Skip to main content
Amazon Bedrock AgentCore runtimes expose an MCP endpoint that requires AWS Signature Version 4 (SigV4) on every request. TrueFoundry stores shared AWS credentials on the MCP server and signs upstream calls in the MCP Gateway — users do not complete a Connect / OAuth consent flow.
This guide covers registering an existing AgentCore runtime that uses IAM inbound auth (access key credentials). Assumed-role support is not covered here yet.

​
Guide to registering an AgentCore MCP server

1

Open your AgentCore runtime in AWS

  1. Sign in to the AWS Console in the region where your runtime lives (for example US East (N. Virginia) / us-east-1).
  2. Open Amazon Bedrock → AgentCore → Build → Runtime.
  3. In Runtime resources, click the runtime you want to connect (for example an IAM-backed MCP runtime such as tfy_mcp_iam or tfy_test_mcp_server). Status should be Ready.
AgentCore Runtime resources list in AWS Console
Use Build → Runtime, not Discover → Registry. The MCP invoke URL is built from the Runtime ARN (…:runtime/…), not a registry ARN.
2

Copy the Runtime ARN and build the MCP URL

  1. On the runtime detail page, copy the Runtime ARN.
AgentCore runtime detail page showing Runtime ARNExample ARN:
  1. Build the MCP URL with this template:
The ARN must be percent-encoded in the path (: → %3A, / → %2F). TrueFoundry’s gateway signs the URL as stored — it does not encode the ARN for you.Encode it in a shell:
Example result:
The region in the URL, the region in the ARN, and the AWS Region you select later in TrueFoundry must all match.
3

Create an IAM user for AgentCore invoke

You need a long-lived IAM access key (access key ID + secret). Temporary Okta/SSO session credentials are not enough — the MCP Gateway SigV4 path currently signs with access key + secret only (no session token).
  1. In AWS Console, open IAM → Users.
  2. Click Create user and give it a name (for example tfy-mcp-agentcore).
  3. On Set permissions, choose Attach policies directly.
  4. Attach a policy that allows invoke on your runtime ARN. Example:
For a quick local test you can temporarily attach AdministratorAccess, then remove it after you create keys.IAM create user Set permissions step
  1. Finish Create user.
4

Create an access key for that IAM user

  1. Open the new user → Security credentials.
  2. Under Access keys, click Create access key.
  3. Choose Application running outside AWS → Next → Create access key.
  4. Copy Access key and Secret access key now. The secret is shown only once.
Do not paste raw keys into git, screenshots, or public docs. Prefer storing them in TrueFoundry Secrets (next step) and referencing them by FQN.
5

Store the keys as TrueFoundry secrets (recommended)

  1. In TrueFoundry, open Secrets and create (or reuse) a secret group — for example agentcore-aws.
  2. Add two secrets:
    • Key: AWS_ACCESS_KEY_ID → value: your IAM access key ID
    • Key: AWS_SECRET_ACCESS_KEY → value: your IAM secret access key
See Manage secrets for the full UI flow.
  1. Note each secret’s FQN. It looks like:
Example:
You will paste these FQNs into the MCP server form (or YAML) instead of the raw key values. TrueFoundry resolves them at runtime when the gateway signs requests.
6

Register the remote MCP server in TrueFoundry

  1. Go to MCP Gateway → Add Server → Connect any Remote MCP Server.
  2. Set URL to the encoded AgentCore MCP URL from earlier.
  3. Add Collaborators as needed.
  4. Under Auth Data, select AWS SigV4.
  5. Fill in:
TrueFoundry MCP Auth Data form with AWS SigV4 selected
  1. Click Add MCP Server (or Update).
7

Optional: apply via manifest / API