feat: add gateway auth and multi-gateway support to agent templates by aidandaly24 · Pull Request #427 · aws/agentcore-cli

aidandaly24 · 2026-02-24T21:15:08Z

Description

Add gateway authentication and multi-gateway support to agent templates so agents can connect to MCP gateways.

SigV4 Authentication

Each framework's mcp_client/client.py includes a SigV4HTTPXAuth class that signs HTTP requests using botocore's SigV4Auth, passed to the MCP client via httpx.AsyncClient(auth=...). This enables agents to authenticate with AWS_IAM gateways (Lambda function URLs).

Multi-Gateway Support

Templates use {{#each gatewayProviders}} loops to generate per-gateway client functions. Each gateway gets its own env var (AGENTCORE_GATEWAY_{NAME}_URL) and auth configuration. A convenience function collects clients from all gateways.

Template System Changes

AgentRenderConfig extended with hasGateway, gatewayProviders, and gatewayAuthTypes
Schema mapper reads mcp.json to populate gateway config for rendering
Added snakeCase Handlebars helper for Python function names
All main.py files use {{#if hasGateway}} conditionals for correct imports
Missing env vars log a warning and return None instead of crashing
All 5 frameworks updated: Strands, LangChain, OpenAI Agents, Google ADK, AutoGen
All gateways are auto-included when creating an agent

Related Issue

Part of the MCP Gateway Phase 1 integration (gateway-integration branch). Task 16.

Type of Change

New feature

Testing

I ran npm run test:unit and npm run test:integ
I ran npm run typecheck
I ran npm run lint
If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

I have read the CONTRIBUTING document
I have added any necessary tests that prove my fix is effective or my feature works
I have updated the documentation accordingly
I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
My changes generate no new warnings
Any dependent changes have been merged and published

notgitika

Overall, LGTM.

This is a great start and we can go ahead with my comments + @tejaskash 's in follow-up PRs

notgitika · 2026-02-24T23:48:28Z

src/assets/python/langchain_langgraph/base/main.py

+    mcp_tools = []
+    if mcp_client:
+        mcp_tools = await mcp_client.get_tools()


MultiServerMCPClient is normally used as async with. Calling .get_tools() without entering the context manager may not initialize connections.

notgitika · 2026-02-24T23:49:55Z

src/assets/python/strands/base/mcp_client/client.py

+        logger.warning("{{envVarName}} not set — {{name}} gateway tools unavailable")
+        return None
+    {{#if (eq authType "AWS_IAM")}}
+    http_client = httpx.AsyncClient(auth=SigV4HTTPXAuth())


This client is never closed, which leaks connections. Should be managed with async with or closed on shutdown.

notgitika · 2026-02-24T23:50:59Z

src/cli/templates/render.ts

+Handlebars.registerHelper('snakeCase', (str: string) => {
+  return str.replace(/[^a-zA-Z0-9]/g, '_').toLowerCase();
+});


Produces double underscores (My--GW → my__gateway) and invalid Python identifiers for digit-leading names. Collapse consecutive _ and handle leading digits.

notgitika · 2026-02-24T23:52:12Z

src/assets/python/openaiagents/base/main.py

    try:
-        async with mcp_server as server:
-            active_servers = [server] if server else []
+        {{#if hasGateway}}


Gateway and non-gateway branches duplicate a lot of lines of agent creation. We could factor out the shared logic

notgitika · 2026-02-24T23:54:20Z

Can we also add tests in this PR around mapMcpGatewaysToGatewayProviders?

Add SigV4 authentication to MCP client templates so agents can authenticate with AWS_IAM gateways. Each framework's client.py uses Handlebars conditionals to include auth when gateways exist. SigV4HTTPXAuth class signs HTTP requests using botocore SigV4Auth, passed to the MCP client via httpx.AsyncClient. Templates read gateway URLs from AGENTCORE_GATEWAY_{NAME}_URL env vars and handle missing vars gracefully (warn, don't crash). Updated all 5 frameworks: Strands, LangChain, OpenAI Agents, Google ADK, AutoGen. Schema mapper reads mcp.json to populate gateway config for template rendering. All gateways are auto- included when creating an agent.

Replace single-gateway [0] indexing with {{#each gatewayProviders}} loops. Each gateway gets its own client function (Strands) or entry in the servers dict (LangChain/OpenAI/AutoGen/ADK). Add snakeCase Handlebars helper for gateway function names. Add gatewayAuthTypes array for conditional SigV4 imports. Fix @index parse error by using plain variable names.

All 5 framework main.py files now use Handlebars conditionals to import the correct MCP client function based on hasGateway flag. Fix snakeCase helper to handle all special characters.

…way support Replace custom SigV4HTTPXAuth class with official mcp-proxy-for-aws package: - Strands: aws_iam_streamablehttp_client factory pattern - LangChain: SigV4HTTPXAuth via auth param in MultiServerMCPClient config - OpenAI Agents: SigV4HTTPXAuth via httpx_client_factory param - Google ADK: SigV4HTTPXAuth via httpx_client_factory in StreamableHTTPConnectionParams Revert AutoGen to original upstream — SDK doesn't support custom httpx auth (no httpx_client_factory param).

…late

…427) * feat: add gateway auth support to agent templates Add SigV4 authentication to MCP client templates so agents can authenticate with AWS_IAM gateways. Each framework's client.py uses Handlebars conditionals to include auth when gateways exist. SigV4HTTPXAuth class signs HTTP requests using botocore SigV4Auth, passed to the MCP client via httpx.AsyncClient. Templates read gateway URLs from AGENTCORE_GATEWAY_{NAME}_URL env vars and handle missing vars gracefully (warn, don't crash). Updated all 5 frameworks: Strands, LangChain, OpenAI Agents, Google ADK, AutoGen. Schema mapper reads mcp.json to populate gateway config for template rendering. All gateways are auto- included when creating an agent. * feat: add multi-gateway support and fix template rendering Replace single-gateway [0] indexing with {{#each gatewayProviders}} loops. Each gateway gets its own client function (Strands) or entry in the servers dict (LangChain/OpenAI/AutoGen/ADK). Add snakeCase Handlebars helper for gateway function names. Add gatewayAuthTypes array for conditional SigV4 imports. Fix @index parse error by using plain variable names. * fix: update main.py files with gateway conditional imports All 5 framework main.py files now use Handlebars conditionals to import the correct MCP client function based on hasGateway flag. Fix snakeCase helper to handle all special characters. * style: fix formatting * refactor: use mcp-proxy-for-aws for gateway auth, remove AutoGen gateway support Replace custom SigV4HTTPXAuth class with official mcp-proxy-for-aws package: - Strands: aws_iam_streamablehttp_client factory pattern - LangChain: SigV4HTTPXAuth via auth param in MultiServerMCPClient config - OpenAI Agents: SigV4HTTPXAuth via httpx_client_factory param - Google ADK: SigV4HTTPXAuth via httpx_client_factory in StreamableHTTPConnectionParams Revert AutoGen to original upstream — SDK doesn't support custom httpx auth (no httpx_client_factory param). * fix: pass AWS region to aws_iam_streamablehttp_client in Strands template

* feat: mcp gateway schema types (auth, outbound auth, OAuth credentials) (#375) * ci: add feat/gateway-integration branch to workflow triggers (#376) * feat: mcp gateway schema types (auth, outbound auth, OAuth credentials) * fix: address CR feedback — scopes optional, specific validation errors * refactor: rename mcp-tool to gateway-target across CLI (#377) * feat: enable gateway commands, UI updates, deploy pipeline, credential validation (#382) * feat: add external MCP server target support and unassigned targets (#406) * feat: add OAuth credential provider creation during deploy (#407) * feat: add OAuth credential provider creation during deploy * fix: address review comments — add clarifying comments for vendor config, race condition, and ARN inconsistency * fix: use typed SDK responses instead of Record<string, unknown> casts * fix: on conflict, update OAuth provider instead of GET to avoid silently ignoring new credentials * refactor: remove exposure/mcp-runtime mode from gateway-target command (#414) * refactor: remove exposure/mcp-runtime mode from gateway-target command All gateway targets are now behind-gateway only. The mcp-runtime exposure mode was disabled and never used by customers. - Remove ExposureMode type, EXPOSURE_MODE_OPTIONS, --exposure and --agents CLI flags - Simplify wizard flow: name → source → language → gateway → host → confirm - Remove mcp-runtime code paths from create-mcp, remove-gateway-target, McpGuidedEditor - Remove existingAgents prop chain (only used for mcp-runtime agent selection) - Clean up unused imports (ViewMode, AgentCoreMcpRuntimeTool, WizardMultiSelect) * test: update tests for exposure removal - Remove mcp-runtime validation tests and fixtures - Remove mcp-runtime integration tests (add and remove) - Simplify gateway target test fixtures to behind-gateway only * style: fix formatting * test: add unit tests for Batches 1-3 gateway functionality (#415) Comprehensive test coverage for MCP Gateway Phase 1 Batches 1-3: - Schema validation: gateway targets, outbound auth, credentials, deployed state - OAuth credential provider: CRUD operations, conflict handling, error paths - Pre-deploy identity: OAuth setup, credential collection, env var mapping - CLI validation: existing-endpoint path, credential validation - Deploy outputs: buildDeployedState with credentials, parseGatewayOutputs - External target creation: assignment, unassigned, duplicates, outboundAuth - Gateway target removal: listing, preview, removal operations - Preflight: gateway-only deploy validation - Credential references: cross-gateway warning on removal - Add command actions: buildGatewayTargetConfig mapping - UI: AddScreen/RemoveScreen enablement, ResourceGraph unassigned targets - Types: constants validation (AUTHORIZER_TYPE_OPTIONS, SKIP_FOR_NOW, SOURCE_OPTIONS) Adds 86 new test cases across 17 files. * feat: assign unassigned targets to gateways and preserve targets on removal (#410) * feat: assign unassigned targets to gateways and preserve targets on removal * test: add unit tests for unassigned target assignment and gateway removal - getUnassignedTargets: returns targets, empty when no config, empty when field missing - createGatewayFromWizard: moves selected targets to new gateway, removes from unassigned - removeGateway: preserves targets as unassigned on removal, no-op for empty gateways - previewRemoveGateway: shows 'will become unassigned' warning * style: fix formatting and merge duplicate imports * docs: add comment explaining unassigned targets preservation * feat: add OAuth credential support to add identity and outbound auth CLI flags (#416) * feat: add OAuth credential support to add identity and outbound auth CLI flags Extend createCredential to support OAuth credentials alongside API keys: - CreateCredentialConfig is now a discriminated union (ApiKey vs OAuth) - OAuth writes CLIENT_ID and CLIENT_SECRET to .env.local - OAuth writes OAuthCredentialProvider config to agentcore.json Add CLI flags for non-interactive workflows: - add identity: --type oauth, --discovery-url, --client-id, --client-secret, --scopes - add gateway-target: --outbound-auth, --credential-name, --oauth-client-id, --oauth-client-secret, --oauth-discovery-url, --oauth-scopes - Inline OAuth credential creation when --oauth-* fields provided without --credential-name Adds 15 new tests covering OAuth credential creation, validation, and edge cases. * fix: use || instead of ?? for empty string handling and add discoveryUrl validation * fix: sanitize hyphens in credential env var names for POSIX compliance * test: update env var expectations for hyphen-to-underscore sanitization * fix: use nullish coalescing operator in validate.ts (#429) Fix ESLint prefer-nullish-coalescing errors. * feat: add OAuth credential setup and gateway output parsing to TUI deploy flow (#411) * feat: add OAuth credential setup and gateway output parsing to TUI deploy flow * refactor: rename hasOwned* to has* identity provider helpers * fix: log gateway config errors instead of silently catching * feat: display gateway target sync status after deploy (#419) Query ListGatewayTargets after successful deployment and display sync status for each target: - READY: ✓ synced - SYNCHRONIZING: ⟳ syncing... - FAILED: ✗ failed Integrated into both CLI and TUI deploy paths. TUI uses React state for proper rendering. API errors are non-blocking — deploy succeeds regardless of status query result. * refactor: remove gateway bind flow from add gateway TUI (#431) Gateways are project-level in Phase 1 — all agents get all gateways automatically via CDK env vars. The bind-agent-to-gateway flow was pre-Phase 1 code that is no longer needed. Add gateway now goes straight to the create wizard. * fix: prettier formatting for gateway-status.ts (#449) * feat: add gateway auth and multi-gateway support to agent templates (#427) * feat: add gateway auth support to agent templates Add SigV4 authentication to MCP client templates so agents can authenticate with AWS_IAM gateways. Each framework's client.py uses Handlebars conditionals to include auth when gateways exist. SigV4HTTPXAuth class signs HTTP requests using botocore SigV4Auth, passed to the MCP client via httpx.AsyncClient. Templates read gateway URLs from AGENTCORE_GATEWAY_{NAME}_URL env vars and handle missing vars gracefully (warn, don't crash). Updated all 5 frameworks: Strands, LangChain, OpenAI Agents, Google ADK, AutoGen. Schema mapper reads mcp.json to populate gateway config for template rendering. All gateways are auto- included when creating an agent. * feat: add multi-gateway support and fix template rendering Replace single-gateway [0] indexing with {{#each gatewayProviders}} loops. Each gateway gets its own client function (Strands) or entry in the servers dict (LangChain/OpenAI/AutoGen/ADK). Add snakeCase Handlebars helper for gateway function names. Add gatewayAuthTypes array for conditional SigV4 imports. Fix @index parse error by using plain variable names. * fix: update main.py files with gateway conditional imports All 5 framework main.py files now use Handlebars conditionals to import the correct MCP client function based on hasGateway flag. Fix snakeCase helper to handle all special characters. * style: fix formatting * refactor: use mcp-proxy-for-aws for gateway auth, remove AutoGen gateway support Replace custom SigV4HTTPXAuth class with official mcp-proxy-for-aws package: - Strands: aws_iam_streamablehttp_client factory pattern - LangChain: SigV4HTTPXAuth via auth param in MultiServerMCPClient config - OpenAI Agents: SigV4HTTPXAuth via httpx_client_factory param - Google ADK: SigV4HTTPXAuth via httpx_client_factory in StreamableHTTPConnectionParams Revert AutoGen to original upstream — SDK doesn't support custom httpx auth (no httpx_client_factory param). * fix: pass AWS region to aws_iam_streamablehttp_client in Strands template * refactor: remove dead agent binding step from add gateway wizard (#456) * feat: wire existing-endpoint flow for gateway targets (#455) * feat: wire existing-endpoint flow for gateway targets * test: add routing and validation tests for existing-endpoint flow * refactor: remove source/language/host steps, existing-endpoint is the only flow * fix: CDK template types and credential ARN passthrough for gateway deploy (#432) * fix: correct CDK template type names and prop names The CDK stack template used McpSpec (doesn't exist) instead of AgentCoreMcpSpec, and passed wrong prop names to AgentCoreMcp: - spec → mcpSpec - application → agentCoreApplication - Added missing projectName prop * fix: collect API key credential ARNs and write to deployed state before CDK synth API key credential providers were created during deploy but their ARNs were not stored in deployed state, causing CDK to fail with 'Credential not found in deployed state' for gateway targets with API key auth. - Return credentialProviderArn from create/update API key providers - Unify API key and OAuth credential ARNs into single deployed state map - Move credential setup before CDK synth so template can read ARNs - Write partial deployed state with credentials before synth * fix: pass credential ARNs from deployed state to CDK gateway construct CDK template now reads deployed-state.json and extracts credential provider ARNs per target, passing them to AgentCoreMcp so gateway targets can reference outbound auth credentials. * fix: reorder TUI preflight to create credentials before CDK synth * fix: fetch OAuth credential ARN via Get after create/update * fix: handle Mcp prefix in gateway output key parsing * fix: bump CDK version to 2.239.0 in project template * fix: lint errors in deploy actions and preflight hook * feat: set gateway env vars in agentcore dev for local testing (#428) Read deployed-state.json for gateway URLs and mcp.json for auth types, then set AGENTCORE_GATEWAY_{NAME}_URL and AGENTCORE_GATEWAY_{NAME}_AUTH_TYPE env vars when running agentcore dev locally. - New gateway-env.ts helper iterates all deployment targets - Integrated in both CLI dev command and TUI dev hook - .env.local values take precedence over gateway env vars - Graceful fallback when no deployed state exists - Fixed parseGatewayOutputs to parse Id, Arn, and Url outputs separately - Added gatewayUrl field to deployed-state schema (optional, backward compat) * fix: prettier formatting for upstream files (#461) * refactor: remove dead bind flow and rename MCP Tool to Gateway Target (#459) * refactor: remove mode selection and bind flow from gateway target wizard * fix: rename 'MCP Tool' to 'Gateway Target' in UI labels, CLI output, and comments * fix: update CDK asset snapshot for cdk/bin/cdk.ts * fix: prettier formatting for AddGatewayTargetFlow.tsx * feat: add outbound auth wizard step with inline credential creation (#417) * fix: require gateway when creating a gateway target (#469) * fix: require gateway when creating a gateway target A gateway target must always be attached to a gateway. Previously it was possible to create unassigned targets via "Skip for now" in the TUI or by omitting --gateway in non-interactive mode. - Validation now requires --gateway and verifies the gateway exists - TUI removes the "Skip for now" option from gateway selection - createExternalGatewayTarget rejects missing gateway at operations layer - Updated tests to cover all new validation paths * style: fix prettier formatting * fix: correct gateway success message to reference gateway-target command (#468) * feat: add OAuth credential type to add identity TUI wizard (#464) * feat: add OAuth credential type to add identity TUI wizard * fix: add OIDC well-known suffix validation to identity TUI discovery URL * refactor: reuse identity screen for OAuth credential creation in gateway target flow * fix: correct deploy step ordering and credential count display * fix: allow identity creation without existing agents * fix: rename MCP gateway references to gateway in UI text * fix: add missing newline to identity types * feat: implement inbound auth (#467) * feat: extend JWT wizard with allowedScopes and agent OAuth credential inputs * feat: auto-create managed OAuth credential for CUSTOM_JWT gateway * feat: add CLI flags for CUSTOM_JWT agent OAuth credentials * feat: add CUSTOM_JWT Bearer token auth to agent templates (Strands, LangChain, OpenAI, Google ADK) * feat: protect managed credentials from accidental deletion * test: add tests for CUSTOM_JWT CLI validation and managed credential protection * fix: resolve httpx import collision between AWS_IAM and CUSTOM_JWT templates * fix: use placeholder instead of initialValue for gateway discovery URL * feat: wire CUSTOM_JWT inbound auth through AgentCore identity system * fix: prettier formatting and remove redundant condition * fix: sanitize OAuth error to prevent clear-text logging of sensitive data --------- Co-authored-by: Tejas Kashinath <42380254+tejaskash@users.noreply.github.com>

aidandaly24 had a problem deploying to e2e-testing February 24, 2026 21:15 — with GitHub Actions Failure

github-actions bot added size/m PR size: M and removed size/m PR size: M labels Feb 24, 2026

aidandaly24 changed the title ~~feat: add gateway auth support to agent templates~~ feat: add gateway auth and multi-gateway support to agent templates Feb 24, 2026

aidandaly24 force-pushed the feat/batch-5-agent-gateway-auth branch from 10d415a to 1c74bb4 Compare February 24, 2026 22:53

github-actions bot added size/m PR size: M and removed size/m PR size: M labels Feb 24, 2026

aidandaly24 force-pushed the feat/batch-5-agent-gateway-auth branch from 1c74bb4 to d9b90be Compare February 24, 2026 22:59

github-actions bot added size/m PR size: M and removed size/m PR size: M labels Feb 24, 2026

notgitika approved these changes Feb 24, 2026

View reviewed changes

github-actions bot added size/m PR size: M and removed size/m PR size: M labels Feb 25, 2026

aidandaly24 force-pushed the feat/batch-5-agent-gateway-auth branch from 2b7b91d to d9b90be Compare February 25, 2026 02:12

github-actions bot added size/m PR size: M and removed size/m PR size: M labels Feb 25, 2026

aidandaly24 force-pushed the feat/batch-5-agent-gateway-auth branch from 12af7bf to 1f153bc Compare February 25, 2026 05:59

github-actions bot added size/m PR size: M and removed size/m PR size: M labels Feb 25, 2026

aidandaly24 added 5 commits February 25, 2026 14:22

fix: update main.py files with gateway conditional imports

1e3f58a

All 5 framework main.py files now use Handlebars conditionals to import the correct MCP client function based on hasGateway flag. Fix snakeCase helper to handle all special characters.

style: fix formatting

9dfe27b

fix: pass AWS region to aws_iam_streamablehttp_client in Strands temp…

6a1696c

…late

aidandaly24 force-pushed the feat/batch-5-agent-gateway-auth branch from 2e2c990 to 6a1696c Compare February 25, 2026 19:23

github-actions bot added size/m PR size: M and removed size/m PR size: M labels Feb 25, 2026

aidandaly24 merged commit add47b2 into aws:feat/gateway-integration Feb 25, 2026
14 of 16 checks passed

aidandaly24 had a problem deploying to e2e-testing March 5, 2026 18:51 — with GitHub Actions Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add gateway auth and multi-gateway support to agent templates#427

feat: add gateway auth and multi-gateway support to agent templates#427
aidandaly24 merged 6 commits intoaws:feat/gateway-integrationfrom
aidandaly24:feat/batch-5-agent-gateway-auth

aidandaly24 commented Feb 24, 2026 •

edited

Loading

Uh oh!

notgitika left a comment

Uh oh!

notgitika Feb 24, 2026

Uh oh!

notgitika Feb 24, 2026

Uh oh!

notgitika Feb 24, 2026

Uh oh!

notgitika Feb 24, 2026

Uh oh!

notgitika commented Feb 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

aidandaly24 commented Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

SigV4 Authentication

Multi-Gateway Support

Template System Changes

Related Issue

Type of Change

Testing

Checklist

Uh oh!

notgitika left a comment

Choose a reason for hiding this comment

Uh oh!

notgitika Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

notgitika Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

notgitika Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

notgitika Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

notgitika commented Feb 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

aidandaly24 commented Feb 24, 2026 •

edited

Loading