feat: add external MCP server target support and unassigned targets by aidandaly24 · Pull Request #406 · aws/agentcore-cli

aidandaly24 · 2026-02-23T18:13:40Z

Description

Add support for connecting to existing external MCP servers via endpoint URLs, without scaffolding new code.

Source step in wizard: New "Existing endpoint" vs "Create new" selection when adding a gateway target
External endpoint flow: When "Existing endpoint" is selected, prompts for endpoint URL and skips language/host steps. Creates target in mcp.json with targetType: 'mcpServer' and endpoint field — no files scaffolded to app/mcp/
Unassigned targets: "Skip for now" option in gateway selection stores targets in unassignedTargets[] array in mcp.json for later assignment
CLI flags: --type, --source, --endpoint for non-interactive usage (e.g. agentcore add gateway-target --name my-target --source existing-endpoint --endpoint https://example.com/mcp)
Schema: Added unassignedTargets field to AgentCoreMcpSpecSchema

Related Issue

Closes #

Documentation PR

N/A

Type of Change

Testing

How have you tested the change?

I ran npm run test:unit and npm run test:integ
I ran npm run typecheck
I ran npm run lint
If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

I have read the CONTRIBUTING document
I have added any necessary tests that prove my fix is effective or my feature works
I have updated the documentation accordingly
I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
My changes generate no new warnings
Any dependent changes have been merged and published

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

notgitika · 2026-02-23T20:26:00Z

src/cli/commands/add/validate.ts

+  if (options.source === 'existing-endpoint') {
+    if (!options.endpoint) {
+      return { valid: false, error: '--endpoint is required when source is existing-endpoint' };
+    }


When source === 'existing-endpoint', this returns { valid: true } immediately but ValidatedAddGatewayTargetOptions still requires language, exposure, etc. In non-interactive mode, downstream code that reads those fields will get undefined.

We cna either return a distinct validated type for external endpoints, or populate sensible defaults for the skipped fields before returning.

notgitika · 2026-02-23T20:26:59Z

src/cli/tui/screens/mcp/AddGatewayTargetFlow.tsx

+            setFlow({ name: 'create-success', toolName: result.toolName, projectPath: result.projectPath });
+          })
+          .catch((err: Error) => {
+            setFlow({ name: 'error', message: err instanceof Error ? err.message : 'Unknown error' });


nit: The parameter is typed as Error, but .catch() receives unknown at runtime. The instanceof check is actually correct, the type annotation should be unknown to be honest about it:

.catch((err: unknown) => {

notgitika · 2026-02-23T20:27:55Z

src/cli/commands/add/command.tsx

    .description('Add a gateway target to the project')
    .option('--name <name>', 'Tool name')
    .option('--description <desc>', 'Tool description')
+    .option('--type <type>', 'Target type: mcpServer or lambda')


nit: this --type option is added but never used. validate.ts validates it, but nothing in the flow reads options.type to change behavior

notgitika · 2026-02-23T20:29:05Z

src/cli/tui/screens/mcp/AddGatewayTargetScreen.tsx

-            onSubmit={wizard.setName}
+            prompt={wizard.step === 'endpoint' ? 'MCP server endpoint URL' : MCP_TOOL_STEP_LABELS[wizard.step]}
+            initialValue={
+              wizard.step === 'endpoint' ? 'https://example.com/mcp' : generateUniqueName('mytool', existingToolNames)


this link is non-submittable right? as in, is it just a placeholder that is non-submittable? We don't want users accidentally submitting it

notgitika · 2026-02-23T20:30:06Z

src/cli/tui/screens/mcp/useAddGatewayTargetWizard.ts

+  const setGateway = useCallback(
+    (gateway: string) => {
+      setConfig(c => ({
+        ...c,
+        gateway: gateway === 'skip-for-now' ? undefined : gateway,
+      }));
+      if (config.source === 'existing-endpoint' || gateway === 'skip-for-now') {
+        setStep('confirm');
+      } else {
+        setStep('host');
+      }
+    },
+    [config.source]
+  );


nit: setGateway reads config.source from the outer closure. If source changes and setGateway fires before re-render, the condition could reference a stale value. It would be more correct to pass source as a parameter or use a ref.

notgitika · 2026-02-23T20:31:26Z

src/cli/tui/screens/mcp/AddGatewayTargetScreen.tsx

+            initialValue={
+              wizard.step === 'endpoint' ? 'https://example.com/mcp' : generateUniqueName('mytool', existingToolNames)
+            }
+            onSubmit={wizard.step === 'endpoint' ? wizard.setEndpoint : wizard.setName}


Missing endpoint validation in the TUI path which means users can submit any string. the CLI path validates the URL in validate.ts, but the interactive wizard does not. we can add a customValidation that mirrors the new URL() + protocol check.

notgitika · 2026-02-23T20:32:10Z

src/cli/tui/screens/mcp/useAddGatewayTargetWizard.ts

+        ...c,
+        gateway: gateway === 'skip-for-now' ? undefined : gateway,
+      }));
+      if (config.source === 'existing-endpoint' || gateway === 'skip-for-now') {


can we make skip-for-now a constant? seems like it appears in a bunch of places

notgitika

LGTM thank you for addressing the comments!!

…406)

* feat: mcp gateway schema types (auth, outbound auth, OAuth credentials) (#375) * ci: add feat/gateway-integration branch to workflow triggers (#376) * feat: mcp gateway schema types (auth, outbound auth, OAuth credentials) * fix: address CR feedback — scopes optional, specific validation errors * refactor: rename mcp-tool to gateway-target across CLI (#377) * feat: enable gateway commands, UI updates, deploy pipeline, credential validation (#382) * feat: add external MCP server target support and unassigned targets (#406) * feat: add OAuth credential provider creation during deploy (#407) * feat: add OAuth credential provider creation during deploy * fix: address review comments — add clarifying comments for vendor config, race condition, and ARN inconsistency * fix: use typed SDK responses instead of Record<string, unknown> casts * fix: on conflict, update OAuth provider instead of GET to avoid silently ignoring new credentials * refactor: remove exposure/mcp-runtime mode from gateway-target command (#414) * refactor: remove exposure/mcp-runtime mode from gateway-target command All gateway targets are now behind-gateway only. The mcp-runtime exposure mode was disabled and never used by customers. - Remove ExposureMode type, EXPOSURE_MODE_OPTIONS, --exposure and --agents CLI flags - Simplify wizard flow: name → source → language → gateway → host → confirm - Remove mcp-runtime code paths from create-mcp, remove-gateway-target, McpGuidedEditor - Remove existingAgents prop chain (only used for mcp-runtime agent selection) - Clean up unused imports (ViewMode, AgentCoreMcpRuntimeTool, WizardMultiSelect) * test: update tests for exposure removal - Remove mcp-runtime validation tests and fixtures - Remove mcp-runtime integration tests (add and remove) - Simplify gateway target test fixtures to behind-gateway only * style: fix formatting * test: add unit tests for Batches 1-3 gateway functionality (#415) Comprehensive test coverage for MCP Gateway Phase 1 Batches 1-3: - Schema validation: gateway targets, outbound auth, credentials, deployed state - OAuth credential provider: CRUD operations, conflict handling, error paths - Pre-deploy identity: OAuth setup, credential collection, env var mapping - CLI validation: existing-endpoint path, credential validation - Deploy outputs: buildDeployedState with credentials, parseGatewayOutputs - External target creation: assignment, unassigned, duplicates, outboundAuth - Gateway target removal: listing, preview, removal operations - Preflight: gateway-only deploy validation - Credential references: cross-gateway warning on removal - Add command actions: buildGatewayTargetConfig mapping - UI: AddScreen/RemoveScreen enablement, ResourceGraph unassigned targets - Types: constants validation (AUTHORIZER_TYPE_OPTIONS, SKIP_FOR_NOW, SOURCE_OPTIONS) Adds 86 new test cases across 17 files. * feat: assign unassigned targets to gateways and preserve targets on removal (#410) * feat: assign unassigned targets to gateways and preserve targets on removal * test: add unit tests for unassigned target assignment and gateway removal - getUnassignedTargets: returns targets, empty when no config, empty when field missing - createGatewayFromWizard: moves selected targets to new gateway, removes from unassigned - removeGateway: preserves targets as unassigned on removal, no-op for empty gateways - previewRemoveGateway: shows 'will become unassigned' warning * style: fix formatting and merge duplicate imports * docs: add comment explaining unassigned targets preservation * feat: add OAuth credential support to add identity and outbound auth CLI flags (#416) * feat: add OAuth credential support to add identity and outbound auth CLI flags Extend createCredential to support OAuth credentials alongside API keys: - CreateCredentialConfig is now a discriminated union (ApiKey vs OAuth) - OAuth writes CLIENT_ID and CLIENT_SECRET to .env.local - OAuth writes OAuthCredentialProvider config to agentcore.json Add CLI flags for non-interactive workflows: - add identity: --type oauth, --discovery-url, --client-id, --client-secret, --scopes - add gateway-target: --outbound-auth, --credential-name, --oauth-client-id, --oauth-client-secret, --oauth-discovery-url, --oauth-scopes - Inline OAuth credential creation when --oauth-* fields provided without --credential-name Adds 15 new tests covering OAuth credential creation, validation, and edge cases. * fix: use || instead of ?? for empty string handling and add discoveryUrl validation * fix: sanitize hyphens in credential env var names for POSIX compliance * test: update env var expectations for hyphen-to-underscore sanitization * fix: use nullish coalescing operator in validate.ts (#429) Fix ESLint prefer-nullish-coalescing errors. * feat: add OAuth credential setup and gateway output parsing to TUI deploy flow (#411) * feat: add OAuth credential setup and gateway output parsing to TUI deploy flow * refactor: rename hasOwned* to has* identity provider helpers * fix: log gateway config errors instead of silently catching * feat: display gateway target sync status after deploy (#419) Query ListGatewayTargets after successful deployment and display sync status for each target: - READY: ✓ synced - SYNCHRONIZING: ⟳ syncing... - FAILED: ✗ failed Integrated into both CLI and TUI deploy paths. TUI uses React state for proper rendering. API errors are non-blocking — deploy succeeds regardless of status query result. * refactor: remove gateway bind flow from add gateway TUI (#431) Gateways are project-level in Phase 1 — all agents get all gateways automatically via CDK env vars. The bind-agent-to-gateway flow was pre-Phase 1 code that is no longer needed. Add gateway now goes straight to the create wizard. * fix: prettier formatting for gateway-status.ts (#449) * feat: add gateway auth and multi-gateway support to agent templates (#427) * feat: add gateway auth support to agent templates Add SigV4 authentication to MCP client templates so agents can authenticate with AWS_IAM gateways. Each framework's client.py uses Handlebars conditionals to include auth when gateways exist. SigV4HTTPXAuth class signs HTTP requests using botocore SigV4Auth, passed to the MCP client via httpx.AsyncClient. Templates read gateway URLs from AGENTCORE_GATEWAY_{NAME}_URL env vars and handle missing vars gracefully (warn, don't crash). Updated all 5 frameworks: Strands, LangChain, OpenAI Agents, Google ADK, AutoGen. Schema mapper reads mcp.json to populate gateway config for template rendering. All gateways are auto- included when creating an agent. * feat: add multi-gateway support and fix template rendering Replace single-gateway [0] indexing with {{#each gatewayProviders}} loops. Each gateway gets its own client function (Strands) or entry in the servers dict (LangChain/OpenAI/AutoGen/ADK). Add snakeCase Handlebars helper for gateway function names. Add gatewayAuthTypes array for conditional SigV4 imports. Fix @index parse error by using plain variable names. * fix: update main.py files with gateway conditional imports All 5 framework main.py files now use Handlebars conditionals to import the correct MCP client function based on hasGateway flag. Fix snakeCase helper to handle all special characters. * style: fix formatting * refactor: use mcp-proxy-for-aws for gateway auth, remove AutoGen gateway support Replace custom SigV4HTTPXAuth class with official mcp-proxy-for-aws package: - Strands: aws_iam_streamablehttp_client factory pattern - LangChain: SigV4HTTPXAuth via auth param in MultiServerMCPClient config - OpenAI Agents: SigV4HTTPXAuth via httpx_client_factory param - Google ADK: SigV4HTTPXAuth via httpx_client_factory in StreamableHTTPConnectionParams Revert AutoGen to original upstream — SDK doesn't support custom httpx auth (no httpx_client_factory param). * fix: pass AWS region to aws_iam_streamablehttp_client in Strands template * refactor: remove dead agent binding step from add gateway wizard (#456) * feat: wire existing-endpoint flow for gateway targets (#455) * feat: wire existing-endpoint flow for gateway targets * test: add routing and validation tests for existing-endpoint flow * refactor: remove source/language/host steps, existing-endpoint is the only flow * fix: CDK template types and credential ARN passthrough for gateway deploy (#432) * fix: correct CDK template type names and prop names The CDK stack template used McpSpec (doesn't exist) instead of AgentCoreMcpSpec, and passed wrong prop names to AgentCoreMcp: - spec → mcpSpec - application → agentCoreApplication - Added missing projectName prop * fix: collect API key credential ARNs and write to deployed state before CDK synth API key credential providers were created during deploy but their ARNs were not stored in deployed state, causing CDK to fail with 'Credential not found in deployed state' for gateway targets with API key auth. - Return credentialProviderArn from create/update API key providers - Unify API key and OAuth credential ARNs into single deployed state map - Move credential setup before CDK synth so template can read ARNs - Write partial deployed state with credentials before synth * fix: pass credential ARNs from deployed state to CDK gateway construct CDK template now reads deployed-state.json and extracts credential provider ARNs per target, passing them to AgentCoreMcp so gateway targets can reference outbound auth credentials. * fix: reorder TUI preflight to create credentials before CDK synth * fix: fetch OAuth credential ARN via Get after create/update * fix: handle Mcp prefix in gateway output key parsing * fix: bump CDK version to 2.239.0 in project template * fix: lint errors in deploy actions and preflight hook * feat: set gateway env vars in agentcore dev for local testing (#428) Read deployed-state.json for gateway URLs and mcp.json for auth types, then set AGENTCORE_GATEWAY_{NAME}_URL and AGENTCORE_GATEWAY_{NAME}_AUTH_TYPE env vars when running agentcore dev locally. - New gateway-env.ts helper iterates all deployment targets - Integrated in both CLI dev command and TUI dev hook - .env.local values take precedence over gateway env vars - Graceful fallback when no deployed state exists - Fixed parseGatewayOutputs to parse Id, Arn, and Url outputs separately - Added gatewayUrl field to deployed-state schema (optional, backward compat) * fix: prettier formatting for upstream files (#461) * refactor: remove dead bind flow and rename MCP Tool to Gateway Target (#459) * refactor: remove mode selection and bind flow from gateway target wizard * fix: rename 'MCP Tool' to 'Gateway Target' in UI labels, CLI output, and comments * fix: update CDK asset snapshot for cdk/bin/cdk.ts * fix: prettier formatting for AddGatewayTargetFlow.tsx * feat: add outbound auth wizard step with inline credential creation (#417) * fix: require gateway when creating a gateway target (#469) * fix: require gateway when creating a gateway target A gateway target must always be attached to a gateway. Previously it was possible to create unassigned targets via "Skip for now" in the TUI or by omitting --gateway in non-interactive mode. - Validation now requires --gateway and verifies the gateway exists - TUI removes the "Skip for now" option from gateway selection - createExternalGatewayTarget rejects missing gateway at operations layer - Updated tests to cover all new validation paths * style: fix prettier formatting * fix: correct gateway success message to reference gateway-target command (#468) * feat: add OAuth credential type to add identity TUI wizard (#464) * feat: add OAuth credential type to add identity TUI wizard * fix: add OIDC well-known suffix validation to identity TUI discovery URL * refactor: reuse identity screen for OAuth credential creation in gateway target flow * fix: correct deploy step ordering and credential count display * fix: allow identity creation without existing agents * fix: rename MCP gateway references to gateway in UI text * fix: add missing newline to identity types * feat: implement inbound auth (#467) * feat: extend JWT wizard with allowedScopes and agent OAuth credential inputs * feat: auto-create managed OAuth credential for CUSTOM_JWT gateway * feat: add CLI flags for CUSTOM_JWT agent OAuth credentials * feat: add CUSTOM_JWT Bearer token auth to agent templates (Strands, LangChain, OpenAI, Google ADK) * feat: protect managed credentials from accidental deletion * test: add tests for CUSTOM_JWT CLI validation and managed credential protection * fix: resolve httpx import collision between AWS_IAM and CUSTOM_JWT templates * fix: use placeholder instead of initialValue for gateway discovery URL * feat: wire CUSTOM_JWT inbound auth through AgentCore identity system * fix: prettier formatting and remove redundant condition * fix: sanitize OAuth error to prevent clear-text logging of sensitive data --------- Co-authored-by: Tejas Kashinath <42380254+tejaskash@users.noreply.github.com>

aidandaly24 had a problem deploying to e2e-testing February 23, 2026 18:13 — with GitHub Actions Failure

github-actions bot added the size/m PR size: M label Feb 23, 2026

notgitika requested changes Feb 23, 2026

View reviewed changes

feat: add external MCP server target support and unassigned targets

adc89a7

aidandaly24 force-pushed the feat/batch-3-target-credential-infra branch from 37252b3 to adc89a7 Compare February 23, 2026 20:57

github-actions bot added size/m PR size: M and removed size/m PR size: M labels Feb 23, 2026

notgitika self-requested a review February 23, 2026 21:05

notgitika approved these changes Feb 23, 2026

View reviewed changes

aidandaly24 merged commit 0e96f8e into aws:feat/gateway-integration Feb 23, 2026
15 of 16 checks passed

aidandaly24 mentioned this pull request Feb 24, 2026

feat: assign unassigned targets to gateways and preserve targets on removal #410

Merged

11 tasks

aidandaly24 added a commit that referenced this pull request Mar 2, 2026

feat: add external MCP server target support and unassigned targets (#…

da7da9d

…406)

aidandaly24 had a problem deploying to e2e-testing March 5, 2026 18:51 — with GitHub Actions Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add external MCP server target support and unassigned targets#406

feat: add external MCP server target support and unassigned targets#406
aidandaly24 merged 1 commit intoaws:feat/gateway-integrationfrom
aidandaly24:feat/batch-3-target-credential-infra

aidandaly24 commented Feb 23, 2026

Uh oh!

notgitika Feb 23, 2026

Uh oh!

notgitika Feb 23, 2026

Uh oh!

notgitika Feb 23, 2026

Uh oh!

notgitika Feb 23, 2026

Uh oh!

notgitika Feb 23, 2026

Uh oh!

notgitika Feb 23, 2026

Uh oh!

notgitika Feb 23, 2026

Uh oh!

notgitika left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

aidandaly24 commented Feb 23, 2026

Description

Related Issue

Documentation PR

Type of Change

Testing

Checklist

Uh oh!

notgitika Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

notgitika Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

notgitika Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

notgitika Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

notgitika Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

notgitika Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

notgitika Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

notgitika left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants