> ## Documentation Index
> Fetch the complete documentation index at: https://www.truefoundry.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Register an AWS Bedrock AgentCore MCP Server

> Connect an Amazon Bedrock AgentCore runtime as a remote MCP server using AWS SigV4 authentication.

Amazon Bedrock AgentCore runtimes expose an MCP endpoint that requires **AWS Signature Version 4 (SigV4)** on every request. TrueFoundry stores shared AWS credentials on the MCP server and signs upstream calls in the MCP Gateway — users do **not** complete a Connect / OAuth consent flow.

<Info>
  This guide covers registering an existing AgentCore runtime that uses **IAM inbound auth** (access key credentials). Assumed-role support is not covered here yet.
</Info>

## Guide to registering an AgentCore MCP server

<Steps>
  <Step title="Open your AgentCore runtime in AWS">
    1. Sign in to the AWS Console in the region where your runtime lives (for example **US East (N. Virginia) / `us-east-1`**).
    2. Open **Amazon Bedrock → AgentCore → Build → Runtime**.
    3. In **Runtime resources**, click the runtime you want to connect (for example an IAM-backed MCP runtime such as `tfy_mcp_iam` or `tfy_test_mcp_server`). Status should be **Ready**.

    <img src="https://mintcdn.com/truefoundry/npq6Hzj6kpICQLHN/images/docs/ai-gateway/agentcore-runtime-list.png?fit=max&auto=format&n=npq6Hzj6kpICQLHN&q=85&s=7c19d1f816c249d1d6c0740f612fbfa2" alt="AgentCore Runtime resources list in AWS Console" width="1024" height="190" data-path="images/docs/ai-gateway/agentcore-runtime-list.png" />

    <Note>
      Use **Build → Runtime**, not **Discover → Registry**. The MCP invoke URL is built from the **Runtime ARN** (`…:runtime/…`), not a registry ARN.
    </Note>
  </Step>

  <Step title="Copy the Runtime ARN and build the MCP URL">
    1. On the runtime detail page, copy the **Runtime ARN**.

    <img src="https://mintcdn.com/truefoundry/npq6Hzj6kpICQLHN/images/docs/ai-gateway/agentcore-runtime-arn.png?fit=max&auto=format&n=npq6Hzj6kpICQLHN&q=85&s=e680f9f81079d04835736fb0e3bceac6" alt="AgentCore runtime detail page showing Runtime ARN" width="1024" height="530" data-path="images/docs/ai-gateway/agentcore-runtime-arn.png" />

    Example ARN:

    ```text theme={"dark"}
    arn:aws:bedrock-agentcore:us-east-1:123456789012:runtime/my-runtime-abc123
    ```

    2. Build the MCP URL with this template:

    ```text theme={"dark"}
    https://bedrock-agentcore.{region}.amazonaws.com/runtimes/{urlencoded-runtime-ARN}/invocations?qualifier=DEFAULT
    ```

    The ARN must be **percent-encoded** in the path (`:` → `%3A`, `/` → `%2F`). TrueFoundry’s gateway signs the URL as stored — it does not encode the ARN for you.

    Encode it in a shell:

    ```bash theme={"dark"}
    python3 -c 'from urllib.parse import quote; print(quote("arn:aws:bedrock-agentcore:us-east-1:123456789012:runtime/my-runtime-abc123", safe=""))'
    ```

    Example result:

    ```text theme={"dark"}
    https://bedrock-agentcore.us-east-1.amazonaws.com/runtimes/arn%3Aaws%3Abedrock-agentcore%3Aus-east-1%3A123456789012%3Aruntime%2Fmy-runtime-abc123/invocations?qualifier=DEFAULT
    ```

    <Warning>
      The region in the URL, the region in the ARN, and the **AWS Region** you select later in TrueFoundry must all match.
    </Warning>
  </Step>

  <Step title="Create an IAM user for AgentCore invoke">
    You need a **long-lived IAM access key** (access key ID + secret). Temporary Okta/SSO session credentials are not enough — the MCP Gateway SigV4 path currently signs with access key + secret only (no session token).

    1. In AWS Console, open **IAM → Users**.
    2. Click **Create user** and give it a name (for example `tfy-mcp-agentcore`).
    3. On **Set permissions**, choose **Attach policies directly**.
    4. Attach a policy that allows invoke on your runtime ARN. Example:

    ```json theme={"dark"}
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "bedrock-agentcore:InvokeAgentRuntime",
          "Resource": "arn:aws:bedrock-agentcore:us-east-1:123456789012:runtime/my-runtime-abc123"
        }
      ]
    }
    ```

    For a quick local test you can temporarily attach `AdministratorAccess`, then remove it after you create keys.

    <img src="https://mintcdn.com/truefoundry/npq6Hzj6kpICQLHN/images/docs/ai-gateway/agentcore-iam-set-permissions.png?fit=max&auto=format&n=npq6Hzj6kpICQLHN&q=85&s=4abb4a7022e3295d9acfd058f6aa8281" alt="IAM create user Set permissions step" width="1024" height="532" data-path="images/docs/ai-gateway/agentcore-iam-set-permissions.png" />

    5. Finish **Create user**.
  </Step>

  <Step title="Create an access key for that IAM user">
    1. Open the new user → **Security credentials**.
    2. Under **Access keys**, click **Create access key**.
    3. Choose **Application running outside AWS** → **Next** → **Create access key**.
    4. Copy **Access key** and **Secret access key** now. The secret is shown only once.

    <Warning>
      Do not paste raw keys into git, screenshots, or public docs. Prefer storing them in TrueFoundry Secrets (next step) and referencing them by FQN.
    </Warning>
  </Step>

  <Step title="Store the keys as TrueFoundry secrets (recommended)">
    1. In TrueFoundry, open **Secrets** and create (or reuse) a secret group — for example `agentcore-aws`.
    2. Add two secrets:
       * Key: `AWS_ACCESS_KEY_ID` → value: your IAM access key ID
       * Key: `AWS_SECRET_ACCESS_KEY` → value: your IAM secret access key

    See [Manage secrets](/docs/manage-secrets) for the full UI flow.

    3. Note each secret’s FQN. It looks like:

    ```text theme={"dark"}
    tfy-secret://<tenant>:<secret-group>:<secret-key>
    ```

    Example:

    ```text theme={"dark"}
    tfy-secret://truefoundry:agentcore-aws:AWS_ACCESS_KEY_ID
    tfy-secret://truefoundry:agentcore-aws:AWS_SECRET_ACCESS_KEY
    ```

    You will paste these FQNs into the MCP server form (or YAML) instead of the raw key values. TrueFoundry resolves them at runtime when the gateway signs requests.
  </Step>

  <Step title="Register the remote MCP server in TrueFoundry">
    1. Go to **MCP Gateway** → **Add Server** → **Connect any Remote MCP Server**.
    2. Set **URL** to the encoded AgentCore MCP URL from earlier.
    3. Add **Collaborators** as needed.
    4. Under **Auth Data**, select **AWS SigV4**.
    5. Fill in:

    | Field                     | Value                                                                       |
    | ------------------------- | --------------------------------------------------------------------------- |
    | **AWS Region**            | Same region as the runtime (for example `us-east-1`)                        |
    | **AWS Access Key ID**     | `tfy-secret://…:AWS_ACCESS_KEY_ID` (or the raw key for a quick test)        |
    | **AWS Secret Access Key** | `tfy-secret://…:AWS_SECRET_ACCESS_KEY` (or the raw secret for a quick test) |

    <img src="https://mintcdn.com/truefoundry/npq6Hzj6kpICQLHN/images/docs/ai-gateway/agentcore-tfy-sigv4-form.png?fit=max&auto=format&n=npq6Hzj6kpICQLHN&q=85&s=0dcb908b1c9a0e975da7cfd275dfd232" alt="TrueFoundry MCP Auth Data form with AWS SigV4 selected" width="1720" height="1082" data-path="images/docs/ai-gateway/agentcore-tfy-sigv4-form.png" />

    6. Click **Add MCP Server** (or **Update**).
  </Step>

  <Step title="Optional: apply via manifest / API">
    ```yaml theme={"dark"}
    type: mcp-server/remote
    name: my-agentcore-mcp
    url: https://bedrock-agentcore.us-east-1.amazonaws.com/runtimes/arn%3Aaws%3A.../invocations?qualifier=DEFAULT
    auth_data:
      type: aws-sigv4
      region: us-east-1
      auth:
        type: aws-access-key
        access_key_id: tfy-secret://truefoundry:agentcore-aws:AWS_ACCESS_KEY_ID
        secret_access_key: tfy-secret://truefoundry:agentcore-aws:AWS_SECRET_ACCESS_KEY
    ```
  </Step>
</Steps>