Kiro 使用 AgentCore Web Search Tool 替代 EXA Search 的配置 - AgentCore Gateway 配置 CUSTOM_JWT 认证

REGION="us-east-1"
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
ROLE_NAME="AgentCoreWebSearchKiroGatewayRole"
GATEWAY_NAME="websearch-kiro-jwt-gateway"
USER_POOL_NAME="websearch-kiro-pool"
COGNITO_DOMAIN_PREFIX="websearch-kiro-${ACCOUNT_ID}"

USER_POOL_ID=$(aws cognito-idp create-user-pool \
  --pool-name "$USER_POOL_NAME" \
  --region "$REGION" \
  --query 'UserPool.Id' --output text)
echo "USER_POOL_ID=$USER_POOL_ID"

USER_POOL_ID=us-east-1_o2qx89QGH

aws cognito-idp create-user-pool-domain \
  --domain "$COGNITO_DOMAIN_PREFIX" \
  --user-pool-id "$USER_POOL_ID" \
  --managed-login-version 1 \
  --region "$REGION"

{
    "ManagedLoginVersion": 1
}

echo https://${COGNITO_DOMAIN_PREFIX}.auth.${REGION}.amazoncognito.com

CLIENT_ID=$(aws cognito-idp create-user-pool-client \
  --user-pool-id "$USER_POOL_ID" \
  --client-name "kiro-websearch-authcode-client" \
  --no-generate-secret \
  --allowed-o-auth-flows code \
  --allowed-o-auth-scopes openid \
  --allowed-o-auth-flows-user-pool-client \
  --callback-urls "http://localhost:38123/oauth/callback" "http://localhost:38123/callback" "http://localhost:38123" \
  --supported-identity-providers COGNITO \
  --prevent-user-existence-errors ENABLED \
  --region "$REGION" \
  --query 'UserPoolClient.ClientId' --output text)
echo "CLIENT_ID=$CLIENT_ID"

CLIENT_ID=xxxxxxxxxxxxxxxxxx

TEST_USERNAME="user01"
TEST_PASSWORD="<自定义一个满足密码策略的强密码>"

aws cognito-idp admin-create-user \
  --user-pool-id "$USER_POOL_ID" \
  --username "$TEST_USERNAME" \
  --user-attributes Name=email,Value="kiro-tester@example.com" Name=email_verified,Value=true \
  --message-action SUPPRESS \
  --region "$REGION"

aws cognito-idp admin-set-user-password \
  --user-pool-id "$USER_POOL_ID" \
  --username "$TEST_USERNAME" \
  --password "$TEST_PASSWORD" \
  --permanent \
  --region "$REGION"

aws iam create-role \
  --role-name "$ROLE_NAME" \
  --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"bedrock-agentcore.amazonaws.com"},"Action":"sts:AssumeRole"}]}' \
  --description "AgentCore Web Search demo gateway service role (for Kiro JWT auth)"

aws iam put-role-policy \
  --role-name "$ROLE_NAME" \
  --policy-name "WebSearchInvokePolicy" \
  --policy-document "{
    \"Version\": \"2012-10-17\",
    \"Statement\": [
      {
        \"Sid\": \"InvokeWebSearch\",
        \"Effect\": \"Allow\",
        \"Action\": \"bedrock-agentcore:InvokeWebSearch\",
        \"Resource\": \"arn:aws:bedrock-agentcore:${REGION}:aws:tool/web-search.v1\"
      }
    ]
  }"

ROLE_ARN=$(aws iam get-role --role-name "$ROLE_NAME" --query Role.Arn --output text)
DISCOVERY_URL="https://cognito-idp.${REGION}.amazonaws.com/${USER_POOL_ID}/.well-known/openid-configuration"

aws bedrock-agentcore-control create-gateway \
  --name "$GATEWAY_NAME" \
  --role-arn "$ROLE_ARN" \
  --protocol-type MCP \
  --authorizer-type CUSTOM_JWT \
  --authorizer-configuration "{
    \"customJWTAuthorizer\": {
      \"discoveryUrl\": \"${DISCOVERY_URL}\",
      \"allowedClients\": [\"${CLIENT_ID}\"],
      \"allowedScopes\": [\"openid\"]
    }
  }" \
  --description "Web Search demo gateway for Kiro integration (CUSTOM_JWT inbound auth)" \
  --region "$REGION"

GATEWAY_ID=$(aws bedrock-agentcore-control list-gateways \
  --region "$REGION" \
  --query "items[?name=='${GATEWAY_NAME}'].gatewayId | [0]" \
  --output text)

aws bedrock-agentcore-control get-gateway \
  --gateway-identifier "$GATEWAY_ID" \
  --region "$REGION" \
  --query '{status:status, gatewayUrl:gatewayUrl}'

{
    "status": "READY",
    "gatewayUrl": "https://websearch-kiro-jwt-gateway-aechsb1ccn.gateway.bedrock-agentcore.us-east-1.amazonaws.com/mcp"
}

aws bedrock-agentcore-control create-gateway-target \
  --gateway-identifier "$GATEWAY_ID" \
  --name "web-search" \
  --target-configuration '{"mcp":{"connector":{"source":{"connectorId":"web-search"},"configurations":[{"name":"WebSearch","description":"在互联网上检索当前的公开网页信息，返回标题、URL、发布日期与摘要片段，适用于回答实时事件、最新版本号、价格等训练数据之外的问题。","parameterValues":{}}]}}}' \
  --credential-provider-configurations '[{"credentialProviderType":"GATEWAY_IAM_ROLE"}]' \
  --region "$REGION" \
  --query targetId --output text

VP1YHEVFU5

aws bedrock-agentcore-control list-gateway-targets \
  --gateway-identifier "$GATEWAY_ID" \
  --region "$REGION" \
  --query "items[?name=='web-search'].{targetId:targetId, status:status}"

[
    {
        "targetId": "VP1YHEVFU5",
        "status": "READY"
    }
]

Kiro IDE
  ├── 独立 OAuth 状态
  └── localhost:38123 回调监听

Kiro CLI
  ├── 独立 OAuth 状态
  └── 也尝试监听 localhost:38123
                    ↓
               端口冲突

Kiro IDE ──stdio──> mcp-remote 实例 A ─┐
                                      ├── ~/.mcp-auth 共享 Token
Kiro CLI ──stdio──> mcp-remote 实例 B ─┘
                         │
                         └── Bearer Token → AgentCore Gateway

npm view mcp-remote version

0.8.6

npm install -g mcp-remote@0.8.6

added 1 package, and changed 81 packages in 3s

npm list -g --depth=0 mcp-remote
command -v mcp-remote

/opt/homebrew/lib
└── mcp-remote@0.8.6

/opt/homebrew/bin/mcp-remote

{
  "mcpServers": {
    "agentcore-gateway": {
      "command": "<command -v mcp-remote 返回的路径>",
      "args": [
        "<第四章创建的 Gateway URL>",
        "38123",
        "--use-id-token",
        "--static-oauth-client-info",
        "{\"client_id\":\"<第三章创建的 CLIENT_ID>\"}",
        "--static-oauth-client-metadata",
        "{\"scope\":\"openid\",\"token_endpoint_auth_method\":\"none\"}"
      ],
      "env": {},
      "disabled": false
    }
  }
}

{
  "mcpServers": {
    "agentcore-gateway": {
      "command": "/opt/homebrew/bin/mcp-remote",
      "args": [
        "https://websearch-kiro-jwt-gateway-aechsb1ccn.gateway.bedrock-agentcore.us-east-1.amazonaws.com/mcp",
        "38123",
        "--use-id-token",
        "--static-oauth-client-info",
        "{\"client_id\":\"38d1ierl6pv39i2kv6f41eg8t9\"}",
        "--static-oauth-client-metadata",
        "{\"scope\":\"openid\",\"token_endpoint_auth_method\":\"none\"}"
      ],
      "env": {},
      "disabled": false
    }
  }
}

https://websearch-kiro-<ACCOUNT_ID>.auth.us-east-1.amazoncognito.com/oauth2/authorize?response_type=code&client_id=<CLIENT_ID>&redirect_uri=http%3A%2F%2Flocalhost%3A38123%2Foauth%2Fcallback&scope=openid&code_challenge=<PKCE_CHALLENGE>&code_challenge_method=S256&state=<随机状态值>

http://localhost:38123/oauth/callback?code=<一次性授权码>&state=<随机状态值>

/mcp

lsof -nP -iTCP:38123 -sTCP:LISTEN

{
  "mcpServers": {
    "agentcore-gateway": {
      "command": "/opt/homebrew/bin/mcp-remote",
      "args": [
        "<第四章创建的 Gateway URL>",
        "38123",
        "--use-id-token",
        "--static-oauth-client-info",
        "{\"client_id\":\"<第三章创建的 CLIENT_ID>\"}",
        "--static-oauth-client-metadata",
        "{\"scope\":\"openid\",\"token_endpoint_auth_method\":\"none\"}"
      ]
    }
  }
}

AgentCore Gateway Target
        ↓
AgentCore Gateway
        ↓
Gateway 专用 IAM Role

Cognito 托管域名
        ↓
Cognito User Pool（同时删除 App Client 与测试用户）

REGION="us-east-1"
ROLE_NAME="AgentCoreWebSearchKiroGatewayRole"
GATEWAY_NAME="websearch-kiro-jwt-gateway"
USER_POOL_NAME="websearch-kiro-pool"

GATEWAY_ID=$(aws bedrock-agentcore-control list-gateways \
  --region "$REGION" \
  --query "items[?name=='${GATEWAY_NAME}'].gatewayId | [0]" \
  --output text)
echo "GATEWAY_ID=$GATEWAY_ID"

if [[ -n "$GATEWAY_ID" && "$GATEWAY_ID" != "None" ]]; then
  TARGET_IDS=$(aws bedrock-agentcore-control list-gateway-targets \
    --gateway-identifier "$GATEWAY_ID" \
    --region "$REGION" \
    --query 'items[].targetId' \
    --output text)

  if [[ -n "$TARGET_IDS" && "$TARGET_IDS" != "None" ]]; then
    for TARGET_ID in $TARGET_IDS; do
      aws bedrock-agentcore-control delete-gateway-target \
        --gateway-identifier "$GATEWAY_ID" \
        --target-id "$TARGET_ID" \
        --region "$REGION"
    done

    while [[ "$(aws bedrock-agentcore-control list-gateway-targets \
      --gateway-identifier "$GATEWAY_ID" \
      --region "$REGION" \
      --query 'length(items)' \
      --output text)" != "0" ]]; do
      sleep 3
    done
  fi

  aws bedrock-agentcore-control delete-gateway \
    --gateway-identifier "$GATEWAY_ID" \
    --region "$REGION"

  while [[ "$(aws bedrock-agentcore-control list-gateways \
    --region "$REGION" \
    --query "length(items[?gatewayId=='${GATEWAY_ID}'])" \
    --output text)" != "0" ]]; do
    sleep 3
  done
fi

if aws iam get-role --role-name "$ROLE_NAME" >/dev/null 2>&1; then
  if aws iam get-role-policy \
    --role-name "$ROLE_NAME" \
    --policy-name "WebSearchInvokePolicy" >/dev/null 2>&1; then
    aws iam delete-role-policy \
      --role-name "$ROLE_NAME" \
      --policy-name "WebSearchInvokePolicy"
  fi

  aws iam delete-role --role-name "$ROLE_NAME"
fi

USER_POOL_ID=$(aws cognito-idp list-user-pools \
  --max-results 60 \
  --region "$REGION" \
  --query "UserPools[?Name=='${USER_POOL_NAME}'].Id | [0]" \
  --output text)
echo "USER_POOL_ID=$USER_POOL_ID"

if [[ -n "$USER_POOL_ID" && "$USER_POOL_ID" != "None" ]]; then
  COGNITO_DOMAIN=$(aws cognito-idp describe-user-pool \
    --user-pool-id "$USER_POOL_ID" \
    --region "$REGION" \
    --query 'UserPool.Domain' \
    --output text)

  if [[ -n "$COGNITO_DOMAIN" && "$COGNITO_DOMAIN" != "None" ]]; then
    aws cognito-idp delete-user-pool-domain \
      --domain "$COGNITO_DOMAIN" \
      --user-pool-id "$USER_POOL_ID" \
      --region "$REGION"
  fi

  aws cognito-idp delete-user-pool \
    --user-pool-id "$USER_POOL_ID" \
    --region "$REGION"
fi

aws bedrock-agentcore-control list-gateways \
  --region "$REGION" \
  --query "items[?name=='${GATEWAY_NAME}'].{name:name,gatewayId:gatewayId}" \
  --output json

aws cognito-idp list-user-pools \
  --max-results 60 \
  --region "$REGION" \
  --query "UserPools[?Name=='${USER_POOL_NAME}'].{Name:Name,Id:Id}" \
  --output json

aws iam list-roles \
  --query "Roles[?RoleName=='${ROLE_NAME}'].{RoleName:RoleName,Arn:Arn}" \
  --output json

[]