Bedrock AgentCore

A remote MCP target behind an AgentCore Gateway.

Setup

1. Create an AgentCore Gateway, or use an existing one.
2. Add the endpoint as an MCP target.
3. Store the API key in Secrets Manager and give the gateway an outbound credential that reads it.
4. Point your agent at the gateway rather than at this endpoint directly.

# The gateway holds the credential; the agent never sees it.
Target type:  MCP
Endpoint:     https://api.unzoi.com/mcp
Auth:         API key header, x-api-key
Secret:       arn:aws:secretsmanager:REGION:ACCOUNT:secret:unzoi-api-key

What differs here

• The reason to front this with a gateway rather than calling it directly is credential handling: the key lives in Secrets Manager and never reaches the agent’s context or its logs.
• The gateway is also where to put an outbound rate limit, so a runaway agent hits a limit you control before it hits the one you are billed for.
• One key per gateway keeps usage attributable. The console reports usage per tenant, so several agents sharing one key are indistinguishable in it.

Next

• Get a key at console.unzoi.com, if you have not.
• The tool reference — what the model is reading when it chooses between the six tools.
• Stories for context windows — the one habit that most changes how well an agent works against this API.
• Limits — an agent that loops can spend a monthly quota faster than you expect.
• Bedrock AgentCore's own MCP documentation — authoritative for anything about the client itself, including config paths, which move.

Endpoint, for copying: https://api.unzoi.com/mcp