AMAZON BEDROCK / SERVICE DETAIL S04 GATEWAY
AGENTCORE GATEWAYPRACTICAL
CHAPTER 12 / 36
TOPIC create a gateway, add a target, call a tool
REV 2026.07
New to these words? Sheet 01-A "Key terms" defines tool, MCP, and Lambda. Concept: chapter 11 "Gateway".
IN PLAIN WORDS
You will create a gateway, attach an AWS Lambda function as a tool, deploy, then run a small agent that finds and calls that tool. Terms: target = a backend you attach (a Lambda, an API); authorizer = who may call the gateway (NONE = open, for testing; CUSTOM_JWT = requires a login token); MCP endpoint = the single web address the agent connects to; tool schema = a small file describing the tool's inputs.
[ 1 ] INSTALL AND CREATE A PROJECT
$ npm install -g @aws/agentcore
$ agentcore create --name MyGatewayAgent --defaults
# --defaults gives a Python Strands agent
[x] AWS account with credentials
[x] Node.js 18+, Python 3.10+
[x] IAM permissions for roles, Lambda, bedrock-agentcore
[x] Model access: Claude Sonnet 4.6
[ 2 ] ADD A GATEWAY AND A LAMBDA TARGET
# simplest: no inbound auth
$ agentcore add gateway --name TestGateway --authorizer-type NONE --runtimes MyGatewayAgent
$ agentcore add gateway-target --name TestLambdaTarget --type lambda-function-arn \
--lambda-arn <YOUR_LAMBDA_ARN> --tool-schema-file tools.json --gateway TestGateway
# or with JWT inbound auth (Cognito discovery URL):
$ agentcore add gateway --name TestGateway --authorizer-type CUSTOM_JWT \
--discovery-url https://cognito-idp.us-east-1.amazonaws.com/<POOL_ID>/.well-known/openid-configuration \
--allowed-audience <CLIENT_ID> --runtimes MyGatewayAgent
[ 3 ] DEPLOY AND GET THE GATEWAY URL
$ agentcore deploy # synthesizes a CDK stack, 2 to 3 minutes
$ agentcore status # shows your gateway URL
The gateway is an MCP endpoint at:
https://gateway-id.gateway.bedrock-agentcore.region.amazonaws.com/mcp
[ 4 ] CALL THE TOOLS FROM A STRANDS AGENT (run_agent.py)
$ pip install strands-agents mcp
from strands import Agent
from strands.models import BedrockModel
from strands.tools.mcp.mcp_client import MCPClient
from mcp.client.streamable_http import streamablehttp_client
gateway_url = "<YOUR_GATEWAY_URL>" # from agentcore status
model = BedrockModel(
model_id="us.anthropic.claude-sonnet-4-6", # current Sonnet, via a cross-region inference profile
streaming=True)
mcp_client = MCPClient(
lambda: streamablehttp_client(gateway_url))
with mcp_client:
# discover the tools the gateway exposes
tools = mcp_client.list_tools_sync()
print([t.tool_name for t in tools])
# give them to the agent
agent = Agent(model=model, tools=tools)
# the model can now call your Lambda tool
response = agent("What's the weather in Seattle?")
print(response)
No auth token is needed for the NONE authorizer. With CUSTOM_JWT, pass the bearer token in the MCP client headers.
[ 5 ] VALIDATE AND CLEAN UP
$ curl -X POST YOUR_GATEWAY_URL -H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'
$ aws logs tail /aws/bedrock-agentcore/gateways/YOUR_GATEWAY_ID --follow
# remove the gateway:
$ agentcore remove gateway --name TestGateway