AWS bedrock-agentcore documentation change
Summary
Updated authorization header usage, corrected endpoint URLs, improved code examples for MCP tool calls with proper authentication handling, and added async examples.
Security assessment
The changes emphasize proper Authorization header implementation and demonstrate secure credential handling in code samples. While improving authentication documentation, there's no evidence this addresses an active vulnerability. The updates prevent potential misconfigurations by showing secure patterns.
Diff
diff --git a/bedrock-agentcore/latest/devguide/gateway-using-mcp-call.md b/bedrock-agentcore/latest/devguide/gateway-using-mcp-call.md index 8b068dada..2f93b37c3 100644 --- a//bedrock-agentcore/latest/devguide/gateway-using-mcp-call.md +++ b//bedrock-agentcore/latest/devguide/gateway-using-mcp-call.md @@ -7,2 +6,0 @@ Code samples for calling toolsErrors -Amazon Bedrock AgentCore is in preview release and is subject to change. - @@ -17 +15 @@ To call a specific tool, make a POST request to the gateway's MCP endpoint and s - Authorization: Bearer ${AccessToken} + Authorization: ${Authorization header} @@ -25 +23 @@ Replace the following values: - * `${AccessToken}` – The access token provided by the identity provider when you set up [inbound authorization](./gateway-inbound-auth.html). + * `${Authorization header}` – The authorization credentials from the identity provider when you set up [inbound authorization](./gateway-inbound-auth.html). @@ -27 +25 @@ Replace the following values: - * `${RequestBody}` – The JSON payload of the request body, as specified in [Calling tools](https://docs.aws.amazon.com/https://modelcontextprotocol.io/specification/2025-03-26/server/tools#calling-tools) in the [Model Context Protocol (MCP)](https://docs.aws.amazon.com/https://modelcontextprotocol.io/docs/getting-started/intro). Include `tools/call` as the `method` and include the `name` of the tool and its `arguments`. + * `${RequestBody}` – The JSON payload of the request body, as specified in [Calling tools](https://docs.aws.amazon.com/https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools) in the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/docs/getting-started/intro). Include `tools/call` as the `method` and include the `name` of the tool and its `arguments`. @@ -93 +91 @@ Python requests package - gateway_url = "https://${GatewayEndpoint}" # Replace with your actual gateway endpoint + gateway_url = "https://${GatewayEndpoint}/mcp" # Replace with your actual gateway endpoint @@ -98 +96 @@ Python requests package - "getOrderStatus", + "openapi-target-1___get_orders_byId", # Replace with <{TargetId}__{ToolName}> @@ -107,3 +104,0 @@ MCP Client - import json - from datetime import timedelta - @@ -111,0 +107 @@ MCP Client + import asyncio @@ -114,0 +111,2 @@ MCP Client + token, + tool_params, @@ -117 +115,5 @@ MCP Client - headers = {**headers} if headers else {} + default_headers = { + "Authorization": f"Bearer {token}" + } + headers = {**default_headers, **(headers or {})} + @@ -132,13 +134,5 @@ MCP Client - # 2. Invoke a tool - list_tools_response = await session.list_tools() - tools = list_tools_response.tools - print("Invoking Tools...") - for tool in tools: - tool_name = tool.name - args = { - "param1": "paramValue1" - } - invoke_tool_response = await session.call_tool( - tool_name, - arguments=args, - read_timeout_seconds=timedelta(seconds=60) + # 2. Call specific tool + print(f"Calling tool: {tool_params['name']}") + tool_response = await session.call_tool( + name=tool_params['name'], + arguments=tool_params['arguments'] @@ -146,9 +140,17 @@ MCP Client - contents = invoke_tool_response.content - for content in contents: - text = content.text - try: - content = json.dumps(json.loads(text), indent=4) - except: - content = text - print( - f"Invoke tool response: Name - {content}" + print(f"Tool response: {tool_response}") + return tool_response + + + async def main(): + url = "https://${GatewayEndpoint}/mcp" + token = "your_bearer_token_here" + tool_params = { + "name": "LambdaTarget___get_order_tool", + "arguments": { + "orderId": "order123" + } + } + await execute_mcp( + url=url, + token=token, + tool_params=tool_params @@ -156,0 +159,4 @@ MCP Client + + if __name__ == "__main__": + asyncio.run(main()) + @@ -165,3 +171 @@ This is for invoking agent - import asyncio - from strands import Agent - from mcp import ClientSession + from strands.tools.mcp.mcp_client import MCPClient @@ -170,12 +173,0 @@ This is for invoking agent - async def main(): - # Create strands agent - agent = Agent() - - # Connect to MCP server via streamable HTTP - async with streamablehttp_client("{gatewayURL}") as (read, write, get_session_id): - async with ClientSession(read, write) as session: - # Initialize MCP session - await session.initialize() - - result = await session.call_tool('x_amz_bedrock_agentcore_searchaws___recommend', arguments={"query": "How do I process images?"}) - print(f"Result: {result.content}") @@ -187,2 +179,14 @@ This is for invoking agent - if __name__ == "__main__": - asyncio.run(main()) + def run_agent(mcp_url: str, access_token: str): + mcp_client = MCPClient(lambda: create_streamable_http_transport(mcp_url, access_token)) + + with mcp_client: + result = mcp_client.call_tool_sync( + tool_use_id="tool-123", # A unique ID for the tool call + name="openapi-target-1___get_orders", # The name of the tool to invoke + arguments={} # A dictionary of arguments for the tool + ) + print(result) + + url = {gatewayUrl} + token = {AccessToken} + run_agent(url, token) @@ -204,0 +209 @@ This is for invoking agent + region, @@ -207 +212,3 @@ This is for invoking agent - agent = create_react_agent(model_id, tools) + model = ChatBedrock(model_id=model_id, region_name=region) + + agent = create_react_agent(model, tools) @@ -267 +274 @@ An internal server error occurred. - * MCP errors. For more information about these types of errors, [Error Handling](https://docs.aws.amazon.com/https://modelcontextprotocol.io/specification/2024-11-05/server/tools#error-handlinghttps://modelcontextprotocol.io/specification/2024-11-05/server/tools#error-handling) in the [Model Context Protocol (MCP)](https://docs.aws.amazon.com/https://modelcontextprotocol.io/docs/getting-started/intro) documentation. + * MCP errors. For more information about these types of errors, [Error Handling](https://docs.aws.amazon.com/https://modelcontextprotocol.io/specification/2024-11-05/server/tools#error-handlinghttps://modelcontextprotocol.io/specification/2024-11-05/server/tools#error-handling) in the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/docs/getting-started/intro) documentation.