AWS bedrock-agentcore documentation change
Summary
Fixed typographical issues (apostrophes) and formatting (headings, lists, code references) in the MCP server gateway target documentation.
Security assessment
The changes are purely cosmetic, involving typographical fixes (straight to curly apostrophes), formatting adjustments (removing backticks from a heading, compressing a list into a single line, and adding spaces around code references). There is no evidence of addressing a security vulnerability, weakness, or incident. The technical content about IAM (SigV4) authorization, OAuth, and JSON Schema restrictions remains unchanged, so there are no security implications.
Diff
diff --git a/bedrock-agentcore/latest/devguide/gateway-target-MCPservers.md b/bedrock-agentcore/latest/devguide/gateway-target-MCPservers.md index 0b4d93298..d945e564f 100644 --- a//bedrock-agentcore/latest/devguide/gateway-target-MCPservers.md +++ b//bedrock-agentcore/latest/devguide/gateway-target-MCPservers.md @@ -30 +30 @@ Tool discovery is managed through the synchronization operation provided by the -Implicit synchronization is the automatic tool discovery and indexing that occurs during `CreateGatewayTarget` and `UpdateGatewayTarget` operations. Gateway immediately calls the MCP server's tools/list capability to fetch available tools and make tools available in the unified catalog without requiring separate user action. +Implicit synchronization is the automatic tool discovery and indexing that occurs during `CreateGatewayTarget` and `UpdateGatewayTarget` operations. Gateway immediately calls the MCP server’s tools/list capability to fetch available tools and make tools available in the unified catalog without requiring separate user action. @@ -38 +38 @@ Synchronization is a critical mechanism for maintaining accurate tool catalogs w -**When to call`SynchronizeGatewayTargets`** +**When to call SynchronizeGatewayTargets** @@ -40 +40 @@ Synchronization is a critical mechanism for maintaining accurate tool catalogs w -Use this API whenever your MCP server's tools change - whether adding new tools, modifying existing tool schemas, or removing deprecated tools. Since Gateway pre-computes vector embeddings for semantic search and maintains normalized tool catalogs, synchronization ensures users can discover and invoke the latest available tools across all target types. +Use this API whenever your MCP server’s tools change - whether adding new tools, modifying existing tool schemas, or removing deprecated tools. Since Gateway pre-computes vector embeddings for semantic search and maintains normalized tool catalogs, synchronization ensures users can discover and invoke the latest available tools across all target types. @@ -61,16 +61 @@ The following types of the authorization strategy are supported. -IAM (SigV4) outbound authorization requires that the MCP server is hosted behind an AWS service that natively supports IAM authentication. The gateway signs outbound requests with SigV4 but does not modify the authentication configuration on the target. The target service must be able to verify SigV4 signatures. - -The following AWS services natively support IAM authentication and are compatible with IAM outbound authorization for MCP server targets: - - * Amazon Bedrock AgentCore Gateway - - * Amazon Bedrock AgentCore Runtime (see [Deploy MCP servers in AgentCore Runtime](./runtime-mcp.html)) - - * Amazon API Gateway - - * Lambda Function URLs - - - - -Services that do not natively verify SigV4 signatures, such as Application Load Balancer or direct Amazon EC2 endpoints, are not compatible with IAM outbound authorization. If your MCP server is hosted behind one of these services, use OAuth or API key authorization instead. +IAM (SigV4) outbound authorization requires that the MCP server is hosted behind an AWS service that natively supports IAM authentication. The gateway signs outbound requests with SigV4 but does not modify the authentication configuration on the target. The target service must be able to verify SigV4 signatures. The following AWS services natively support IAM authentication and are compatible with IAM outbound authorization for MCP server targets: * Amazon Bedrock AgentCore Gateway * Amazon Bedrock AgentCore Runtime (see [Deploy MCP servers in AgentCore Runtime](./runtime-mcp.html) ) * Amazon API Gateway * Lambda Function URLs Services that do not natively verify SigV4 signatures, such as Application Load Balancer or direct Amazon EC2 endpoints, are not compatible with IAM outbound authorization. If your MCP server is hosted behind one of these services, use OAuth or API key authorization instead. @@ -88 +73 @@ The following must be configured. - 4. JSON Schema reference keywords such as `$ref`, `$defs`, `$anchor`, `$dynamicRef`, and `$dynamicAnchor` are not supported in the tool definitions returned by the MCP server's `tools/list` response. If your MCP server returns tool schemas containing these keywords, the target creation or synchronization will fail. Ensure your MCP server returns fully resolved, self-contained JSON schemas without reference keywords. + 4. JSON Schema reference keywords such as `$ref` , `$defs` , `$anchor` , `$dynamicRef` , and `$dynamicAnchor` are not supported in the tool definitions returned by the MCP server’s `tools/list` response. If your MCP server returns tool schemas containing these keywords, the target creation or synchronization will fail. Ensure your MCP server returns fully resolved, self-contained JSON schemas without reference keywords. @@ -99 +84 @@ To support the Authorization Code grant type (three-legged OAuth) with MCP serve -With this method, the admin user completes the authorization code flow during `CreateGatewayTarget`, `UpdateGatewayTarget`, or `SynchronizeGatewayTargets` operations using the authorization URL returned in the response. This allows Amazon Bedrock AgentCore Gateway to discover and cache the MCP server's tools upfront. +With this method, the admin user completes the authorization code flow during `CreateGatewayTarget` , `UpdateGatewayTarget` , or `SynchronizeGatewayTargets` operations using the authorization URL returned in the response. This allows Amazon Bedrock AgentCore Gateway to discover and cache the MCP server’s tools upfront. @@ -115 +100 @@ You cannot synchronize a target that has a static tool schema (`mcpToolSchema`) -[OAuth 2.0 authorization URL session binding](./oauth2-authorization-url-session-binding.html) verifies that the user who initiated the OAuth authorization request is the same user who granted consent. After the user completes consent, the browser redirects back to a return URL configured on the target with a unique session URI. The application is then responsible for calling the [CompleteResourceTokenAuth](https://docs.aws.amazon.com/bedrock-agentcore/latest/APIReference/API_CompleteResourceTokenAuth.html) API, presenting both the user's identity and the session URI. Amazon Bedrock AgentCore Identity validates that the user who started the flow is the same user who completed it before exchanging the authorization code for an access token. +[OAuth 2.0 authorization URL session binding](./oauth2-authorization-url-session-binding.html) verifies that the user who initiated the OAuth authorization request is the same user who granted consent. After the user completes consent, the browser redirects back to a return URL configured on the target with a unique session URI. The application is then responsible for calling the [CompleteResourceTokenAuth](https://docs.aws.amazon.com/bedrock-agentcore/latest/APIReference/API_CompleteResourceTokenAuth.html) API, presenting both the user’s identity and the session URI. Amazon Bedrock AgentCore Identity validates that the user who started the flow is the same user who completed it before exchanging the authorization code for an access token.