ReadingResearchRadarInvestment framework
Sign in / Sign up
← Back to reading
News3 min read·2026-10-21DisconfirmAI Editorial

Eon Senior DevOps Engineer Roei Zavida: Policy Size and OAuth Binding Force Hybrid Architecture After MCP Gateway Consolidates Hundreds of Tools

After deploying Amazon Bedrock AgentCore Gateway to over 100 developers, Eon Senior DevOps Engineer Roei Zavida encountered three production issues—Cedar policy size approaching its quota, OAuth state parameter incompatibility between standard MCP clients and AgentCore's session-URI binding, and tool manifest noise—resolved respectively through a DEFAULT/DYNAMIC hybrid mode, an API Gateway translation shim, and Runtime-layer filtering.

ImportanceMaterialEvidenceE3 inspectableWrite-upStandard

Original publication time 2026-10-20 23:57 GMT+8

After Eon Senior DevOps Engineer Roei Zavida deployed the company's internal MCP tool gateway to over 100 developers, he hit a problem the documentation doesn't warn you about in advance: the Cedar authorization policy's size was approaching its quota limit.

Eon is a cloud data platform company that provides resource discovery, backup, and ransomware detection across AWS, Azure, and GCP. Its engineering team needs to simultaneously check Kubernetes logs, Grafana metrics, GitHub PRs, and cloud-provider health status when investigating a production incident. Previously each developer ran about ten MCP servers locally, each with its own credentials, and onboarding took two days. They chose Amazon Bedrock AgentCore Gateway as the unified entry point, using Cedar policies to control which tools humans and agents could each invoke, and IAM cross-account role assumption to replace VPC peering. After going live, new-hire configuration dropped to about two minutes, and local MCP processes went to zero.

But what Zavida emphasizes in the blog post is not these numbers—rather, three production issues that surfaced after reaching hundred-plus scale and approximately 10,000 sessions.

Sign in / Sign up
ReadingResearchRadarInvestment framework

The first is policy size. In DEFAULT mode, the gateway pre-indexes every tool's schema, and all of these count toward Cedar policy size. Dozens of targets exposing extensive tool manifests pushed the policy toward its quota. The fix: switch high-tool-count targets to DYNAMIC mode, where the gateway forwards tools/list calls to the MCP server at request time instead of pre-indexing schemas, adding zero bytes to the policy. The trade-off is that DYNAMIC targets lose semantic search—developers cannot describe what they need in natural language and have the gateway match tools. Eon's compromise is a hybrid configuration: targets with fewer tools that require per-user OAuth consent stay on DEFAULT, while large-catalog targets use DYNAMIC.

The second is OAuth protocol mismatch. Claude Code, Cursor, and Codex expect the OAuth flow to carry a state parameter for CSRF protection, but AgentCore uses session-URI binding. Zavida's team added an Amazon API Gateway translation shim in front of the gateway so standard clients can complete authentication without modification.

The third is tool manifest noise. Some MCP servers expose hundreds of tools, but individual developers only need a small subset for their service. Eon built a Runtime-layer filtering wrapper that reduces the number of returned tools, both cutting the risk of accidental invocation and avoiding the need to force these targets onto DYNAMIC mode and lose semantic search.

The common thread across these three problems: the managed gateway solved the core pain points of scattered credentials and cross-account networking, but its default assumptions—pre-indexing all schemas, a single OAuth pattern, complete tool manifests—produced friction against real multi-account, multi-protocol environments. What Zavida offers is not a switch to a different solution, but local adaptation within the same gateway.

For teams building agentic systems, the transferable insight from this practice record is: the value of a unified MCP gateway lies in centralizing identity and policy in one place, but once scale increases, you need to prepare different access modes for tool targets with different characteristics, and leave room for a protocol translation layer.

Sources

  • 原始出处aws.amazon.com↗
Continue researching →