AgentCore MCP OAuth Facade

Bedrock AgentCore Gateway and Runtime expose MCP endpoints, but real-world MCP clients expect a complete OAuth 2.0 + MCP implementation: RFC 9728 protected resource metadata, RFC 8414 authorization server metadata, Dynamic Client Registration, arbitrary loopback redirect URIs, Mcp-Session-Id continuity, SSE responses, and un-paginated tool lists. Neither Cognito nor AgentCore Gateway provides all of that out of the box.

This skill captures a production-tested pattern: a small stateless Lambda facade (CloudFront → HTTP API → Lambda) that bridges every gap while never issuing tokens itself — Cognito remains the issuer, and the Gateway's JWT authorizer validates tokens unchanged.