@aws/nx-plugin 1.0.0-rc.3 → 1.0.0-rc.30

package/src/utils/agent-connection/files/core-strands/mcp/agentcore-mcp-client-strands.ts.template

@@ -0,0 +1,27 @@
+import { McpClient } from '@strands-agents/sdk';
+import {
+  AgentCoreMcpTransport,
+  type AgentCoreMcpTransportIamOptions,
+  type AgentCoreMcpTransportJwtOptions,
+  type AgentCoreMcpTransportNoAuthOptions,
+} from './agentcore-mcp-transport.js';
+
+/** Strands MCP clients for a Bedrock AgentCore runtime. */
+export class AgentCoreMcpClientStrands {
+  /** SigV4-authenticated client for a Bedrock AgentCore runtime. */
+  static withIamAuth(options: AgentCoreMcpTransportIamOptions): McpClient {
+    return new McpClient({ transport: AgentCoreMcpTransport.withIamAuth(options) });
+  }
+
+  /** Bearer-authenticated client for a Bedrock AgentCore runtime. */
+  static withJwtAuth(options: AgentCoreMcpTransportJwtOptions): McpClient {
+    return new McpClient({ transport: AgentCoreMcpTransport.withJwtAuth(options) });
+  }
+
+  /** For local dev — plain HTTP, no auth. */
+  static withoutAuth(options: AgentCoreMcpTransportNoAuthOptions): McpClient {
+    return new McpClient({
+      transport: AgentCoreMcpTransport.withoutAuth(options),
+    });
+  }
+}

package/src/utils/agent-connection/files/py-core-a2a/agentcore_a2a_client_config.py.template

@@ -0,0 +1,43 @@
+from collections.abc import Callable
+
+import boto3
+import httpx
+from a2a.client import ClientConfig
+
+from .agentcore_endpoints import a2a_url_from_arn, region_from_arn
+from .auth.session import jwt_auth, plain_auth, sigv4_auth
+
+
+def _config(url: str, auth: httpx.Auth) -> tuple[str, ClientConfig]:
+    httpx_client = httpx.AsyncClient(auth=auth, timeout=120)
+    return url, ClientConfig(httpx_client=httpx_client, streaming=False)
+
+
+class AgentCoreA2aClientConfig:
+    """Factory for A2A client configs that connect to a Bedrock AgentCore
+    runtime. Each forwards the current async-context session via the AgentCore
+    session header. Framework-agnostic — wrap the result in a framework's
+    A2A client."""
+
+    @staticmethod
+    def with_iam_auth(agent_runtime_arn: str) -> tuple[str, ClientConfig]:
+        """SigV4-authenticated A2A client config for a Bedrock AgentCore runtime."""
+        region = region_from_arn(agent_runtime_arn)
+        credentials = boto3.Session(region_name=region).get_credentials()
+        return _config(
+            a2a_url_from_arn(agent_runtime_arn), sigv4_auth(credentials, region)
+        )
+
+    @staticmethod
+    def with_jwt_auth(
+        agent_runtime_arn: str, access_token_provider: Callable[[], str]
+    ) -> tuple[str, ClientConfig]:
+        """Bearer-authenticated A2A client config for a Bedrock AgentCore runtime."""
+        return _config(
+            a2a_url_from_arn(agent_runtime_arn), jwt_auth(access_token_provider)
+        )
+
+    @staticmethod
+    def without_auth(url: str) -> tuple[str, ClientConfig]:
+        """Plain-HTTP A2A client config — for local dev."""
+        return _config(url, plain_auth())

package/src/utils/agent-connection/files/py-core-auth/agentcore_endpoints.py.template

@@ -0,0 +1,47 @@
+"""Resolve Bedrock AgentCore invocation endpoints from a runtime ARN.
+
+Framework-agnostic — reusable by any framework's connection client.
+"""
+
+import re
+from urllib.parse import quote
+
+
+def region_from_arn(agent_runtime_arn: str) -> str:
+    """Extract the AWS region from a Bedrock AgentCore runtime ARN.
+
+    ARN format: arn:partition:service:region:account-id:resource
+    """
+    return agent_runtime_arn.split(":")[3]
+
+
+def mcp_url_from_arn(agent_runtime_arn: str) -> str:
+    """The MCP invocation URL for a runtime ARN."""
+    region = region_from_arn(agent_runtime_arn)
+    encoded_arn = quote(agent_runtime_arn, safe="")
+    return (
+        f"https://bedrock-agentcore.{region}.amazonaws.com/runtimes/"
+        f"{encoded_arn}/invocations?qualifier=DEFAULT"
+    )
+
+
+def a2a_url_from_arn(agent_runtime_arn: str) -> str:
+    """The A2A invocation URL for a runtime ARN. A2A on AgentCore is mounted at
+    the `/invocations/` root (trailing slash matters)."""
+    region = region_from_arn(agent_runtime_arn)
+    encoded_arn = quote(agent_runtime_arn, safe="")
+    return (
+        f"https://bedrock-agentcore.{region}.amazonaws.com/runtimes/"
+        f"{encoded_arn}/invocations/"
+    )
+
+
+def region_from_gateway_url(gateway_url: str) -> str:
+    """Extract the AWS region from an AgentCore Gateway MCP URL."""
+    match = re.search(r"\.bedrock-agentcore\.([^.]+)\.amazonaws\.com", gateway_url)
+    if not match:
+        raise ValueError(
+            f"Cannot determine region from gateway URL '{gateway_url}'. "
+            "Pass region explicitly."
+        )
+    return match.group(1)

package/src/utils/agent-connection/files/py-core-auth/auth/session.py.template

@@ -0,0 +1,51 @@
+from collections.abc import Callable
+
+import httpx
+
+from ..session_context import get_current_session_id
+from .sigv4 import SigV4HTTPXAuth
+
+SESSION_HEADER = "X-Amzn-Bedrock-AgentCore-Runtime-Session-Id"
+
+
+class SessionHeaderAuth(httpx.Auth):
+    """Stamps the AgentCore session header from the current async context,
+    then delegates to an optional inner auth (e.g. SigV4)."""
+
+    requires_request_body = True
+    requires_response_body = True
+
+    def __init__(self, inner: httpx.Auth | None = None):
+        self._inner = inner
+
+    def auth_flow(self, request: httpx.Request):  # type: ignore[override]
+        sid = get_current_session_id()
+        if sid:
+            request.headers[SESSION_HEADER] = sid
+        if self._inner is None:
+            yield request
+            return
+        yield from self._inner.auth_flow(request)
+
+
+def sigv4_auth(
+    credentials, region: str, service: str = "bedrock-agentcore"
+) -> httpx.Auth:
+    """Session-forwarding SigV4 auth (per-request, body-aware)."""
+    return SessionHeaderAuth(SigV4HTTPXAuth(credentials, service, region))
+
+
+def jwt_auth(access_token_provider: Callable[[], str]) -> httpx.Auth:
+    """Session-forwarding bearer-token auth."""
+
+    class _Bearer(httpx.Auth):
+        def auth_flow(self, request: httpx.Request):
+            request.headers["Authorization"] = f"Bearer {access_token_provider()}"
+            yield request
+
+    return SessionHeaderAuth(_Bearer())
+
+
+def plain_auth() -> httpx.Auth:
+    """Session-forwarding plain auth — for local dev."""
+    return SessionHeaderAuth()

package/src/utils/agent-connection/files/py-core-gateway/agentcore_gateway_mcp_transport.py.template

@@ -0,0 +1,28 @@
+from .agentcore_endpoints import region_from_gateway_url
+from .agentcore_transport import (
+    TransportFactory,
+    no_auth_transport,
+    sigv4_transport,
+)
+
+
+class AgentCoreGatewayMCPTransport:
+    """Factory for MCP transport factories that connect to an AgentCore Gateway.
+    Forwards the current async-context session via the AgentCore session header,
+    which the gateway propagates to downstream MCP server targets.
+    """
+
+    @staticmethod
+    def with_iam_auth(
+        gateway_url: str,
+        region: str | None = None,
+    ) -> TransportFactory:
+        """Create a gateway MCP transport authenticated with IAM SigV4."""
+        return sigv4_transport(
+            gateway_url, region or region_from_gateway_url(gateway_url)
+        )
+
+    @staticmethod
+    def without_auth(gateway_url: str) -> TransportFactory:
+        """Plain-HTTP gateway transport, for the local gateway started by the dev target."""
+        return no_auth_transport(gateway_url)

package/src/utils/agent-connection/files/py-core-langchain/a2a/agentcore_a2a_client_langchain.py.template

@@ -0,0 +1,99 @@
+import asyncio
+from collections.abc import Callable
+from concurrent.futures import ThreadPoolExecutor
+from uuid import uuid4
+
+from a2a.client import A2ACardResolver, ClientConfig, ClientFactory
+from a2a.types import Message, Part, Role, Task, TextPart
+
+from .agentcore_a2a_client_config import AgentCoreA2aClientConfig
+
+
+def _run_sync(coro):
+    # The tool is invoked from sync agent code, which under uvicorn runs inside a
+    # live event loop where asyncio.run() would raise — fall back to a worker.
+    try:
+        asyncio.get_running_loop()
+    except RuntimeError:
+        return asyncio.run(coro)
+    with ThreadPoolExecutor(max_workers=1) as pool:
+        return pool.submit(asyncio.run, coro).result()
+
+
+def _text(event) -> str:
+    # Collect text parts from a bare Message or a (Task, update) event.
+    parts = []
+    if isinstance(event, Message):
+        parts = event.parts
+    elif isinstance(event, tuple):
+        task, update = event
+        if isinstance(task, Task) and task.artifacts:
+            parts = [p for a in task.artifacts for p in (a.parts or [])]
+        elif update is not None and getattr(update, "status", None) and update.status.message:
+            parts = update.status.message.parts
+    return "".join(p.root.text for p in parts if getattr(p.root, "text", None))
+
+
+class _A2AClient:
+    """A synchronously-callable A2A client. Sends a text prompt to the remote
+    agent and returns its text reply. Built on the a2a SDK only — no Strands."""
+
+    def __init__(self, url: str, client_config: ClientConfig):
+        self._url = url
+        self._config = client_config
+
+    def __call__(self, prompt: str) -> str:
+        return _run_sync(self._invoke(prompt))
+
+    async def _invoke(self, prompt: str) -> str:
+        # AgentCoreA2aClientConfig always sets the signed httpx client.
+        httpx_client = self._config.httpx_client
+        if httpx_client is None:
+            raise RuntimeError("A2A client config is missing an httpx client")
+        card = await A2ACardResolver(
+            httpx_client=httpx_client, base_url=self._url
+        ).get_agent_card()
+        client = ClientFactory(self._config).create(card)
+        message = Message(
+            kind="message",
+            role=Role.user,
+            message_id=uuid4().hex,
+            parts=[Part(TextPart(kind="text", text=prompt))],
+        )
+        # The client config uses streaming=False, so the last event carries the
+        # complete response.
+        reply = ""
+        async for event in client.send_message(message):
+            text = _text(event)
+            if text:
+                reply = text
+        return reply
+
+
+class AgentCoreA2aClientLangChain:
+    """Factory for A2A clients that connect to an AgentCore runtime.
+
+    Reuses the framework-agnostic Layer-1 ``AgentCoreA2aClientConfig`` (signed
+    ``a2a.client.ClientConfig``) and drives the a2a SDK directly, so a LangChain
+    agent delegating to an A2A agent pulls in no Strands dependency."""
+
+    @staticmethod
+    def with_iam_auth(agent_runtime_arn: str) -> _A2AClient:
+        """SigV4-authenticated client for a Bedrock AgentCore runtime."""
+        return _A2AClient(*AgentCoreA2aClientConfig.with_iam_auth(agent_runtime_arn))
+
+    @staticmethod
+    def with_jwt_auth(
+        agent_runtime_arn: str, access_token_provider: Callable[[], str]
+    ) -> _A2AClient:
+        """Bearer-authenticated client for a Bedrock AgentCore runtime."""
+        return _A2AClient(
+            *AgentCoreA2aClientConfig.with_jwt_auth(
+                agent_runtime_arn, access_token_provider
+            )
+        )
+
+    @staticmethod
+    def without_auth(url: str) -> _A2AClient:
+        """Plain-HTTP client for local dev."""
+        return _A2AClient(*AgentCoreA2aClientConfig.without_auth(url))

package/src/utils/agent-connection/files/py-core-langchain/gateway/agentcore_gateway_mcp_client_langchain.py.template

@@ -0,0 +1,57 @@
+import asyncio
+from concurrent.futures import ThreadPoolExecutor
+
+import boto3
+import httpx
+
+from langchain_core.tools import BaseTool
+from langchain_mcp_adapters.client import MultiServerMCPClient
+
+from .agentcore_endpoints import region_from_gateway_url
+from .auth.session import plain_auth, sigv4_auth
+
+
+def _run_sync(coro):
+    # Tools load during agent construction, which under uvicorn runs inside a
+    # live event loop where asyncio.run() would raise — fall back to a worker.
+    try:
+        asyncio.get_running_loop()
+    except RuntimeError:
+        return asyncio.run(coro)
+    with ThreadPoolExecutor(max_workers=1) as pool:
+        return pool.submit(asyncio.run, coro).result()
+
+
+def _load_tools(url: str, auth: httpx.Auth) -> list[BaseTool]:
+    # Pass a connection config so each tool opens a fresh session per call and
+    # stays usable after construction (no shared session to close).
+    client = MultiServerMCPClient(
+        {
+            "server": {
+                "transport": "streamable_http",
+                "url": url,
+                "auth": auth,
+                "terminate_on_close": False,
+            }
+        }
+    )
+    return _run_sync(client.get_tools())
+
+
+class AgentCoreGatewayMCPClientLangChain:
+    """Loads LangChain tools from an AgentCore Gateway."""
+
+    @staticmethod
+    def with_iam_auth(
+        gateway_url: str,
+        region: str | None = None,
+    ) -> list[BaseTool]:
+        """SigV4-authenticated tools for an AgentCore Gateway."""
+        resolved_region = region or region_from_gateway_url(gateway_url)
+        credentials = boto3.Session(region_name=resolved_region).get_credentials()
+        return _load_tools(gateway_url, sigv4_auth(credentials, resolved_region))
+
+    @staticmethod
+    def without_auth(gateway_url: str) -> list[BaseTool]:
+        """Plain-HTTP tools for the local gateway started by the dev target."""
+        return _load_tools(gateway_url, plain_auth())

package/src/utils/agent-connection/files/py-core-langchain/mcp/agentcore_mcp_client_langchain.py.template

@@ -0,0 +1,64 @@
+import asyncio
+from collections.abc import Callable
+from concurrent.futures import ThreadPoolExecutor
+
+import boto3
+import httpx
+
+from langchain_core.tools import BaseTool
+from langchain_mcp_adapters.client import MultiServerMCPClient
+
+from .agentcore_endpoints import mcp_url_from_arn, region_from_arn
+from .auth.session import jwt_auth, plain_auth, sigv4_auth
+
+
+def _run_sync(coro):
+    # Tools load during agent construction, which under uvicorn runs inside a
+    # live event loop where asyncio.run() would raise — fall back to a worker.
+    try:
+        asyncio.get_running_loop()
+    except RuntimeError:
+        return asyncio.run(coro)
+    with ThreadPoolExecutor(max_workers=1) as pool:
+        return pool.submit(asyncio.run, coro).result()
+
+
+def _load_tools(url: str, auth: httpx.Auth) -> list[BaseTool]:
+    # Pass a connection config so each tool opens a fresh session per call and
+    # stays usable after construction (no shared session to close).
+    client = MultiServerMCPClient(
+        {
+            "server": {
+                "transport": "streamable_http",
+                "url": url,
+                "auth": auth,
+                "terminate_on_close": False,
+            }
+        }
+    )
+    return _run_sync(client.get_tools())
+
+
+class AgentCoreMCPClientLangChain:
+    """Loads LangChain tools from an MCP server on an AgentCore runtime."""
+
+    @staticmethod
+    def with_iam_auth(agent_runtime_arn: str) -> list[BaseTool]:
+        """SigV4-authenticated tools for a Bedrock AgentCore runtime."""
+        region = region_from_arn(agent_runtime_arn)
+        url = mcp_url_from_arn(agent_runtime_arn)
+        credentials = boto3.Session(region_name=region).get_credentials()
+        return _load_tools(url, sigv4_auth(credentials, region))
+
+    @staticmethod
+    def with_jwt_auth(
+        agent_runtime_arn: str, access_token_provider: Callable[[], str]
+    ) -> list[BaseTool]:
+        """Bearer-authenticated tools for a Bedrock AgentCore runtime."""
+        url = mcp_url_from_arn(agent_runtime_arn)
+        return _load_tools(url, jwt_auth(access_token_provider))
+
+    @staticmethod
+    def without_auth(url: str) -> list[BaseTool]:
+        """Plain-HTTP tools for local dev."""
+        return _load_tools(url, plain_auth())

package/src/utils/agent-connection/files/py-core-mcp/agentcore_mcp_transport.py.template

@@ -0,0 +1,34 @@
+from collections.abc import Callable
+
+from .agentcore_endpoints import mcp_url_from_arn, region_from_arn
+from .agentcore_transport import (
+    TransportFactory,
+    jwt_transport,
+    no_auth_transport,
+    sigv4_transport,
+)
+
+
+class AgentCoreMCPTransport:
+    """Factory for MCP transport factories that connect to an AgentCore runtime."""
+
+    @staticmethod
+    def with_iam_auth(agent_runtime_arn: str) -> TransportFactory:
+        """SigV4-authenticated transport for a Bedrock AgentCore runtime."""
+        return sigv4_transport(
+            mcp_url_from_arn(agent_runtime_arn), region_from_arn(agent_runtime_arn)
+        )
+
+    @staticmethod
+    def with_jwt_auth(
+        agent_runtime_arn: str, access_token_provider: Callable[[], str]
+    ) -> TransportFactory:
+        """Bearer-authenticated transport for a Bedrock AgentCore runtime."""
+        return jwt_transport(
+            mcp_url_from_arn(agent_runtime_arn), access_token_provider
+        )
+
+    @staticmethod
+    def without_auth(url: str) -> TransportFactory:
+        """Plain-HTTP transport — for local dev."""
+        return no_auth_transport(url)

package/src/utils/agent-connection/files/py-core-runtime-config/runtime_config.py.template

@@ -5,9 +5,13 @@ from aws_lambda_powertools.utilities import parameters
 from botocore.config import Config
 
 
-def _get_agentcore_runtime_config() -> dict[str, Any]:
+def get_agentcore_runtime_config() -> dict[str, Any]:
     """Read the runtime-config ``agentcore`` namespace from AppConfig.
 
+    Returns a dict of the shape ``{"agentRuntimes": {name: arn, ...},
+    "gateways": {name: url, ...}}``, where keys are the class names of
+    connected target constructs.
+
     ``RUNTIME_CONFIG_APP_ID`` is set on the AgentCore runtime by the generated
     CDK/Terraform construct for this project.
     """
@@ -23,20 +27,3 @@ def _get_agentcore_runtime_config() -> dict[str, Any]:
         config=Config(region_name=region) if region else None,
     )
     return cast(dict[str, Any], provider.get("agentcore", transform="json"))
-
-
-def get_connected_agent_runtime_arn(name: str) -> str:
-    """Resolve the AgentCore runtime ARN for a connected agent or MCP server
-    from this project's runtime configuration.
-
-    ``name`` must match the class name of the target construct
-    (e.g. ``MyAgent``, ``InventoryMcpServer``).
-    """
-    config = _get_agentcore_runtime_config()
-    agent_runtimes = config.get("agentRuntimes", {}) if config else {}
-    arn = agent_runtimes.get(name)
-    if not arn:
-        raise RuntimeError(
-            f"No connected agent runtime named '{name}' found in runtime configuration."
-        )
-    return arn

package/src/utils/agent-connection/files/py-core-shared/agentcore_transport.py.template

@@ -0,0 +1,40 @@
+from collections.abc import Callable
+from typing import Any
+
+import boto3
+
+from mcp.client.streamable_http import streamablehttp_client
+
+from .auth.session import jwt_auth, plain_auth, sigv4_auth
+
+# Agent frameworks wrap a transport *factory* — a no-arg callable returning a
+# streamable-HTTP transport context manager. Typed as ``Any`` so this layer
+# stays free of any framework-specific transport type.
+TransportFactory = Callable[[], Any]
+
+
+def _factory(url: str, auth) -> TransportFactory:
+    return lambda: streamablehttp_client(
+        url,
+        auth=auth,
+        timeout=120,
+        terminate_on_close=False,
+    )
+
+
+def sigv4_transport(url: str, region: str) -> TransportFactory:
+    """SigV4-signed transport factory for a resolved AgentCore endpoint."""
+    credentials = boto3.Session(region_name=region).get_credentials()
+    return _factory(url, sigv4_auth(credentials, region))
+
+
+def jwt_transport(
+    url: str, access_token_provider: Callable[[], str]
+) -> TransportFactory:
+    """Bearer-token transport factory for a resolved AgentCore endpoint."""
+    return _factory(url, jwt_auth(access_token_provider))
+
+
+def no_auth_transport(url: str) -> TransportFactory:
+    """Plain-HTTP transport factory — for local dev."""
+    return _factory(url, plain_auth())

package/src/utils/agent-connection/files/py-core-strands/a2a/agentcore_a2a_client_strands.py.template

@@ -0,0 +1,66 @@
+from collections.abc import Callable
+
+from strands.agent.a2a_agent import A2AAgent
+
+from .agentcore_a2a_client_config import AgentCoreA2aClientConfig
+
+
+def _build(
+    config: tuple, *, name: str | None, description: str | None
+) -> A2AAgent:
+    url, client_config = config
+    kwargs: dict = {"endpoint": url, "client_config": client_config}
+    if name:
+        kwargs["name"] = name
+    if description:
+        kwargs["description"] = description
+    return A2AAgent(**kwargs)
+
+
+class AgentCoreA2aClientStrands:
+    """Factory for Strands A2A clients that connect to an AgentCore runtime."""
+
+    @staticmethod
+    def with_iam_auth(
+        agent_runtime_arn: str,
+        *,
+        name: str | None = None,
+        description: str | None = None,
+    ) -> A2AAgent:
+        """SigV4-authenticated client for a Bedrock AgentCore runtime."""
+        return _build(
+            AgentCoreA2aClientConfig.with_iam_auth(agent_runtime_arn),
+            name=name,
+            description=description,
+        )
+
+    @staticmethod
+    def with_jwt_auth(
+        agent_runtime_arn: str,
+        access_token_provider: Callable[[], str],
+        *,
+        name: str | None = None,
+        description: str | None = None,
+    ) -> A2AAgent:
+        """Bearer-authenticated client for a Bedrock AgentCore runtime."""
+        return _build(
+            AgentCoreA2aClientConfig.with_jwt_auth(
+                agent_runtime_arn, access_token_provider
+            ),
+            name=name,
+            description=description,
+        )
+
+    @staticmethod
+    def without_auth(
+        url: str,
+        *,
+        name: str | None = None,
+        description: str | None = None,
+    ) -> A2AAgent:
+        """Plain-HTTP client — for local dev."""
+        return _build(
+            AgentCoreA2aClientConfig.without_auth(url),
+            name=name,
+            description=description,
+        )

package/src/utils/agent-connection/files/py-core-strands/base/model_errors_strands.py.template

@@ -0,0 +1,40 @@
+import logging
+
+from botocore.exceptions import ClientError, NoCredentialsError, PartialCredentialsError
+from strands.hooks import AfterModelCallEvent, HookRegistry
+
+logger = logging.getLogger(__name__)
+
+_NO_CREDENTIALS = (
+    "Unable to invoke the model: no AWS credentials found. Configure credentials "
+    "(e.g. run `aws configure`, set AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / "
+    "AWS_SESSION_TOKEN, or assume a role) before running the agent."
+)
+_ACCESS_DENIED = (
+    "Unable to invoke the model: access denied. Grant your AWS principal permission "
+    "to call bedrock:InvokeModelWithResponseStream for your model."
+)
+
+
+def _is_access_denied(error: BaseException) -> bool:
+    return isinstance(error, ClientError) and error.response.get("Error", {}).get("Code") == "AccessDeniedException"
+
+
+class _LogModelErrors:
+    def register_hooks(self, registry: HookRegistry, **_kwargs) -> None:
+        registry.add_callback(AfterModelCallEvent, self._on_after_model_call)
+
+    @staticmethod
+    def _on_after_model_call(event: AfterModelCallEvent) -> None:
+        error = event.exception
+        if error is None:
+            return
+        if isinstance(error, (NoCredentialsError, PartialCredentialsError)):
+            logger.error(_NO_CREDENTIALS)
+        elif _is_access_denied(error):
+            logger.error(_ACCESS_DENIED)
+        else:
+            logger.error("Model invocation failed: %s", error)
+
+
+log_model_errors = _LogModelErrors()

package/src/utils/agent-connection/files/py-core-strands/gateway/agentcore_gateway_mcp_client_strands.py.template

@@ -0,0 +1,22 @@
+from strands.tools.mcp.mcp_client import MCPClient
+
+from .agentcore_gateway_mcp_transport import AgentCoreGatewayMCPTransport
+
+
+class AgentCoreGatewayMCPClientStrands:
+    """Factory for Strands MCP clients that connect to an AgentCore Gateway."""
+
+    @staticmethod
+    def with_iam_auth(
+        gateway_url: str,
+        region: str | None = None,
+    ) -> MCPClient:
+        """Create a gateway MCP client authenticated with IAM SigV4."""
+        return MCPClient(
+            AgentCoreGatewayMCPTransport.with_iam_auth(gateway_url, region)
+        )
+
+    @staticmethod
+    def without_auth(gateway_url: str) -> MCPClient:
+        """Plain-HTTP gateway client, for the local gateway started by the dev target."""
+        return MCPClient(AgentCoreGatewayMCPTransport.without_auth(gateway_url))