External Service Integration
External service integration lets AI-Starter call tools from external services in chat using the Model Context Protocol (MCP). Register MCP servers (Streamable HTTP) and OAuth authentication providers on the admin console's External Services screen, then link them to assistants. MCP servers can also authenticate with AWS IAM (SigV4).
Overview
- Register OAuth authentication providers and MCP servers on the admin console's External Services screen
- Link MCP servers in the assistant's Platform Metadata
- If the MCP server requires OAuth, users connect their account from External Service Integration in personal settings (see Account)
- Call external service tools from chat
Registering External Services
Open the External Services card from the admin console home screen and click Add New to register a service. Configure the following fields based on the service type.
OAuth Authentication Provider
Register this when each user needs to connect their own external service account. Tokens are obtained through the authorization code flow with PKCE.
Supported Method
Of the client registration methods defined by the MCP Authorization specification, AI-Starter supports only the pre-registration model — where an administrator registers a client ID and secret issued in advance by the external service. Dynamic Client Registration (DCR) and automatic authorization server metadata discovery are not supported, so you cannot connect to an MCP server that requires DCR.
| Field | Description |
|---|---|
| ID | Unique service identifier (alphanumeric, _, and - only) |
| Display Name | Name shown in the admin console and user UI |
| Client ID | OAuth client ID |
| Client Secret | OAuth client secret |
| Authorization Endpoint | URL for authorization requests |
| Token Endpoint | URL for obtaining access tokens |
| Scopes | List of scopes to request during authorization (optional) |
MCP Server
Register MCP servers that assistants can use as tools. Streamable HTTP endpoints are supported.
| Field | Description |
|---|---|
| ID | Unique service identifier (alphanumeric, _, and - only) |
| Display Name | Name shown in the admin console and user UI |
| Server URL | MCP Streamable HTTP endpoint URL |
| Auth Provider ID | Authentication method for the connection. Set the ID of a registered OAuth provider to use the user's OAuth token, or select AWS IAM Authentication to connect via AWS IAM (SigV4) (optional) |
| Allowed Tools | List of tool names to allow (all tools are allowed when omitted) |
| Denied Tools | List of tool names to deny (takes precedence over allowed tools) |
Connecting to AgentCore Gateway with AWS IAM (SigV4) Authentication
MCP servers provided by Amazon Bedrock AgentCore Gateway can be reached with AWS IAM (SigV4) instead of OAuth. When registering the server, select AWS IAM Authentication as the Auth Provider ID.
Linking to an Assistant
Link MCP servers as MCP Servers in the assistant's Platform Metadata. Currently, this is available on assistants with the BedrockClaude type.
- Open the edit screen for the target assistant in the admin console
- Set Platform Metadata type to BedrockClaude
- Add an entry in the MCP Servers section
- Set MCP Server ID to the ID of the MCP server registered on the External Services screen
- Optionally configure Tool Name Prefix / Allowed Tools / Denied Tools per assistant
For field details, see Platform Metadata - BedrockClaude.
Tool Allow/Deny Lists
You can restrict which tools are exposed both when registering an MCP server and when configuring an assistant.
- Denied tools take precedence over allowed tools
- When allowed tools are specified, only tools in the list are available
- Both the external service and assistant settings must allow a tool for it to be used