AWS bedrock-agentcore documentation change
Summary
Added semantic search documentation with code examples and Cognito token acquisition implementation
Security assessment
Added OAuth 2.0 client credentials flow example for Cognito demonstrates secure token acquisition patterns, which qualifies as security documentation. No specific vulnerability addressed.
Diff
diff --git a/bedrock-agentcore/latest/devguide/gateway-using-mcp.md b/bedrock-agentcore/latest/devguide/gateway-using-mcp.md index 211a8982c..258a13e8f 100644 --- a//bedrock-agentcore/latest/devguide/gateway-using-mcp.md +++ b//bedrock-agentcore/latest/devguide/gateway-using-mcp.md @@ -5 +5 @@ -Authentication for MCP Requests +Using Semantic SearchAuthentication for MCP Requests @@ -11 +11,3 @@ Amazon Bedrock AgentCore is in preview release and is subject to change. -Gateway implements the Model Context Protocol (MCP), which provides a standardized way for agents to discover and invoke tools. The gateway exposes two main MCP operations: +Gateway implements the Model Context Protocol (MCP), which provides a standardized way for agents to discover and invoke tools. Gateway is compatible with MCP clients that implement this specification. + +The gateway exposes two main MCP operations: @@ -19,0 +22,39 @@ Gateway implements the Model Context Protocol (MCP), which provides a standardiz +Gateway also provides a built-in semantic search capability through the `x_amz_bedrock_agentcore_search` tool, which helps agents find the most relevant tools for specific tasks without needing to know all available tools. + +## Using Semantic Search + +The semantic search tool allows agents to discover relevant tools based on natural language queries. This is particularly useful when you have many tools and want the agent to automatically find the most appropriate ones. + + + # Example: Using semantic search to find relevant tools + import json + from mcp import ClientSession + from mcp.client.streamable_http import streamablehttp_client + + async def search_tools(gateway_url, access_token, query): + headers = {"Authorization": f"Bearer {access_token}"} + async with streamablehttp_client(gateway_url, headers=headers) as (read, write, _): + async with ClientSession(read, write) as session: + await session.initialize() + + # Use the built-in search tool + response = await session.call_tool( + "x_amz_bedrock_agentcore_search", + arguments={"query": query} + ) + + # Parse the search results + for content in response.content: + results = json.loads(content.text) + print(f"Found {len(results)} relevant tools for: {query}") + for tool in results: + print(f"- {tool['name']}: {tool['description']}") + + # Example usage + await search_tools( + "https://gateway-id.gateway.bedrock-agentcore.us-west-2.amazonaws.com/mcp", + "your-access-token", + "How do I process images?" + ) + + @@ -34,0 +76,23 @@ Before making MCP requests to a gateway, you need to obtain an authentication to +### Amazon Cognito Token Acquisition + +For Amazon Cognito, use the OAuth 2.0 token endpoint with client credentials flow: + + + import requests + import base64 + + def get_cognito_access_token(client_id, client_secret, cognito_domain): + credentials = base64.b64encode(f"{client_id}:{client_secret}".encode()).decode() + + response = requests.post( + f"https://{cognito_domain}/oauth2/token", + headers={ + "Authorization": f"Basic {credentials}", + "Content-Type": "application/x-www-form-urlencoded" + }, + data={"grant_type": "client_credentials"} + ) + + return response.json()["access_token"] + +