Securing MCP at Scale with Noma and Amazon Bedrock AgentCore Gateway

With the increased adoption of Model Context Protocol (MCP) across AI clients and
applications, organizations are looking for secure and scalable solutions to allow
employees to build and consume MCP-based tools from their preferred AI client.
Amazon Bedrock AgentCore Gateway is a fully-managed AI gateway that provides a single, secure entry point for agentic traffic—connecting agents to tools, to other agents, and to large language models (LLMs). Rather than serving only as an MCP tool gateway, Gateway routes and secures any agentic traffic through one endpoint: it converts APIs, Lambda functions, and existing services into Model Context Protocol (MCP)-compatible tools; fronts other agents and HTTP services through passthrough targets (including Agent-to-Agent (A2A) traffic); and routes inference requests across multiple model providers through a unified, model-based routing endpoint.

Early MCP security controls focused on local, stdio-based MCP servers running on employee

endpoints. That model gave security teams a natural enforcement point: the employee

workstation. But as MCP adoption moves toward centralized gateway solutions like Amazon

Bedrock AgentCore Gateway, this approach is no longer enough.

With AgentCore Gateway, tool execution moves away from the employee endpoint and into

remote runtimes, SaaS APIs, Lambda functions, internal APIs or even external MCP servers

proxied by the gateway.

This means that endpoint-only MCP controls lose visibility into the actual request path, the tool

invocation, and the request content. Security teams can no longer rely on controlling what runs

locally; they need visibility and enforcement at the gateway layer, where MCP requests and

responses actually flow.

Centralized gateways make MCP easier to manage, scale, and share across the organization,

but they also concentrate risk.

In a local MCP setup, a malicious, poisoned, or misconfiguration typically impacts only a single developer workstation or a small group of users. In a gateway-based architecture, the same

compromised MCP server, poisoned tool, misleading schema, or overly permissive target can

be exposed to many users, agents, and applications through the shared tool catalog.

Because agents rely on tool names, descriptions, schemas, and parameters to decide which

tools to call, poisoned or misleading metadata can influence agent behavior at scale. A single misconfiguration or compromised tool is enough to expose the entire organization to risk.

MCP tools are rapidly evolving from developer-focused utilities into powerful enterprise actions.

Organizations are building tools that query production databases, update tickets, access

customer records in the CRM, send messages, trigger workflows, and perform write

operations across internal systems.

As these tools accumulate more permissions, every tool call becomes a runtime security decision.

Security teams need more than proof of authentication — they need to understand what the tool is doing, which arguments are being passed, which system is being accessed, and whether the action is appropriate given the actor and context.

The same tool call might be perfectly legitimate for a security engineer investigating an incident, suspicious when initiated by a contractor, and outright prohibited for a non-human identity or autonomous agent.

These challenges demand a gateway-level security layer that can inspect, classify,

enforce, and record MCP activity across both tool calls and tool outputs.

Amazon Bedrock AgentCore Gateway serves as the enterprise control plane for exposing and consuming MCP tools at scale — centralizing tool discovery, gateway and target authentication, and connectivity to enterprise systems and networks.

Noma Runtime Protection integrates with AgentCore at the point where MCP activity

actually happens: the gateway request and response path. By leveraging AgentCore Gateway

request and response interceptors, the Noma integration inspects tool invocations before they

reach the target and scans tool outputs before they are returned to the caller.

The following use cases are based on existing customer engagements anonymized.

A support agent has access to a CRM MCP server through AgentCore Gateway. This MCP

allows support teams to summarize customer context, review open cases, and draft next steps.

A support rep asks: “Summarize the latest open cases for Acme Corp and suggest next steps.”

This is a legitimate, read-oriented request. The agent retrieves open cases and case comments

through read-only CRM tools.

A support bot uses a PostgreSQL MCP server through AgentCore Gateway to help support

teams debug customer issues. The database contains order records and operational metadata,

some of which may include sensitive customer information.

The user asks: “Show me the latest failed orders for customer ACME so I can debug the issue.”

The agent invokes the query_database tool with a query against the orders database.

The query itself is legitimate, but the returned records include fields that are not required for

debugging the failed order, including email address, phone number, shipping address, and a

payment token-like value.

Centralized gateways like AWS Bedrock AgentCore give enterprises a scalable way to

expose tools to agents and AI clients. But as MCP tools become more powerful, security has to

move into the runtime path.

By integrating with Amazon Bedrock AgentCore Gateway interceptors, Noma inspects both

sides of the MCP interaction: the tool call before it executes and the tool output before it returns

to the caller. This allows teams to enforce identity-aware and context-aware policies across

internal and external tools, without giving up the operational benefits of a centralized gateway.

With Noma and AgentCore Gateway, organizations can safely scale MCP adoption while

reducing the risk of prompt injection, unsafe tool use, sensitive data exposure, and unauthorized

agent-driven actions.