agentcore-cli 0.31.1__py3-none-any.whl

agentcore/schema/schemas/mcp.py

@@ -0,0 +1,650 @@
+"""Gateways, gateway targets and MCP runtime tools (port of ``schemas/mcp.ts``)."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Annotated, Any, Final, Literal, TypedDict, get_args
+
+from pydantic import Field, model_validator
+
+from .._zod import (
+    Issue,
+    PassthroughModel,
+    StrictModel,
+    ZBool,
+    ZodModel,
+    array_checks,
+    js_regex,
+    raise_issues,
+    zint,
+    zstr,
+)
+from ..constants import NetworkMode, NodeRuntime, PythonRuntime
+from .agent_env import EnvVarName, GatewayName, Instrumentation
+from .auth import GatewayAuthorizerConfig, GatewayAuthorizerType
+from .mcp_defs import ToolDefinition
+from .primitives.tags import Tags
+
+# ============================================================================
+# MCP-Specific Schemas
+# ============================================================================
+
+GatewayTargetType = Literal[
+    "lambda",
+    "mcpServer",
+    "openApiSchema",
+    "smithyModel",
+    "apiGateway",
+    "lambdaFunctionArn",
+    "httpRuntime",
+    "connector",
+    "passthrough",
+]
+GATEWAY_TARGET_TYPES: Final[tuple[GatewayTargetType, ...]] = get_args(GatewayTargetType)
+
+# Target types that use the non-MCP (HTTP) protocol; they require a gateway with protocolType "None".
+NON_MCP_TARGET_TYPES: Final[tuple[GatewayTargetType, ...]] = ("httpRuntime", "passthrough")
+
+# Target types that use the MCP protocol.
+MCP_TARGET_TYPES: Final[tuple[GatewayTargetType, ...]] = (
+    "lambda",
+    "mcpServer",
+    "openApiSchema",
+    "smithyModel",
+    "apiGateway",
+    "lambdaFunctionArn",
+)
+
+# ============================================================================
+# Connector (managed-service gateway target)
+# ============================================================================
+
+# Managed-service connector identifiers (the L3 maps each to an operation name + Enabled list).
+CONNECTOR_ID: Final[dict[str, str]] = {
+    "BEDROCK_KNOWLEDGE_BASES": "bedrock-knowledge-bases",
+    "WEB_SEARCH": "web-search",
+}
+ConnectorId = Literal["bedrock-knowledge-bases", "web-search"]
+CONNECTOR_ID_VALUES: Final[tuple[ConnectorId, ...]] = get_args(ConnectorId)
+
+# Real Bedrock KB IDs are 10 uppercase alphanumerics and can never collide with a KB name.
+REAL_KB_ID_PATTERN: Final = js_regex(r"^[A-Z0-9]{10}$")
+
+# ============================================================================
+# Gateway Outbound Auth
+# ============================================================================
+
+OutboundAuthType = Literal["OAUTH", "API_KEY", "NONE", "GATEWAY_IAM_ROLE", "JWT_PASSTHROUGH"]
+OUTBOUND_AUTH_TYPES: Final[tuple[OutboundAuthType, ...]] = get_args(OutboundAuthType)
+
+
+class OutboundAuth(StrictModel):
+    type: OutboundAuthType = "NONE"
+    credential_name: zstr(min=1) | None = None
+    scopes: list[str] | None = None
+    service: zstr(min=1, max=64) | None = None
+    region: zstr(min=1, max=32) | None = None
+
+
+@dataclass(frozen=True)
+class TargetTypeAuthConfig:
+    # Target cannot be created without outbound auth.
+    auth_required: bool
+    # Allowed OutboundAuthType values (empty = no outbound auth applicable).
+    valid_auth_types: tuple[OutboundAuthType, ...]
+    # CDK passes GATEWAY_IAM_ROLE when no auth is configured.
+    iam_role_fallback: bool
+
+
+# Outbound authentication rules per gateway target type (single source of truth).
+TARGET_TYPE_AUTH_CONFIG: Final[dict[GatewayTargetType, TargetTypeAuthConfig]] = {
+    "openApiSchema": TargetTypeAuthConfig(True, ("OAUTH", "API_KEY"), False),
+    "smithyModel": TargetTypeAuthConfig(False, (), True),
+    "apiGateway": TargetTypeAuthConfig(False, ("API_KEY", "NONE"), True),
+    "mcpServer": TargetTypeAuthConfig(False, ("OAUTH", "NONE"), False),
+    "lambda": TargetTypeAuthConfig(False, ("OAUTH", "NONE"), True),
+    "lambdaFunctionArn": TargetTypeAuthConfig(False, ("OAUTH", "NONE"), True),
+    "httpRuntime": TargetTypeAuthConfig(False, ("OAUTH", "NONE"), True),
+    # Connector targets call the managed service via the gateway's IAM role; no outbound auth applies.
+    "connector": TargetTypeAuthConfig(False, (), True),
+    "passthrough": TargetTypeAuthConfig(True, ("GATEWAY_IAM_ROLE", "OAUTH", "JWT_PASSTHROUGH"), False),
+}
+
+# ============================================================================
+# API Gateway Target
+# ============================================================================
+
+ApiGatewayHttpMethod = Literal["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"]
+API_GATEWAY_HTTP_METHODS: Final[tuple[ApiGatewayHttpMethod, ...]] = get_args(ApiGatewayHttpMethod)
+
+
+class ApiGatewayToolFilter(StrictModel):
+    filter_path: zstr(min=1)
+    methods: Annotated[list[ApiGatewayHttpMethod], array_checks(min=1)]
+
+
+class ApiGatewayToolOverride(StrictModel):
+    name: zstr(min=1)
+    path: zstr(min=1)
+    method: ApiGatewayHttpMethod
+    description: str | None = None
+
+
+class ApiGatewayToolConfiguration(StrictModel):
+    tool_filters: Annotated[list[ApiGatewayToolFilter], array_checks(min=1)]
+    tool_overrides: list[ApiGatewayToolOverride] | None = None
+
+
+class ApiGatewayConfig(StrictModel):
+    rest_api_id: zstr(min=1)
+    stage: zstr(min=1)
+    api_gateway_tool_configuration: ApiGatewayToolConfiguration
+
+
+class LambdaFunctionArnConfig(StrictModel):
+    lambda_arn: zstr(min=1, max=170)
+    tool_schema_file: zstr(min=1)
+
+
+McpImplementationLanguage = Literal["TypeScript", "Python"]
+MCP_IMPLEMENTATION_LANGUAGES: Final[tuple[McpImplementationLanguage, ...]] = get_args(McpImplementationLanguage)
+
+ComputeHost = Literal["Lambda", "AgentCoreRuntime"]
+COMPUTE_HOSTS: Final[tuple[ComputeHost, ...]] = get_args(ComputeHost)
+
+# ============================================================================
+# Tool Implementation Binding
+# ============================================================================
+
+
+class ToolImplementationBinding(StrictModel):
+    """Code-based tool implementation; the CLI installs deps, bundles, zips and uploads it."""
+
+    language: McpImplementationLanguage
+    path: zstr(min=1)
+    handler: zstr(min=1)
+
+
+class IamPolicyDocument(PassthroughModel):
+    """Opaque IAM policy document, passed through verbatim to CloudFormation / IAM."""
+
+    version: Annotated[str, Field(alias="Version")]
+    statement: Annotated[list[Any], Field(alias="Statement")]
+
+
+# ============================================================================
+# Runtime Configuration
+# ============================================================================
+
+_AgentRuntimeName = zstr(
+    min=1,
+    max=48,
+    pattern=r"^[a-zA-Z][a-zA-Z0-9_]{0,47}$",
+    pattern_msg="Must begin with a letter and contain only alphanumeric characters and underscores (max 48 chars)",
+)
+
+# "file.py", "file.py:handler" or "path/file.py:handler".
+_PythonEntrypoint = zstr(
+    min=1,
+    pattern=r"^[a-zA-Z0-9_][a-zA-Z0-9_/.-]*\.py(:[a-zA-Z_][a-zA-Z0-9_]*)?$",
+    pattern_msg='Must be a Python file path with optional handler (e.g., "main.py:agent" or "src/handler.py:app")',
+)
+
+
+class CodeZipRuntimeConfig(StrictModel):
+    artifact: Literal["CodeZip"]
+    python_version: PythonRuntime
+    name: _AgentRuntimeName
+    entrypoint: _PythonEntrypoint
+    code_location: zstr(min=1)
+    instrumentation: Instrumentation | None = None
+    network_mode: NetworkMode = "PUBLIC"
+    description: str | None = None
+
+
+# Runtime configuration for AgentCore Runtime (MCP mode): explicit CodeZip artifact configuration.
+RuntimeConfig = CodeZipRuntimeConfig
+
+# ============================================================================
+# Compute Configuration
+# ============================================================================
+
+
+class LambdaComputeConfig(StrictModel):
+    """Lambda compute (Python or TypeScript)."""
+
+    host: Literal["Lambda"]
+    implementation: ToolImplementationBinding
+    node_version: NodeRuntime | None = None
+    python_version: PythonRuntime | None = None
+    timeout: zint(ge=1, le=900) | None = None
+    memory_size: zint(ge=128, le=10240) | None = None
+    iam_policy: IamPolicyDocument | None = None
+
+    @model_validator(mode="after")
+    def _refine(self) -> LambdaComputeConfig:
+        lang = self.implementation.language
+        if (lang == "TypeScript" and not self.node_version) or (lang == "Python" and not self.python_version):
+            raise_issues(
+                [((), "TypeScript Lambda must specify nodeVersion, Python Lambda must specify pythonVersion")], self
+            )
+        return self
+
+
+class AgentCoreRuntimeComputeConfig(StrictModel):
+    """AgentCore Runtime compute (Python only)."""
+
+    host: Literal["AgentCoreRuntime"]
+    implementation: ToolImplementationBinding
+    runtime: RuntimeConfig | None = None
+    iam_policy: IamPolicyDocument | None = None
+
+    @model_validator(mode="after")
+    def _refine(self) -> AgentCoreRuntimeComputeConfig:
+        if self.implementation.language != "Python":
+            raise_issues([((), "AgentCore Runtime only supports Python")], self)
+        return self
+
+
+ToolComputeConfig = Annotated[LambdaComputeConfig | AgentCoreRuntimeComputeConfig, Field(discriminator="host")]
+
+# ============================================================================
+# Schema Source (for OpenAPI / Smithy targets)
+# ============================================================================
+
+
+class SchemaS3Source(StrictModel):
+    uri: zstr(min=1, starts_with="s3://")
+    bucket_owner_account_id: str | None = None
+
+
+class SchemaInlineSource(StrictModel):
+    """Local file reference, relative to the project root (read at synth time)."""
+
+    path: zstr(min=1)
+
+
+class InlineSchemaSource(StrictModel):
+    inline: SchemaInlineSource
+
+
+class S3SchemaSource(StrictModel):
+    s3: SchemaS3Source
+
+
+SchemaSource = Annotated[InlineSchemaSource | S3SchemaSource, Field(union_mode="left_to_right")]
+
+# ============================================================================
+# HTTP Runtime / Passthrough Configuration
+# ============================================================================
+
+
+class HttpRuntimeConfig(StrictModel):
+    runtime: zstr(min=1)
+    runtime_endpoint: zstr(min=1) | None = None
+
+
+class StickinessConfig(StrictModel):
+    identifier: zstr(min=1, max=256)
+    timeout: zint(ge=1, le=86400) | None = None
+
+
+# HTTP is NOT valid — use CUSTOM for plain HTTP/REST backends.
+PassthroughProtocolType = Literal["MCP", "A2A", "INFERENCE", "CUSTOM"]
+PASSTHROUGH_PROTOCOL_TYPES: Final[tuple[PassthroughProtocolType, ...]] = get_args(PassthroughProtocolType)
+
+
+class PassthroughConfig(StrictModel):
+    endpoint: zstr(
+        min=1,
+        pattern=r"^https:\/\/[a-zA-Z0-9\-.]+(:[0-9]{1,5})?(\/.*)?$",
+        pattern_msg="Must be a valid HTTPS URL",
+    )
+    protocol_type: PassthroughProtocolType = "CUSTOM"
+    stickiness_configuration: StickinessConfig | None = None
+
+
+# ============================================================================
+# Gateway Target
+# ============================================================================
+
+
+class ConnectorParameterOverride(ZodModel):
+    path: str
+    description: str | None = None
+    visible: ZBool | None = None
+
+
+class ConnectorConfiguration(ZodModel):
+    """Per-operation configuration entry for connector targets (e.g. Retrieve, WebSearch)."""
+
+    name: str
+    description: str | None = None
+    parameter_values: dict[str, Any] | None = None
+    parameter_overrides: list[ConnectorParameterOverride] | None = None
+
+
+class AgentCoreGatewayTarget(StrictModel):
+    """Binds one or more ToolDefinitions to the compute (or external endpoint) that services them."""
+
+    name: zstr(min=1)
+    target_type: GatewayTargetType
+    # Required for Lambda targets; optional for MCP Server (discovered via tools/list).
+    tool_definitions: list[ToolDefinition] | None = None
+    compute: ToolComputeConfig | None = None
+    # Endpoint URL for mcpServer targets.
+    endpoint: zstr(url=True) | None = None
+    outbound_auth: OutboundAuth | None = None
+    api_gateway: ApiGatewayConfig | None = None
+    schema_source: SchemaSource | None = None
+    lambda_function_arn: LambdaFunctionArnConfig | None = None
+    http_runtime: HttpRuntimeConfig | None = None
+    connector_id: ConnectorId | None = None
+    configurations: list[ConnectorConfiguration] | None = None
+    passthrough: PassthroughConfig | None = None
+
+    @model_validator(mode="after")
+    def _refine(self) -> AgentCoreGatewayTarget:
+        issues = _gateway_target_issues(self)
+        raise_issues(issues, self)
+        return self
+
+
+def _gateway_target_issues(d: AgentCoreGatewayTarget) -> list[Issue]:
+    issues: list[Issue] = []
+    t = d.target_type
+    has_tools = bool(d.tool_definitions)
+
+    def add(field: str | None, msg: str) -> None:
+        issues.append(((field,) if field else (), msg))
+
+    if t == "apiGateway":
+        if d.api_gateway is None:
+            add("apiGateway", "apiGateway config is required for apiGateway target type")
+        if d.compute is not None:
+            add("compute", "compute is not applicable for apiGateway target type")
+        if d.endpoint:
+            add("endpoint", "endpoint is not applicable for apiGateway target type")
+        if has_tools:
+            add(
+                "toolDefinitions",
+                "toolDefinitions is not applicable for apiGateway target type (tools are auto-discovered)",
+            )
+        if d.lambda_function_arn is not None:
+            add("lambdaFunctionArn", "lambdaFunctionArn is not applicable for apiGateway target type")
+    if t in ("openApiSchema", "smithyModel"):
+        if d.schema_source is None:
+            add("schemaSource", f"{t} targets require a schemaSource.")
+        if d.compute is not None:
+            add("compute", f"compute is not applicable for {t} target type")
+        if d.endpoint:
+            add("endpoint", f"endpoint is not applicable for {t} target type")
+        if has_tools:
+            add("toolDefinitions", f"toolDefinitions is not applicable for {t} target type")
+        if d.api_gateway is not None:
+            add("apiGateway", f"apiGateway config is not applicable for {t} target type")
+    if t == "lambdaFunctionArn":
+        if d.lambda_function_arn is None:
+            add("lambdaFunctionArn", "lambdaFunctionArn config is required for lambdaFunctionArn target type")
+        if d.compute is not None:
+            add("compute", "compute is not applicable for lambdaFunctionArn target type")
+        if d.endpoint:
+            add("endpoint", "endpoint is not applicable for lambdaFunctionArn target type")
+        if d.api_gateway is not None:
+            add("apiGateway", "apiGateway is not applicable for lambdaFunctionArn target type")
+        if d.outbound_auth is not None:
+            add("outboundAuth", "outboundAuth is not applicable for lambdaFunctionArn target type")
+        if has_tools:
+            add(
+                "toolDefinitions",
+                "toolDefinitions is not applicable for lambdaFunctionArn target type (tools are defined via "
+                "toolSchemaFile)",
+            )
+    if t == "mcpServer":
+        if d.compute is None and not d.endpoint:
+            add(None, "MCP Server targets require either an endpoint URL or compute configuration.")
+        if d.api_gateway is not None:
+            add("apiGateway", "apiGateway is not applicable for mcpServer target type")
+        if d.lambda_function_arn is not None:
+            add("lambdaFunctionArn", "lambdaFunctionArn is not applicable for mcpServer target type")
+    if t == "httpRuntime":
+        if d.http_runtime is None:
+            add(
+                "httpRuntime",
+                "httpRuntime targets require an httpRuntime configuration (with a runtime reference).",
+            )
+        if d.endpoint:
+            add("endpoint", "httpRuntime targets should use httpRuntime.runtimeEndpoint instead of endpoint.")
+        if d.compute is not None:
+            add("compute", "compute is not applicable for httpRuntime target type")
+        if d.api_gateway is not None:
+            add("apiGateway", "apiGateway is not applicable for httpRuntime target type")
+        if d.lambda_function_arn is not None:
+            add("lambdaFunctionArn", "lambdaFunctionArn is not applicable for httpRuntime target type")
+        if has_tools:
+            add("toolDefinitions", "toolDefinitions is not applicable for httpRuntime target type")
+    if t == "passthrough":
+        if d.passthrough is None:
+            add("passthrough", "passthrough targets require a passthrough configuration (with an endpoint).")
+        if d.endpoint:
+            add("endpoint", "passthrough targets should use passthrough.endpoint instead of endpoint.")
+        if d.compute is not None:
+            add("compute", "compute is not applicable for passthrough target type")
+        if d.api_gateway is not None:
+            add("apiGateway", "apiGateway is not applicable for passthrough target type")
+        if d.lambda_function_arn is not None:
+            add("lambdaFunctionArn", "lambdaFunctionArn is not applicable for passthrough target type")
+        if d.http_runtime is not None:
+            add("httpRuntime", "httpRuntime is not applicable for passthrough target type")
+        if has_tools:
+            add("toolDefinitions", "toolDefinitions is not applicable for passthrough target type")
+    if t == "lambda" and d.compute is None:
+        add("compute", "Lambda targets require compute configuration.")
+    if t == "lambda" and not has_tools:
+        add("toolDefinitions", "Lambda targets require at least one tool definition.")
+    if t == "connector":
+        if not d.connector_id:
+            add("connectorId", "connectorId is required for connector target type")
+        if d.compute is not None:
+            add("compute", "compute is not applicable for connector target type")
+        if d.endpoint:
+            add("endpoint", "endpoint is not applicable for connector target type")
+        if has_tools:
+            add("toolDefinitions", "toolDefinitions is not applicable for connector target type")
+        if d.api_gateway is not None:
+            add("apiGateway", "apiGateway is not applicable for connector target type")
+        if d.lambda_function_arn is not None:
+            add("lambdaFunctionArn", "lambdaFunctionArn is not applicable for connector target type")
+        if d.schema_source is not None:
+            add("schemaSource", "schemaSource is not applicable for connector target type")
+        if d.http_runtime is not None:
+            add("httpRuntime", "httpRuntime is not applicable for connector target type")
+        if d.passthrough is not None:
+            add("passthrough", "passthrough is not applicable for connector target type")
+    if t != "connector":
+        if d.connector_id:
+            add("connectorId", "connectorId only applies to connector target type")
+        if d.configurations:
+            add("configurations", "configurations only applies to connector target type")
+
+    # Centralized outbound auth validation (driven by TARGET_TYPE_AUTH_CONFIG).
+    auth_config = TARGET_TYPE_AUTH_CONFIG[t]
+    auth_type = d.outbound_auth.type if d.outbound_auth is not None else "NONE"
+    if auth_config.auth_required and auth_type == "NONE":
+        add("outboundAuth", f"{t} targets require outbound auth ({' or '.join(auth_config.valid_auth_types)})")
+    if not auth_config.valid_auth_types and auth_type != "NONE":
+        add("outboundAuth", f"{t} targets use IAM role auth; outboundAuth is not applicable")
+    if auth_config.valid_auth_types and auth_type != "NONE" and auth_type not in auth_config.valid_auth_types:
+        add("outboundAuth", f"{t} targets do not support {auth_type} outbound auth")
+    oa = d.outbound_auth
+    if oa is not None and oa.type not in ("NONE", "GATEWAY_IAM_ROLE", "JWT_PASSTHROUGH") and not oa.credential_name:
+        issues.append((("outboundAuth", "credentialName"), f"{oa.type} outbound auth requires a credentialName."))
+    if t == "passthrough" and oa is not None and oa.type == "GATEWAY_IAM_ROLE" and not oa.service:
+        issues.append(
+            (
+                ("outboundAuth", "service"),
+                "GATEWAY_IAM_ROLE outbound auth on passthrough targets requires a service name.",
+            )
+        )
+    if oa is not None and oa.type == "JWT_PASSTHROUGH" and t != "passthrough":
+        issues.append(
+            (("outboundAuth", "type"), "JWT_PASSTHROUGH outbound auth is only valid for passthrough targets.")
+        )
+    return issues
+
+
+# ============================================================================
+# Gateway
+# ============================================================================
+
+GatewayExceptionLevel = Literal["NONE", "DEBUG"]
+GATEWAY_EXCEPTION_LEVELS: Final[tuple[GatewayExceptionLevel, ...]] = get_args(GatewayExceptionLevel)
+
+PolicyEngineMode = Literal["LOG_ONLY", "ENFORCE"]
+POLICY_ENGINE_MODES: Final[tuple[PolicyEngineMode, ...]] = get_args(PolicyEngineMode)
+
+
+class GatewayPolicyEngineConfiguration(StrictModel):
+    policy_engine_name: zstr(min=1)
+    mode: PolicyEngineMode
+
+
+GatewayProtocolType = Literal["MCP", "None"]
+GATEWAY_PROTOCOL_TYPES: Final[tuple[GatewayProtocolType, ...]] = get_args(GatewayProtocolType)
+
+
+class AgentCoreGateway(StrictModel):
+    """Gateway with opinionated defaults (authorizerType NONE, semantic search on)."""
+
+    name: GatewayName
+    # Actual AWS resource name for imported gateways (CDK uses it instead of projectName-name).
+    resource_name: GatewayName | None = None
+    protocol_type: GatewayProtocolType | None = None
+    description: str | None = None
+    targets: list[AgentCoreGatewayTarget]
+    authorizer_type: GatewayAuthorizerType = "NONE"
+    authorizer_configuration: GatewayAuthorizerConfig | None = None
+    enable_semantic_search: ZBool = True
+    exception_level: GatewayExceptionLevel = "NONE"
+    policy_engine_configuration: GatewayPolicyEngineConfiguration | None = None
+    # Existing IAM execution role; when set, CDK uses it instead of creating one.
+    execution_role_arn: (
+        zstr(max=2048, pattern=r"^arn:[^:]+:iam::\d{12}:role\/.+", pattern_msg="Must be a valid IAM role ARN") | None
+    ) = None
+    tags: Tags | None = None
+
+    @model_validator(mode="after")
+    def _refine(self) -> AgentCoreGateway:
+        issues: list[Issue] = []
+        if self.authorizer_type == "CUSTOM_JWT" and (
+            self.authorizer_configuration is None or self.authorizer_configuration.custom_jwt_authorizer is None
+        ):
+            issues.append(
+                (
+                    ("authorizerConfiguration",),
+                    "customJwtAuthorizer configuration is required when authorizerType is CUSTOM_JWT",
+                )
+            )
+        # A protocolType "None" (HTTP) gateway can host any target type; only an MCP gateway is
+        # restricted from hosting the HTTP-only target types.
+        for target in self.targets:
+            if self.protocol_type != "None" and target.target_type in NON_MCP_TARGET_TYPES:
+                issues.append(
+                    (
+                        (),
+                        (
+                            f'Target "{target.name}" is {target.target_type} but gateway does not have protocolType: '
+                            '"None". Add --protocol-type None when creating the gateway.'
+                        ),
+                    )
+                )
+        raise_issues(issues, self)
+        return self
+
+
+# ============================================================================
+# MCP Runtime Tool
+# ============================================================================
+
+
+class McpRuntimeBinding(StrictModel):
+    """Grants a runtime InvokeAgentRuntime on the tool and sets its ARN in ``envVarName``."""
+
+    runtime_name: zstr(min=1)
+    env_var_name: EnvVarName
+
+
+class AgentCoreMcpRuntimeTool(StrictModel):
+    """An MCP tool server deployed as AgentCoreRuntime compute, addressed directly (not via a Gateway)."""
+
+    name: zstr(min=1)
+    tool_definition: ToolDefinition
+    compute: AgentCoreRuntimeComputeConfig
+    bindings: list[McpRuntimeBinding] | None = None
+
+
+class AgentCoreMcpSpec(TypedDict, total=False):
+    """Shape of the MCP-related fields within AgentCoreProjectSpec (previously mcp.json)."""
+
+    agentCoreGateways: list[AgentCoreGateway]
+    mcpRuntimeTools: list[AgentCoreMcpRuntimeTool]
+    unassignedTargets: list[AgentCoreGatewayTarget]
+
+
+__all__ = [
+    "API_GATEWAY_HTTP_METHODS",
+    "COMPUTE_HOSTS",
+    "CONNECTOR_ID",
+    "CONNECTOR_ID_VALUES",
+    "GATEWAY_EXCEPTION_LEVELS",
+    "GATEWAY_PROTOCOL_TYPES",
+    "GATEWAY_TARGET_TYPES",
+    "MCP_IMPLEMENTATION_LANGUAGES",
+    "MCP_TARGET_TYPES",
+    "NON_MCP_TARGET_TYPES",
+    "OUTBOUND_AUTH_TYPES",
+    "PASSTHROUGH_PROTOCOL_TYPES",
+    "POLICY_ENGINE_MODES",
+    "REAL_KB_ID_PATTERN",
+    "TARGET_TYPE_AUTH_CONFIG",
+    "AgentCoreGateway",
+    "AgentCoreGatewayTarget",
+    "AgentCoreMcpRuntimeTool",
+    "AgentCoreMcpSpec",
+    "AgentCoreRuntimeComputeConfig",
+    "ApiGatewayConfig",
+    "ApiGatewayHttpMethod",
+    "ApiGatewayToolConfiguration",
+    "ApiGatewayToolFilter",
+    "ApiGatewayToolOverride",
+    "CodeZipRuntimeConfig",
+    "ComputeHost",
+    "ConnectorConfiguration",
+    "ConnectorId",
+    "ConnectorParameterOverride",
+    "GatewayExceptionLevel",
+    "GatewayPolicyEngineConfiguration",
+    "GatewayProtocolType",
+    "GatewayTargetType",
+    "HttpRuntimeConfig",
+    "IamPolicyDocument",
+    "InlineSchemaSource",
+    "LambdaComputeConfig",
+    "LambdaFunctionArnConfig",
+    "McpImplementationLanguage",
+    "McpRuntimeBinding",
+    "OutboundAuth",
+    "OutboundAuthType",
+    "PassthroughConfig",
+    "PassthroughProtocolType",
+    "PolicyEngineMode",
+    "RuntimeConfig",
+    "S3SchemaSource",
+    "SchemaInlineSource",
+    "SchemaS3Source",
+    "SchemaSource",
+    "StickinessConfig",
+    "TargetTypeAuthConfig",
+    "ToolComputeConfig",
+    "ToolImplementationBinding",
+]