AWS bedrock-agentcore medium security documentation change

Service: bedrock-agentcore · 2025-10-16 · Security-related medium

File: bedrock-agentcore/latest/devguide/gateway-using-mcp-list.md

Summary

Updated authorization header reference, MCP specification version updates, and code sample improvements including mandatory auth header handling

Security assessment

The change enforces Authorization header handling in code samples by adding Bearer token implementation. This demonstrates secure authentication practices, preventing unauthorized access by ensuring credentials are properly included. The update from 'AccessToken' to 'Authorization header' clarifies secure credential handling requirements.

Diff

diff --git a/bedrock-agentcore/latest/devguide/gateway-using-mcp-list.md b/bedrock-agentcore/latest/devguide/gateway-using-mcp-list.md
index 2f71ae014..af019d1ff 100644
--- a//bedrock-agentcore/latest/devguide/gateway-using-mcp-list.md
+++ b//bedrock-agentcore/latest/devguide/gateway-using-mcp-list.md
@@ -7,2 +6,0 @@ Code samples for listing tools
-Amazon Bedrock AgentCore is in preview release and is subject to change. 
-
@@ -17 +15 @@ To list all available tools that an AgentCore gateway provides, make a POST requ
-    Authorization: Bearer ${AccessToken}
+    Authorization: ${Authorization header}
@@ -25 +23 @@ Replace the following values:
-  * `${AccessToken}` – The access token provided by the identity provider when you set up [inbound authorization](./gateway-inbound-auth.html).
+  * `${Authorization header}` – The authorization credentials from the identity provider when you set up [inbound authorization](./gateway-inbound-auth.html).
@@ -27 +25 @@ Replace the following values:
-  * `${RequestBody}` – The JSON payload of the request body, as specified in [Listing tools](https://docs.aws.amazon.com/https://modelcontextprotocol.io/specification/2025-03-26/server/tools#listing-tools) in the [Model Context Protocol (MCP)](https://docs.aws.amazon.com/https://modelcontextprotocol.io/docs/getting-started/intro). Include `tools/list` as the `method`.
+  * `${RequestBody}` – The JSON payload of the request body, as specified in [Listing tools](https://docs.aws.amazon.com/https://modelcontextprotocol.io/specification/2025-06-18/server/tools#listing-tools) in the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/docs/getting-started/intro). Include `tools/list` as the `method`.
@@ -34 +32 @@ Replace the following values:
-For a list of optionally supported parameters for `tools/list`, see the `params` object in the request body at [Tools](https://modelcontextprotocol.io/specification/2025-03-26/server/tools) in the [Model Context Protocol documentation](https://modelcontextprotocol.io/specification/2025-03-26). At the top of the page next to the search bar, you can select the MCP version whose documentation you want to view. Make sure that the version is one [supported by Amazon Bedrock AgentCore](./gateway-using.html).
+For a list of optionally supported parameters for `tools/list`, see the `params` object in the request body at [Tools](https://modelcontextprotocol.io/specification/2025-06-18/server/tools) in the [Model Context Protocol documentation](https://modelcontextprotocol.io/specification/2025-06-18). At the top of the page next to the search bar, you can select the MCP version whose documentation you want to view. Make sure that the version is one [supported by Amazon Bedrock AgentCore](./gateway-using.html).
@@ -65 +63 @@ Python requests package
-    gateway_url = "https://${GatewayEndpoint}" # Replace with your actual gateway endpoint
+    gateway_url = "https://${GatewayEndpoint}/mcp" # Replace with your actual gateway endpoint
@@ -73,0 +72 @@ MCP Client
+    import asyncio
@@ -78,0 +78 @@ MCP Client
+        token,
@@ -81 +81,5 @@ MCP Client
-        headers = {**headers} if headers else {}
+        default_headers = {
+            "Authorization": f"Bearer {token}"
+        }
+        headers = {**default_headers, **(headers or {})}
+        
@@ -117,0 +122,19 @@ MCP Client
+    async def main():
+        url = "https://${GatewayEndpoint}/mcp"
+        token = "your_bearer_token_here"
+        
+        # Optional additional headers
+        additional_headers = {
+            "Content-Type": "application/json",
+        }
+        
+        await execute_mcp(
+            url=url,
+            token=token,
+            headers=additional_headers
+        )
+    
+    # Run the async function
+    if __name__ == "__main__":
+        asyncio.run(main())
+    
@@ -123,3 +145,0 @@ Strands MCP Client
-    from strands import Agent
-    import logging
-    from strands.models import BedrockModel
@@ -214 +234 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please
-Obtain an access token
+Use a gateway