AWS outlines push-based updates for its Agent Registry
AWS has outlined an event-driven architecture that automatically synchronizes AWS Agent Registry records when MCP servers gain tools or change their schemas. The design uses CloudTrail, EventBridge and Lambda to keep registry metadata current across single-account and multi-account deployments.
- AWS detailed an event-driven system for synchronizing AWS Agent Registry records.
- CloudTrail captures UpdateAgentRuntime events and EventBridge routes them to Lambda.
- Lambda queries MCP servers, compares tool schemas and updates existing records.
- The architecture supports single-account and cross-account deployments.
- AgentCore Identity handles OAuth authentication without storing client secrets in Lambda environment variables.
A response to stale MCP server metadata
The AWS Agent Registry, a capability of Amazon Bedrock AgentCore, stores records for Model Context Protocol servers and their tool schemas. When a server changes but its registry record does not, consumers can miss newly added capabilities or call tools with outdated schemas.
AWS says stale metadata can lead to unexpected runtime behavior, silent workflow deviations and reduced trust in the registry. Teams may then rely on hardcoded endpoints, informal knowledge sharing or outdated documentation instead of using the catalog as a central source of truth.
How the event-driven pipeline works
The architecture starts when a developer updates an MCP server through the AgentCore CLI or directly. The resulting UpdateAgentRuntime API call is captured by AWS CloudTrail as a management event. Amazon EventBridge matches the event and routes it to a synchronization Lambda function.
In a single-account deployment, the services communicate within the same account. In the cross-account design, the MCP server runs in Account B, while Account A owns the registry, EventBridge rule, Lambda function and CloudTrail logs. Matching events from Account B are forwarded to Account A, which acts as the registry account.
The Lambda function extracts the runtime Amazon Resource Name from the event, uses the account and Region information to construct the MCP server invocation URL, and authenticates through AgentCore Identity. It then calls the server using the MCP initialize and tools/list operations, compares the returned tools with the registry record, and updates the record when the schema has changed.
AWS says CloudTrail delivery can take approximately 5, 15 minutes. The Lambda handles one event at a time through the Amazon EventBridge invocation model and can run independently for each server that emits an update event.
Designed for existing registry records
The sample architecture updates records that were created during the MCP server's initial onboarding. It does not create new registry records, so an MCP server must already have a matching record identified by its ARN.
AgentCore Identity brokers the OAuth token exchange used by Lambda to access the target server. AWS says the credential provider stores the Cognito and OAuth configuration securely in AgentCore Identity, allowing the Lambda to authenticate without storing client secrets in its environment variables.
For organizations managing MCP servers across accounts, the design provides a way to connect runtime changes with an existing governance workflow. Its stated purpose is to keep catalog records aligned with deployed tools, helping consumers rely on the registry rather than discovering server capabilities through separate, less controlled channels.
