One MCP URL for Claude Code, Cursor and Codex — and the Same Gateway for an Agent Entering Under Another Identity
In a guest post co-written with Roei Zavida of Eon, developers using Claude Code, Cursor or OpenAI Codex connect through a single MCP URL, while an autonomous SRE agent running Claude on Amazon Bedrock connects to the same gateway with a different identity.
A single AgentCore MCP Gateway is the company-wide front door, and Cedar policies in ENFORCE mode decide which principals can invoke which tools. That gateway is described as a managed gateway with built-in identity federation, Cedar-based authorization policies and runtime hosting that converts local MCP servers into remote HTTP endpoints.
AI-generated discussion · Different perspectives
The premise is familiar to anyone wiring up agent tooling: agents and humans both need dozens of operational tools spread across clouds, each with its own authentication model, network boundary and access policy. The design choice worth borrowing is where the policy lives — the core security decision here was enforcing read and write boundaries through Cedar at the gateway, rather than spreading permission logic across the tools themselves.
The rejected alternative deserves more credit than it usually gets in these write-ups: a single reverse proxy aggregating every tool, with a custom authentication layer, already handled credential consolidation. What it left on the team's plate was tool protocol translation, session management and authorization logic built from scratch — and the claim is that the managed route met the requirements without custom infrastructure. That is a maintenance trade, not a capability miracle.