AWS Bedrock AgentCore Gateway

Amazon Bedrock AgentCore Gateway treats remote MCP servers as first-class targets. Consensus’s stateless server works with all supported protocol versions, including the sessionless 2026-07-28.

Shared API key

Store the key

aws bedrock-agentcore-control create-api-key-credential-provider \
    --name consensus-api-key \
    --api-key "ak_live_..."

Create the target

aws bedrock-agentcore-control create-gateway-target \
    --gateway-identifier "your-gateway-id" \
    --name "Consensus" \
    --target-configuration '{
        "mcp": {
            "mcpServer": {
                "endpoint": "https://mcp.consensus.app/mcp"
            }
        }
    }' \
    --credential-provider-configurations '[{
        "credentialProviderType": "API_KEY",
        "credentialProvider": {
            "apiKeyCredentialProvider": {
                "providerArn": "arn:aws:bedrock-agentcore:<region>:<account>:token-vault/default/apikeycredentialprovider/consensus-api-key",
                "credentialLocation": "HEADER",
                "credentialParameterName": "Authorization",
                "credentialPrefix": "Bearer"
            }
        }
    }]'

Or with the toolkit CLI:

agentcore add gateway-target --name Consensus --type mcp-server --endpoint https://mcp.consensus.app/mcp --gateway MyGateway

, then agentcore deploy.

Per-user OAuth

AgentCore’s OAuth credential providers require a clientId and clientSecret; they don’t perform Dynamic Client Registration. Contact sales for a confidential client, then create a CustomOAuth2 provider with discoveryUrl set to https://consensus.app/.well-known/oauth-authorization-server and use grantType: AUTHORIZATION_CODE on the target. The target stays in CREATE_PENDING_AUTH until an admin completes consent.

Notes

The credential provider must be in the same region as the gateway.
Tool schemas are synced at create time; call SynchronizeGatewayTargets if the tool list changes.
Token passthrough (JWT_PASSTHROUGH) isn’t available for MCP targets.

AWS docs: MCP server targets · Outbound auth

Enterprise

Microsoft

AI gateways

AWS Bedrock AgentCore Gateway

Shared API key

Per-user OAuth

Notes

​Shared API key

​Per-user OAuth

​Notes

Shared API key

Per-user OAuth

Notes