@aws/nx-plugin-mcp 1.0.1 → 1.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -106,6 +106,8 @@ When you select `cognito`, the Gateway is configured with a Custom JWT authorize
|
|
|
106
106
|
|
|
107
107
|
The generated infrastructure consumes an existing Cognito user pool and client — it does not create them. You can generate a `UserIdentity` using the <Link path="/guides/react-website-auth">`ts#website#auth` generator</Link>, or provide your own.
|
|
108
108
|
|
|
109
|
+
Select `cognito` when the Gateway fronts a `auth: cognito` agent: the Gateway forwards the caller's token to the agent's runtime, so it has to have received one. See <Link path="guides/connection/agentcore-gateway-agent">Gateway to Agent</Link>.
|
|
110
|
+
|
|
109
111
|
<Infrastructure>
|
|
110
112
|
<Fragment slot="cdk">
|
|
111
113
|
The generated construct requires an `identity` prop supplying the user pool and client:
|
|
@@ -25,6 +25,10 @@ Before using this generator, ensure you have:
|
|
|
25
25
|
1. An <Link path="guides/agentcore-gateway">`agentcore-gateway`</Link> project generated with `protocol: http`
|
|
26
26
|
2. An agent component (<Link path="guides/ts-agent">`ts#agent`</Link> or <Link path="guides/py-agent">`py#agent`</Link>) created with `infra: agentcore`. Either `auth: iam` (the Gateway invokes it with its own role) or `auth: cognito` (the Gateway forwards the caller's JWT — see [Forwarding caller identity](#forwarding-caller-identity-to-the-runtime)) works.
|
|
27
27
|
|
|
28
|
+
:::caution[Cognito agents need a Cognito Gateway]
|
|
29
|
+
A `auth: cognito` agent is invoked by forwarding the token the Gateway validated on the way in, so it requires a Gateway generated with `auth: cognito` too — an `auth: iam` Gateway authenticates its callers with SigV4 and has no bearer token to forward. The generator rejects that pairing. A Cognito Gateway can front an `auth: iam` agent, which it invokes with its own role.
|
|
30
|
+
:::
|
|
31
|
+
|
|
28
32
|
:::caution[TypeScript HTTP agents]
|
|
29
33
|
A TypeScript `http` agent serves tRPC over WebSocket, and AgentCore Gateway does not support WebSocket or bidirectional streaming — the generator rejects this combination. Generate the agent with the `ag-ui` protocol instead.
|
|
30
34
|
:::
|