MoEngage turned 400 private APIs into agent tools with AgentCore Gateway, saving six months of engineering

AWS ML Blog · rss · 2026-10-30

An AWS ML Blog deep dive on how MoEngage made 400 internal REST APIs (25 teams, 7 Regions, VPC-private) safely callable by AI agents using Amazon Bedrock AgentCore Gateway, saving an estimated six months of platform engineering and cutting API onboarding from days to hours.

Core principle: teams don't build MCP servers—each just ships an OpenAPI spec; the AI platform team owns the MCP layer end to end.

Four constraints: no public endpoints ever; identity/tenant context injected server-side, never exposed as model-settable parameters; and server-side tool filtering, since a full 400-tool catalog would cost 20,000+ tokens per connection—client-side filtering isn't an authorization boundary.

How the gateway maps to these: managed MCP server generates tools directly from OpenAPI specs (TargetoperationId naming); Cedar policies with partial evaluation filter tools/list per principal before serialization (e.g., a QA bot never even receives write tools); managed egress over VPC Lattice removes per-API networking; built-in semantic search lets agents find tools by task description, also eliminating rename fragility.

Original post →

More from coding & agent

coding & agent channel →