag":118,"props":2231,"children":2232},{"__ignoreMap":151},[2233,2241,2249,2257,2265,2272,2280,2288,2295,2303,2311,2319,2327,2335,2343,2351,2359,2367,2374,2383,2392,2400,2409,2417,2425,2433],{"type":47,"tag":1433,"props":2234,"children":2235},{"class":1435,"line":1436},[2236],{"type":47,"tag":1433,"props":2237,"children":2238},{},[2239],{"type":53,"value":2240},"import os\n",{"type":47,"tag":1433,"props":2242,"children":2243},{"class":1435,"line":1445},[2244],{"type":47,"tag":1433,"props":2245,"children":2246},{},[2247],{"type":53,"value":2248},"import asyncio\n",{"type":47,"tag":1433,"props":2250,"children":2251},{"class":1435,"line":1454},[2252],{"type":47,"tag":1433,"props":2253,"children":2254},{},[2255],{"type":53,"value":2256},"from mcp import ClientSession\n",{"type":47,"tag":1433,"props":2258,"children":2259},{"class":1435,"line":1463},[2260],{"type":47,"tag":1433,"props":2261,"children":2262},{},[2263],{"type":53,"value":2264},"from mcp.client.streamable_http import streamablehttp_client\n",{"type":47,"tag":1433,"props":2266,"children":2267},{"class":1435,"line":1472},[2268],{"type":47,"tag":1433,"props":2269,"children":2270},{"emptyLinePlaceholder":1624},[2271],{"type":53,"value":1627},{"type":47,"tag":1433,"props":2273,"children":2274},{"class":1435,"line":1481},[2275],{"type":47,"tag":1433,"props":2276,"children":2277},{},[2278],{"type":53,"value":2279},"# Injected by AgentCore after deploy. Format: AGENTCORE_GATEWAY_\u003CUPPERCASENAME>_URL\n",{"type":47,"tag":1433,"props":2281,"children":2282},{"class":1435,"line":1676},[2283],{"type":47,"tag":1433,"props":2284,"children":2285},{},[2286],{"type":53,"value":2287},"GATEWAY_URL = os.getenv(\"AGENTCORE_GATEWAY_MYGATEWAY_URL\")\n",{"type":47,"tag":1433,"props":2289,"children":2290},{"class":1435,"line":1694},[2291],{"type":47,"tag":1433,"props":2292,"children":2293},{"emptyLinePlaceholder":1624},[2294],{"type":53,"value":1627},{"type":47,"tag":1433,"props":2296,"children":2297},{"class":1435,"line":1712},[2298],{"type":47,"tag":1433,"props":2299,"children":2300},{},[2301],{"type":53,"value":2302},"async def get_gateway_tools():\n",{"type":47,"tag":1433,"props":2304,"children":2305},{"class":1435,"line":1730},[2306],{"type":47,"tag":1433,"props":2307,"children":2308},{},[2309],{"type":53,"value":2310},"    \"\"\"Discover tools from the gateway. Returns empty list if not deployed.\"\"\"\n",{"type":47,"tag":1433,"props":2312,"children":2313},{"class":1435,"line":1896},[2314],{"type":47,"tag":1433,"props":2315,"children":2316},{},[2317],{"type":53,"value":2318},"    if not GATEWAY_URL:\n",{"type":47,"tag":1433,"props":2320,"children":2321},{"class":1435,"line":1912},[2322],{"type":47,"tag":1433,"props":2323,"children":2324},{},[2325],{"type":53,"value":2326},"        return []\n",{"type":47,"tag":1433,"props":2328,"children":2329},{"class":1435,"line":1928},[2330],{"type":47,"tag":1433,"props":2331,"children":2332},{},[2333],{"type":53,"value":2334},"    async with streamablehttp_client(GATEWAY_URL) as (read, write, _):\n",{"type":47,"tag":1433,"props":2336,"children":2337},{"class":1435,"line":1944},[2338],{"type":47,"tag":1433,"props":2339,"children":2340},{},[2341],{"type":53,"value":2342},"        async with ClientSession(read, write) as session:\n",{"type":47,"tag":1433,"props":2344,"children":2345},{"class":1435,"line":1962},[2346],{"type":47,"tag":1433,"props":2347,"children":2348},{},[2349],{"type":53,"value":2350},"            await session.initialize()\n",{"type":47,"tag":1433,"props":2352,"children":2353},{"class":1435,"line":1980},[2354],{"type":47,"tag":1433,"props":2355,"children":2356},{},[2357],{"type":53,"value":2358},"            result = await session.list_tools()\n",{"type":47,"tag":1433,"props":2360,"children":2361},{"class":1435,"line":1998},[2362],{"type":47,"tag":1433,"props":2363,"children":2364},{},[2365],{"type":53,"value":2366},"            return result.tools\n",{"type":47,"tag":1433,"props":2368,"children":2369},{"class":1435,"line":2016},[2370],{"type":47,"tag":1433,"props":2371,"children":2372},{"emptyLinePlaceholder":1624},[2373],{"type":53,"value":1627},{"type":47,"tag":1433,"props":2375,"children":2377},{"class":1435,"line":2376},19,[2378],{"type":47,"tag":1433,"props":2379,"children":2380},{},[2381],{"type":53,"value":2382},"async def call_gateway_tool(tool_name: str, arguments: dict):\n",{"type":47,"tag":1433,"props":2384,"children":2386},{"class":1435,"line":2385},20,[2387],{"type":47,"tag":1433,"props":2388,"children":2389},{},[2390],{"type":53,"value":2391},"    \"\"\"Call a specific tool through the gateway.\"\"\"\n",{"type":47,"tag":1433,"props":2393,"children":2395},{"class":1435,"line":2394},21,[2396],{"type":47,"tag":1433,"props":2397,"children":2398},{},[2399],{"type":53,"value":2318},{"type":47,"tag":1433,"props":2401,"children":2403},{"class":1435,"line":2402},22,[2404],{"type":47,"tag":1433,"props":2405,"children":2406},{},[2407],{"type":53,"value":2408},"        raise RuntimeError(\"Gateway not available in local dev — deploy first\")\n",{"type":47,"tag":1433,"props":2410,"children":2412},{"class":1435,"line":2411},23,[2413],{"type":47,"tag":1433,"props":2414,"children":2415},{},[2416],{"type":53,"value":2334},{"type":47,"tag":1433,"props":2418,"children":2420},{"class":1435,"line":2419},24,[2421],{"type":47,"tag":1433,"props":2422,"children":2423},{},[2424],{"type":53,"value":2342},{"type":47,"tag":1433,"props":2426,"children":2428},{"class":1435,"line":2427},25,[2429],{"type":47,"tag":1433,"props":2430,"children":2431},{},[2432],{"type":53,"value":2350},{"type":47,"tag":1433,"props":2434,"children":2436},{"class":1435,"line":2435},26,[2437],{"type":47,"tag":1433,"props":2438,"children":2439},{},[2440],{"type":53,"value":2441},"            return await session.call_tool(tool_name, arguments)\n",{"type":47,"tag":55,"props":2443,"children":2444},{},[2445,2450],{"type":47,"tag":232,"props":2446,"children":2447},{},[2448],{"type":53,"value":2449},"For Strands",{"type":53,"value":2451},", pass gateway tools directly to the agent:",{"type":47,"tag":143,"props":2453,"children":2455},{"className":1425,"code":2454,"language":1427,"meta":151,"style":151},"from mcp.client.streamable_http import streamablehttp_client\nfrom mcp import ClientSession\nfrom strands import Agent\nfrom bedrock_agentcore.runtime import BedrockAgentCoreApp\nfrom model.load import load_model  # scaffolded by `agentcore create`\n\napp = BedrockAgentCoreApp()\nGATEWAY_URL = os.getenv(\"AGENTCORE_GATEWAY_MYGATEWAY_URL\")\n\n@app.entrypoint\ndef invoke(payload, context):\n    if not GATEWAY_URL:\n        # Local dev — run without gateway tools\n        agent = Agent(model=load_model())\n        return {\"response\": str(agent(payload.get(\"prompt\", \"\")))}\n\n    # Deployed — discover and use gateway tools\n    tools = asyncio.run(get_gateway_tools())\n    agent = Agent(\n        model=load_model(),\n        tools=tools,\n    )\n    return {\"response\": str(agent(payload.get(\"prompt\", \"\")))}\n\nif __name__ == \"__main__\":\n    app.run()\n",[2456],{"type":47,"tag":118,"props":2457,"children":2458},{"__ignoreMap":151},[2459,2466,2473,2481,2489,2497,2504,2512,2519,2526,2534,2542,2549,2557,2565,2573,2580,2588,2596,2604,2612,2620,2628,2636,2643,2651],{"type":47,"tag":1433,"props":2460,"children":2461},{"class":1435,"line":1436},[2462],{"type":47,"tag":1433,"props":2463,"children":2464},{},[2465],{"type":53,"value":2264},{"type":47,"tag":1433,"props":2467,"children":2468},{"class":1435,"line":1445},[2469],{"type":47,"tag":1433,"props":2470,"children":2471},{},[2472],{"type":53,"value":2256},{"type":47,"tag":1433,"props":2474,"children":2475},{"class":1435,"line":1454},[2476],{"type":47,"tag":1433,"props":2477,"children":2478},{},[2479],{"type":53,"value":2480},"from strands import Agent\n",{"type":47,"tag":1433,"props":2482,"children":2483},{"class":1435,"line":1463},[2484],{"type":47,"tag":1433,"props":2485,"children":2486},{},[2487],{"type":53,"value":2488},"from bedrock_agentcore.runtime import BedrockAgentCoreApp\n",{"type":47,"tag":1433,"props":2490,"children":2491},{"class":1435,"line":1472},[2492],{"type":47,"tag":1433,"props":2493,"children":2494},{},[2495],{"type":53,"value":2496},"from model.load import load_model  # scaffolded by `agentcore create`\n",{"type":47,"tag":1433,"props":2498,"children":2499},{"class":1435,"line":1481},[2500],{"type":47,"tag":1433,"props":2501,"children":2502},{"emptyLinePlaceholder":1624},[2503],{"type":53,"value":1627},{"type":47,"tag":1433,"props":2505,"children":2506},{"class":1435,"line":1676},[2507],{"type":47,"tag":1433,"props":2508,"children":2509},{},[2510],{"type":53,"value":2511},"app = BedrockAgentCoreApp()\n",{"type":47,"tag":1433,"props":2513,"children":2514},{"class":1435,"line":1694},[2515],{"type":47,"tag":1433,"props":2516,"children":2517},{},[2518],{"type":53,"value":2287},{"type":47,"tag":1433,"props":2520,"children":2521},{"class":1435,"line":1712},[2522],{"type":47,"tag":1433,"props":2523,"children":2524},{"emptyLinePlaceholder":1624},[2525],{"type":53,"value":1627},{"type":47,"tag":1433,"props":2527,"children":2528},{"class":1435,"line":1730},[2529],{"type":47,"tag":1433,"props":2530,"children":2531},{},[2532],{"type":53,"value":2533},"@app.entrypoint\n",{"type":47,"tag":1433,"props":2535,"children":2536},{"class":1435,"line":1896},[2537],{"type":47,"tag":1433,"props":2538,"children":2539},{},[2540],{"type":53,"value":2541},"def invoke(payload, context):\n",{"type":47,"tag":1433,"props":2543,"children":2544},{"class":1435,"line":1912},[2545],{"type":47,"tag":1433,"props":2546,"children":2547},{},[2548],{"type":53,"value":2318},{"type":47,"tag":1433,"props":2550,"children":2551},{"class":1435,"line":1928},[2552],{"type":47,"tag":1433,"props":2553,"children":2554},{},[2555],{"type":53,"value":2556},"        # Local dev — run without gateway tools\n",{"type":47,"tag":1433,"props":2558,"children":2559},{"class":1435,"line":1944},[2560],{"type":47,"tag":1433,"props":2561,"children":2562},{},[2563],{"type":53,"value":2564},"        agent = Agent(model=load_model())\n",{"type":47,"tag":1433,"props":2566,"children":2567},{"class":1435,"line":1962},[2568],{"type":47,"tag":1433,"props":2569,"children":2570},{},[2571],{"type":53,"value":2572},"        return {\"response\": str(agent(payload.get(\"prompt\", \"\")))}\n",{"type":47,"tag":1433,"props":2574,"children":2575},{"class":1435,"line":1980},[2576],{"type":47,"tag":1433,"props":2577,"children":2578},{"emptyLinePlaceholder":1624},[2579],{"type":53,"value":1627},{"type":47,"tag":1433,"props":2581,"children":2582},{"class":1435,"line":1998},[2583],{"type":47,"tag":1433,"props":2584,"children":2585},{},[2586],{"type":53,"value":2587},"    # Deployed — discover and use gateway tools\n",{"type":47,"tag":1433,"props":2589,"children":2590},{"class":1435,"line":2016},[2591],{"type":47,"tag":1433,"props":2592,"children":2593},{},[2594],{"type":53,"value":2595},"    tools = asyncio.run(get_gateway_tools())\n",{"type":47,"tag":1433,"props":2597,"children":2598},{"class":1435,"line":2376},[2599],{"type":47,"tag":1433,"props":2600,"children":2601},{},[2602],{"type":53,"value":2603},"    agent = Agent(\n",{"type":47,"tag":1433,"props":2605,"children":2606},{"class":1435,"line":2385},[2607],{"type":47,"tag":1433,"props":2608,"children":2609},{},[2610],{"type":53,"value":2611},"        model=load_model(),\n",{"type":47,"tag":1433,"props":2613,"children":2614},{"class":1435,"line":2394},[2615],{"type":47,"tag":1433,"props":2616,"children":2617},{},[2618],{"type":53,"value":2619},"        tools=tools,\n",{"type":47,"tag":1433,"props":2621,"children":2622},{"class":1435,"line":2402},[2623],{"type":47,"tag":1433,"props":2624,"children":2625},{},[2626],{"type":53,"value":2627},"    )\n",{"type":47,"tag":1433,"props":2629,"children":2630},{"class":1435,"line":2411},[2631],{"type":47,"tag":1433,"props":2632,"children":2633},{},[2634],{"type":53,"value":2635},"    return {\"response\": str(agent(payload.get(\"prompt\", \"\")))}\n",{"type":47,"tag":1433,"props":2637,"children":2638},{"class":1435,"line":2419},[2639],{"type":47,"tag":1433,"props":2640,"children":2641},{"emptyLinePlaceholder":1624},[2642],{"type":53,"value":1627},{"type":47,"tag":1433,"props":2644,"children":2645},{"class":1435,"line":2427},[2646],{"type":47,"tag":1433,"props":2647,"children":2648},{},[2649],{"type":53,"value":2650},"if __name__ == \"__main__\":\n",{"type":47,"tag":1433,"props":2652,"children":2653},{"class":1435,"line":2435},[2654],{"type":47,"tag":1433,"props":2655,"children":2656},{},[2657],{"type":53,"value":2658},"    app.run()\n",{"type":47,"tag":55,"props":2660,"children":2661},{},[2662,2667],{"type":47,"tag":232,"props":2663,"children":2664},{},[2665],{"type":53,"value":2666},"For LangGraph",{"type":53,"value":2668},", add gateway tools to the tool node:",{"type":47,"tag":143,"props":2670,"children":2672},{"className":1425,"code":2671,"language":1427,"meta":151,"style":151},"from langchain_mcp_adapters.client import MultiServerMCPClient\n\n@app.entrypoint\ndef agent_invocation(payload, context):\n    if not GATEWAY_URL:\n        tools = []\n    else:\n        # Use LangChain MCP adapter to get tools as LangChain-compatible tools\n        client = MultiServerMCPClient({\"gateway\": {\"url\": GATEWAY_URL, \"transport\": \"streamable_http\"}})\n        tools = asyncio.run(client.get_tools())\n\n    llm_with_tools = llm.bind_tools(tools)\n    # ... rest of your LangGraph graph ...\n",[2673],{"type":47,"tag":118,"props":2674,"children":2675},{"__ignoreMap":151},[2676,2684,2691,2698,2706,2713,2721,2729,2737,2745,2753,2760,2768],{"type":47,"tag":1433,"props":2677,"children":2678},{"class":1435,"line":1436},[2679],{"type":47,"tag":1433,"props":2680,"children":2681},{},[2682],{"type":53,"value":2683},"from langchain_mcp_adapters.client import MultiServerMCPClient\n",{"type":47,"tag":1433,"props":2685,"children":2686},{"class":1435,"line":1445},[2687],{"type":47,"tag":1433,"props":2688,"children":2689},{"emptyLinePlaceholder":1624},[2690],{"type":53,"value":1627},{"type":47,"tag":1433,"props":2692,"children":2693},{"class":1435,"line":1454},[2694],{"type":47,"tag":1433,"props":2695,"children":2696},{},[2697],{"type":53,"value":2533},{"type":47,"tag":1433,"props":2699,"children":2700},{"class":1435,"line":1463},[2701],{"type":47,"tag":1433,"props":2702,"children":2703},{},[2704],{"type":53,"value":2705},"def agent_invocation(payload, context):\n",{"type":47,"tag":1433,"props":2707,"children":2708},{"class":1435,"line":1472},[2709],{"type":47,"tag":1433,"props":2710,"children":2711},{},[2712],{"type":53,"value":2318},{"type":47,"tag":1433,"props":2714,"children":2715},{"class":1435,"line":1481},[2716],{"type":47,"tag":1433,"props":2717,"children":2718},{},[2719],{"type":53,"value":2720},"        tools = []\n",{"type":47,"tag":1433,"props":2722,"children":2723},{"class":1435,"line":1676},[2724],{"type":47,"tag":1433,"props":2725,"children":2726},{},[2727],{"type":53,"value":2728},"    else:\n",{"type":47,"tag":1433,"props":2730,"children":2731},{"class":1435,"line":1694},[2732],{"type":47,"tag":1433,"props":2733,"children":2734},{},[2735],{"type":53,"value":2736},"        # Use LangChain MCP adapter to get tools as LangChain-compatible tools\n",{"type":47,"tag":1433,"props":2738,"children":2739},{"class":1435,"line":1712},[2740],{"type":47,"tag":1433,"props":2741,"children":2742},{},[2743],{"type":53,"value":2744},"        client = MultiServerMCPClient({\"gateway\": {\"url\": GATEWAY_URL, \"transport\": \"streamable_http\"}})\n",{"type":47,"tag":1433,"props":2746,"children":2747},{"class":1435,"line":1730},[2748],{"type":47,"tag":1433,"props":2749,"children":2750},{},[2751],{"type":53,"value":2752},"        tools = asyncio.run(client.get_tools())\n",{"type":47,"tag":1433,"props":2754,"children":2755},{"class":1435,"line":1896},[2756],{"type":47,"tag":1433,"props":2757,"children":2758},{"emptyLinePlaceholder":1624},[2759],{"type":53,"value":1627},{"type":47,"tag":1433,"props":2761,"children":2762},{"class":1435,"line":1912},[2763],{"type":47,"tag":1433,"props":2764,"children":2765},{},[2766],{"type":53,"value":2767},"    llm_with_tools = llm.bind_tools(tools)\n",{"type":47,"tag":1433,"props":2769,"children":2770},{"class":1435,"line":1928},[2771],{"type":47,"tag":1433,"props":2772,"children":2773},{},[2774],{"type":53,"value":2775},"    # ... rest of your LangGraph graph ...\n",{"type":47,"tag":316,"props":2777,"children":2778},{},[],{"type":47,"tag":61,"props":2780,"children":2782},{"id":2781},"path-b-lambda-function-as-tools",[2783],{"type":53,"value":2784},"Path B: Lambda function as tools",{"type":47,"tag":143,"props":2786,"children":2788},{"className":1573,"code":2787,"language":1575,"meta":151,"style":151},"agentcore add gateway-target \\\n  --type lambda-function-arn \\\n  --name MyTools \\\n  --lambda-arn arn:aws:lambda:us-east-1:123456789012:function:my-tools \\\n  --tool-schema-file tools.json \\\n  --gateway MyGateway\n",[2789],{"type":47,"tag":118,"props":2790,"children":2791},{"__ignoreMap":151},[2792,2811,2827,2843,2860,2877],{"type":47,"tag":1433,"props":2793,"children":2794},{"class":1435,"line":1436},[2795,2799,2803,2807],{"type":47,"tag":1433,"props":2796,"children":2797},{"style":1594},[2798],{"type":53,"value":1597},{"type":47,"tag":1433,"props":2800,"children":2801},{"style":1600},[2802],{"type":53,"value":1603},{"type":47,"tag":1433,"props":2804,"children":2805},{"style":1600},[2806],{"type":53,"value":1778},{"type":47,"tag":1433,"props":2808,"children":2809},{"style":1653},[2810],{"type":53,"value":1656},{"type":47,"tag":1433,"props":2812,"children":2813},{"class":1435,"line":1445},[2814,2818,2823],{"type":47,"tag":1433,"props":2815,"children":2816},{"style":1600},[2817],{"type":53,"value":1790},{"type":47,"tag":1433,"props":2819,"children":2820},{"style":1600},[2821],{"type":53,"value":2822}," lambda-function-arn",{"type":47,"tag":1433,"props":2824,"children":2825},{"style":1653},[2826],{"type":53,"value":1656},{"type":47,"tag":1433,"props":2828,"children":2829},{"class":1435,"line":1454},[2830,2834,2839],{"type":47,"tag":1433,"props":2831,"children":2832},{"style":1600},[2833],{"type":53,"value":1664},{"type":47,"tag":1433,"props":2835,"children":2836},{"style":1600},[2837],{"type":53,"value":2838}," MyTools",{"type":47,"tag":1433,"props":2840,"children":2841},{"style":1653},[2842],{"type":53,"value":1656},{"type":47,"tag":1433,"props":2844,"children":2845},{"class":1435,"line":1463},[2846,2851,2856],{"type":47,"tag":1433,"props":2847,"children":2848},{"style":1600},[2849],{"type":53,"value":2850},"  --lambda-arn",{"type":47,"tag":1433,"props":2852,"children":2853},{"style":1600},[2854],{"type":53,"value":2855}," arn:aws:lambda:us-east-1:123456789012:function:my-tools",{"type":47,"tag":1433,"props":2857,"children":2858},{"style":1653},[2859],{"type":53,"value":1656},{"type":47,"tag":1433,"props":2861,"children":2862},{"class":1435,"line":1472},[2863,2868,2873],{"type":47,"tag":1433,"props":2864,"children":2865},{"style":1600},[2866],{"type":53,"value":2867},"  --tool-schema-file",{"type":47,"tag":1433,"props":2869,"children":2870},{"style":1600},[2871],{"type":53,"value":2872}," tools.json",{"type":47,"tag":1433,"props":2874,"children":2875},{"style":1653},[2876],{"type":53,"value":1656},{"type":47,"tag":1433,"props":2878,"children":2879},{"class":1435,"line":1481},[2880,2884],{"type":47,"tag":1433,"props":2881,"children":2882},{"style":1600},[2883],{"type":53,"value":1840},{"type":47,"tag":1433,"props":2885,"children":2886},{"style":1600},[2887],{"type":53,"value":1618},{"type":47,"tag":55,"props":2889,"children":2890},{},[2891,2893,2899],{"type":53,"value":2892},"The ",{"type":47,"tag":118,"props":2894,"children":2896},{"className":2895},[],[2897],{"type":53,"value":2898},"tools.json",{"type":53,"value":2900}," defines the tool schemas:",{"type":47,"tag":143,"props":2902,"children":2906},{"className":2903,"code":2904,"language":2905,"meta":151,"style":151},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"inlinePayload\": [\n    {\n      \"name\": \"get_weather\",\n      \"description\": \"Get current weather for a city\",\n      \"inputSchema\": {\n        \"type\": \"object\",\n        \"properties\": {\n          \"city\": {\"type\": \"string\", \"description\": \"City name\"}\n        },\n        \"required\": [\"city\"]\n      }\n    }\n  ]\n}\n","json",[2907],{"type":47,"tag":118,"props":2908,"children":2909},{"__ignoreMap":151},[2910,2919,2948,2956,2996,3033,3058,3097,3121,3217,3225,3267,3275,3283,3291],{"type":47,"tag":1433,"props":2911,"children":2912},{"class":1435,"line":1436},[2913],{"type":47,"tag":1433,"props":2914,"children":2916},{"style":2915},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[2917],{"type":53,"value":2918},"{\n",{"type":47,"tag":1433,"props":2920,"children":2921},{"class":1435,"line":1445},[2922,2927,2933,2938,2943],{"type":47,"tag":1433,"props":2923,"children":2924},{"style":2915},[2925],{"type":53,"value":2926},"  \"",{"type":47,"tag":1433,"props":2928,"children":2930},{"style":2929},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[2931],{"type":53,"value":2932},"inlinePayload",{"type":47,"tag":1433,"props":2934,"children":2935},{"style":2915},[2936],{"type":53,"value":2937},"\"",{"type":47,"tag":1433,"props":2939,"children":2940},{"style":2915},[2941],{"type":53,"value":2942},":",{"type":47,"tag":1433,"props":2944,"children":2945},{"style":2915},[2946],{"type":53,"value":2947}," [\n",{"type":47,"tag":1433,"props":2949,"children":2950},{"class":1435,"line":1454},[2951],{"type":47,"tag":1433,"props":2952,"children":2953},{"style":2915},[2954],{"type":53,"value":2955},"    {\n",{"type":47,"tag":1433,"props":2957,"children":2958},{"class":1435,"line":1463},[2959,2964,2969,2973,2977,2982,2987,2991],{"type":47,"tag":1433,"props":2960,"children":2961},{"style":2915},[2962],{"type":53,"value":2963},"      \"",{"type":47,"tag":1433,"props":2965,"children":2966},{"style":1594},[2967],{"type":53,"value":2968},"name",{"type":47,"tag":1433,"props":2970,"children":2971},{"style":2915},[2972],{"type":53,"value":2937},{"type":47,"tag":1433,"props":2974,"children":2975},{"style":2915},[2976],{"type":53,"value":2942},{"type":47,"tag":1433,"props":2978,"children":2979},{"style":2915},[2980],{"type":53,"value":2981}," \"",{"type":47,"tag":1433,"props":2983,"children":2984},{"style":1600},[2985],{"type":53,"value":2986},"get_weather",{"type":47,"tag":1433,"props":2988,"children":2989},{"style":2915},[2990],{"type":53,"value":2937},{"type":47,"tag":1433,"props":2992,"children":2993},{"style":2915},[2994],{"type":53,"value":2995},",\n",{"type":47,"tag":1433,"props":2997,"children":2998},{"class":1435,"line":1472},[2999,3003,3008,3012,3016,3020,3025,3029],{"type":47,"tag":1433,"props":3000,"children":3001},{"style":2915},[3002],{"type":53,"value":2963},{"type":47,"tag":1433,"props":3004,"children":3005},{"style":1594},[3006],{"type":53,"value":3007},"description",{"type":47,"tag":1433,"props":3009,"children":3010},{"style":2915},[3011],{"type":53,"value":2937},{"type":47,"tag":1433,"props":3013,"children":3014},{"style":2915},[3015],{"type":53,"value":2942},{"type":47,"tag":1433,"props":3017,"children":3018},{"style":2915},[3019],{"type":53,"value":2981},{"type":47,"tag":1433,"props":3021,"children":3022},{"style":1600},[3023],{"type":53,"value":3024},"Get current weather for a city",{"type":47,"tag":1433,"props":3026,"children":3027},{"style":2915},[3028],{"type":53,"value":2937},{"type":47,"tag":1433,"props":3030,"children":3031},{"style":2915},[3032],{"type":53,"value":2995},{"type":47,"tag":1433,"props":3034,"children":3035},{"class":1435,"line":1481},[3036,3040,3045,3049,3053],{"type":47,"tag":1433,"props":3037,"children":3038},{"style":2915},[3039],{"type":53,"value":2963},{"type":47,"tag":1433,"props":3041,"children":3042},{"style":1594},[3043],{"type":53,"value":3044},"inputSchema",{"type":47,"tag":1433,"props":3046,"children":3047},{"style":2915},[3048],{"type":53,"value":2937},{"type":47,"tag":1433,"props":3050,"children":3051},{"style":2915},[3052],{"type":53,"value":2942},{"type":47,"tag":1433,"props":3054,"children":3055},{"style":2915},[3056],{"type":53,"value":3057}," {\n",{"type":47,"tag":1433,"props":3059,"children":3060},{"class":1435,"line":1676},[3061,3066,3072,3076,3080,3084,3089,3093],{"type":47,"tag":1433,"props":3062,"children":3063},{"style":2915},[3064],{"type":53,"value":3065},"        \"",{"type":47,"tag":1433,"props":3067,"children":3069},{"style":3068},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[3070],{"type":53,"value":3071},"type",{"type":47,"tag":1433,"props":3073,"children":3074},{"style":2915},[3075],{"type":53,"value":2937},{"type":47,"tag":1433,"props":3077,"children":3078},{"style":2915},[3079],{"type":53,"value":2942},{"type":47,"tag":1433,"props":3081,"children":3082},{"style":2915},[3083],{"type":53,"value":2981},{"type":47,"tag":1433,"props":3085,"children":3086},{"style":1600},[3087],{"type":53,"value":3088},"object",{"type":47,"tag":1433,"props":3090,"children":3091},{"style":2915},[3092],{"type":53,"value":2937},{"type":47,"tag":1433,"props":3094,"children":3095},{"style":2915},[3096],{"type":53,"value":2995},{"type":47,"tag":1433,"props":3098,"children":3099},{"class":1435,"line":1694},[3100,3104,3109,3113,3117],{"type":47,"tag":1433,"props":3101,"children":3102},{"style":2915},[3103],{"type":53,"value":3065},{"type":47,"tag":1433,"props":3105,"children":3106},{"style":3068},[3107],{"type":53,"value":3108},"properties",{"type":47,"tag":1433,"props":3110,"children":3111},{"style":2915},[3112],{"type":53,"value":2937},{"type":47,"tag":1433,"props":3114,"children":3115},{"style":2915},[3116],{"type":53,"value":2942},{"type":47,"tag":1433,"props":3118,"children":3119},{"style":2915},[3120],{"type":53,"value":3057},{"type":47,"tag":1433,"props":3122,"children":3123},{"class":1435,"line":1712},[3124,3129,3135,3139,3143,3148,3152,3157,3161,3165,3169,3174,3178,3183,3187,3191,3195,3199,3203,3208,3212],{"type":47,"tag":1433,"props":3125,"children":3126},{"style":2915},[3127],{"type":53,"value":3128},"          \"",{"type":47,"tag":1433,"props":3130,"children":3132},{"style":3131},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[3133],{"type":53,"value":3134},"city",{"type":47,"tag":1433,"props":3136,"children":3137},{"style":2915},[3138],{"type":53,"value":2937},{"type":47,"tag":1433,"props":3140,"children":3141},{"style":2915},[3142],{"type":53,"value":2942},{"type":47,"tag":1433,"props":3144,"children":3145},{"style":2915},[3146],{"type":53,"value":3147}," {",{"type":47,"tag":1433,"props":3149,"children":3150},{"style":2915},[3151],{"type":53,"value":2937},{"type":47,"tag":1433,"props":3153,"children":3155},{"style":3154},"--shiki-light:#916B53;--shiki-default:#916B53;--shiki-dark:#916B53",[3156],{"type":53,"value":3071},{"type":47,"tag":1433,"props":3158,"children":3159},{"style":2915},[3160],{"type":53,"value":2937},{"type":47,"tag":1433,"props":3162,"children":3163},{"style":2915},[3164],{"type":53,"value":2942},{"type":47,"tag":1433,"props":3166,"children":3167},{"style":2915},[3168],{"type":53,"value":2981},{"type":47,"tag":1433,"props":3170,"children":3171},{"style":1600},[3172],{"type":53,"value":3173},"string",{"type":47,"tag":1433,"props":3175,"children":3176},{"style":2915},[3177],{"type":53,"value":2937},{"type":47,"tag":1433,"props":3179,"children":3180},{"style":2915},[3181],{"type":53,"value":3182},",",{"type":47,"tag":1433,"props":3184,"children":3185},{"style":2915},[3186],{"type":53,"value":2981},{"type":47,"tag":1433,"props":3188,"children":3189},{"style":3154},[3190],{"type":53,"value":3007},{"type":47,"tag":1433,"props":3192,"children":3193},{"style":2915},[3194],{"type":53,"value":2937},{"type":47,"tag":1433,"props":3196,"children":3197},{"style":2915},[3198],{"type":53,"value":2942},{"type":47,"tag":1433,"props":3200,"children":3201},{"style":2915},[3202],{"type":53,"value":2981},{"type":47,"tag":1433,"props":3204,"children":3205},{"style":1600},[3206],{"type":53,"value":3207},"City name",{"type":47,"tag":1433,"props":3209,"children":3210},{"style":2915},[3211],{"type":53,"value":2937},{"type":47,"tag":1433,"props":3213,"children":3214},{"style":2915},[3215],{"type":53,"value":3216},"}\n",{"type":47,"tag":1433,"props":3218,"children":3219},{"class":1435,"line":1730},[3220],{"type":47,"tag":1433,"props":3221,"children":3222},{"style":2915},[3223],{"type":53,"value":3224},"        },\n",{"type":47,"tag":1433,"props":3226,"children":3227},{"class":1435,"line":1896},[3228,3232,3237,3241,3245,3250,3254,3258,3262],{"type":47,"tag":1433,"props":3229,"children":3230},{"style":2915},[3231],{"type":53,"value":3065},{"type":47,"tag":1433,"props":3233,"children":3234},{"style":3068},[3235],{"type":53,"value":3236},"required",{"type":47,"tag":1433,"props":3238,"children":3239},{"style":2915},[3240],{"type":53,"value":2937},{"type":47,"tag":1433,"props":3242,"children":3243},{"style":2915},[3244],{"type":53,"value":2942},{"type":47,"tag":1433,"props":3246,"children":3247},{"style":2915},[3248],{"type":53,"value":3249}," [",{"type":47,"tag":1433,"props":3251,"children":3252},{"style":2915},[3253],{"type":53,"value":2937},{"type":47,"tag":1433,"props":3255,"children":3256},{"style":1600},[3257],{"type":53,"value":3134},{"type":47,"tag":1433,"props":3259,"children":3260},{"style":2915},[3261],{"type":53,"value":2937},{"type":47,"tag":1433,"props":3263,"children":3264},{"style":2915},[3265],{"type":53,"value":3266},"]\n",{"type":47,"tag":1433,"props":3268,"children":3269},{"class":1435,"line":1912},[3270],{"type":47,"tag":1433,"props":3271,"children":3272},{"style":2915},[3273],{"type":53,"value":3274},"      }\n",{"type":47,"tag":1433,"props":3276,"children":3277},{"class":1435,"line":1928},[3278],{"type":47,"tag":1433,"props":3279,"children":3280},{"style":2915},[3281],{"type":53,"value":3282},"    }\n",{"type":47,"tag":1433,"props":3284,"children":3285},{"class":1435,"line":1944},[3286],{"type":47,"tag":1433,"props":3287,"children":3288},{"style":2915},[3289],{"type":53,"value":3290},"  ]\n",{"type":47,"tag":1433,"props":3292,"children":3293},{"class":1435,"line":1962},[3294],{"type":47,"tag":1433,"props":3295,"children":3296},{"style":2915},[3297],{"type":53,"value":3216},{"type":47,"tag":55,"props":3299,"children":3300},{},[3301,3306,3308,3313,3315,3321],{"type":47,"tag":232,"props":3302,"children":3303},{},[3304],{"type":53,"value":3305},"Auth:",{"type":53,"value":3307}," Lambda targets use IAM role auth automatically — no ",{"type":47,"tag":118,"props":3309,"children":3311},{"className":3310},[],[3312],{"type":53,"value":2038},{"type":53,"value":3314}," flag. The gateway's execution role needs ",{"type":47,"tag":118,"props":3316,"children":3318},{"className":3317},[],[3319],{"type":53,"value":3320},"lambda:InvokeFunction",{"type":53,"value":3322}," on the Lambda ARN.",{"type":47,"tag":55,"props":3324,"children":3325},{},[3326],{"type":53,"value":3327},"Use the same MCP client code from Path A to call the tools.",{"type":47,"tag":316,"props":3329,"children":3330},{},[],{"type":47,"tag":61,"props":3332,"children":3334},{"id":3333},"path-c-openapi-spec-as-tools",[3335],{"type":53,"value":3336},"Path C: OpenAPI spec as tools",{"type":47,"tag":143,"props":3338,"children":3340},{"className":1573,"code":3339,"language":1575,"meta":151,"style":151},"# From a local file (api-key auth)\nagentcore add credential --name MyAPIKey --api-key sk-...\n\nagentcore add gateway-target \\\n  --type open-api-schema \\\n  --name MyAPI \\\n  --schema specs\u002Fapi.json \\\n  --gateway MyGateway \\\n  --outbound-auth api-key \\\n  --credential-name MyAPIKey\n",[3341],{"type":47,"tag":118,"props":3342,"children":3343},{"__ignoreMap":151},[3344,3352,3387,3394,3413,3429,3445,3462,3477,3493],{"type":47,"tag":1433,"props":3345,"children":3346},{"class":1435,"line":1436},[3347],{"type":47,"tag":1433,"props":3348,"children":3349},{"style":1585},[3350],{"type":53,"value":3351},"# From a local file (api-key auth)\n",{"type":47,"tag":1433,"props":3353,"children":3354},{"class":1435,"line":1445},[3355,3359,3363,3368,3372,3377,3382],{"type":47,"tag":1433,"props":3356,"children":3357},{"style":1594},[3358],{"type":53,"value":1597},{"type":47,"tag":1433,"props":3360,"children":3361},{"style":1600},[3362],{"type":53,"value":1603},{"type":47,"tag":1433,"props":3364,"children":3365},{"style":1600},[3366],{"type":53,"value":3367}," credential",{"type":47,"tag":1433,"props":3369,"children":3370},{"style":1600},[3371],{"type":53,"value":1613},{"type":47,"tag":1433,"props":3373,"children":3374},{"style":1600},[3375],{"type":53,"value":3376}," MyAPIKey",{"type":47,"tag":1433,"props":3378,"children":3379},{"style":1600},[3380],{"type":53,"value":3381}," --api-key",{"type":47,"tag":1433,"props":3383,"children":3384},{"style":1600},[3385],{"type":53,"value":3386}," sk-...\n",{"type":47,"tag":1433,"props":3388,"children":3389},{"class":1435,"line":1454},[3390],{"type":47,"tag":1433,"props":3391,"children":3392},{"emptyLinePlaceholder":1624},[3393],{"type":53,"value":1627},{"type":47,"tag":1433,"props":3395,"children":3396},{"class":1435,"line":1463},[3397,3401,3405,3409],{"type":47,"tag":1433,"props":3398,"children":3399},{"style":1594},[3400],{"type":53,"value":1597},{"type":47,"tag":1433,"props":3402,"children":3403},{"style":1600},[3404],{"type":53,"value":1603},{"type":47,"tag":1433,"props":3406,"children":3407},{"style":1600},[3408],{"type":53,"value":1778},{"type":47,"tag":1433,"props":3410,"children":3411},{"style":1653},[3412],{"type":53,"value":1656},{"type":47,"tag":1433,"props":3414,"children":3415},{"class":1435,"line":1472},[3416,3420,3425],{"type":47,"tag":1433,"props":3417,"children":3418},{"style":1600},[3419],{"type":53,"value":1790},{"type":47,"tag":1433,"props":3421,"children":3422},{"style":1600},[3423],{"type":53,"value":3424}," open-api-schema",{"type":47,"tag":1433,"props":3426,"children":3427},{"style":1653},[3428],{"type":53,"value":1656},{"type":47,"tag":1433,"props":3430,"children":3431},{"class":1435,"line":1481},[3432,3436,3441],{"type":47,"tag":1433,"props":3433,"children":3434},{"style":1600},[3435],{"type":53,"value":1664},{"type":47,"tag":1433,"props":3437,"children":3438},{"style":1600},[3439],{"type":53,"value":3440}," MyAPI",{"type":47,"tag":1433,"props":3442,"children":3443},{"style":1653},[3444],{"type":53,"value":1656},{"type":47,"tag":1433,"props":3446,"children":3447},{"class":1435,"line":1676},[3448,3453,3458],{"type":47,"tag":1433,"props":3449,"children":3450},{"style":1600},[3451],{"type":53,"value":3452},"  --schema",{"type":47,"tag":1433,"props":3454,"children":3455},{"style":1600},[3456],{"type":53,"value":3457}," specs\u002Fapi.json",{"type":47,"tag":1433,"props":3459,"children":3460},{"style":1653},[3461],{"type":53,"value":1656},{"type":47,"tag":1433,"props":3463,"children":3464},{"class":1435,"line":1694},[3465,3469,3473],{"type":47,"tag":1433,"props":3466,"children":3467},{"style":1600},[3468],{"type":53,"value":1840},{"type":47,"tag":1433,"props":3470,"children":3471},{"style":1600},[3472],{"type":53,"value":1669},{"type":47,"tag":1433,"props":3474,"children":3475},{"style":1653},[3476],{"type":53,"value":1656},{"type":47,"tag":1433,"props":3478,"children":3479},{"class":1435,"line":1712},[3480,3484,3489],{"type":47,"tag":1433,"props":3481,"children":3482},{"style":1600},[3483],{"type":53,"value":1950},{"type":47,"tag":1433,"props":3485,"children":3486},{"style":1600},[3487],{"type":53,"value":3488}," api-key",{"type":47,"tag":1433,"props":3490,"children":3491},{"style":1653},[3492],{"type":53,"value":1656},{"type":47,"tag":1433,"props":3494,"children":3495},{"class":1435,"line":1730},[3496,3501],{"type":47,"tag":1433,"props":3497,"children":3498},{"style":1600},[3499],{"type":53,"value":3500},"  --credential-name",{"type":47,"tag":1433,"props":3502,"children":3503},{"style":1600},[3504],{"type":53,"value":3505}," MyAPIKey\n",{"type":47,"tag":55,"props":3507,"children":3508},{},[3509,3514,3516,3521,3523,3528],{"type":47,"tag":232,"props":3510,"children":3511},{},[3512],{"type":53,"value":3513},"Auth is required",{"type":53,"value":3515}," for OpenAPI targets — either ",{"type":47,"tag":118,"props":3517,"children":3519},{"className":3518},[],[3520],{"type":53,"value":1027},{"type":53,"value":3522}," (client credentials or authorization code) or ",{"type":47,"tag":118,"props":3524,"children":3526},{"className":3525},[],[3527],{"type":53,"value":1112},{"type":53,"value":124},{"type":47,"tag":55,"props":3530,"children":3531},{},[3532,3534,3539,3541,3547],{"type":53,"value":3533},"⚠️ ",{"type":47,"tag":232,"props":3535,"children":3536},{},[3537],{"type":53,"value":3538},"Security note:",{"type":53,"value":3540}," ",{"type":47,"tag":118,"props":3542,"children":3544},{"className":3543},[],[3545],{"type":53,"value":3546},"--api-key",{"type":53,"value":3548}," appears in shell history. Two safer options:",{"type":47,"tag":267,"props":3550,"children":3551},{},[3552,3577],{"type":47,"tag":72,"props":3553,"children":3554},{},[3555,3560,3562,3568,3570,3575],{"type":47,"tag":232,"props":3556,"children":3557},{},[3558],{"type":53,"value":3559},"Interactive prompt (recommended):",{"type":53,"value":3561}," run ",{"type":47,"tag":118,"props":3563,"children":3565},{"className":3564},[],[3566],{"type":53,"value":3567},"agentcore add credential --name MyAPIKey --type api-key",{"type":53,"value":3569}," without ",{"type":47,"tag":118,"props":3571,"children":3573},{"className":3572},[],[3574],{"type":53,"value":3546},{"type":53,"value":3576}," — the CLI will prompt, and the value goes straight into the credential provider (Secrets Manager-backed) without hitting your shell history.",{"type":47,"tag":72,"props":3578,"children":3579},{},[3580,3601,3603,3609,3611,3617,3619,3624],{"type":47,"tag":232,"props":3581,"children":3582},{},[3583,3585,3591,3593,3599],{"type":53,"value":3584},"Edit ",{"type":47,"tag":118,"props":3586,"children":3588},{"className":3587},[],[3589],{"type":53,"value":3590},"agentcore.json",{"type":53,"value":3592}," + ",{"type":47,"tag":118,"props":3594,"children":3596},{"className":3595},[],[3597],{"type":53,"value":3598},".env.local",{"type":53,"value":3600}," for local dev only:",{"type":53,"value":3602}," if you need the credential to work under ",{"type":47,"tag":118,"props":3604,"children":3606},{"className":3605},[],[3607],{"type":53,"value":3608},"agentcore dev",{"type":53,"value":3610},", put the value in ",{"type":47,"tag":118,"props":3612,"children":3614},{"className":3613},[],[3615],{"type":53,"value":3616},"agentcore\u002F.env.local",{"type":53,"value":3618}," (gitignored). This file is read by the local dev server only — it is ",{"type":47,"tag":232,"props":3620,"children":3621},{},[3622],{"type":53,"value":3623},"not",{"type":53,"value":3625}," uploaded to runtime on deploy. The deployed runtime gets the value from the credential provider.",{"type":47,"tag":55,"props":3627,"children":3628},{},[3629,3631,3635,3637,3643],{"type":53,"value":3630},"Do ",{"type":47,"tag":232,"props":3632,"children":3633},{},[3634],{"type":53,"value":3623},{"type":53,"value":3636}," try to ship a credential to the deployed runtime via environment variables — AgentCore Runtime env vars are not vault-backed. Register the credential once with ",{"type":47,"tag":118,"props":3638,"children":3640},{"className":3639},[],[3641],{"type":53,"value":3642},"agentcore add credential",{"type":53,"value":3644}," and reference it by name in the gateway target or in code (Path D).",{"type":47,"tag":316,"props":3646,"children":3647},{},[],{"type":47,"tag":61,"props":3649,"children":3651},{"id":3650},"path-d-credentials-for-use-in-agent-code",[3652],{"type":53,"value":3653},"Path D: Credentials for use in agent code",{"type":47,"tag":55,"props":3655,"children":3656},{},[3657],{"type":53,"value":3658},"For calling APIs directly in agent code (not through a gateway target).",{"type":47,"tag":161,"props":3660,"children":3662},{"id":3661},"before-you-reach-for-path-d-check-if-its-actually-the-right-path",[3663],{"type":53,"value":3664},"Before you reach for Path D, check if it's actually the right path",{"type":47,"tag":55,"props":3666,"children":3667},{},[3668,3670,3675],{"type":53,"value":3669},"Path D is the ",{"type":47,"tag":232,"props":3671,"children":3672},{},[3673],{"type":53,"value":3674},"fallback",{"type":53,"value":3676},", not the starting point. For most external services, a Gateway target (Paths A–C) is safer and less code. Before generating Path D code, confirm one of these applies:",{"type":47,"tag":68,"props":3678,"children":3679},{},[3680,3685,3690,3695,3700],{"type":47,"tag":72,"props":3681,"children":3682},{},[3683],{"type":53,"value":3684},"The service uses a streaming\u002Fbidirectional protocol Gateway doesn't front (SSE with live output, WebSockets, WebRTC)",{"type":47,"tag":72,"props":3686,"children":3687},{},[3688],{"type":53,"value":3689},"It's a measurably latency-critical hot path and the team has accepted the trade-off",{"type":47,"tag":72,"props":3691,"children":3692},{},[3693],{"type":53,"value":3694},"The client is a vendor binary SDK with no HTTP surface",{"type":47,"tag":72,"props":3696,"children":3697},{},[3698],{"type":53,"value":3699},"It's an AWS service SDK where the runtime's execution role already has IAM permissions (in which case: use the SDK directly — no credential registration needed)",{"type":47,"tag":72,"props":3701,"children":3702},{},[3703],{"type":53,"value":3704},"The developer has a specific blocker (e.g., the service ships an OpenAI-shaped API the vendor's SDK wraps, and rebuilding the SDK call as a Gateway target would be a regression)",{"type":47,"tag":55,"props":3706,"children":3707},{},[3708],{"type":53,"value":3709},"If none of those applies, route back to Path A\u002FB\u002FC:",{"type":47,"tag":258,"props":3711,"children":3712},{},[3713],{"type":47,"tag":55,"props":3714,"children":3715},{},[3716],{"type":53,"value":3717},"\"Before we wire up a credential for direct use in agent code, can we front this as a Gateway target instead? Gateway injects the credential at the edge — your agent code never touches the secret — and the tool becomes policy-enforceable. If SERVICE has an OpenAPI spec, MCP server, or Lambda function in front of it, Path C \u002F A \u002F B is the better fit. Which one applies?\"",{"type":47,"tag":55,"props":3719,"children":3720},{},[3721],{"type":53,"value":3722},"Only continue into the rest of Path D when the developer confirms a legitimate reason Gateway won't work.",{"type":47,"tag":161,"props":3724,"children":3726},{"id":3725},"register-the-credential",[3727],{"type":53,"value":3728},"Register the credential",{"type":47,"tag":143,"props":3730,"children":3732},{"className":1573,"code":3731,"language":1575,"meta":151,"style":151},"# API key\nagentcore add credential --name OpenAI --api-key sk-...\n\n# OAuth (machine-to-machine)\nagentcore add credential \\\n  --name MyOAuthProvider \\\n  --type oauth \\\n  --discovery-url https:\u002F\u002Fidp.example.com\u002F.well-known\u002Fopenid-configuration \\\n  --client-id my-client-id \\\n  --client-secret my-client-secret \\\n  --scopes read,write\n",[3733],{"type":47,"tag":118,"props":3734,"children":3735},{"__ignoreMap":151},[3736,3744,3776,3783,3791,3810,3826,3841,3857,3874,3891],{"type":47,"tag":1433,"props":3737,"children":3738},{"class":1435,"line":1436},[3739],{"type":47,"tag":1433,"props":3740,"children":3741},{"style":1585},[3742],{"type":53,"value":3743},"# API key\n",{"type":47,"tag":1433,"props":3745,"children":3746},{"class":1435,"line":1445},[3747,3751,3755,3759,3763,3768,3772],{"type":47,"tag":1433,"props":3748,"children":3749},{"style":1594},[3750],{"type":53,"value":1597},{"type":47,"tag":1433,"props":3752,"children":3753},{"style":1600},[3754],{"type":53,"value":1603},{"type":47,"tag":1433,"props":3756,"children":3757},{"style":1600},[3758],{"type":53,"value":3367},{"type":47,"tag":1433,"props":3760,"children":3761},{"style":1600},[3762],{"type":53,"value":1613},{"type":47,"tag":1433,"props":3764,"children":3765},{"style":1600},[3766],{"type":53,"value":3767}," OpenAI",{"type":47,"tag":1433,"props":3769,"children":3770},{"style":1600},[3771],{"type":53,"value":3381},{"type":47,"tag":1433,"props":3773,"children":3774},{"style":1600},[3775],{"type":53,"value":3386},{"type":47,"tag":1433,"props":3777,"children":3778},{"class":1435,"line":1454},[3779],{"type":47,"tag":1433,"props":3780,"children":3781},{"emptyLinePlaceholder":1624},[3782],{"type":53,"value":1627},{"type":47,"tag":1433,"props":3784,"children":3785},{"class":1435,"line":1463},[3786],{"type":47,"tag":1433,"props":3787,"children":3788},{"style":1585},[3789],{"type":53,"value":3790},"# OAuth (machine-to-machine)\n",{"type":47,"tag":1433,"props":3792,"children":3793},{"class":1435,"line":1472},[3794,3798,3802,3806],{"type":47,"tag":1433,"props":3795,"children":3796},{"style":1594},[3797],{"type":53,"value":1597},{"type":47,"tag":1433,"props":3799,"children":3800},{"style":1600},[3801],{"type":53,"value":1603},{"type":47,"tag":1433,"props":3803,"children":3804},{"style":1600},[3805],{"type":53,"value":3367},{"type":47,"tag":1433,"props":3807,"children":3808},{"style":1653},[3809],{"type":53,"value":1656},{"type":47,"tag":1433,"props":3811,"children":3812},{"class":1435,"line":1481},[3813,3817,3822],{"type":47,"tag":1433,"props":3814,"children":3815},{"style":1600},[3816],{"type":53,"value":1664},{"type":47,"tag":1433,"props":3818,"children":3819},{"style":1600},[3820],{"type":53,"value":3821}," MyOAuthProvider",{"type":47,"tag":1433,"props":3823,"children":3824},{"style":1653},[3825],{"type":53,"value":1656},{"type":47,"tag":1433,"props":3827,"children":3828},{"class":1435,"line":1676},[3829,3833,3837],{"type":47,"tag":1433,"props":3830,"children":3831},{"style":1600},[3832],{"type":53,"value":1790},{"type":47,"tag":1433,"props":3834,"children":3835},{"style":1600},[3836],{"type":53,"value":1955},{"type":47,"tag":1433,"props":3838,"children":3839},{"style":1653},[3840],{"type":53,"value":1656},{"type":47,"tag":1433,"props":3842,"children":3843},{"class":1435,"line":1694},[3844,3848,3853],{"type":47,"tag":1433,"props":3845,"children":3846},{"style":1600},[3847],{"type":53,"value":1700},{"type":47,"tag":1433,"props":3849,"children":3850},{"style":1600},[3851],{"type":53,"value":3852}," https:\u002F\u002Fidp.example.com\u002F.well-known\u002Fopenid-configuration",{"type":47,"tag":1433,"props":3854,"children":3855},{"style":1653},[3856],{"type":53,"value":1656},{"type":47,"tag":1433,"props":3858,"children":3859},{"class":1435,"line":1712},[3860,3865,3870],{"type":47,"tag":1433,"props":3861,"children":3862},{"style":1600},[3863],{"type":53,"value":3864},"  --client-id",{"type":47,"tag":1433,"props":3866,"children":3867},{"style":1600},[3868],{"type":53,"value":3869}," my-client-id",{"type":47,"tag":1433,"props":3871,"children":3872},{"style":1653},[3873],{"type":53,"value":1656},{"type":47,"tag":1433,"props":3875,"children":3876},{"class":1435,"line":1730},[3877,3882,3887],{"type":47,"tag":1433,"props":3878,"children":3879},{"style":1600},[3880],{"type":53,"value":3881},"  --client-secret",{"type":47,"tag":1433,"props":3883,"children":3884},{"style":1600},[3885],{"type":53,"value":3886}," my-client-secret",{"type":47,"tag":1433,"props":3888,"children":3889},{"style":1653},[3890],{"type":53,"value":1656},{"type":47,"tag":1433,"props":3892,"children":3893},{"class":1435,"line":1896},[3894,3899],{"type":47,"tag":1433,"props":3895,"children":3896},{"style":1600},[3897],{"type":53,"value":3898},"  --scopes",{"type":47,"tag":1433,"props":3900,"children":3901},{"style":1600},[3902],{"type":53,"value":2027},{"type":47,"tag":55,"props":3904,"children":3905},{},[3906,3907,3911,3912,3917,3918,3924],{"type":53,"value":3533},{"type":47,"tag":232,"props":3908,"children":3909},{},[3910],{"type":53,"value":3538},{"type":53,"value":3540},{"type":47,"tag":118,"props":3913,"children":3915},{"className":3914},[],[3916],{"type":53,"value":3546},{"type":53,"value":1262},{"type":47,"tag":118,"props":3919,"children":3921},{"className":3920},[],[3922],{"type":53,"value":3923},"--client-secret",{"type":53,"value":3925}," appear in shell history. Run the command without those flags to get an interactive prompt — the value goes straight into the credential provider without touching your shell history.",{"type":47,"tag":55,"props":3927,"children":3928},{},[3929,3934,3936,3941,3943,3948,3950,3955,3957,3962],{"type":47,"tag":232,"props":3930,"children":3931},{},[3932],{"type":53,"value":3933},"For local dev only",{"type":53,"value":3935},", put the same value in ",{"type":47,"tag":118,"props":3937,"children":3939},{"className":3938},[],[3940],{"type":53,"value":3616},{"type":53,"value":3942}," (gitignored) so ",{"type":47,"tag":118,"props":3944,"children":3946},{"className":3945},[],[3947],{"type":53,"value":3608},{"type":53,"value":3949}," can resolve the decorator locally. The deployed runtime ignores ",{"type":47,"tag":118,"props":3951,"children":3953},{"className":3952},[],[3954],{"type":53,"value":3598},{"type":53,"value":3956}," and fetches the secret from the credential provider at call time — ",{"type":47,"tag":232,"props":3958,"children":3959},{},[3960],{"type":53,"value":3961},"never",{"type":53,"value":3963}," ship secrets as runtime environment variables.",{"type":47,"tag":161,"props":3965,"children":3967},{"id":3966},"use-credentials-in-agent-code",[3968],{"type":53,"value":3969},"Use credentials in agent code",{"type":47,"tag":55,"props":3971,"children":3972},{},[3973,3975,3981,3983,3989],{"type":53,"value":3974},"Use the ",{"type":47,"tag":118,"props":3976,"children":3978},{"className":3977},[],[3979],{"type":53,"value":3980},"@requires_api_key",{"type":53,"value":3982}," or ",{"type":47,"tag":118,"props":3984,"children":3986},{"className":3985},[],[3987],{"type":53,"value":3988},"@requires_access_token",{"type":53,"value":3990}," decorators — they handle token caching and refresh automatically. The decorators work with both sync and async functions:",{"type":47,"tag":143,"props":3992,"children":3994},{"className":1425,"code":3993,"language":1427,"meta":151,"style":151},"from bedrock_agentcore.identity.auth import requires_api_key, requires_access_token\n\n# Sync function — decorator injects the fetched key via keyword arg\n@requires_api_key(provider_name=\"OpenAI\")\ndef call_openai(prompt: str, *, api_key: str) -> str:\n    import openai\n    client = openai.OpenAI(api_key=api_key)\n    response = client.chat.completions.create(\n        model=\"gpt-4o\",\n        messages=[{\"role\": \"user\", \"content\": prompt}]\n    )\n    return response.choices[0].message.content\n\n# Async function — same decorator, async def\n@requires_access_token(\n    provider_name=\"MyOAuthProvider\",\n    scopes=[\"read\", \"write\"],\n    auth_flow=\"M2M\",\n)\nasync def call_my_api(data: dict, *, access_token: str) -> dict:\n    import httpx\n    async with httpx.AsyncClient() as client:\n        response = await client.post(\n            \"https:\u002F\u002Fapi.example.com\u002Fendpoint\",\n            headers={\"Authorization\": f\"Bearer {access_token}\"},\n            json=data,\n        )\n        return response.json()\n",[3995],{"type":47,"tag":118,"props":3996,"children":3997},{"__ignoreMap":151},[3998,4006,4013,4021,4029,4037,4045,4053,4061,4069,4077,4084,4092,4099,4107,4115,4123,4131,4139,4146,4154,4162,4170,4178,4186,4194,4202,4211],{"type":47,"tag":1433,"props":3999,"children":4000},{"class":1435,"line":1436},[4001],{"type":47,"tag":1433,"props":4002,"children":4003},{},[4004],{"type":53,"value":4005},"from bedrock_agentcore.identity.auth import requires_api_key, requires_access_token\n",{"type":47,"tag":1433,"props":4007,"children":4008},{"class":1435,"line":1445},[4009],{"type":47,"tag":1433,"props":4010,"children":4011},{"emptyLinePlaceholder":1624},[4012],{"type":53,"value":1627},{"type":47,"tag":1433,"props":4014,"children":4015},{"class":1435,"line":1454},[4016],{"type":47,"tag":1433,"props":4017,"children":4018},{},[4019],{"type":53,"value":4020},"# Sync function — decorator injects the fetched key via keyword arg\n",{"type":47,"tag":1433,"props":4022,"children":4023},{"class":1435,"line":1463},[4024],{"type":47,"tag":1433,"props":4025,"children":4026},{},[4027],{"type":53,"value":4028},"@requires_api_key(provider_name=\"OpenAI\")\n",{"type":47,"tag":1433,"props":4030,"children":4031},{"class":1435,"line":1472},[4032],{"type":47,"tag":1433,"props":4033,"children":4034},{},[4035],{"type":53,"value":4036},"def call_openai(prompt: str, *, api_key: str) -> str:\n",{"type":47,"tag":1433,"props":4038,"children":4039},{"class":1435,"line":1481},[4040],{"type":47,"tag":1433,"props":4041,"children":4042},{},[4043],{"type":53,"value":4044},"    import openai\n",{"type":47,"tag":1433,"props":4046,"children":4047},{"class":1435,"line":1676},[4048],{"type":47,"tag":1433,"props":4049,"children":4050},{},[4051],{"type":53,"value":4052},"    client = openai.OpenAI(api_key=api_key)\n",{"type":47,"tag":1433,"props":4054,"children":4055},{"class":1435,"line":1694},[4056],{"type":47,"tag":1433,"props":4057,"children":4058},{},[4059],{"type":53,"value":4060},"    response = client.chat.completions.create(\n",{"type":47,"tag":1433,"props":4062,"children":4063},{"class":1435,"line":1712},[4064],{"type":47,"tag":1433,"props":4065,"children":4066},{},[4067],{"type":53,"value":4068},"        model=\"gpt-4o\",\n",{"type":47,"tag":1433,"props":4070,"children":4071},{"class":1435,"line":1730},[4072],{"type":47,"tag":1433,"props":4073,"children":4074},{},[4075],{"type":53,"value":4076},"        messages=[{\"role\": \"user\", \"content\": prompt}]\n",{"type":47,"tag":1433,"props":4078,"children":4079},{"class":1435,"line":1896},[4080],{"type":47,"tag":1433,"props":4081,"children":4082},{},[4083],{"type":53,"value":2627},{"type":47,"tag":1433,"props":4085,"children":4086},{"class":1435,"line":1912},[4087],{"type":47,"tag":1433,"props":4088,"children":4089},{},[4090],{"type":53,"value":4091},"    return response.choices[0].message.content\n",{"type":47,"tag":1433,"props":4093,"children":4094},{"class":1435,"line":1928},[4095],{"type":47,"tag":1433,"props":4096,"children":4097},{"emptyLinePlaceholder":1624},[4098],{"type":53,"value":1627},{"type":47,"tag":1433,"props":4100,"children":4101},{"class":1435,"line":1944},[4102],{"type":47,"tag":1433,"props":4103,"children":4104},{},[4105],{"type":53,"value":4106},"# Async function — same decorator, async def\n",{"type":47,"tag":1433,"props":4108,"children":4109},{"class":1435,"line":1962},[4110],{"type":47,"tag":1433,"props":4111,"children":4112},{},[4113],{"type":53,"value":4114},"@requires_access_token(\n",{"type":47,"tag":1433,"props":4116,"children":4117},{"class":1435,"line":1980},[4118],{"type":47,"tag":1433,"props":4119,"children":4120},{},[4121],{"type":53,"value":4122},"    provider_name=\"MyOAuthProvider\",\n",{"type":47,"tag":1433,"props":4124,"children":4125},{"class":1435,"line":1998},[4126],{"type":47,"tag":1433,"props":4127,"children":4128},{},[4129],{"type":53,"value":4130},"    scopes=[\"read\", \"write\"],\n",{"type":47,"tag":1433,"props":4132,"children":4133},{"class":1435,"line":2016},[4134],{"type":47,"tag":1433,"props":4135,"children":4136},{},[4137],{"type":53,"value":4138},"    auth_flow=\"M2M\",\n",{"type":47,"tag":1433,"props":4140,"children":4141},{"class":1435,"line":2376},[4142],{"type":47,"tag":1433,"props":4143,"children":4144},{},[4145],{"type":53,"value":1478},{"type":47,"tag":1433,"props":4147,"children":4148},{"class":1435,"line":2385},[4149],{"type":47,"tag":1433,"props":4150,"children":4151},{},[4152],{"type":53,"value":4153},"async def call_my_api(data: dict, *, access_token: str) -> dict:\n",{"type":47,"tag":1433,"props":4155,"children":4156},{"class":1435,"line":2394},[4157],{"type":47,"tag":1433,"props":4158,"children":4159},{},[4160],{"type":53,"value":4161},"    import httpx\n",{"type":47,"tag":1433,"props":4163,"children":4164},{"class":1435,"line":2402},[4165],{"type":47,"tag":1433,"props":4166,"children":4167},{},[4168],{"type":53,"value":4169},"    async with httpx.AsyncClient() as client:\n",{"type":47,"tag":1433,"props":4171,"children":4172},{"class":1435,"line":2411},[4173],{"type":47,"tag":1433,"props":4174,"children":4175},{},[4176],{"type":53,"value":4177},"        response = await client.post(\n",{"type":47,"tag":1433,"props":4179,"children":4180},{"class":1435,"line":2419},[4181],{"type":47,"tag":1433,"props":4182,"children":4183},{},[4184],{"type":53,"value":4185},"            \"https:\u002F\u002Fapi.example.com\u002Fendpoint\",\n",{"type":47,"tag":1433,"props":4187,"children":4188},{"class":1435,"line":2427},[4189],{"type":47,"tag":1433,"props":4190,"children":4191},{},[4192],{"type":53,"value":4193},"            headers={\"Authorization\": f\"Bearer {access_token}\"},\n",{"type":47,"tag":1433,"props":4195,"children":4196},{"class":1435,"line":2435},[4197],{"type":47,"tag":1433,"props":4198,"children":4199},{},[4200],{"type":53,"value":4201},"            json=data,\n",{"type":47,"tag":1433,"props":4203,"children":4205},{"class":1435,"line":4204},27,[4206],{"type":47,"tag":1433,"props":4207,"children":4208},{},[4209],{"type":53,"value":4210},"        )\n",{"type":47,"tag":1433,"props":4212,"children":4214},{"class":1435,"line":4213},28,[4215],{"type":47,"tag":1433,"props":4216,"children":4217},{},[4218],{"type":53,"value":4219},"        return response.json()\n",{"type":47,"tag":55,"props":4221,"children":4222},{},[4223,4225,4231,4232,4238],{"type":53,"value":4224},"The decorator itself handles the token lifecycle — you don't need to make the function async just to use it. Parameters are keyword-only (",{"type":47,"tag":118,"props":4226,"children":4228},{"className":4227},[],[4229],{"type":53,"value":4230},"*, api_key: str",{"type":53,"value":3982},{"type":47,"tag":118,"props":4233,"children":4235},{"className":4234},[],[4236],{"type":53,"value":4237},"*, access_token: str",{"type":53,"value":4239},") — the decorator injects them.",{"type":47,"tag":55,"props":4241,"children":4242},{},[4243,4248,4250,4255,4257,4262],{"type":47,"tag":232,"props":4244,"children":4245},{},[4246],{"type":53,"value":4247},"Local dev:",{"type":53,"value":4249}," In ",{"type":47,"tag":118,"props":4251,"children":4253},{"className":4252},[],[4254],{"type":53,"value":3608},{"type":53,"value":4256},", credentials are read from ",{"type":47,"tag":118,"props":4258,"children":4260},{"className":4259},[],[4261],{"type":53,"value":3616},{"type":53,"value":4263},". The decorator pattern works the same way locally and deployed.",{"type":47,"tag":316,"props":4265,"children":4266},{},[],{"type":47,"tag":61,"props":4268,"children":4270},{"id":4269},"local-dev-gap",[4271],{"type":53,"value":4272},"Local dev gap",{"type":47,"tag":258,"props":4274,"children":4275},{},[4276,4285,4315],{"type":47,"tag":55,"props":4277,"children":4278},{},[4279,4283],{"type":47,"tag":1433,"props":4280,"children":4281},{},[4282],{"type":53,"value":1568},{"type":53,"value":4284},"\nGateway URLs (AGENTCORE_GATEWAY_*_URL) are only available after deploy.\nIn agentcore dev, these env vars are not set. Always check before using:",{"type":47,"tag":143,"props":4286,"children":4288},{"className":1425,"code":4287,"language":1427,"meta":151,"style":151},"GATEWAY_URL = os.getenv(\"AGENTCORE_GATEWAY_MYGATEWAY_URL\")\nif not GATEWAY_URL:\n    # run without gateway tools in local dev\n",[4289],{"type":47,"tag":118,"props":4290,"children":4291},{"__ignoreMap":151},[4292,4299,4307],{"type":47,"tag":1433,"props":4293,"children":4294},{"class":1435,"line":1436},[4295],{"type":47,"tag":1433,"props":4296,"children":4297},{},[4298],{"type":53,"value":2287},{"type":47,"tag":1433,"props":4300,"children":4301},{"class":1435,"line":1445},[4302],{"type":47,"tag":1433,"props":4303,"children":4304},{},[4305],{"type":53,"value":4306},"if not GATEWAY_URL:\n",{"type":47,"tag":1433,"props":4308,"children":4309},{"class":1435,"line":1454},[4310],{"type":47,"tag":1433,"props":4311,"children":4312},{},[4313],{"type":53,"value":4314},"    # run without gateway tools in local dev\n",{"type":47,"tag":55,"props":4316,"children":4317},{},[4318],{"type":53,"value":4319},"Never assume the gateway is available locally.",{"type":47,"tag":316,"props":4321,"children":4322},{},[],{"type":47,"tag":61,"props":4324,"children":4326},{"id":4325},"troubleshooting",[4327],{"type":53,"value":4328},"Troubleshooting",{"type":47,"tag":55,"props":4330,"children":4331},{},[4332,4337,4339,4345],{"type":47,"tag":232,"props":4333,"children":4334},{},[4335],{"type":53,"value":4336},"\"mcp-server target doesn't support api-key auth\"",{"type":53,"value":4338},"\nCorrect — API key auth is not supported for MCP server targets at the API level (",{"type":47,"tag":113,"props":4340,"children":4342},{"href":1305,"rel":4341},[1241],[4343],{"type":53,"value":4344},"MCP target auth strategies",{"type":53,"value":4346},"). Options: OAuth (2LO or 3LO), IAM (for MCP servers hosted on AgentCore Runtime, API Gateway, or Lambda Function URLs), or Path D — manage the credential in agent code and call the MCP server directly.",{"type":47,"tag":55,"props":4348,"children":4349},{},[4350,4362,4364,4369,4370,4376,4377,4382,4384,4389,4390,4395],{"type":47,"tag":232,"props":4351,"children":4352},{},[4353,4355,4360],{"type":53,"value":4354},"\"I need 3LO \u002F authorization-code OAuth but ",{"type":47,"tag":118,"props":4356,"children":4358},{"className":4357},[],[4359],{"type":53,"value":1213},{"type":53,"value":4361}," doesn't ask for a return URL\"",{"type":53,"value":4363},"\nThe CLI only configures 2LO (client credentials). 3-legged OAuth requires boto3 — call ",{"type":47,"tag":118,"props":4365,"children":4367},{"className":4366},[],[4368],{"type":53,"value":2080},{"type":53,"value":1254},{"type":47,"tag":118,"props":4371,"children":4373},{"className":4372},[],[4374],{"type":53,"value":4375},"credentialProviderType: OAUTH",{"type":53,"value":1021},{"type":47,"tag":118,"props":4378,"children":4380},{"className":4379},[],[4381],{"type":53,"value":1260},{"type":53,"value":4383},", and ",{"type":47,"tag":118,"props":4385,"children":4387},{"className":4386},[],[4388],{"type":53,"value":1268},{"type":53,"value":2095},{"type":47,"tag":113,"props":4391,"children":4393},{"href":2098,"rel":4392},[1241],[4394],{"type":53,"value":2102},{"type":53,"value":124},{"type":47,"tag":55,"props":4397,"children":4398},{},[4399,4404,4406,4411,4412,4417],{"type":47,"tag":232,"props":4400,"children":4401},{},[4402],{"type":53,"value":4403},"\"api-gateway target doesn't support oauth\"",{"type":53,"value":4405},"\nUse ",{"type":47,"tag":118,"props":4407,"children":4409},{"className":4408},[],[4410],{"type":53,"value":1112},{"type":53,"value":3982},{"type":47,"tag":118,"props":4413,"children":4415},{"className":4414},[],[4416],{"type":53,"value":1019},{"type":53,"value":4418}," for API Gateway targets.",{"type":47,"tag":55,"props":4420,"children":4421},{},[4422,4427,4429,4435,4437,4443],{"type":47,"tag":232,"props":4423,"children":4424},{},[4425],{"type":53,"value":4426},"Gateway URL not set after deploy",{"type":53,"value":4428},"\nRun ",{"type":47,"tag":118,"props":4430,"children":4432},{"className":4431},[],[4433],{"type":53,"value":4434},"agentcore fetch access --name MyGateway",{"type":53,"value":4436}," to get the URL. Check ",{"type":47,"tag":118,"props":4438,"children":4440},{"className":4439},[],[4441],{"type":53,"value":4442},"agentcore status --type gateway",{"type":53,"value":4444}," to verify the gateway is deployed.",{"type":47,"tag":55,"props":4446,"children":4447},{},[4448,4453,4455,4461],{"type":47,"tag":232,"props":4449,"children":4450},{},[4451],{"type":53,"value":4452},"Tool calls failing with auth errors",{"type":53,"value":4454},"\nCheck ",{"type":47,"tag":118,"props":4456,"children":4458},{"className":4457},[],[4459],{"type":53,"value":4460},"agentcore logs --runtime MyAgent --since 1h --level error",{"type":53,"value":4462}," for the specific error. Common causes: expired OAuth token, wrong credential name, IAM permission missing.",{"type":47,"tag":55,"props":4464,"children":4465},{},[4466,4471],{"type":47,"tag":232,"props":4467,"children":4468},{},[4469],{"type":53,"value":4470},"\"Adding gateway to existing agent\" workaround",{"type":53,"value":4472},"\nThe CLI recommends creating a throwaway agent to copy gateway client code. This skill generates the code directly — no workaround needed.",{"type":47,"tag":55,"props":4474,"children":4475},{},[4476,4481,4483,4489,4490,4496],{"type":47,"tag":232,"props":4477,"children":4478},{},[4479],{"type":53,"value":4480},"MCP clients (Claude Desktop, claude.ai) can't auto-connect to Gateway",{"type":53,"value":4482},"\nAgentCore Gateway does not currently implement the MCP OAuth spec endpoints (RFC 8414 OAuth Authorization Server Metadata, RFC 7591 Dynamic Client Registration). MCP clients that expect to auto-discover OAuth config and register themselves — like Claude Desktop and claude.ai — cannot connect without manual credential configuration. The workaround is to manually obtain the Cognito ",{"type":47,"tag":118,"props":4484,"children":4486},{"className":4485},[],[4487],{"type":53,"value":4488},"client_id",{"type":53,"value":1262},{"type":47,"tag":118,"props":4491,"children":4493},{"className":4492},[],[4494],{"type":53,"value":4495},"client_secret",{"type":53,"value":4497}," and enter them in the MCP client's advanced settings. This is a platform limitation, not a config error.",{"type":47,"tag":61,"props":4499,"children":4501},{"id":4500},"output",[4502],{"type":53,"value":4503},"Output",{"type":47,"tag":68,"props":4505,"children":4506},{},[4507,4519,4524,4529,4534],{"type":47,"tag":72,"props":4508,"children":4509},{},[4510,4512,4517],{"type":53,"value":4511},"A clear recommendation on ",{"type":47,"tag":232,"props":4513,"children":4514},{},[4515],{"type":53,"value":4516},"Gateway target vs direct API call",{"type":53,"value":4518},", grounded in the five cases where direct is legitimate",{"type":47,"tag":72,"props":4520,"children":4521},{},[4522],{"type":53,"value":4523},"CLI commands to set up the gateway and target (or to register the credential, if Path D is the right call)",{"type":47,"tag":72,"props":4525,"children":4526},{},[4527],{"type":53,"value":4528},"Framework-specific gateway client code",{"type":47,"tag":72,"props":4530,"children":4531},{},[4532],{"type":53,"value":4533},"Credential setup (avoiding shell history exposure, never stored in runtime env vars)",{"type":47,"tag":72,"props":4535,"children":4536},{},[4537],{"type":53,"value":4538},"Local dev gap handling",{"type":47,"tag":4540,"props":4541,"children":4542},"style",{},[4543],{"type":53,"value":4544},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":4546,"total":4707},[4547,4562,4569,4584,4599,4609,4624,4640,4657,4670,4682,4697],{"slug":4548,"name":4548,"fn":4549,"description":4550,"org":4551,"tags":4552,"stars":24,"repoUrl":25,"updatedAt":4561},"agents-build","add capabilities to existing agent projects","Use when adding capabilities to an existing agent project — memory, app integration, VPC, multi-agent, migration, model changes, browser, code interpreter, or resource removal. Triggers on: \"add memory\", \"remember across sessions\", \"call agent from app\", \"invoke agent from code\", \"auth to call agent\", \"streaming responses\", \"VPC\", \"VPC connectivity\", \"VPC error\", \"can't reach from VPC\", \"multi-agent\", \"A2A\", \"A2A auth\", \"orchestrator not delegating\", \"specialist not called\", \"migrate Bedrock Agent\", \"after import\", \"migration issue\", \"framework for migration\", \"change model\", \"browser tool\", \"code interpreter\", \"delete agent\", \"tear down\", \"agentcore remove\", \"cross-account memory\", \"resource-based policy on memory\", \"pay for x402 content\", \"402 Payment Required\", \"microtransactions\", \"paid API or tool\". Not for connecting to external APIs via Gateway — use agents-connect. Not for scaffolding a new project — use agents-get-started. Not for CLI\u002Fdev server errors — use agents-debug. Strands vs LangGraph in a migration context routes here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4553,4554,4557,4558],{"name":13,"slug":14,"type":15},{"name":4555,"slug":4556,"type":15},"Automation","automation",{"name":23,"slug":8,"type":15},{"name":4559,"slug":4560,"type":15},"Engineering","engineering","2026-07-12T08:42:53.812877",{"slug":4,"name":4,"fn":5,"description":6,"org":4563,"tags":4564,"stars":24,"repoUrl":25,"updatedAt":26},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4565,4566,4567,4568],{"name":13,"slug":14,"type":15},{"name":20,"slug":21,"type":15},{"name":17,"slug":18,"type":15},{"name":23,"slug":8,"type":15},{"slug":4570,"name":4570,"fn":4571,"description":4572,"org":4573,"tags":4574,"stars":24,"repoUrl":25,"updatedAt":4583},"agents-debug","debug agent and environment issues","Use when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues. Reads traces and logs to diagnose root causes. Also checks prerequisites when the CLI itself isn't working. Triggers on: \"agent not working\", \"wrong answer\", \"agent error\", \"tool call failing\", \"debug agent\", \"check logs\", \"read traces\", \"broken\", \"500 error\", \"424 error\", \"model access denied\", \"command not found\", \"stuck in DELETING\", \"maxVms exceeded\", \"cold start diagnosis\", \"cold start slow\", \"agentcore create error\", \"create failed\", \"exit code 7\", \"connection refused local dev\". Not for deploy failures — use agents-deploy. Not for performance tuning without errors — use agents-optimize. Not for VPC configuration — use agents-build. Not for observability setup or missing logs — use agents-optimize.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4575,4576,4577,4580],{"name":13,"slug":14,"type":15},{"name":23,"slug":8,"type":15},{"name":4578,"slug":4579,"type":15},"Debugging","debugging",{"name":4581,"slug":4582,"type":15},"Observability","observability","2026-07-16T06:00:44.679093",{"slug":4585,"name":4585,"fn":4586,"description":4587,"org":4588,"tags":4589,"stars":24,"repoUrl":25,"updatedAt":4598},"agents-deploy","deploy AI agents to AWS","Use when deploying your agent to AWS, or when a deploy has failed. Handles pre-flight validation, CDK\u002FIAM\u002Fquota error diagnosis, version management, rollback, and canary deployments. Triggers on: \"deploy my agent\", \"agentcore deploy\", \"deploy failed\", \"CDK error\", \"rollback\", \"canary deploy\", \"pin version\", \"redeploy\", \"deploy stuck\". Not for production hardening — use agents-harden. Not for adding capabilities before deploy — use agents-build or agents-connect. Not for VPC configuration errors — use agents-build.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4590,4591,4592,4595],{"name":13,"slug":14,"type":15},{"name":23,"slug":8,"type":15},{"name":4593,"slug":4594,"type":15},"CI\u002FCD","ci-cd",{"name":4596,"slug":4597,"type":15},"Deployment","deployment","2026-07-12T08:42:55.059577",{"slug":4600,"name":4600,"fn":4601,"description":4602,"org":4603,"tags":4604,"stars":24,"repoUrl":25,"updatedAt":4608},"agents-get-started","scaffold and deploy new agent projects","Use when a developer wants to create a new agent project or get started with AgentCore. Handles framework selection, project scaffolding, first deploy, and first invocation. Triggers on: \"build an agent\", \"create an agent\", \"get started\", \"new project\", \"agentcore create\", \"which framework\", \"Strands vs LangGraph\", \"hello world agent\", \"first agent\", \"create MCP server\", \"host MCP server\", \"agentcore dev\", \"dev server\", \"what port\", \"local development\". Not for adding capabilities to existing projects — use agents-build or agents-connect. Strands vs LangGraph in a migration context routes to agents-build, not here. Connecting to an existing MCP server routes to agents-connect, not here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4605,4606,4607],{"name":13,"slug":14,"type":15},{"name":23,"slug":8,"type":15},{"name":4596,"slug":4597,"type":15},"2026-07-12T08:42:51.963247",{"slug":4610,"name":4610,"fn":4611,"description":4612,"org":4613,"tags":4614,"stars":24,"repoUrl":25,"updatedAt":4623},"agents-harden","harden agents for production","Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle, rate limiting, input validation, and quota guidance. Triggers on: \"production checklist\", \"harden agent\", \"production ready\", \"secure agent\", \"inbound auth\", \"going live\", \"cold start optimization\", \"session lifecycle\", \"StopRuntimeSession\", \"quota\", \"throttling\", \"maxVms\", \"rate limit\", \"security audit of outbound API calls\", \"gateway target audit for production\", \"restrict who can call\", \"lock down endpoint\", \"only our app can call\". Not for Cedar tool-restriction policies — use agents-connect. Not for quality measurement — use agents-optimize. Not for outbound credential storage or API key wiring — use agents-connect. Not for A2A agent-to-agent auth — use agents-build. Cold start observation and diagnosis (not optimization) routes to agents-debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4615,4616,4617,4620],{"name":13,"slug":14,"type":15},{"name":23,"slug":8,"type":15},{"name":4618,"slug":4619,"type":15},"Best Practices","best-practices",{"name":4621,"slug":4622,"type":15},"Security","security","2026-07-16T06:00:42.174705",{"slug":4625,"name":4625,"fn":4626,"description":4627,"org":4628,"tags":4629,"stars":24,"repoUrl":25,"updatedAt":4639},"agents-optimize","optimize agent quality and performance","Use when measuring or improving agent quality and performance — set up evaluators, online monitoring, CI\u002FCD quality gates, observability, or cost optimization. Triggers on: \"evaluate my agent\", \"add evaluator\", \"measure quality\", \"quality gate\", \"run evals\", \"agent too slow\", \"why is it slow\", \"reduce latency\", \"set up observability\", \"CloudWatch dashboard\", \"how much does my agent cost\", \"cost optimization\", \"logs not showing up\", \"logs missing\", \"spans not found\", \"eval failing\", \"eval error\", \"dev traces\", \"local traces\", \"agentcore dev traces\", \"traces to CloudWatch\". Not for debugging errors or crashes — use agents-debug. Slow but correct routes here; broken routes to debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4630,4631,4632,4635,4636],{"name":13,"slug":14,"type":15},{"name":23,"slug":8,"type":15},{"name":4633,"slug":4634,"type":15},"Evals","evals",{"name":4581,"slug":4582,"type":15},{"name":4637,"slug":4638,"type":15},"Performance","performance","2026-07-12T08:42:56.488105",{"slug":4641,"name":4641,"fn":4642,"description":4643,"org":4644,"tags":4645,"stars":24,"repoUrl":25,"updatedAt":4656},"amazon-aurora-mysql","manage Amazon Aurora MySQL clusters","Amazon Aurora MySQL — creates, modifies, and advises on Aurora MySQL clusters specifically (MySQL-compatible engine, Aurora serverless, parallel query). Trigger for Aurora MySQL cluster operations, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or MySQL upgrade planning. Aurora MySQL uses full (VPC-based) configuration — express configuration is PostgreSQL-only. For Aurora PostgreSQL, use amazon-aurora-postgresql instead. Contains safety guardrails and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4646,4647,4650,4653],{"name":23,"slug":8,"type":15},{"name":4648,"slug":4649,"type":15},"Database","database",{"name":4651,"slug":4652,"type":15},"MySQL","mysql",{"name":4654,"slug":4655,"type":15},"Serverless","serverless","2026-07-12T08:43:13.27939",{"slug":4658,"name":4658,"fn":4659,"description":4660,"org":4661,"tags":4662,"stars":24,"repoUrl":25,"updatedAt":4669},"amazon-aurora-postgresql","configure Amazon Aurora PostgreSQL clusters","Amazon Aurora PostgreSQL — creates, modifies, and advises on Aurora PostgreSQL clusters specifically (PostgreSQL-compatible engine, Aurora serverless, express configuration, pgvector, Babelfish). Trigger for Aurora PostgreSQL cluster operations, express-configuration quick-start, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or PostgreSQL upgrade planning. For Aurora MySQL, use amazon-aurora-mysql instead. Contains safety guardrails, express-first routing, and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4663,4664,4665,4668],{"name":23,"slug":8,"type":15},{"name":4648,"slug":4649,"type":15},{"name":4666,"slug":4667,"type":15},"PostgreSQL","postgresql",{"name":4654,"slug":4655,"type":15},"2026-07-16T06:00:34.789624",{"slug":4671,"name":4671,"fn":4672,"description":4673,"org":4674,"tags":4675,"stars":24,"repoUrl":25,"updatedAt":4681},"amazon-bedrock","build generative AI apps with Amazon Bedrock","Builds generative AI applications on Amazon Bedrock. Covers model invocation (Converse API, InvokeModel), RAG with Knowledge Bases, Bedrock Agents, Guardrails, and AgentCore. Use when invoking models, setting up Knowledge Bases, creating agents, applying guardrails, deploying to AgentCore, migrating\u002Fporting\u002Fconverting a Bedrock Agent (including inline agents) to an AgentCore Harness, troubleshooting Bedrock errors (ThrottlingException, AccessDeniedException), or choosing models (Claude, Llama, Nova, Titan). ALSO USE for prompt caching setup and debugging, quota health checks and throttling diagnosis, cost attribution and tracking, migrating between Claude model generations (4.5 to 4.6 to 4.7), chunking strategies, API selection (Converse vs InvokeModel), guardrail capabilities, and model selection. Also covers AgentCore Payments setup (x402, microtransactions, Payment Manager, Connector, Instrument, Coinbase CDP, Stripe Privy, 402 Payment Required, pay for content, paid endpoint, agent payments). NOT for custom model training, Rekognition, or Comprehend.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4676,4677,4678],{"name":13,"slug":14,"type":15},{"name":23,"slug":8,"type":15},{"name":4679,"slug":4680,"type":15},"LLM","llm","2026-07-25T05:30:35.20899",{"slug":4683,"name":4683,"fn":4684,"description":4685,"org":4686,"tags":4687,"stars":24,"repoUrl":25,"updatedAt":4696},"amazon-documentdb","manage Amazon DocumentDB clusters","Manages Amazon DocumentDB end-to-end — serverless-on-8.0 cluster setup, TLS\u002FVPC\u002Fdriver config, flexible-schema and vector-search data modeling, MongoDB compatibility assessment, DMS-based migration, slow-query diagnosis, major version upgrades (4.0→5.0→8.0), Well-Architected reviews (41-check wa_review.py), cost estimation, and security hardening. Retrieve for every DocumentDB question and when the user asks to set up or migrate MongoDB to AWS — DocumentDB is AWS's MongoDB-compatible managed database. Triggers: JSON document store, document database, MongoDB on AWS, Nested fields, Lambda cannot connect, TLS handshake, VPC port 27017, IAM auth, Secrets Manager, encryption at rest, $graphLookup, flexible schema, COLLSCAN, compound index, DMS migration, CDC cutover, $vectorSearch, RAG, Global Clusters, DR replication, cost sizing, audit, health check, production-readiness.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4688,4689,4690,4693],{"name":23,"slug":8,"type":15},{"name":4648,"slug":4649,"type":15},{"name":4691,"slug":4692,"type":15},"MongoDB","mongodb",{"name":4694,"slug":4695,"type":15},"NoSQL","nosql","2026-07-12T08:43:00.455878",{"slug":4698,"name":4698,"fn":4699,"description":4700,"org":4701,"tags":4702,"stars":24,"repoUrl":25,"updatedAt":4706},"amazon-dynamodb","design and debug DynamoDB data layers","Designs, reviews, and debugs DynamoDB data layers from design axioms — enumerates access patterns, chooses partition\u002Fsort keys and GSIs, decides single-table vs. multi-table, configures Streams, Global Tables, TTL, and zero-ETL integrations to OpenSearch\u002FRedshift\u002FSageMaker Lakehouse, and produces a defensible data-layer design with a monthly cost estimate and optional live validation. Applies whenever a user is designing, reviewing, or refactoring anything backed by DynamoDB — schemas, access patterns, GSIs, single- vs. multi-table choices, Streams consumers, transactional outboxes, Global Tables, zero-ETL pipelines — even when they don't say \"axioms\" or \"design review.\" Also applies when debugging hot partitions, throttling, unbounded Scans, LWW conflicts, or surprise bills on DynamoDB workloads.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4703,4704,4705],{"name":23,"slug":8,"type":15},{"name":4648,"slug":4649,"type":15},{"name":4694,"slug":4695,"type":15},"2026-07-16T06:00:37.690386",115,{"items":4709,"total":4759},[4710,4717,4724,4731,4738,4744,4751],{"slug":4548,"name":4548,"fn":4549,"description":4550,"org":4711,"tags":4712,"stars":24,"repoUrl":25,"updatedAt":4561},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4713,4714,4715,4716],{"name":13,"slug":14,"type":15},{"name":4555,"slug":4556,"type":15},{"name":23,"slug":8,"type":15},{"name":4559,"slug":4560,"type":15},{"slug":4,"name":4,"fn":5,"description":6,"org":4718,"tags":4719,"stars":24,"repoUrl":25,"updatedAt":26},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4720,4721,4722,4723],{"name":13,"slug":14,"type":15},{"name":20,"slug":21,"type":15},{"name":17,"slug":18,"type":15},{"name":23,"slug":8,"type":15},{"slug":4570,"name":4570,"fn":4571,"description":4572,"org":4725,"tags":4726,"stars":24,"repoUrl":25,"updatedAt":4583},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4727,4728,4729,4730],{"name":13,"slug":14,"type":15},{"name":23,"slug":8,"type":15},{"name":4578,"slug":4579,"type":15},{"name":4581,"slug":4582,"type":15},{"slug":4585,"name":4585,"fn":4586,"description":4587,"org":4732,"tags":4733,"stars":24,"repoUrl":25,"updatedAt":4598},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4734,4735,4736,4737],{"name":13,"slug":14,"type":15},{"name":23,"slug":8,"type":15},{"name":4593,"slug":4594,"type":15},{"name":4596,"slug":4597,"type":15},{"slug":4600,"name":4600,"fn":4601,"description":4602,"org":4739,"tags":4740,"stars":24,"repoUrl":25,"updatedAt":4608},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4741,4742,4743],{"name":13,"slug":14,"type":15},{"name":23,"slug":8,"type":15},{"name":4596,"slug":4597,"type":15},{"slug":4610,"name":4610,"fn":4611,"description":4612,"org":4745,"tags":4746,"stars":24,"repoUrl":25,"updatedAt":4623},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4747,4748,4749,4750],{"name":13,"slug":14,"type":15},{"name":23,"slug":8,"type":15},{"name":4618,"slug":4619,"type":15},{"name":4621,"slug":4622,"type":15},{"slug":4625,"name":4625,"fn":4626,"description":4627,"org":4752,"tags":4753,"stars":24,"repoUrl":25,"updatedAt":4639},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4754,4755,4756,4757,4758],{"name":13,"slug":14,"type":15},{"name":23,"slug":8,"type":15},{"name":4633,"slug":4634,"type":15},{"name":4581,"slug":4582,"type":15},{"name":4637,"slug":4638,"type":15},114]