待翻译：Connect an AgentCore Runtime hosted MCP server to Amazon Quick

AI 服务暂时不可用，以下为来源正文，待恢复后补全翻译。

Model Context Protocol (MCP) servers allow foundation models to access external data and tools, supporting standardized, secure access to files, databases, and APIs. They give AI agents the ability to interact with real-world applications, reduce hallucinations with accurate context, and offer stateful, multi-turn capabilities. Industry-standard architectures quickly evolved and adopted MCP to power agentic AI workflows. Amazon Quick supports MCP integrations for autonomous execution, real-time data access, and specialized AI sub-agent integrations. If you already have an MCP server, you can use this integration guide to integrate it with Amazon Quick. If you do not have an MCP server yet, you can use the AWS provided guidance for deploying MCP servers on AWS, which follows AWS Well-Architected pillars. Depending on your use case, you have several options: If you have your own REST API or one running on Amazon API Gateway, you can integrate Amazon Quick directly with your API using Amazon Bedrock AgentCore Gateway. If you prefer a serverless architecture and need only the bare minimum execution capability for your AI agent, you can author an AWS Lambda function and integrate with Amazon Quick using AgentCore Gateway. If you want a fully managed serverless MCP server solution with session isolation, extended execution time, persistent file systems, built-in authentication, observability, enhanced payload, bidirectional streaming, and evaluations, you can use AgentCore Runtime for MCP server hosting and connect with Amazon Quick using AgentCore Gateway. In this post, you will learn how to deploy and host your MCP server in AgentCore Runtime and integrate it with Amazon Quick, along with the prerequisites. With this pattern, you promote reusability and avoid duplication of AI tools, so clients can reuse commonly used tools and agents exposed through an MCP server instead of authoring them from scratch again. Your customers get a way to use your product inside Amazon Quick (chat agents and workflows) without building custom connectors for every use case. Solution overview As of this writing, you can use Amazon Quick in a web browser or the desktop app to work with a chat agent or Flows that provide AI agent capabilities. To connect the AI agent with the MCP server for access to additional tools and sub-agent capabilities, you need to integrate the MCP server with Amazon Quick. The integration is handled through connectors on the Amazon Quick end and AgentCore Gateway on the AgentCore end. AgentCore Gateway and Runtime are available in Amazon Bedrock AgentCore, a fully managed service for building generative AI applications. The authorization flow from Amazon Quick to AgentCore Gateway is referred to as Inbound Auth, and the flow from AgentCore Gateway to AgentCore Runtime is referred to as Outbound Auth. Inbound Auth handles authentication and authorizes the user to access the MCP server. For Inbound Auth, we use Amazon Cognito for authorization needs, but you can use another identity provider. Outbound Auth handles machine-to-machine authentication and authorization, and we use AgentCore Identity, a comprehensive identity and access management service purpose-built for AI agents. The MCP protocol currently requires OAuth 2.0 as the authentication protocol, so Outbound Auth uses OAuth 2.0. Prerequisites Before you begin, verify that you meet the following prerequisites to deploy the solution in your own AWS account using the step-by-step instructions in this post. An AWS account. Amazon Quick set up with an Author or higher subscription. Permission to create AWS Identity and Access Management (IAM) roles and policies, and AWS resources for AgentCore, Amazon Cognito, and Amazon CloudWatch. Basic knowledge of AWS services. For the Amazon Bedrock AgentCore setup: Access to a command-line environment with the AWS SDK and Python installed. Knowledge of the AWS CLI and Python. Amazon Bedrock with access enabled for Anthropic models. To run this tutorial: Python 3.10+. AWS credentials configured. Amazon Bedrock AgentCore SDK. MCP (Model Context Protocol) library. Running Docker daemon. Implementation steps Follow these steps to go from a locally authored MCP server to a fully integrated, authenticated tool available inside your Amazon Quick chat agent. Implement and deploy a sample remote MCP server on AgentCore Runtime. Integrate the MCP server with AgentCore Gateway with inbound and outbound auth. Register the MCP integration in Amazon Quick and integrate with your chat agent. Test the MCP server integration within Amazon Quick. Clean up resources. Step 1: Implement and deploy a remote MCP server on AgentCore Runtime In this step, we deploy a sample MCP server on AgentCore Runtime with basic dummy tools. The detailed step-by-step code is available in the AgentCore samples notebook on GitHub, and we cover it at a high level. Create the project structure and files as follows: Project structure mcp_server_project/ ├── mcp_server.py # Main MCP server code ├── requirements.txt # Dependencies └── init.py # Python package marker File: requirements.txt mcp>=1.10.0 boto3 bedrock-agentcore bedrock-agentcore-starter-toolkit>=0.1.21 strands-agents Install the requirements in your Python interpreter using the following command: uv venv sample-venv # Create Virtual Environment source sample-venv/bin/activate # Activate Virtual Environment uv pip install -r requirements.txt # Install the dependencies The following is a sample bare-minimum code. For more details on secure auth setup, see Building a secure auth code flow setup using AgentCore Gateway with MCP clients. When you configure an AgentCore Runtime with the MCP protocol, the service expects MCP server containers to be available at the path 0.0.0.0:8000/mcp, which is the default path supported by most official MCP server SDKs. File: sample_mcp_server.py from mcp.server.fastmcp import FastMCP mcp = FastMCP(host="0.0.0.0", stateless_http=True) @mcp.tool() def getOrder() -> int: """Get an order""" return 123 @mcp.tool() def updateOrder(orderId: int) -> int: """Update existing order""" return 456 if name == "main": mcp.run(transport="streamable-http") The server uses FastMCP with stateless_http=True, which is required for AgentCore Runtime compatibility. This code does the following: FastMCP: Creates an MCP server that can host your tools. @mcp.tool(): Decorator that turns your Python functions into MCP tools. stateless_http=True: Required for AgentCore Runtime compatibility. You can test your MCP server locally using a local MCP server client by following the Creating Local Testing Client and Testing Locally sections in the notebook. Now, you are ready to deploy to AgentCore Runtime. You can deploy using the Bedrock starter kit from the terminal (described in the following steps) or through a Python script, as listed in the Launching MCP Server to AgentCore Runtime section in the notebook. We use the AgentCore starter kit in this tutorial. Open your terminal with the current working directory set to your project directory, and configure your project for deployment. The configure command is interactive with self-explanatory steps. You can pick the defaults for this tutorial. # Configure your AgentCore project agentcore configure --entrypoint mcp_server.py --name simple_mcp_server The configure command performs several key setup tasks automatically. It generates a Dockerfile and .dockerignore file for containerizing your agent so that your Python application runs consistently across different environments. Most importantly, it creates a .bedrock_agentcore.yaml configuration file that stores your agent’s runtime settings and deployment parameters. The --entrypoint parameter specifies the Python file that contains your agent’s main logic. This is the file with your @app.entrypoint decorated function. The --name parameter assigns a unique identifier to your agent within your AWS account, which is used for resource naming and management across AWS services. After you configure the project, you can initiate the deployment by running the following command. agentcore launch You should be able to see the MCP server in Runtime now. Step 2: Integrate the MCP server with AgentCore Gateway with inbound and outbound auth In this step, we configure AgentCore Gateway to act as the secure bridge between Amazon Quick and your deployed MCP server. The inbound and outbound flows are set up with recommended security best practices, including end-to-end TLS that is available out of the box. You can refer to the respective service documentation for customizations. This involves setting up an IAM role for the Gateway, configuring two Amazon Cognito user pools to handle Inbound Auth (authorizing requests from Amazon Quick) and Outbound Auth (authenticating calls to the MCP server through OAuth 2.0), and creating the Gateway endpoint. For programmatic setup, follow the MCP server as a target tutorial on GitHub. Step 2a: Create an IAM role for AgentCore Gateway to assume Go to the AWS Management Console, choose IAM, and then choose Create role. Select Amazon Bedrock AgentCore as the use case. You can attach the following inline IAM policy in Permissions: { "Version": "2012-10-17", "Statement": [ { "Sid": "MCPServerRuntimePermissions", "Effect": "Allow", "Action": [ "bedrock-agentcore:InvokeAgentRuntime", "bedrock-agentcore:InvokeRegistryMcp", "secretsmanager:GetSecretValue" ], "Resource": [ "arn:aws:bedrock-agentcore:::runtime/", "arn:aws:bedrock-agentcore:::runtime//runtime-endpoint/*" } ] } Use the sample role name agentcore-sample-mcpgateway-role (or pick your own). For Resource, populate it with the runtime ARN of the MCP server deployed on AgentCore Runtime. Step 2b: Create an Amazon Cognito user pool for inbound authorization to the Gateway Navigate to Amazon Cognito and create a new user pool that serves as the Inbound authorization layer, validating requests from Amazon Quick before they reach the Gateway. Go to Amazon Cognito and choose Create user pool. Next, configure the resource server for your user pool. In the navigation pane, choose Domain under Branding, and create a new resource server to define the protected custom scope invoke that the Gateway validates during authorization. Keep a note of the following Inbound Auth details from the user pool created earlier, because these are referenced in later steps: Client ID and Client Secret: In the navigation pane, choose App Clients, and then select your app client to view the credentials. Discovery URL: https://cognito-idp.{REGION}.amazonaws.com/{gw_user_pool_id}/.well-known/openid-configuration Step 2c: Create an Amazon Cognito user pool for outbound authorization Navigate to Amazon Cognito and create a second user pool that serves as the Outbound authorization layer, so the Gateway can authenticate itself when making calls to the MCP server hosted on AgentCore Runtime. Go to Amazon Cognito and choose Create user pool. Similar to inbound authorization, create a resource server for outbound authorization and get the details for the client ID, secret, and discovery URL with the protected custom scope invoke. Keep a note of the following information available from the user pool for Outbound Auth that is needed later: Client ID and Client Secret: In the navigation pane, choose App Clients, and then select your app client to view the credentials. Discovery URL: https://cognito-idp.{REGION}.amazonaws.com/{gw_user_pool_id}/.well-known/openid-configuration Next, create an OAuth credential provider in AgentCore Identity. Navigate to Amazon Bedrock AgentCore, choose Identity, and then choose Add Outbound Auth and Create OAuth Client. Populate the form with the Discovery URL, Client ID, and Client Secret from the app client created in the Outbound Auth Amazon Cognito user pool in the previous [truncated for AI cost control]