Bedrock Gateway tightens MCP security and control

Bedrock's AgentCore Gateway now centralizes MCP security at scale.

In two updates from AWS, the Bedrock AgentCore Gateway adds deeper enterprise controls to Model Context Protocol deployments and arms agents with a layered security model that blends policy, credentials, and runtime validation. The core idea is to move away from a patchwork of individually secured MCP servers toward a single trusted entry point that handles credentials, policy enforcement, private connectivity, and logging. The team reports that the gateway’s centralization reduces duplication across teams, giving security teams a unified view of how MCP infrastructure is used across the organization and easing contract and compliance reviews. The paper shows that enterprises can align tool usage with business units without building bespoke security per server, a win for large orgs juggling hundreds of MCP tools.

On the MCP side, AWS extends tool schemas so prompts and resources become first class citizens in the system, along with features for dynamic runtime discovery of MCP servers. This lets an organization add new MCP endpoints without rearchitecting security workflows every time. The supply chain for real time interactions gets a boost too: streaming and session management support stateful conversations, while elicitation for mid execution input requests lets the gateway prompt for missing data without breaking the interaction flow. OAuth 2.0 on behalf of token exchange is introduced for delegated authentication, so teams can grant tools access to other teams without handing out broad credentials. For practitioners, these capabilities translate to more predictable access control, and to tooling that can scale as quickly as the number of MCP servers grows. For hands on examples, AWS points to a GitHub samples repository that shows how to wire up these primitives in production.

The second thread of the updates shifts to securing agent behavior itself. In a world where hundreds of agents operate across dozens of teams, governance becomes a real challenge when LLM powered agents decide at runtime which tools to invoke and with what arguments. The gateway now offers two complementary mechanisms: policy and interceptors. Policy in AgentCore for deterministic access control uses Cedar, a declarative policy language, to evaluate requests against a principal, an action, and a resource with optional context. The result is an allow or deny decision that is automatically logged for audit trails. Lambda interceptors provide dynamic validation by letting teams run custom code before or after each tool call. Interceptors can enrich payloads, perform token exchanges, or filter responses, enabling a layered security approach that can adapt to live workflow conditions. The team notes that both mechanisms work together to create a governance fabric that is hard for any single agent to bypass.

Industry observers say the engineering constraints are clear. The paper shows a practical balance between centralized governance and runtime flexibility, a design pattern many large enterprises have sought as they scale agent usage. The gateway’s dual approach means policy can catch what is known in advance, while interceptors catch what emerges during execution. The team reports that this combination helps auditors trace tool use, while operators retain the ability to adjust behavior on the fly as workflows evolve.

Two takeaways for practitioners stand out. First, centralization pays off in observability and policy consistency but necessitates robust high availability and disaster recovery plans to avoid a single point of failure becoming a bottleneck. Second, layering deterministic Cedar policies with dynamic Lambda interceptors yields stronger guardrails, yet introduces additional policy authoring and maintenance workloads. Expect a learning curve as teams write Cedar rules and craft interceptor logic that covers common failure modes, from malformed payloads to subtle exfiltration risks. A third practical note: runtime discovery and on demand token exchange simplify onboarding of new tools, but require disciplined credential lifecycle management and clear ownership of tool metadata. As enterprises push toward broader agent adoption, the updated Bedrock Gateway offers a concrete path to govern tool use at scale without sacrificing responsiveness for real time workflows.

The updates also signal a broader industry pattern: secure agent platforms increasingly rely on centralized, auditable gateways that unify credential handling, policy enforcement, and dynamic validation. The combination of MCP tool schema enhancements, runtime discovery, and Cedar plus Lambda interceptors gives enterprises a toolkit to balance autonomy and oversight across increasingly complex AI-enabled workflows.