feat: add outbound auth wizard step with inline credential creation#417
Merged
notgitika merged 1 commit intoaws:feat/gateway-integrationfrom Feb 26, 2026
Conversation
aidandaly24
had a problem deploying
to
e2e-testing
GitHub Actions
Failure
aidandaly24
force-pushed
the
feat/batch-4-outbound-auth-wizard
branch
from
37b14c8 to
66a33cc
Compare
aidandaly24
force-pushed
the
feat/batch-4-outbound-auth-wizard
branch
from
66a33cc to
a8682f4
Compare
github-actions
bot
added
size/m
aidandaly24
force-pushed
the
feat/batch-4-outbound-auth-wizard
branch
from
6c91b7c to
a8682f4
Compare
aidandaly24
force-pushed
the
feat/batch-4-outbound-auth-wizard
branch
from
a8682f4 to
606661b
Compare
notgitika
requested changes
Feb 24, 2026
aidandaly24
force-pushed
the
feat/batch-4-outbound-auth-wizard
branch
from
606661b to
630afdc
Compare
aidandaly24
force-pushed
the
feat/batch-4-outbound-auth-wizard
branch
from
9108f0e to
975a54c
Compare
aidandaly24
force-pushed
the
feat/batch-4-outbound-auth-wizard
branch
from
b0f864e to
6c1f6da
Compare
aidandaly24
changed the title
aidandaly24
force-pushed
the
feat/batch-4-outbound-auth-wizard
branch
from
b0f1e33 to
7efb623
Compare
Contributor
|
LGTM |
notgitika
merged commit 5d9d710
into
aws:feat/gateway-integration
13 of 15 checks passed
15 tasks
aidandaly24
added a commit
that referenced
this pull request
Mar 2, 2026
aidandaly24
added a commit
that referenced
this pull request
Mar 2, 2026
* feat: mcp gateway schema types (auth, outbound auth, OAuth credentials) (#375) * ci: add feat/gateway-integration branch to workflow triggers (#376) * feat: mcp gateway schema types (auth, outbound auth, OAuth credentials) * fix: address CR feedback — scopes optional, specific validation errors * refactor: rename mcp-tool to gateway-target across CLI (#377) * feat: enable gateway commands, UI updates, deploy pipeline, credential validation (#382) * feat: add external MCP server target support and unassigned targets (#406) * feat: add OAuth credential provider creation during deploy (#407) * feat: add OAuth credential provider creation during deploy * fix: address review comments — add clarifying comments for vendor config, race condition, and ARN inconsistency * fix: use typed SDK responses instead of Record<string, unknown> casts * fix: on conflict, update OAuth provider instead of GET to avoid silently ignoring new credentials * refactor: remove exposure/mcp-runtime mode from gateway-target command (#414) * refactor: remove exposure/mcp-runtime mode from gateway-target command All gateway targets are now behind-gateway only. The mcp-runtime exposure mode was disabled and never used by customers. - Remove ExposureMode type, EXPOSURE_MODE_OPTIONS, --exposure and --agents CLI flags - Simplify wizard flow: name → source → language → gateway → host → confirm - Remove mcp-runtime code paths from create-mcp, remove-gateway-target, McpGuidedEditor - Remove existingAgents prop chain (only used for mcp-runtime agent selection) - Clean up unused imports (ViewMode, AgentCoreMcpRuntimeTool, WizardMultiSelect) * test: update tests for exposure removal - Remove mcp-runtime validation tests and fixtures - Remove mcp-runtime integration tests (add and remove) - Simplify gateway target test fixtures to behind-gateway only * style: fix formatting * test: add unit tests for Batches 1-3 gateway functionality (#415) Comprehensive test coverage for MCP Gateway Phase 1 Batches 1-3: - Schema validation: gateway targets, outbound auth, credentials, deployed state - OAuth credential provider: CRUD operations, conflict handling, error paths - Pre-deploy identity: OAuth setup, credential collection, env var mapping - CLI validation: existing-endpoint path, credential validation - Deploy outputs: buildDeployedState with credentials, parseGatewayOutputs - External target creation: assignment, unassigned, duplicates, outboundAuth - Gateway target removal: listing, preview, removal operations - Preflight: gateway-only deploy validation - Credential references: cross-gateway warning on removal - Add command actions: buildGatewayTargetConfig mapping - UI: AddScreen/RemoveScreen enablement, ResourceGraph unassigned targets - Types: constants validation (AUTHORIZER_TYPE_OPTIONS, SKIP_FOR_NOW, SOURCE_OPTIONS) Adds 86 new test cases across 17 files. * feat: assign unassigned targets to gateways and preserve targets on removal (#410) * feat: assign unassigned targets to gateways and preserve targets on removal * test: add unit tests for unassigned target assignment and gateway removal - getUnassignedTargets: returns targets, empty when no config, empty when field missing - createGatewayFromWizard: moves selected targets to new gateway, removes from unassigned - removeGateway: preserves targets as unassigned on removal, no-op for empty gateways - previewRemoveGateway: shows 'will become unassigned' warning * style: fix formatting and merge duplicate imports * docs: add comment explaining unassigned targets preservation * feat: add OAuth credential support to add identity and outbound auth CLI flags (#416) * feat: add OAuth credential support to add identity and outbound auth CLI flags Extend createCredential to support OAuth credentials alongside API keys: - CreateCredentialConfig is now a discriminated union (ApiKey vs OAuth) - OAuth writes CLIENT_ID and CLIENT_SECRET to .env.local - OAuth writes OAuthCredentialProvider config to agentcore.json Add CLI flags for non-interactive workflows: - add identity: --type oauth, --discovery-url, --client-id, --client-secret, --scopes - add gateway-target: --outbound-auth, --credential-name, --oauth-client-id, --oauth-client-secret, --oauth-discovery-url, --oauth-scopes - Inline OAuth credential creation when --oauth-* fields provided without --credential-name Adds 15 new tests covering OAuth credential creation, validation, and edge cases. * fix: use || instead of ?? for empty string handling and add discoveryUrl validation * fix: sanitize hyphens in credential env var names for POSIX compliance * test: update env var expectations for hyphen-to-underscore sanitization * fix: use nullish coalescing operator in validate.ts (#429) Fix ESLint prefer-nullish-coalescing errors. * feat: add OAuth credential setup and gateway output parsing to TUI deploy flow (#411) * feat: add OAuth credential setup and gateway output parsing to TUI deploy flow * refactor: rename hasOwned* to has* identity provider helpers * fix: log gateway config errors instead of silently catching * feat: display gateway target sync status after deploy (#419) Query ListGatewayTargets after successful deployment and display sync status for each target: - READY: ✓ synced - SYNCHRONIZING: ⟳ syncing... - FAILED: ✗ failed Integrated into both CLI and TUI deploy paths. TUI uses React state for proper rendering. API errors are non-blocking — deploy succeeds regardless of status query result. * refactor: remove gateway bind flow from add gateway TUI (#431) Gateways are project-level in Phase 1 — all agents get all gateways automatically via CDK env vars. The bind-agent-to-gateway flow was pre-Phase 1 code that is no longer needed. Add gateway now goes straight to the create wizard. * fix: prettier formatting for gateway-status.ts (#449) * feat: add gateway auth and multi-gateway support to agent templates (#427) * feat: add gateway auth support to agent templates Add SigV4 authentication to MCP client templates so agents can authenticate with AWS_IAM gateways. Each framework's client.py uses Handlebars conditionals to include auth when gateways exist. SigV4HTTPXAuth class signs HTTP requests using botocore SigV4Auth, passed to the MCP client via httpx.AsyncClient. Templates read gateway URLs from AGENTCORE_GATEWAY_{NAME}_URL env vars and handle missing vars gracefully (warn, don't crash). Updated all 5 frameworks: Strands, LangChain, OpenAI Agents, Google ADK, AutoGen. Schema mapper reads mcp.json to populate gateway config for template rendering. All gateways are auto- included when creating an agent. * feat: add multi-gateway support and fix template rendering Replace single-gateway [0] indexing with {{#each gatewayProviders}} loops. Each gateway gets its own client function (Strands) or entry in the servers dict (LangChain/OpenAI/AutoGen/ADK). Add snakeCase Handlebars helper for gateway function names. Add gatewayAuthTypes array for conditional SigV4 imports. Fix @index parse error by using plain variable names. * fix: update main.py files with gateway conditional imports All 5 framework main.py files now use Handlebars conditionals to import the correct MCP client function based on hasGateway flag. Fix snakeCase helper to handle all special characters. * style: fix formatting * refactor: use mcp-proxy-for-aws for gateway auth, remove AutoGen gateway support Replace custom SigV4HTTPXAuth class with official mcp-proxy-for-aws package: - Strands: aws_iam_streamablehttp_client factory pattern - LangChain: SigV4HTTPXAuth via auth param in MultiServerMCPClient config - OpenAI Agents: SigV4HTTPXAuth via httpx_client_factory param - Google ADK: SigV4HTTPXAuth via httpx_client_factory in StreamableHTTPConnectionParams Revert AutoGen to original upstream — SDK doesn't support custom httpx auth (no httpx_client_factory param). * fix: pass AWS region to aws_iam_streamablehttp_client in Strands template * refactor: remove dead agent binding step from add gateway wizard (#456) * feat: wire existing-endpoint flow for gateway targets (#455) * feat: wire existing-endpoint flow for gateway targets * test: add routing and validation tests for existing-endpoint flow * refactor: remove source/language/host steps, existing-endpoint is the only flow * fix: CDK template types and credential ARN passthrough for gateway deploy (#432) * fix: correct CDK template type names and prop names The CDK stack template used McpSpec (doesn't exist) instead of AgentCoreMcpSpec, and passed wrong prop names to AgentCoreMcp: - spec → mcpSpec - application → agentCoreApplication - Added missing projectName prop * fix: collect API key credential ARNs and write to deployed state before CDK synth API key credential providers were created during deploy but their ARNs were not stored in deployed state, causing CDK to fail with 'Credential not found in deployed state' for gateway targets with API key auth. - Return credentialProviderArn from create/update API key providers - Unify API key and OAuth credential ARNs into single deployed state map - Move credential setup before CDK synth so template can read ARNs - Write partial deployed state with credentials before synth * fix: pass credential ARNs from deployed state to CDK gateway construct CDK template now reads deployed-state.json and extracts credential provider ARNs per target, passing them to AgentCoreMcp so gateway targets can reference outbound auth credentials. * fix: reorder TUI preflight to create credentials before CDK synth * fix: fetch OAuth credential ARN via Get after create/update * fix: handle Mcp prefix in gateway output key parsing * fix: bump CDK version to 2.239.0 in project template * fix: lint errors in deploy actions and preflight hook * feat: set gateway env vars in agentcore dev for local testing (#428) Read deployed-state.json for gateway URLs and mcp.json for auth types, then set AGENTCORE_GATEWAY_{NAME}_URL and AGENTCORE_GATEWAY_{NAME}_AUTH_TYPE env vars when running agentcore dev locally. - New gateway-env.ts helper iterates all deployment targets - Integrated in both CLI dev command and TUI dev hook - .env.local values take precedence over gateway env vars - Graceful fallback when no deployed state exists - Fixed parseGatewayOutputs to parse Id, Arn, and Url outputs separately - Added gatewayUrl field to deployed-state schema (optional, backward compat) * fix: prettier formatting for upstream files (#461) * refactor: remove dead bind flow and rename MCP Tool to Gateway Target (#459) * refactor: remove mode selection and bind flow from gateway target wizard * fix: rename 'MCP Tool' to 'Gateway Target' in UI labels, CLI output, and comments * fix: update CDK asset snapshot for cdk/bin/cdk.ts * fix: prettier formatting for AddGatewayTargetFlow.tsx * feat: add outbound auth wizard step with inline credential creation (#417) * fix: require gateway when creating a gateway target (#469) * fix: require gateway when creating a gateway target A gateway target must always be attached to a gateway. Previously it was possible to create unassigned targets via "Skip for now" in the TUI or by omitting --gateway in non-interactive mode. - Validation now requires --gateway and verifies the gateway exists - TUI removes the "Skip for now" option from gateway selection - createExternalGatewayTarget rejects missing gateway at operations layer - Updated tests to cover all new validation paths * style: fix prettier formatting * fix: correct gateway success message to reference gateway-target command (#468) * feat: add OAuth credential type to add identity TUI wizard (#464) * feat: add OAuth credential type to add identity TUI wizard * fix: add OIDC well-known suffix validation to identity TUI discovery URL * refactor: reuse identity screen for OAuth credential creation in gateway target flow * fix: correct deploy step ordering and credential count display * fix: allow identity creation without existing agents * fix: rename MCP gateway references to gateway in UI text * fix: add missing newline to identity types * feat: implement inbound auth (#467) * feat: extend JWT wizard with allowedScopes and agent OAuth credential inputs * feat: auto-create managed OAuth credential for CUSTOM_JWT gateway * feat: add CLI flags for CUSTOM_JWT agent OAuth credentials * feat: add CUSTOM_JWT Bearer token auth to agent templates (Strands, LangChain, OpenAI, Google ADK) * feat: protect managed credentials from accidental deletion * test: add tests for CUSTOM_JWT CLI validation and managed credential protection * fix: resolve httpx import collision between AWS_IAM and CUSTOM_JWT templates * fix: use placeholder instead of initialValue for gateway discovery URL * feat: wire CUSTOM_JWT inbound auth through AgentCore identity system * fix: prettier formatting and remove redundant condition * fix: sanitize OAuth error to prevent clear-text logging of sensitive data --------- Co-authored-by: Tejas Kashinath <42380254+tejaskash@users.noreply.github.com>
aidandaly24
had a problem deploying
to
e2e-testing
GitHub Actions
Failure
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
When creating a gateway target through the TUI wizard, users previously had no way to configure outbound authentication. They'd have to manually edit mcp.json to add auth config after the
fact.
This PR adds an outbound auth step to the wizard flow. After selecting a gateway, users now see:
If "No authorization" is selected, the wizard skips straight to confirm. If credential creation fails (e.g. duplicate name), the sub-flow resets so the user can try again.
The confirm screen now shows the auth type and credential name in the review.
Note: API Key was removed from the outbound auth options as MCP server targets only support OAuth and NoAuth per the service documentation.
New wizard flows:
This is the TUI layer on top of the operations added in the previous PR (Task 12a), which added createCredential OAuth support and CLI flags.
Related Issue
Part of the MCP Gateway Phase 1 integration (gateway-integration branch). Task 12b.
Type of Change
Testing
How have you tested the change?
No new tests — this is TUI wiring over the operations layer tested in Task 12a. The credential creation, validation, and config writing are all covered by existing tests.
Checklist