feat(gateway): add Custom JWT inbound auth for MCP gateways - #596

Closed
aidandaly24 wants to merge 1 commit into
aws:mainfrom
aidandaly24:feat/custom-jwt-gateway
Closed

feat(gateway): add Custom JWT inbound auth for MCP gateways#596
aidandaly24 wants to merge 1 commit into
aws:mainfrom
aidandaly24:feat/custom-jwt-gateway

Conversation

@aidandaly24

@aidandaly24aidandaly24 commented Mar 23, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Description

Add full Custom JWT inbound authorization support for MCP gateways, including custom claim validations matching the CFN CustomClaimValidationType structure.

Summary

  • Add Custom JWT authorizer type to the gateway TUI wizard with a dynamic constraint picker, custom claims manager (add/edit/delete), and optional OAuth client credential flow
  • Add --custom-claims <json>, --client-id, --client-secret CLI flags (renaming from --agent-client-id/--agent-client-secret)
  • Relax validation: allowedClients is no longer required — at least one of allowedAudience, allowedClients, allowedScopes, or customClaims must be provided
  • Enforce HTTPS on OIDC discovery URLs in both schema validation and CLI/TUI input
  • Add custom claims Zod schemas: ClaimMatchOperatorSchema, ClaimMatchValueSchema, InboundTokenClaimValueTypeSchema, CustomClaimValidationSchema

Changes by Category

Schema

  • src/schema/schemas/mcp.ts — Custom claims Zod schemas; refactor CustomJwtAuthorizerConfigSchema with optional fields, .strict(), .superRefine() enforcing at-least-one constraint, HTTPS enforcement
  • src/schema/schemas/deployed-state.ts — Make allowedAudience/allowedClients optional; add allowedScopes and customClaims fields

CLI Flags / Validation

  • src/cli/commands/add/types.ts — Replace agentClientId/agentClientSecret with clientId/clientSecret; add customClaims
  • src/cli/commands/add/validate.ts — At-least-one-constraint validation, --custom-claims JSON parsing, HTTPS check, renamed flags
  • src/cli/primitives/GatewayPrimitive.ts — Renamed flags, custom claims JSON parsing, conditional field spreading

TUI Wizard

  • src/cli/tui/screens/mcp/AddGatewayScreen.tsx — Major rewrite: typed JwtSubStep union, constraint picker multi-select, CustomClaimsManager component with add/edit/delete, CustomClaimForm tabbed form (Tab cycles, Left/Right cycles selects), HTTPS validation, disable raw Escape exit
  • src/cli/tui/screens/mcp/types.ts — Updated jwtConfig type for optional fields and custom claims
  • src/cli/tui/screens/mcp/useAddGatewayWizard.ts — Updated setJwtConfig parameter types
  • src/cli/tui/hooks/useCreateMcp.ts — Pass customClaims directly; rename credential fields
  • src/cli/tui/App.tsx — Remove dead PlaceholderScreen route
  • src/cli/tui/screens/PlaceholderScreen.tsx — Deleted (unused)
  • src/cli/tui/screens/index.ts — Remove PlaceholderScreen re-export

Tests

  • src/schema/schemas/__tests__/mcp.test.ts — ClaimMatchValueSchema, CustomClaimValidationSchema, HTTPS, strict, scope-only, all-empty-constraints tests
  • src/cli/commands/add/__tests__/validate.test.ts — Rewritten JWT validation: at-least-one-constraint, custom claims JSON, renamed flags
  • src/cli/commands/add/__tests__/add-gateway.test.ts — Updated flag names
  • src/cli/primitives/__tests__/GatewayPrimitive.test.ts — customClaims pipeline test suite (4 tests)
  • src/cli/tui/screens/mcp/__tests__/AddGatewayJwtConfig.test.tsx — New 652-line test: 7 groups covering full JWT wizard TUI interactions
  • src/cli/tui/screens/mcp/__tests__/finishJwtConfig.test.ts — New: validates TUI data mapping produces shapes accepted by CustomJwtAuthorizerConfigSchema
  • src/cli/tui/screens/mcp/__tests__/useAddGatewayWizard.test.tsx — Extended wizard hook tests for JWT flow, navigation, targets
  • integ-tests/tui/add-gateway-jwt.test.ts — New 415-line TUI integration test: full JWT wizard path
  • integ-tests/tui/setup.ts — New TUI integration test setup

Bug Fix

  • src/cli/cloudformation/outputs.ts — Updated comment documenting hash-suffixed output key pattern (companion CDK PR fixes the actual CfnOutput scope)

Screenshots

TUI Custom JWT Gateway Wizard Flow (13 screenshots)

Main Menu

HelpScreen

Auth Type Selection

Auth type selection showing CUSTOM_JWT

Discovery URL Input

OIDC discovery URL

Allowed Audience Input

Audience values

Allowed Clients Input

Client values

Allowed Scopes Input

Scope values

Custom Claims Prompt

Custom claims prompt

Custom Claim Form — Claim Name

Claim name input

Custom Claim Form — Value Type

Value type selector

Custom Claim Form — Operator

Operator selector

Custom Claim Form — Match Value

Match value input

Claims List

Claims list with saved claim

Confirm Review

Confirm review

Related Issue

N/A — internal feature development

Documentation PR

N/A

Companion PR

CDK constructs: https://github.com/aws/agentcore-l3-cdk-constructs/pull/93

Type of Change

  • Bug fix
  • New feature
  • Breaking change
  • Documentation update
  • Other (please describe):

Testing

How have you tested the change?

  • I ran npm run test:unit and npm run test:integ
  • I ran npm run typecheck
  • I ran npm run lint
  • If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots
  • E2E deploy test: deployed CUSTOM_JWT gateway with audiences + custom claims, verified deployed-state.json populates correctly

Checklist

  • I have read the CONTRIBUTING document
  • I have added any necessary tests that prove my fix is effective or my feature works
  • I have updated the documentation accordingly
  • I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
  • My changes generate no new warnings
  • Any dependent changes have been merged and published

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

@aidandaly24
aidandaly24 requested a review from a teamMarch 23, 2026 02:19
@github-actionsgithub-actionsBot added the size/xl PR size: XL label Mar 23, 2026
@aidandaly24
feat(gateway): add Custom JWT inbound auth for MCP gateways
1a7a386
Add CUSTOM_JWT authorizer support to the gateway creation flow:
- TUI wizard for JWT configuration (discovery URL, audiences, clients,
scopes, custom claim validations with string/string-array match types)
- CLI flags for non-interactive gateway creation with JWT auth
- Schema validation with OIDC discovery URL HTTPS enforcement,
XOR validation for claim match values, and .strict() on config
- Fix gateway output key comment to match Gateway{Name} pattern
(CDK fix in companion agentcore-cdk PR)
@aidandaly24
aidandaly24force-pushed the feat/custom-jwt-gateway branch from 00845c0 to 1a7a386CompareMarch 23, 2026 02:23
@github-actionsgithub-actionsBot added size/xl PR size: XL and removed size/xl PR size: XL labels Mar 23, 2026
@github-actionsgithub-actionsBot added size/xl PR size: XL and removed size/xl PR size: XL labels Mar 23, 2026
@aidandaly24
aidandaly24force-pushed the feat/custom-jwt-gateway branch from 6cdbf0b to 1a7a386CompareMarch 23, 2026 02:32
@github-actionsgithub-actionsBot added size/xl PR size: XL and removed size/xl PR size: XL labels Mar 23, 2026
This was referenced Mar 23, 2026
Merged
Merged
Merged
@aidandaly24

aidandaly24 commented Mar 23, 2026

Copy link
Copy Markdown
ContributorAuthor

This PR has been split into 3 smaller, independently reviewable PRs:

  1. fix(tui): remove dead PlaceholderScreen and fix gateway wizard UX #597 — fix: remove dead PlaceholderScreen code and fix gateway confirm display (bug fixes & cleanup)
  2. fix(gateway): harden inbound auth schema and rename credential flags #598 — fix(gateway): harden inbound auth schema and rename credential flags (schema hardening + flag rename)
  3. feat(gateway): add custom claims validation and TUI wizard for JWT auth #599 — feat(gateway): add custom claims validation and TUI wizard for JWT auth (custom claims feature, stacked on fix(gateway): harden inbound auth schema and rename credential flags #598)

Plus the existing CDK PR:
4. aws/agentcore-l3-cdk-constructs#93 — CDK construct changes (stays as-is)

Merge order: #597 (independent) → #598 (independent) → #599 (rebase onto main after #598 merges) → CDK #93 (independent)

Closing this in favor of the split PRs.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

size/xlPR size: XL

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@aidandaly24
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
feat(gateway): add Custom JWT inbound auth for MCP gateways - #596
Closed
aidandaly24 wants to merge 1 commit into
aws:mainfrom 
aidandaly24:feat/custom-jwt-gateway
Closed
feat(gateway): add Custom JWT inbound auth for MCP gateways#596
aidandaly24 wants to merge 1 commit into
aws:mainfrom 
aidandaly24:feat/custom-jwt-gateway
Conversation
@aidandaly24
@aidandaly24aidandaly24
commented
Mar 23, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Description
Add full Custom JWT inbound authorization support for MCP gateways, including custom claim validations matching the CFN CustomClaimValidationType structure.
Summary
  • Add Custom JWT authorizer type to the gateway TUI wizard with a dynamic constraint picker, custom claims manager (add/edit/delete), and optional OAuth client credential flow
  • Add --custom-claims <json>, --client-id, --client-secret CLI flags (renaming from --agent-client-id/--agent-client-secret)
  • Relax validation: allowedClients is no longer required — at least one of allowedAudience, allowedClients, allowedScopes, or customClaims must be provided
  • Enforce HTTPS on OIDC discovery URLs in both schema validation and CLI/TUI input
  • Add custom claims Zod schemas: ClaimMatchOperatorSchema, ClaimMatchValueSchema, InboundTokenClaimValueTypeSchema, CustomClaimValidationSchema
Changes by Category
Schema
  • src/schema/schemas/mcp.ts — Custom claims Zod schemas; refactor CustomJwtAuthorizerConfigSchema with optional fields, .strict(), .superRefine() enforcing at-least-one constraint, HTTPS enforcement
  • src/schema/schemas/deployed-state.ts — Make allowedAudience/allowedClients optional; add allowedScopes and customClaims fields
CLI Flags / Validation
  • src/cli/commands/add/types.ts — Replace agentClientId/agentClientSecret with clientId/clientSecret; add customClaims
  • src/cli/commands/add/validate.ts — At-least-one-constraint validation, --custom-claims JSON parsing, HTTPS check, renamed flags
  • src/cli/primitives/GatewayPrimitive.ts — Renamed flags, custom claims JSON parsing, conditional field spreading
TUI Wizard
  • src/cli/tui/screens/mcp/AddGatewayScreen.tsx — Major rewrite: typed JwtSubStep union, constraint picker multi-select, CustomClaimsManager component with add/edit/delete, CustomClaimForm tabbed form (Tab cycles, Left/Right cycles selects), HTTPS validation, disable raw Escape exit
  • src/cli/tui/screens/mcp/types.ts — Updated jwtConfig type for optional fields and custom claims
  • src/cli/tui/screens/mcp/useAddGatewayWizard.ts — Updated setJwtConfig parameter types
  • src/cli/tui/hooks/useCreateMcp.ts — Pass customClaims directly; rename credential fields
  • src/cli/tui/App.tsx — Remove dead PlaceholderScreen route
  • src/cli/tui/screens/PlaceholderScreen.tsx — Deleted (unused)
  • src/cli/tui/screens/index.ts — Remove PlaceholderScreen re-export
Tests
  • src/schema/schemas/__tests__/mcp.test.ts — ClaimMatchValueSchema, CustomClaimValidationSchema, HTTPS, strict, scope-only, all-empty-constraints tests
  • src/cli/commands/add/__tests__/validate.test.ts — Rewritten JWT validation: at-least-one-constraint, custom claims JSON, renamed flags
  • src/cli/commands/add/__tests__/add-gateway.test.ts — Updated flag names
  • src/cli/primitives/__tests__/GatewayPrimitive.test.ts — customClaims pipeline test suite (4 tests)
  • src/cli/tui/screens/mcp/__tests__/AddGatewayJwtConfig.test.tsx — New 652-line test: 7 groups covering full JWT wizard TUI interactions
  • src/cli/tui/screens/mcp/__tests__/finishJwtConfig.test.ts — New: validates TUI data mapping produces shapes accepted by CustomJwtAuthorizerConfigSchema
  • src/cli/tui/screens/mcp/__tests__/useAddGatewayWizard.test.tsx — Extended wizard hook tests for JWT flow, navigation, targets
  • integ-tests/tui/add-gateway-jwt.test.ts — New 415-line TUI integration test: full JWT wizard path
  • integ-tests/tui/setup.ts — New TUI integration test setup
Bug Fix
  • src/cli/cloudformation/outputs.ts — Updated comment documenting hash-suffixed output key pattern (companion CDK PR fixes the actual CfnOutput scope)
Screenshots
TUI Custom JWT Gateway Wizard Flow (13 screenshots)
Main Menu
HelpScreen
Auth Type Selection
Auth type selection showing CUSTOM_JWT
Discovery URL Input
OIDC discovery URL
Allowed Audience Input
Audience values
Allowed Clients Input
Client values
Allowed Scopes Input
Scope values
Custom Claims Prompt
Custom claims prompt
Custom Claim Form — Claim Name
Claim name input
Custom Claim Form — Value Type
Value type selector
Custom Claim Form — Operator
Operator selector
Custom Claim Form — Match Value
Match value input
Claims List
Claims list with saved claim
Confirm Review
Confirm review
Related Issue
N/A — internal feature development
Documentation PR
N/A
Companion PR
CDK constructs: https://github.com/aws/agentcore-l3-cdk-constructs/pull/93
Type of Change
  •  Bug fix
  •  New feature
  •  Breaking change
  •  Documentation update
  •  Other (please describe):
Testing
How have you tested the change?
  •  I ran npm run test:unit and npm run test:integ
  •  I ran npm run typecheck
  •  I ran npm run lint
  •  If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots
  •  E2E deploy test: deployed CUSTOM_JWT gateway with audiences + custom claims, verified deployed-state.json populates correctly
Checklist
  •  I have read the CONTRIBUTING document
  •  I have added any necessary tests that prove my fix is effective or my feature works
  •  I have updated the documentation accordingly
  •  I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
  •  My changes generate no new warnings
  •  Any dependent changes have been merged and published
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the

terms of your choice.
@aidandaly24
aidandaly24
requested a review
from a teamMarch 23, 2026 02:19
@github-actionsgithub-actionsBot
added
the 
size/xl
PR size: XL
label
Mar 23, 2026
@aidandaly24
feat(gateway): add Custom JWT inbound auth for MCP gateways
1a7a386
Add CUSTOM_JWT authorizer support to the gateway creation flow:
- TUI wizard for JWT configuration (discovery URL, audiences, clients,
scopes, custom claim validations with string/string-array match types)
- CLI flags for non-interactive gateway creation with JWT auth
- Schema validation with OIDC discovery URL HTTPS enforcement,
XOR validation for claim match values, and .strict() on config
- Fix gateway output key comment to match Gateway{Name} pattern
(CDK fix in companion agentcore-cdk PR)
@aidandaly24
aidandaly24force-pushed
the
feat/custom-jwt-gateway
branch
from
00845c0 to
1a7a386CompareMarch 23, 2026 02:23
@github-actionsgithub-actionsBot
added

size/xl
PR size: XL
and removed

size/xl
PR size: XL
labels
Mar 23, 2026
@github-actionsgithub-actionsBot
added

size/xl
PR size: XL
and removed

size/xl
PR size: XL
labels
Mar 23, 2026
@aidandaly24
aidandaly24force-pushed
the
feat/custom-jwt-gateway
branch
from
6cdbf0b to
1a7a386CompareMarch 23, 2026 02:32
@github-actionsgithub-actionsBot
added

size/xl
PR size: XL
and removed

size/xl
PR size: XL
labels
Mar 23, 2026

This was referenced Mar 23, 2026
 Merged

 Merged

 Merged

@aidandaly24
aidandaly24
commented
Mar 23, 2026

Copy link


Copy Markdown

ContributorAuthor
This PR has been split into 3 smaller, independently reviewable PRs:
  1. fix(tui): remove dead PlaceholderScreen and fix gateway wizard UX #597 — fix: remove dead PlaceholderScreen code and fix gateway confirm display (bug fixes & cleanup)
  2. fix(gateway): harden inbound auth schema and rename credential flags #598 — fix(gateway): harden inbound auth schema and rename credential flags (schema hardening + flag rename)
  3. feat(gateway): add custom claims validation and TUI wizard for JWT auth #599 — feat(gateway): add custom claims validation and TUI wizard for JWT auth (custom claims feature, stacked on fix(gateway): harden inbound auth schema and rename credential flags #598)
Plus the existing CDK PR:

4. aws/agentcore-l3-cdk-constructs#93 — CDK construct changes (stays as-is)
Merge order: #597 (independent) → #598 (independent) → #599 (rebase onto main after #598 merges) → CDK #93 (independent)
Closing this in favor of the split PRs.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

size/xlPR size: XL

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@aidandaly24

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(gateway): add Custom JWT inbound auth for MCP gateways - #596
Closed
aidandaly24 wants to merge 1 commit into
aws:mainfrom 
aidandaly24:feat/custom-jwt-gateway
Closed
feat(gateway): add Custom JWT inbound auth for MCP gateways#596
aidandaly24 wants to merge 1 commit into
aws:mainfrom 
aidandaly24:feat/custom-jwt-gateway
Conversation
@aidandaly24
@aidandaly24aidandaly24
commented
Mar 23, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Description
Add full Custom JWT inbound authorization support for MCP gateways, including custom claim validations matching the CFN CustomClaimValidationType structure.
Summary
  • Add Custom JWT authorizer type to the gateway TUI wizard with a dynamic constraint picker, custom claims manager (add/edit/delete), and optional OAuth client credential flow
  • Add --custom-claims <json>, --client-id, --client-secret CLI flags (renaming from --agent-client-id/--agent-client-secret)
  • Relax validation: allowedClients is no longer required — at least one of allowedAudience, allowedClients, allowedScopes, or customClaims must be provided
  • Enforce HTTPS on OIDC discovery URLs in both schema validation and CLI/TUI input
  • Add custom claims Zod schemas: ClaimMatchOperatorSchema, ClaimMatchValueSchema, InboundTokenClaimValueTypeSchema, CustomClaimValidationSchema
Changes by Category
Schema
  • src/schema/schemas/mcp.ts — Custom claims Zod schemas; refactor CustomJwtAuthorizerConfigSchema with optional fields, .strict(), .superRefine() enforcing at-least-one constraint, HTTPS enforcement
  • src/schema/schemas/deployed-state.ts — Make allowedAudience/allowedClients optional; add allowedScopes and customClaims fields
CLI Flags / Validation
  • src/cli/commands/add/types.ts — Replace agentClientId/agentClientSecret with clientId/clientSecret; add customClaims
  • src/cli/commands/add/validate.ts — At-least-one-constraint validation, --custom-claims JSON parsing, HTTPS check, renamed flags
  • src/cli/primitives/GatewayPrimitive.ts — Renamed flags, custom claims JSON parsing, conditional field spreading
TUI Wizard
  • src/cli/tui/screens/mcp/AddGatewayScreen.tsx — Major rewrite: typed JwtSubStep union, constraint picker multi-select, CustomClaimsManager component with add/edit/delete, CustomClaimForm tabbed form (Tab cycles, Left/Right cycles selects), HTTPS validation, disable raw Escape exit
  • src/cli/tui/screens/mcp/types.ts — Updated jwtConfig type for optional fields and custom claims
  • src/cli/tui/screens/mcp/useAddGatewayWizard.ts — Updated setJwtConfig parameter types
  • src/cli/tui/hooks/useCreateMcp.ts — Pass customClaims directly; rename credential fields
  • src/cli/tui/App.tsx — Remove dead PlaceholderScreen route
  • src/cli/tui/screens/PlaceholderScreen.tsx — Deleted (unused)
  • src/cli/tui/screens/index.ts — Remove PlaceholderScreen re-export
Tests
  • src/schema/schemas/__tests__/mcp.test.ts — ClaimMatchValueSchema, CustomClaimValidationSchema, HTTPS, strict, scope-only, all-empty-constraints tests
  • src/cli/commands/add/__tests__/validate.test.ts — Rewritten JWT validation: at-least-one-constraint, custom claims JSON, renamed flags
  • src/cli/commands/add/__tests__/add-gateway.test.ts — Updated flag names
  • src/cli/primitives/__tests__/GatewayPrimitive.test.ts — customClaims pipeline test suite (4 tests)
  • src/cli/tui/screens/mcp/__tests__/AddGatewayJwtConfig.test.tsx — New 652-line test: 7 groups covering full JWT wizard TUI interactions
  • src/cli/tui/screens/mcp/__tests__/finishJwtConfig.test.ts — New: validates TUI data mapping produces shapes accepted by CustomJwtAuthorizerConfigSchema
  • src/cli/tui/screens/mcp/__tests__/useAddGatewayWizard.test.tsx — Extended wizard hook tests for JWT flow, navigation, targets
  • integ-tests/tui/add-gateway-jwt.test.ts — New 415-line TUI integration test: full JWT wizard path
  • integ-tests/tui/setup.ts — New TUI integration test setup
Bug Fix
  • src/cli/cloudformation/outputs.ts — Updated comment documenting hash-suffixed output key pattern (companion CDK PR fixes the actual CfnOutput scope)
Screenshots
TUI Custom JWT Gateway Wizard Flow (13 screenshots)
Main Menu
HelpScreen
Auth Type Selection
Auth type selection showing CUSTOM_JWT
Discovery URL Input
OIDC discovery URL
Allowed Audience Input
Audience values
Allowed Clients Input
Client values
Allowed Scopes Input
Scope values
Custom Claims Prompt
Custom claims prompt
Custom Claim Form — Claim Name
Claim name input
Custom Claim Form — Value Type
Value type selector
Custom Claim Form — Operator
Operator selector
Custom Claim Form — Match Value
Match value input
Claims List
Claims list with saved claim
Confirm Review
Confirm review
Related Issue
N/A — internal feature development
Documentation PR
N/A
Companion PR
CDK constructs: https://github.com/aws/agentcore-l3-cdk-constructs/pull/93
Type of Change
  •  Bug fix
  •  New feature
  •  Breaking change
  •  Documentation update
  •  Other (please describe):
Testing
How have you tested the change?
  •  I ran npm run test:unit and npm run test:integ
  •  I ran npm run typecheck
  •  I ran npm run lint
  •  If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots
  •  E2E deploy test: deployed CUSTOM_JWT gateway with audiences + custom claims, verified deployed-state.json populates correctly
Checklist
  •  I have read the CONTRIBUTING document
  •  I have added any necessary tests that prove my fix is effective or my feature works
  •  I have updated the documentation accordingly
  •  I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
  •  My changes generate no new warnings
  •  Any dependent changes have been merged and published
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the

terms of your choice.
@aidandaly24
aidandaly24
requested a review
from a teamMarch 23, 2026 02:19
@github-actionsgithub-actionsBot
added
the 
size/xl
PR size: XL
label
Mar 23, 2026
@aidandaly24
feat(gateway): add Custom JWT inbound auth for MCP gateways
1a7a386
Add CUSTOM_JWT authorizer support to the gateway creation flow:
- TUI wizard for JWT configuration (discovery URL, audiences, clients,
scopes, custom claim validations with string/string-array match types)
- CLI flags for non-interactive gateway creation with JWT auth
- Schema validation with OIDC discovery URL HTTPS enforcement,
XOR validation for claim match values, and .strict() on config
- Fix gateway output key comment to match Gateway{Name} pattern
(CDK fix in companion agentcore-cdk PR)
@aidandaly24
aidandaly24force-pushed
the
feat/custom-jwt-gateway
branch
from
00845c0 to
1a7a386CompareMarch 23, 2026 02:23
@github-actionsgithub-actionsBot
added

size/xl
PR size: XL
and removed

size/xl
PR size: XL
labels
Mar 23, 2026
@github-actionsgithub-actionsBot
added

size/xl
PR size: XL
and removed

size/xl
PR size: XL
labels
Mar 23, 2026
@aidandaly24
aidandaly24force-pushed
the
feat/custom-jwt-gateway
branch
from
6cdbf0b to
1a7a386CompareMarch 23, 2026 02:32
@github-actionsgithub-actionsBot
added

size/xl
PR size: XL
and removed

size/xl
PR size: XL
labels
Mar 23, 2026

This was referenced Mar 23, 2026
 Merged

 Merged

 Merged

@aidandaly24
aidandaly24
commented
Mar 23, 2026

Copy link


Copy Markdown

ContributorAuthor
This PR has been split into 3 smaller, independently reviewable PRs:
  1. fix(tui): remove dead PlaceholderScreen and fix gateway wizard UX #597 — fix: remove dead PlaceholderScreen code and fix gateway confirm display (bug fixes & cleanup)
  2. fix(gateway): harden inbound auth schema and rename credential flags #598 — fix(gateway): harden inbound auth schema and rename credential flags (schema hardening + flag rename)
  3. feat(gateway): add custom claims validation and TUI wizard for JWT auth #599 — feat(gateway): add custom claims validation and TUI wizard for JWT auth (custom claims feature, stacked on fix(gateway): harden inbound auth schema and rename credential flags #598)
Plus the existing CDK PR:

4. aws/agentcore-l3-cdk-constructs#93 — CDK construct changes (stays as-is)
Merge order: #597 (independent) → #598 (independent) → #599 (rebase onto main after #598 merges) → CDK #93 (independent)
Closing this in favor of the split PRs.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

size/xlPR size: XL

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@aidandaly24

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(gateway): add Custom JWT inbound auth for MCP gateways - #596
Closed
aidandaly24 wants to merge 1 commit into
aws:mainfrom 
aidandaly24:feat/custom-jwt-gateway
Closed
feat(gateway): add Custom JWT inbound auth for MCP gateways#596
aidandaly24 wants to merge 1 commit into
aws:mainfrom 
aidandaly24:feat/custom-jwt-gateway
Conversation
@aidandaly24
@aidandaly24aidandaly24
commented
Mar 23, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Description
Add full Custom JWT inbound authorization support for MCP gateways, including custom claim validations matching the CFN CustomClaimValidationType structure.
Summary
  • Add Custom JWT authorizer type to the gateway TUI wizard with a dynamic constraint picker, custom claims manager (add/edit/delete), and optional OAuth client credential flow
  • Add --custom-claims <json>, --client-id, --client-secret CLI flags (renaming from --agent-client-id/--agent-client-secret)
  • Relax validation: allowedClients is no longer required — at least one of allowedAudience, allowedClients, allowedScopes, or customClaims must be provided
  • Enforce HTTPS on OIDC discovery URLs in both schema validation and CLI/TUI input
  • Add custom claims Zod schemas: ClaimMatchOperatorSchema, ClaimMatchValueSchema, InboundTokenClaimValueTypeSchema, CustomClaimValidationSchema
Changes by Category
Schema
  • src/schema/schemas/mcp.ts — Custom claims Zod schemas; refactor CustomJwtAuthorizerConfigSchema with optional fields, .strict(), .superRefine() enforcing at-least-one constraint, HTTPS enforcement
  • src/schema/schemas/deployed-state.ts — Make allowedAudience/allowedClients optional; add allowedScopes and customClaims fields
CLI Flags / Validation
  • src/cli/commands/add/types.ts — Replace agentClientId/agentClientSecret with clientId/clientSecret; add customClaims
  • src/cli/commands/add/validate.ts — At-least-one-constraint validation, --custom-claims JSON parsing, HTTPS check, renamed flags
  • src/cli/primitives/GatewayPrimitive.ts — Renamed flags, custom claims JSON parsing, conditional field spreading
TUI Wizard
  • src/cli/tui/screens/mcp/AddGatewayScreen.tsx — Major rewrite: typed JwtSubStep union, constraint picker multi-select, CustomClaimsManager component with add/edit/delete, CustomClaimForm tabbed form (Tab cycles, Left/Right cycles selects), HTTPS validation, disable raw Escape exit
  • src/cli/tui/screens/mcp/types.ts — Updated jwtConfig type for optional fields and custom claims
  • src/cli/tui/screens/mcp/useAddGatewayWizard.ts — Updated setJwtConfig parameter types
  • src/cli/tui/hooks/useCreateMcp.ts — Pass customClaims directly; rename credential fields
  • src/cli/tui/App.tsx — Remove dead PlaceholderScreen route
  • src/cli/tui/screens/PlaceholderScreen.tsx — Deleted (unused)
  • src/cli/tui/screens/index.ts — Remove PlaceholderScreen re-export
Tests
  • src/schema/schemas/__tests__/mcp.test.ts — ClaimMatchValueSchema, CustomClaimValidationSchema, HTTPS, strict, scope-only, all-empty-constraints tests
  • src/cli/commands/add/__tests__/validate.test.ts — Rewritten JWT validation: at-least-one-constraint, custom claims JSON, renamed flags
  • src/cli/commands/add/__tests__/add-gateway.test.ts — Updated flag names
  • src/cli/primitives/__tests__/GatewayPrimitive.test.ts — customClaims pipeline test suite (4 tests)
  • src/cli/tui/screens/mcp/__tests__/AddGatewayJwtConfig.test.tsx — New 652-line test: 7 groups covering full JWT wizard TUI interactions
  • src/cli/tui/screens/mcp/__tests__/finishJwtConfig.test.ts — New: validates TUI data mapping produces shapes accepted by CustomJwtAuthorizerConfigSchema
  • src/cli/tui/screens/mcp/__tests__/useAddGatewayWizard.test.tsx — Extended wizard hook tests for JWT flow, navigation, targets
  • integ-tests/tui/add-gateway-jwt.test.ts — New 415-line TUI integration test: full JWT wizard path
  • integ-tests/tui/setup.ts — New TUI integration test setup
Bug Fix
  • src/cli/cloudformation/outputs.ts — Updated comment documenting hash-suffixed output key pattern (companion CDK PR fixes the actual CfnOutput scope)
Screenshots
TUI Custom JWT Gateway Wizard Flow (13 screenshots)
Main Menu
HelpScreen
Auth Type Selection
Auth type selection showing CUSTOM_JWT
Discovery URL Input
OIDC discovery URL
Allowed Audience Input
Audience values
Allowed Clients Input
Client values
Allowed Scopes Input
Scope values
Custom Claims Prompt
Custom claims prompt
Custom Claim Form — Claim Name
Claim name input
Custom Claim Form — Value Type
Value type selector
Custom Claim Form — Operator
Operator selector
Custom Claim Form — Match Value
Match value input
Claims List
Claims list with saved claim
Confirm Review
Confirm review
Related Issue
N/A — internal feature development
Documentation PR
N/A
Companion PR
CDK constructs: https://github.com/aws/agentcore-l3-cdk-constructs/pull/93
Type of Change
  •  Bug fix
  •  New feature
  •  Breaking change
  •  Documentation update
  •  Other (please describe):
Testing
How have you tested the change?
  •  I ran npm run test:unit and npm run test:integ
  •  I ran npm run typecheck
  •  I ran npm run lint
  •  If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots
  •  E2E deploy test: deployed CUSTOM_JWT gateway with audiences + custom claims, verified deployed-state.json populates correctly
Checklist
  •  I have read the CONTRIBUTING document
  •  I have added any necessary tests that prove my fix is effective or my feature works
  •  I have updated the documentation accordingly
  •  I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
  •  My changes generate no new warnings
  •  Any dependent changes have been merged and published
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the

terms of your choice.
@aidandaly24
aidandaly24
requested a review
from a teamMarch 23, 2026 02:19
@github-actionsgithub-actionsBot
added
the 
size/xl
PR size: XL
label
Mar 23, 2026
@aidandaly24
feat(gateway): add Custom JWT inbound auth for MCP gateways
1a7a386
Add CUSTOM_JWT authorizer support to the gateway creation flow:
- TUI wizard for JWT configuration (discovery URL, audiences, clients,
scopes, custom claim validations with string/string-array match types)
- CLI flags for non-interactive gateway creation with JWT auth
- Schema validation with OIDC discovery URL HTTPS enforcement,
XOR validation for claim match values, and .strict() on config
- Fix gateway output key comment to match Gateway{Name} pattern
(CDK fix in companion agentcore-cdk PR)
@aidandaly24
aidandaly24force-pushed
the
feat/custom-jwt-gateway
branch
from
00845c0 to
1a7a386CompareMarch 23, 2026 02:23
@github-actionsgithub-actionsBot
added

size/xl
PR size: XL
and removed

size/xl
PR size: XL
labels
Mar 23, 2026
@github-actionsgithub-actionsBot
added

size/xl
PR size: XL
and removed

size/xl
PR size: XL
labels
Mar 23, 2026
@aidandaly24
aidandaly24force-pushed
the
feat/custom-jwt-gateway
branch
from
6cdbf0b to
1a7a386CompareMarch 23, 2026 02:32
@github-actionsgithub-actionsBot
added

size/xl
PR size: XL
and removed

size/xl
PR size: XL
labels
Mar 23, 2026

This was referenced Mar 23, 2026
 Merged

 Merged

 Merged

@aidandaly24
aidandaly24
commented
Mar 23, 2026

Copy link


Copy Markdown

ContributorAuthor
This PR has been split into 3 smaller, independently reviewable PRs:
  1. fix(tui): remove dead PlaceholderScreen and fix gateway wizard UX #597 — fix: remove dead PlaceholderScreen code and fix gateway confirm display (bug fixes & cleanup)
  2. fix(gateway): harden inbound auth schema and rename credential flags #598 — fix(gateway): harden inbound auth schema and rename credential flags (schema hardening + flag rename)
  3. feat(gateway): add custom claims validation and TUI wizard for JWT auth #599 — feat(gateway): add custom claims validation and TUI wizard for JWT auth (custom claims feature, stacked on fix(gateway): harden inbound auth schema and rename credential flags #598)
Plus the existing CDK PR:

4. aws/agentcore-l3-cdk-constructs#93 — CDK construct changes (stays as-is)
Merge order: #597 (independent) → #598 (independent) → #599 (rebase onto main after #598 merges) → CDK #93 (independent)
Closing this in favor of the split PRs.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

size/xlPR size: XL

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@aidandaly24

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
feat(gateway): add Custom JWT inbound auth for MCP gateways - #596
Closed
aidandaly24 wants to merge 1 commit into
aws:mainfrom 
aidandaly24:feat/custom-jwt-gateway
Closed
feat(gateway): add Custom JWT inbound auth for MCP gateways#596
aidandaly24 wants to merge 1 commit into
aws:mainfrom 
aidandaly24:feat/custom-jwt-gateway
Conversation
@aidandaly24
@aidandaly24aidandaly24
commented
Mar 23, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Description
Add full Custom JWT inbound authorization support for MCP gateways, including custom claim validations matching the CFN CustomClaimValidationType structure.
Summary
  • Add Custom JWT authorizer type to the gateway TUI wizard with a dynamic constraint picker, custom claims manager (add/edit/delete), and optional OAuth client credential flow
  • Add --custom-claims <json>, --client-id, --client-secret CLI flags (renaming from --agent-client-id/--agent-client-secret)
  • Relax validation: allowedClients is no longer required — at least one of allowedAudience, allowedClients, allowedScopes, or customClaims must be provided
  • Enforce HTTPS on OIDC discovery URLs in both schema validation and CLI/TUI input
  • Add custom claims Zod schemas: ClaimMatchOperatorSchema, ClaimMatchValueSchema, InboundTokenClaimValueTypeSchema, CustomClaimValidationSchema
Changes by Category
Schema
  • src/schema/schemas/mcp.ts — Custom claims Zod schemas; refactor CustomJwtAuthorizerConfigSchema with optional fields, .strict(), .superRefine() enforcing at-least-one constraint, HTTPS enforcement
  • src/schema/schemas/deployed-state.ts — Make allowedAudience/allowedClients optional; add allowedScopes and customClaims fields
CLI Flags / Validation
  • src/cli/commands/add/types.ts — Replace agentClientId/agentClientSecret with clientId/clientSecret; add customClaims
  • src/cli/commands/add/validate.ts — At-least-one-constraint validation, --custom-claims JSON parsing, HTTPS check, renamed flags
  • src/cli/primitives/GatewayPrimitive.ts — Renamed flags, custom claims JSON parsing, conditional field spreading
TUI Wizard
  • src/cli/tui/screens/mcp/AddGatewayScreen.tsx — Major rewrite: typed JwtSubStep union, constraint picker multi-select, CustomClaimsManager component with add/edit/delete, CustomClaimForm tabbed form (Tab cycles, Left/Right cycles selects), HTTPS validation, disable raw Escape exit
  • src/cli/tui/screens/mcp/types.ts — Updated jwtConfig type for optional fields and custom claims
  • src/cli/tui/screens/mcp/useAddGatewayWizard.ts — Updated setJwtConfig parameter types
  • src/cli/tui/hooks/useCreateMcp.ts — Pass customClaims directly; rename credential fields
  • src/cli/tui/App.tsx — Remove dead PlaceholderScreen route
  • src/cli/tui/screens/PlaceholderScreen.tsx — Deleted (unused)
  • src/cli/tui/screens/index.ts — Remove PlaceholderScreen re-export
Tests
  • src/schema/schemas/__tests__/mcp.test.ts — ClaimMatchValueSchema, CustomClaimValidationSchema, HTTPS, strict, scope-only, all-empty-constraints tests
  • src/cli/commands/add/__tests__/validate.test.ts — Rewritten JWT validation: at-least-one-constraint, custom claims JSON, renamed flags
  • src/cli/commands/add/__tests__/add-gateway.test.ts — Updated flag names
  • src/cli/primitives/__tests__/GatewayPrimitive.test.ts — customClaims pipeline test suite (4 tests)
  • src/cli/tui/screens/mcp/__tests__/AddGatewayJwtConfig.test.tsx — New 652-line test: 7 groups covering full JWT wizard TUI interactions
  • src/cli/tui/screens/mcp/__tests__/finishJwtConfig.test.ts — New: validates TUI data mapping produces shapes accepted by CustomJwtAuthorizerConfigSchema
  • src/cli/tui/screens/mcp/__tests__/useAddGatewayWizard.test.tsx — Extended wizard hook tests for JWT flow, navigation, targets
  • integ-tests/tui/add-gateway-jwt.test.ts — New 415-line TUI integration test: full JWT wizard path
  • integ-tests/tui/setup.ts — New TUI integration test setup
Bug Fix
  • src/cli/cloudformation/outputs.ts — Updated comment documenting hash-suffixed output key pattern (companion CDK PR fixes the actual CfnOutput scope)
Screenshots
TUI Custom JWT Gateway Wizard Flow (13 screenshots)
Main Menu
HelpScreen
Auth Type Selection
Auth type selection showing CUSTOM_JWT
Discovery URL Input
OIDC discovery URL
Allowed Audience Input
Audience values
Allowed Clients Input
Client values
Allowed Scopes Input
Scope values
Custom Claims Prompt
Custom claims prompt
Custom Claim Form — Claim Name
Claim name input
Custom Claim Form — Value Type
Value type selector
Custom Claim Form — Operator
Operator selector
Custom Claim Form — Match Value
Match value input
Claims List
Claims list with saved claim
Confirm Review
Confirm review
Related Issue
N/A — internal feature development
Documentation PR
N/A
Companion PR
CDK constructs: https://github.com/aws/agentcore-l3-cdk-constructs/pull/93
Type of Change
  •  Bug fix
  •  New feature
  •  Breaking change
  •  Documentation update
  •  Other (please describe):
Testing
How have you tested the change?
  •  I ran npm run test:unit and npm run test:integ
  •  I ran npm run typecheck
  •  I ran npm run lint
  •  If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots
  •  E2E deploy test: deployed CUSTOM_JWT gateway with audiences + custom claims, verified deployed-state.json populates correctly
Checklist
  •  I have read the CONTRIBUTING document
  •  I have added any necessary tests that prove my fix is effective or my feature works
  •  I have updated the documentation accordingly
  •  I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
  •  My changes generate no new warnings
  •  Any dependent changes have been merged and published
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the

terms of your choice.
@aidandaly24
aidandaly24
requested a review
from a teamMarch 23, 2026 02:19
@github-actionsgithub-actionsBot
added
the 
size/xl
PR size: XL
label
Mar 23, 2026
@aidandaly24
feat(gateway): add Custom JWT inbound auth for MCP gateways
1a7a386
Add CUSTOM_JWT authorizer support to the gateway creation flow:
- TUI wizard for JWT configuration (discovery URL, audiences, clients,
scopes, custom claim validations with string/string-array match types)
- CLI flags for non-interactive gateway creation with JWT auth
- Schema validation with OIDC discovery URL HTTPS enforcement,
XOR validation for claim match values, and .strict() on config
- Fix gateway output key comment to match Gateway{Name} pattern
(CDK fix in companion agentcore-cdk PR)
@aidandaly24
aidandaly24force-pushed
the
feat/custom-jwt-gateway
branch
from
00845c0 to
1a7a386CompareMarch 23, 2026 02:23
@github-actionsgithub-actionsBot
added

size/xl
PR size: XL
and removed

size/xl
PR size: XL
labels
Mar 23, 2026
@github-actionsgithub-actionsBot
added

size/xl
PR size: XL
and removed

size/xl
PR size: XL
labels
Mar 23, 2026
@aidandaly24
aidandaly24force-pushed
the
feat/custom-jwt-gateway
branch
from
6cdbf0b to
1a7a386CompareMarch 23, 2026 02:32
@github-actionsgithub-actionsBot
added

size/xl
PR size: XL
and removed

size/xl
PR size: XL
labels
Mar 23, 2026

This was referenced Mar 23, 2026
 Merged

 Merged

 Merged

@aidandaly24
aidandaly24
commented
Mar 23, 2026

Copy link


Copy Markdown

ContributorAuthor
This PR has been split into 3 smaller, independently reviewable PRs:
  1. fix(tui): remove dead PlaceholderScreen and fix gateway wizard UX #597 — fix: remove dead PlaceholderScreen code and fix gateway confirm display (bug fixes & cleanup)
  2. fix(gateway): harden inbound auth schema and rename credential flags #598 — fix(gateway): harden inbound auth schema and rename credential flags (schema hardening + flag rename)
  3. feat(gateway): add custom claims validation and TUI wizard for JWT auth #599 — feat(gateway): add custom claims validation and TUI wizard for JWT auth (custom claims feature, stacked on fix(gateway): harden inbound auth schema and rename credential flags #598)
Plus the existing CDK PR:

4. aws/agentcore-l3-cdk-constructs#93 — CDK construct changes (stays as-is)
Merge order: #597 (independent) → #598 (independent) → #599 (rebase onto main after #598 merges) → CDK #93 (independent)
Closing this in favor of the split PRs.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

size/xlPR size: XL

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@aidandaly24

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(gateway): add Custom JWT inbound auth for MCP gateways - #596
Closed
aidandaly24 wants to merge 1 commit into
aws:mainfrom 
aidandaly24:feat/custom-jwt-gateway
Closed
feat(gateway): add Custom JWT inbound auth for MCP gateways#596
aidandaly24 wants to merge 1 commit into
aws:mainfrom 
aidandaly24:feat/custom-jwt-gateway
Conversation
@aidandaly24
@aidandaly24aidandaly24
commented
Mar 23, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Description
Add full Custom JWT inbound authorization support for MCP gateways, including custom claim validations matching the CFN CustomClaimValidationType structure.
Summary
  • Add Custom JWT authorizer type to the gateway TUI wizard with a dynamic constraint picker, custom claims manager (add/edit/delete), and optional OAuth client credential flow
  • Add --custom-claims <json>, --client-id, --client-secret CLI flags (renaming from --agent-client-id/--agent-client-secret)
  • Relax validation: allowedClients is no longer required — at least one of allowedAudience, allowedClients, allowedScopes, or customClaims must be provided
  • Enforce HTTPS on OIDC discovery URLs in both schema validation and CLI/TUI input
  • Add custom claims Zod schemas: ClaimMatchOperatorSchema, ClaimMatchValueSchema, InboundTokenClaimValueTypeSchema, CustomClaimValidationSchema
Changes by Category
Schema
  • src/schema/schemas/mcp.ts — Custom claims Zod schemas; refactor CustomJwtAuthorizerConfigSchema with optional fields, .strict(), .superRefine() enforcing at-least-one constraint, HTTPS enforcement
  • src/schema/schemas/deployed-state.ts — Make allowedAudience/allowedClients optional; add allowedScopes and customClaims fields
CLI Flags / Validation
  • src/cli/commands/add/types.ts — Replace agentClientId/agentClientSecret with clientId/clientSecret; add customClaims
  • src/cli/commands/add/validate.ts — At-least-one-constraint validation, --custom-claims JSON parsing, HTTPS check, renamed flags
  • src/cli/primitives/GatewayPrimitive.ts — Renamed flags, custom claims JSON parsing, conditional field spreading
TUI Wizard
  • src/cli/tui/screens/mcp/AddGatewayScreen.tsx — Major rewrite: typed JwtSubStep union, constraint picker multi-select, CustomClaimsManager component with add/edit/delete, CustomClaimForm tabbed form (Tab cycles, Left/Right cycles selects), HTTPS validation, disable raw Escape exit
  • src/cli/tui/screens/mcp/types.ts — Updated jwtConfig type for optional fields and custom claims
  • src/cli/tui/screens/mcp/useAddGatewayWizard.ts — Updated setJwtConfig parameter types
  • src/cli/tui/hooks/useCreateMcp.ts — Pass customClaims directly; rename credential fields
  • src/cli/tui/App.tsx — Remove dead PlaceholderScreen route
  • src/cli/tui/screens/PlaceholderScreen.tsx — Deleted (unused)
  • src/cli/tui/screens/index.ts — Remove PlaceholderScreen re-export
Tests
  • src/schema/schemas/__tests__/mcp.test.ts — ClaimMatchValueSchema, CustomClaimValidationSchema, HTTPS, strict, scope-only, all-empty-constraints tests
  • src/cli/commands/add/__tests__/validate.test.ts — Rewritten JWT validation: at-least-one-constraint, custom claims JSON, renamed flags
  • src/cli/commands/add/__tests__/add-gateway.test.ts — Updated flag names
  • src/cli/primitives/__tests__/GatewayPrimitive.test.ts — customClaims pipeline test suite (4 tests)
  • src/cli/tui/screens/mcp/__tests__/AddGatewayJwtConfig.test.tsx — New 652-line test: 7 groups covering full JWT wizard TUI interactions
  • src/cli/tui/screens/mcp/__tests__/finishJwtConfig.test.ts — New: validates TUI data mapping produces shapes accepted by CustomJwtAuthorizerConfigSchema
  • src/cli/tui/screens/mcp/__tests__/useAddGatewayWizard.test.tsx — Extended wizard hook tests for JWT flow, navigation, targets
  • integ-tests/tui/add-gateway-jwt.test.ts — New 415-line TUI integration test: full JWT wizard path
  • integ-tests/tui/setup.ts — New TUI integration test setup
Bug Fix
  • src/cli/cloudformation/outputs.ts — Updated comment documenting hash-suffixed output key pattern (companion CDK PR fixes the actual CfnOutput scope)
Screenshots
TUI Custom JWT Gateway Wizard Flow (13 screenshots)
Main Menu
HelpScreen
Auth Type Selection
Auth type selection showing CUSTOM_JWT
Discovery URL Input
OIDC discovery URL
Allowed Audience Input
Audience values
Allowed Clients Input
Client values
Allowed Scopes Input
Scope values
Custom Claims Prompt
Custom claims prompt
Custom Claim Form — Claim Name
Claim name input
Custom Claim Form — Value Type
Value type selector
Custom Claim Form — Operator
Operator selector
Custom Claim Form — Match Value
Match value input
Claims List
Claims list with saved claim
Confirm Review
Confirm review
Related Issue
N/A — internal feature development
Documentation PR
N/A
Companion PR
CDK constructs: https://github.com/aws/agentcore-l3-cdk-constructs/pull/93
Type of Change
  •  Bug fix
  •  New feature
  •  Breaking change
  •  Documentation update
  •  Other (please describe):
Testing
How have you tested the change?
  •  I ran npm run test:unit and npm run test:integ
  •  I ran npm run typecheck
  •  I ran npm run lint
  •  If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots
  •  E2E deploy test: deployed CUSTOM_JWT gateway with audiences + custom claims, verified deployed-state.json populates correctly
Checklist
  •  I have read the CONTRIBUTING document
  •  I have added any necessary tests that prove my fix is effective or my feature works
  •  I have updated the documentation accordingly
  •  I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
  •  My changes generate no new warnings
  •  Any dependent changes have been merged and published
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the

terms of your choice.
@aidandaly24
aidandaly24
requested a review
from a teamMarch 23, 2026 02:19
@github-actionsgithub-actionsBot
added
the 
size/xl
PR size: XL
label
Mar 23, 2026
@aidandaly24
feat(gateway): add Custom JWT inbound auth for MCP gateways
1a7a386
Add CUSTOM_JWT authorizer support to the gateway creation flow:
- TUI wizard for JWT configuration (discovery URL, audiences, clients,
scopes, custom claim validations with string/string-array match types)
- CLI flags for non-interactive gateway creation with JWT auth
- Schema validation with OIDC discovery URL HTTPS enforcement,
XOR validation for claim match values, and .strict() on config
- Fix gateway output key comment to match Gateway{Name} pattern
(CDK fix in companion agentcore-cdk PR)
@aidandaly24
aidandaly24force-pushed
the
feat/custom-jwt-gateway
branch
from
00845c0 to
1a7a386CompareMarch 23, 2026 02:23
@github-actionsgithub-actionsBot
added

size/xl
PR size: XL
and removed

size/xl
PR size: XL
labels
Mar 23, 2026
@github-actionsgithub-actionsBot
added

size/xl
PR size: XL
and removed

size/xl
PR size: XL
labels
Mar 23, 2026
@aidandaly24
aidandaly24force-pushed
the
feat/custom-jwt-gateway
branch
from
6cdbf0b to
1a7a386CompareMarch 23, 2026 02:32
@github-actionsgithub-actionsBot
added

size/xl
PR size: XL
and removed

size/xl
PR size: XL
labels
Mar 23, 2026

This was referenced Mar 23, 2026
 Merged

 Merged

 Merged

@aidandaly24
aidandaly24
commented
Mar 23, 2026

Copy link


Copy Markdown

ContributorAuthor
This PR has been split into 3 smaller, independently reviewable PRs:
  1. fix(tui): remove dead PlaceholderScreen and fix gateway wizard UX #597 — fix: remove dead PlaceholderScreen code and fix gateway confirm display (bug fixes & cleanup)
  2. fix(gateway): harden inbound auth schema and rename credential flags #598 — fix(gateway): harden inbound auth schema and rename credential flags (schema hardening + flag rename)
  3. feat(gateway): add custom claims validation and TUI wizard for JWT auth #599 — feat(gateway): add custom claims validation and TUI wizard for JWT auth (custom claims feature, stacked on fix(gateway): harden inbound auth schema and rename credential flags #598)
Plus the existing CDK PR:

4. aws/agentcore-l3-cdk-constructs#93 — CDK construct changes (stays as-is)
Merge order: #597 (independent) → #598 (independent) → #599 (rebase onto main after #598 merges) → CDK #93 (independent)
Closing this in favor of the split PRs.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

size/xlPR size: XL

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@aidandaly24

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(gateway): add Custom JWT inbound auth for MCP gateways - #596
Closed
aidandaly24 wants to merge 1 commit into
aws:mainfrom 
aidandaly24:feat/custom-jwt-gateway
Closed
feat(gateway): add Custom JWT inbound auth for MCP gateways#596
aidandaly24 wants to merge 1 commit into
aws:mainfrom 
aidandaly24:feat/custom-jwt-gateway
Conversation
@aidandaly24
@aidandaly24aidandaly24
commented
Mar 23, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Description
Add full Custom JWT inbound authorization support for MCP gateways, including custom claim validations matching the CFN CustomClaimValidationType structure.
Summary
  • Add Custom JWT authorizer type to the gateway TUI wizard with a dynamic constraint picker, custom claims manager (add/edit/delete), and optional OAuth client credential flow
  • Add --custom-claims <json>, --client-id, --client-secret CLI flags (renaming from --agent-client-id/--agent-client-secret)
  • Relax validation: allowedClients is no longer required — at least one of allowedAudience, allowedClients, allowedScopes, or customClaims must be provided
  • Enforce HTTPS on OIDC discovery URLs in both schema validation and CLI/TUI input
  • Add custom claims Zod schemas: ClaimMatchOperatorSchema, ClaimMatchValueSchema, InboundTokenClaimValueTypeSchema, CustomClaimValidationSchema
Changes by Category
Schema
  • src/schema/schemas/mcp.ts — Custom claims Zod schemas; refactor CustomJwtAuthorizerConfigSchema with optional fields, .strict(), .superRefine() enforcing at-least-one constraint, HTTPS enforcement
  • src/schema/schemas/deployed-state.ts — Make allowedAudience/allowedClients optional; add allowedScopes and customClaims fields
CLI Flags / Validation
  • src/cli/commands/add/types.ts — Replace agentClientId/agentClientSecret with clientId/clientSecret; add customClaims
  • src/cli/commands/add/validate.ts — At-least-one-constraint validation, --custom-claims JSON parsing, HTTPS check, renamed flags
  • src/cli/primitives/GatewayPrimitive.ts — Renamed flags, custom claims JSON parsing, conditional field spreading
TUI Wizard
  • src/cli/tui/screens/mcp/AddGatewayScreen.tsx — Major rewrite: typed JwtSubStep union, constraint picker multi-select, CustomClaimsManager component with add/edit/delete, CustomClaimForm tabbed form (Tab cycles, Left/Right cycles selects), HTTPS validation, disable raw Escape exit
  • src/cli/tui/screens/mcp/types.ts — Updated jwtConfig type for optional fields and custom claims
  • src/cli/tui/screens/mcp/useAddGatewayWizard.ts — Updated setJwtConfig parameter types
  • src/cli/tui/hooks/useCreateMcp.ts — Pass customClaims directly; rename credential fields
  • src/cli/tui/App.tsx — Remove dead PlaceholderScreen route
  • src/cli/tui/screens/PlaceholderScreen.tsx — Deleted (unused)
  • src/cli/tui/screens/index.ts — Remove PlaceholderScreen re-export
Tests
  • src/schema/schemas/__tests__/mcp.test.ts — ClaimMatchValueSchema, CustomClaimValidationSchema, HTTPS, strict, scope-only, all-empty-constraints tests
  • src/cli/commands/add/__tests__/validate.test.ts — Rewritten JWT validation: at-least-one-constraint, custom claims JSON, renamed flags
  • src/cli/commands/add/__tests__/add-gateway.test.ts — Updated flag names
  • src/cli/primitives/__tests__/GatewayPrimitive.test.ts — customClaims pipeline test suite (4 tests)
  • src/cli/tui/screens/mcp/__tests__/AddGatewayJwtConfig.test.tsx — New 652-line test: 7 groups covering full JWT wizard TUI interactions
  • src/cli/tui/screens/mcp/__tests__/finishJwtConfig.test.ts — New: validates TUI data mapping produces shapes accepted by CustomJwtAuthorizerConfigSchema
  • src/cli/tui/screens/mcp/__tests__/useAddGatewayWizard.test.tsx — Extended wizard hook tests for JWT flow, navigation, targets
  • integ-tests/tui/add-gateway-jwt.test.ts — New 415-line TUI integration test: full JWT wizard path
  • integ-tests/tui/setup.ts — New TUI integration test setup
Bug Fix
  • src/cli/cloudformation/outputs.ts — Updated comment documenting hash-suffixed output key pattern (companion CDK PR fixes the actual CfnOutput scope)
Screenshots
TUI Custom JWT Gateway Wizard Flow (13 screenshots)
Main Menu
HelpScreen
Auth Type Selection
Auth type selection showing CUSTOM_JWT
Discovery URL Input
OIDC discovery URL
Allowed Audience Input
Audience values
Allowed Clients Input
Client values
Allowed Scopes Input
Scope values
Custom Claims Prompt
Custom claims prompt
Custom Claim Form — Claim Name
Claim name input
Custom Claim Form — Value Type
Value type selector
Custom Claim Form — Operator
Operator selector
Custom Claim Form — Match Value
Match value input
Claims List
Claims list with saved claim
Confirm Review
Confirm review
Related Issue
N/A — internal feature development
Documentation PR
N/A
Companion PR
CDK constructs: https://github.com/aws/agentcore-l3-cdk-constructs/pull/93
Type of Change
  •  Bug fix
  •  New feature
  •  Breaking change
  •  Documentation update
  •  Other (please describe):
Testing
How have you tested the change?
  •  I ran npm run test:unit and npm run test:integ
  •  I ran npm run typecheck
  •  I ran npm run lint
  •  If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots
  •  E2E deploy test: deployed CUSTOM_JWT gateway with audiences + custom claims, verified deployed-state.json populates correctly
Checklist
  •  I have read the CONTRIBUTING document
  •  I have added any necessary tests that prove my fix is effective or my feature works
  •  I have updated the documentation accordingly
  •  I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
  •  My changes generate no new warnings
  •  Any dependent changes have been merged and published
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the

terms of your choice.
@aidandaly24
aidandaly24
requested a review
from a teamMarch 23, 2026 02:19
@github-actionsgithub-actionsBot
added
the 
size/xl
PR size: XL
label
Mar 23, 2026
@aidandaly24
feat(gateway): add Custom JWT inbound auth for MCP gateways
1a7a386
Add CUSTOM_JWT authorizer support to the gateway creation flow:
- TUI wizard for JWT configuration (discovery URL, audiences, clients,
scopes, custom claim validations with string/string-array match types)
- CLI flags for non-interactive gateway creation with JWT auth
- Schema validation with OIDC discovery URL HTTPS enforcement,
XOR validation for claim match values, and .strict() on config
- Fix gateway output key comment to match Gateway{Name} pattern
(CDK fix in companion agentcore-cdk PR)
@aidandaly24
aidandaly24force-pushed
the
feat/custom-jwt-gateway
branch
from
00845c0 to
1a7a386CompareMarch 23, 2026 02:23
@github-actionsgithub-actionsBot
added

size/xl
PR size: XL
and removed

size/xl
PR size: XL
labels
Mar 23, 2026
@github-actionsgithub-actionsBot
added

size/xl
PR size: XL
and removed

size/xl
PR size: XL
labels
Mar 23, 2026
@aidandaly24
aidandaly24force-pushed
the
feat/custom-jwt-gateway
branch
from
6cdbf0b to
1a7a386CompareMarch 23, 2026 02:32
@github-actionsgithub-actionsBot
added

size/xl
PR size: XL
and removed

size/xl
PR size: XL
labels
Mar 23, 2026

This was referenced Mar 23, 2026
 Merged

 Merged

 Merged

@aidandaly24
aidandaly24
commented
Mar 23, 2026

Copy link


Copy Markdown

ContributorAuthor
This PR has been split into 3 smaller, independently reviewable PRs:
  1. fix(tui): remove dead PlaceholderScreen and fix gateway wizard UX #597 — fix: remove dead PlaceholderScreen code and fix gateway confirm display (bug fixes & cleanup)
  2. fix(gateway): harden inbound auth schema and rename credential flags #598 — fix(gateway): harden inbound auth schema and rename credential flags (schema hardening + flag rename)
  3. feat(gateway): add custom claims validation and TUI wizard for JWT auth #599 — feat(gateway): add custom claims validation and TUI wizard for JWT auth (custom claims feature, stacked on fix(gateway): harden inbound auth schema and rename credential flags #598)
Plus the existing CDK PR:

4. aws/agentcore-l3-cdk-constructs#93 — CDK construct changes (stays as-is)
Merge order: #597 (independent) → #598 (independent) → #599 (rebase onto main after #598 merges) → CDK #93 (independent)
Closing this in favor of the split PRs.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

size/xlPR size: XL

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@aidandaly24

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
feat(gateway): add Custom JWT inbound auth for MCP gateways - #596
Closed
aidandaly24 wants to merge 1 commit into
aws:mainfrom 
aidandaly24:feat/custom-jwt-gateway
Closed
feat(gateway): add Custom JWT inbound auth for MCP gateways#596
aidandaly24 wants to merge 1 commit into
aws:mainfrom 
aidandaly24:feat/custom-jwt-gateway
Conversation
@aidandaly24
@aidandaly24aidandaly24
commented
Mar 23, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Description
Add full Custom JWT inbound authorization support for MCP gateways, including custom claim validations matching the CFN CustomClaimValidationType structure.
Summary
  • Add Custom JWT authorizer type to the gateway TUI wizard with a dynamic constraint picker, custom claims manager (add/edit/delete), and optional OAuth client credential flow
  • Add --custom-claims <json>, --client-id, --client-secret CLI flags (renaming from --agent-client-id/--agent-client-secret)
  • Relax validation: allowedClients is no longer required — at least one of allowedAudience, allowedClients, allowedScopes, or customClaims must be provided
  • Enforce HTTPS on OIDC discovery URLs in both schema validation and CLI/TUI input
  • Add custom claims Zod schemas: ClaimMatchOperatorSchema, ClaimMatchValueSchema, InboundTokenClaimValueTypeSchema, CustomClaimValidationSchema
Changes by Category
Schema
  • src/schema/schemas/mcp.ts — Custom claims Zod schemas; refactor CustomJwtAuthorizerConfigSchema with optional fields, .strict(), .superRefine() enforcing at-least-one constraint, HTTPS enforcement
  • src/schema/schemas/deployed-state.ts — Make allowedAudience/allowedClients optional; add allowedScopes and customClaims fields
CLI Flags / Validation
  • src/cli/commands/add/types.ts — Replace agentClientId/agentClientSecret with clientId/clientSecret; add customClaims
  • src/cli/commands/add/validate.ts — At-least-one-constraint validation, --custom-claims JSON parsing, HTTPS check, renamed flags
  • src/cli/primitives/GatewayPrimitive.ts — Renamed flags, custom claims JSON parsing, conditional field spreading
TUI Wizard
  • src/cli/tui/screens/mcp/AddGatewayScreen.tsx — Major rewrite: typed JwtSubStep union, constraint picker multi-select, CustomClaimsManager component with add/edit/delete, CustomClaimForm tabbed form (Tab cycles, Left/Right cycles selects), HTTPS validation, disable raw Escape exit
  • src/cli/tui/screens/mcp/types.ts — Updated jwtConfig type for optional fields and custom claims
  • src/cli/tui/screens/mcp/useAddGatewayWizard.ts — Updated setJwtConfig parameter types
  • src/cli/tui/hooks/useCreateMcp.ts — Pass customClaims directly; rename credential fields
  • src/cli/tui/App.tsx — Remove dead PlaceholderScreen route
  • src/cli/tui/screens/PlaceholderScreen.tsx — Deleted (unused)
  • src/cli/tui/screens/index.ts — Remove PlaceholderScreen re-export
Tests
  • src/schema/schemas/__tests__/mcp.test.ts — ClaimMatchValueSchema, CustomClaimValidationSchema, HTTPS, strict, scope-only, all-empty-constraints tests
  • src/cli/commands/add/__tests__/validate.test.ts — Rewritten JWT validation: at-least-one-constraint, custom claims JSON, renamed flags
  • src/cli/commands/add/__tests__/add-gateway.test.ts — Updated flag names
  • src/cli/primitives/__tests__/GatewayPrimitive.test.ts — customClaims pipeline test suite (4 tests)
  • src/cli/tui/screens/mcp/__tests__/AddGatewayJwtConfig.test.tsx — New 652-line test: 7 groups covering full JWT wizard TUI interactions
  • src/cli/tui/screens/mcp/__tests__/finishJwtConfig.test.ts — New: validates TUI data mapping produces shapes accepted by CustomJwtAuthorizerConfigSchema
  • src/cli/tui/screens/mcp/__tests__/useAddGatewayWizard.test.tsx — Extended wizard hook tests for JWT flow, navigation, targets
  • integ-tests/tui/add-gateway-jwt.test.ts — New 415-line TUI integration test: full JWT wizard path
  • integ-tests/tui/setup.ts — New TUI integration test setup
Bug Fix
  • src/cli/cloudformation/outputs.ts — Updated comment documenting hash-suffixed output key pattern (companion CDK PR fixes the actual CfnOutput scope)
Screenshots
TUI Custom JWT Gateway Wizard Flow (13 screenshots)
Main Menu
HelpScreen
Auth Type Selection
Auth type selection showing CUSTOM_JWT
Discovery URL Input
OIDC discovery URL
Allowed Audience Input
Audience values
Allowed Clients Input
Client values
Allowed Scopes Input
Scope values
Custom Claims Prompt
Custom claims prompt
Custom Claim Form — Claim Name
Claim name input
Custom Claim Form — Value Type
Value type selector
Custom Claim Form — Operator
Operator selector
Custom Claim Form — Match Value
Match value input
Claims List
Claims list with saved claim
Confirm Review
Confirm review
Related Issue
N/A — internal feature development
Documentation PR
N/A
Companion PR
CDK constructs: https://github.com/aws/agentcore-l3-cdk-constructs/pull/93
Type of Change
  •  Bug fix
  •  New feature
  •  Breaking change
  •  Documentation update
  •  Other (please describe):
Testing
How have you tested the change?
  •  I ran npm run test:unit and npm run test:integ
  •  I ran npm run typecheck
  •  I ran npm run lint
  •  If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots
  •  E2E deploy test: deployed CUSTOM_JWT gateway with audiences + custom claims, verified deployed-state.json populates correctly
Checklist
  •  I have read the CONTRIBUTING document
  •  I have added any necessary tests that prove my fix is effective or my feature works
  •  I have updated the documentation accordingly
  •  I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
  •  My changes generate no new warnings
  •  Any dependent changes have been merged and published
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the

terms of your choice.
@aidandaly24
aidandaly24
requested a review
from a teamMarch 23, 2026 02:19
@github-actionsgithub-actionsBot
added
the 
size/xl
PR size: XL
label
Mar 23, 2026
@aidandaly24
feat(gateway): add Custom JWT inbound auth for MCP gateways
1a7a386
Add CUSTOM_JWT authorizer support to the gateway creation flow:
- TUI wizard for JWT configuration (discovery URL, audiences, clients,
scopes, custom claim validations with string/string-array match types)
- CLI flags for non-interactive gateway creation with JWT auth
- Schema validation with OIDC discovery URL HTTPS enforcement,
XOR validation for claim match values, and .strict() on config
- Fix gateway output key comment to match Gateway{Name} pattern
(CDK fix in companion agentcore-cdk PR)
@aidandaly24
aidandaly24force-pushed
the
feat/custom-jwt-gateway
branch
from
00845c0 to
1a7a386CompareMarch 23, 2026 02:23
@github-actionsgithub-actionsBot
added

size/xl
PR size: XL
and removed

size/xl
PR size: XL
labels
Mar 23, 2026
@github-actionsgithub-actionsBot
added

size/xl
PR size: XL
and removed

size/xl
PR size: XL
labels
Mar 23, 2026
@aidandaly24
aidandaly24force-pushed
the
feat/custom-jwt-gateway
branch
from
6cdbf0b to
1a7a386CompareMarch 23, 2026 02:32
@github-actionsgithub-actionsBot
added

size/xl
PR size: XL
and removed

size/xl
PR size: XL
labels
Mar 23, 2026

This was referenced Mar 23, 2026
 Merged

 Merged

 Merged

@aidandaly24
aidandaly24
commented
Mar 23, 2026

Copy link


Copy Markdown

ContributorAuthor
This PR has been split into 3 smaller, independently reviewable PRs:
  1. fix(tui): remove dead PlaceholderScreen and fix gateway wizard UX #597 — fix: remove dead PlaceholderScreen code and fix gateway confirm display (bug fixes & cleanup)
  2. fix(gateway): harden inbound auth schema and rename credential flags #598 — fix(gateway): harden inbound auth schema and rename credential flags (schema hardening + flag rename)
  3. feat(gateway): add custom claims validation and TUI wizard for JWT auth #599 — feat(gateway): add custom claims validation and TUI wizard for JWT auth (custom claims feature, stacked on fix(gateway): harden inbound auth schema and rename credential flags #598)
Plus the existing CDK PR:

4. aws/agentcore-l3-cdk-constructs#93 — CDK construct changes (stays as-is)
Merge order: #597 (independent) → #598 (independent) → #599 (rebase onto main after #598 merges) → CDK #93 (independent)
Closing this in favor of the split PRs.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

size/xlPR size: XL

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@aidandaly24