AgentCore Gateway Enables Secure, Scalable Tool Access for 400+ Private APIs
· Engineer's Notes · Cem Koyluoglu
A managed MCP gateway allows a platform to expose 400 internal APIs as agent tools without public endpoints, using policy‑based access and semantic search.
What happened
MoEngage operated roughly 400 internal REST APIs built by 25 teams, distributed across seven AWS regions and confined to private virtual private clouds. The APIs were required as tools for AI agents but could not be exposed to the public internet. The company adopted Amazon Bedrock AgentCore Gateway to transform OpenAPI specifications into Model Context Protocol (MCP) tools, centralize policy evaluation, and route calls through managed egress over Amazon VPC Lattice. Onboarding a new API now requires adding a block to its OpenAPI spec and registering the target; the process takes hours instead of days and eliminates the need for a dedicated MCP server per team.
Why it matters in production
The solution satisfies four critical constraints. First, no public endpoint is created; the gateway is reachable only through a VPC interface endpoint with private DNS, preserving data residency and security. Second, identity is injected via headers (X‑MOE‑*) rather than tool arguments, preventing models from manipulating tenant, user, role, or database context. Third, server‑side policy evaluation using Cedar filters the tool catalog before serialization, keeping the context window small and avoiding the cost of transmitting thousands of tool definitions. Fourth, managed egress via VPC Lattice removes the operational burden of per‑service networking changes across regions, allowing new APIs to be added without additional infrastructure. The combination of these properties reduces platform engineering effort by an estimated six months, limits context‑window usage, and ensures that agents only see tools they are authorized to call.
Engineering takeaways
- Use a managed MCP gateway to generate tools directly from OpenAPI specs, eliminating custom server code and protocol expertise.
- Apply a policy engine (Cedar) to filter tools per principal before the catalog is sent, keeping context windows small and enforcing fine‑grained access.
- Route calls through managed egress (VPC Lattice) to keep internal services private and avoid per‑region networking changes.
- Inject identity via headers, not as tool parameters, to keep tenant context out of the model’s view.
- Leverage semantic search (x_amz_bedrock_agentcore_search) for tool discovery, reducing the need for a custom discovery layer and handling tool renames gracefully.
Related work on this site
- Agentic & LLM Automation — Multi-step LLM pipelines that run unattended: model cascades with fallbacks, validation gates, scheduled automation and alerting when something breaks.
- RAG & Grounded LLM Systems — LLM features that answer from the right source instead of from memory: document-grounded assistants, transcript-grounded chat and quality gates around generated output.
- YouTube AI Summarizer — Open-source Chrome extension on the Chrome Web Store: AI summaries, key points, deep analysis, a two-host AI podcast (Gemini TTS) and transcript-grounded chat for any YouTube video, using Groq or Ollama Cloud with the user’s own key.
- Automated AI News Pipeline (this site) — The pipeline behind this site’s Tech News: scheduled GitHub Actions scrape sources, an LLM cascade on Groq rewrites and enhances articles, and layered quality gates (date integrity, language checks, instruction-leak detection, duplicate detection) decide what gets published, with Telegram alerts.
This note was drafted with AI assistance from the primary source credited on this page, and automatically checked against that source before publishing.