> ## Documentation Index
> Fetch the complete documentation index at: https://docs.consensus.app/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Bedrock AgentCore Gateway

> Add the Consensus MCP server as an MCP target in Amazon Bedrock AgentCore Gateway with an API key credential provider.

Amazon Bedrock AgentCore Gateway treats remote MCP servers as first-class targets. Consensus's stateless server works with all supported protocol versions, including the sessionless `2026-07-28`.

## Shared API key

<Steps>
  <Step title="Store the key">
    ```bash theme={null}
    aws bedrock-agentcore-control create-api-key-credential-provider \
        --name consensus-api-key \
        --api-key "ak_live_..."
    ```
  </Step>

  <Step title="Create the target">
    ```bash theme={null}
    aws bedrock-agentcore-control create-gateway-target \
        --gateway-identifier "your-gateway-id" \
        --name "Consensus" \
        --target-configuration '{
            "mcp": {
                "mcpServer": {
                    "endpoint": "https://mcp.consensus.app/mcp"
                }
            }
        }' \
        --credential-provider-configurations '[{
            "credentialProviderType": "API_KEY",
            "credentialProvider": {
                "apiKeyCredentialProvider": {
                    "providerArn": "arn:aws:bedrock-agentcore:<region>:<account>:token-vault/default/apikeycredentialprovider/consensus-api-key",
                    "credentialLocation": "HEADER",
                    "credentialParameterName": "Authorization",
                    "credentialPrefix": "Bearer"
                }
            }
        }]'
    ```

    Or with the toolkit CLI: `agentcore add gateway-target --name Consensus --type mcp-server --endpoint https://mcp.consensus.app/mcp --gateway MyGateway`, then `agentcore deploy`.
  </Step>
</Steps>

## Per-user OAuth

AgentCore's OAuth credential providers require a `clientId` and `clientSecret`; they don't perform Dynamic Client Registration. [Contact sales](https://consensus.app/home/contact/sales/) for a confidential client, then create a `CustomOAuth2` provider with `discoveryUrl` set to `https://consensus.app/.well-known/oauth-authorization-server` and use `grantType: AUTHORIZATION_CODE` on the target. The target stays in `CREATE_PENDING_AUTH` until an admin completes consent.

## Notes

* The credential provider must be in the same region as the gateway.
* Tool schemas are synced at create time; call `SynchronizeGatewayTargets` if the tool list changes.
* Token passthrough (`JWT_PASSTHROUGH`) isn't available for MCP targets.

AWS docs: [MCP server targets](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-target-MCPservers.html) · [Outbound auth](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-outbound-auth.html)