In-depth analysis · About 4 min read
AWS Agent Registry’s runtime discovery separates finding a tool from permission to invoke it
An AWS guide builds a Discover–Instantiate–Execute loop around approved MCP and A2A records, with authentication kept outside search results.
- Source published
- Published here
- Source checked
An October 20 AWS technical guide shows an orchestrator discovering capabilities at runtime instead of importing every tool at build time. Its order-management example combines an MCP server exposed through AgentCore Gateway with pricing and customer-support agents using A2A. The contribution is a concrete connection pattern, not evidence that a larger catalog automatically produces better decisions.
Listen to the news
Read this article aloud or keep listening to the news.
Preparing the reader…
Device voice
Speech is handled by your browser or device. AISubHub does not send the text to an audio API. Voice availability and playback with a locked screen vary by device.
Resuming may repeat a short phrase.
At a glance
- Manual approval moves records through DRAFT, PENDING_APPROVAL and APPROVED; only approved records become discoverable through the configured data plane.
- Discovery returns descriptors, endpoints and record metadata, not invocation credentials; the example separately uses Cognito OAuth for Gateway and IAM-signed calls for A2A runtimes.
A searchable record is a connection contract
Publishers supply a user-facing description and protocol-specific descriptor. MCP records carry server metadata and tool definitions; agent records carry an A2A agent card. The registry has separate control-plane lifecycle operations and data-plane discovery. With manual approval, publishing alone does not make a capability visible: the record must pass the configured review transition. IAM permissions can separate publisher and approver. This creates a place to review endpoint identity and supported operations before discovery, but approval is not proof that every future call is appropriate for every user. Descriptions should distinguish nearby capabilities in the language users actually employ.
Each request assembles a smaller working agent
The outer orchestrator turns a request into hybrid keyword and semantic search, parses returned descriptors and constructs the corresponding clients. It then creates an inner agent with only the discovered tools. The model chooses among that candidate set, produces a response and the clients are torn down at the end of the turn; the next request starts with fresh discovery. In the sample, query fan-out and deduplication improve coverage for order management. Those are choices of this orchestrator, not mandatory Registry behavior. A small candidate set avoids inserting the entire catalog into the prompt, but can also omit the right tool if retrieval fails.
Discovery does not convey authority
For MCP, the descriptor points to the Gateway endpoint; the application obtains its OAuth access token separately through trusted Cognito configuration and Secrets Manager. A2A wrappers invoke AgentCore runtime through Boto3 with the caller’s AWS credentials. Registry access itself has its own authorization. These are distinct boundaries. AISubHub analysis: copying a discovered URL into a client is insufficient; consumers must also know the trusted authentication route and allowed operations. Automatic descriptor synchronization can use credentials to fetch metadata, but the guide explicitly says those credentials are not returned as the runtime consumer’s invocation authentication. A searchable record is therefore neither a secret distribution mechanism nor a blanket permission grant.
Evaluate retrieval and execution together
Three demonstrations cover order status using MCP alone, pricing and discounts chaining MCP with A2A, and a return/refund request matched through the support agent’s description rather than its name. The last shows one semantic match, not a catalog-wide accuracy result. A useful acceptance set should include ambiguous requests, unsupported intent, denied access and incorrect descriptors, recording selected record IDs and downstream outcomes. The sample grants CloudWatch logging permissions but does not create custom dashboards or metrics. Teams must define traces and alerts themselves. For a small stable catalog, fixed wiring may be simpler; a deterministic pipeline is also clearer when the same capabilities always run in the same order. These alternatives are explicitly acknowledged in the guide.
Why it matters
AISubHub analysis: compatible teams can publish a new approved capability without adding a tool-specific import to the orchestrator. Protocol changes, authentication configuration and orchestration policies can still require updates.
Limits and availability
This is a reference implementation and three demonstrations, not a general retrieval benchmark. We did not deploy it, test its costs or independently verify production reliability. The guide identifies Agent Registry as generally available, while feature and regional fit still need checking for a deployment.
Sources and evidence
Source published: Oct 20, 2026 · Source checked: Oct 21, 2026
AI-assisted editorial articles checked against linked primary sources. Vendor claims are attributed; inclusion is not endorsement.