November 7, 2026, (Inside AI) — Amazon has built a serverless Model Context Protocol (MCP) server on Amazon Elastic Container Service (Amazon ECS) with AWS Fargate to give AI agents a single, controlled gateway to its enterprise data lake. The system, developed for Amazon's North America Sort Center (NASC) network, replaces fragmented, per-agent integrations with a metadata-driven architecture that lets any MCP-compatible client query thousands of datasets through one endpoint.
The core problem: planning teams across NASC needed conversational access to operational data for capacity, labor, and package flow management. But each AI assistant built its own connection logic, schema knowledge, and access controls. A schema change meant patching every agent. Onboarding a new dataset took days of custom coding and redeployment. The new MCP server eliminates that duplication by centralizing tool access and enforcing permissions at the server layer.
Adding a new dataset now requires only a JSON metadata file. The server discovers it automatically on the next pipeline sync, generates vector embeddings with Amazon Titan Text Embeddings, and indexes it into Amazon Bedrock Knowledge Bases. No code changes, no server restarts. In testing, end-to-end query latency stays in the 15-20 second range.
Inside the Four-Layer Architecture
The system separates concerns into four independently scalable layers. The client layer authenticates users via Amazon Cognito and stores session state in Amazon DynamoDB. It runs on ECS Fargate behind a public Application Load Balancer with AWS WAF. Authenticated requests then pass through an internal load balancer to the MCP server layer, also on Fargate, which handles orchestration using an AI agent powered by Amazon Bedrock and tools built with FastMCP, a Python framework for MCP servers.
Read: AWS Step Functions workflows now available as AI agent tools
The tools layer connects to Amazon Athena and Amazon Redshift for SQL queries and to Bedrock Knowledge Bases for semantic search. A metadata catalog underpins everything, storing schema descriptions, column-level semantics, and table relationships. The agent references this catalog at query time, so table structures never need hardcoding.
Responsible AI controls are baked in. Amazon Bedrock Guardrails filters harmful content and blocks prompt injection attempts on every model interaction. The Athena query tools enforce SELECT-only queries, rejecting write operations before they reach the data lake. All tool invocations log to Amazon CloudWatch with structured JSON, giving security teams a single audit point.
The architecture's most consequential design choice is separating the tool layer from the agent layer. Agents evolve rapidly, but data access patterns should outlive any single agent implementation. By treating extensibility as a configuration problem rather than a code problem, Amazon has built a system where onboarding a new team or dataset follows a repeatable pattern. This matters beyond Amazon: enterprises wrestling with AI agent sprawl now have a concrete reference architecture for centralized governance. The metadata file itself carries engine-specific query hints, such as instructions to wrap string literals with date() functions, which reduce SQL validation failures. The column_details field pairs each column name and type with a natural language description and sample values. That sample data matters for accurate WHERE clause generation. The agent learns that warehouse_id holds codes like FC-EAST-07, not spelled-out names like 'East region facility.'
An optional context mapping entry narrows the search scope for specific applications. When a context specifies tables, the MCP server limits its metadata catalog search to those tables, reducing noise and improving SQL accuracy. Adding a new business domain requires only adding an entry to this mapping. The context mapping is optional and can be added at any time without modifying the metadata files themselves.
The multi-tenant design hinges on the standardized /mcp endpoint. Any MCP-compatible client, regardless of its LLM or orchestration framework, can discover and invoke tools directly. External clients such as Amazon Q Developer or IDE extensions connect without custom adapters. Adding a new agent requires only pointing it at the server endpoint. Multiple specialized agents for data analysis, document retrieval, and operational alerting can share the same MCP server, each accessing the full tool suite through a common protocol.
Security uses layered enforcement rather than a single checkpoint. The MCP server runs in private subnets behind an internal Application Load Balancer and is not reachable from the internet. Only the client layer, which sits behind a public-facing load balancer with AWS WAF, can route requests to it. Amazon Cognito validates user identity at the client layer, and only authenticated, token-bearing requests are forwarded downstream. At the tool level, the Athena query tools reject write operations before they reach the data lake. All tool invocations are logged to Amazon CloudWatch with structured JSON, which gives security teams a single audit point for data access across every agent and application. This architecture is available in the AWS Regions where Amazon Bedrock and Amazon Bedrock Knowledge Bases are available.
Read: AWS Launches Bedrock Managed Agents Powered by OpenAI in Public Preview
Scaling follows workload patterns. ECS Fargate provides serverless compute with no EC2 instances to manage. Downstream services like Athena and Bedrock scale automatically, so the system handles a single query or hundreds of concurrent queries without configuration changes. Fargate tasks are stateless, with conversation state persisted in DynamoDB, so tasks can be replaced or scaled without data loss.
The same orchestration extends beyond pure SQL. Because document search is registered as another tool on the same server, the agent can answer questions that span structured and unstructured sources in a single turn. For example, a user might ask: 'What was our return rate for Q4, and what does the product team's analysis say about the root causes?' The agent runs an Athena query for the return-rate figure and a Knowledge Bases document search for the analysis, then combines both into one response.
Amazon is extending the architecture in two directions. First, finer-grained access control where table owners can mark sensitive columns as restricted per permission group, and the agent automatically excludes those columns from generated SQL without prompt-level changes. Second, closing the feedback loop so that when queries fail or produce low-confidence results, the system captures the failure pattern and surfaces targeted suggestions for improving column descriptions or adding query hints.
The Model Context Protocol, originally developed by Anthropic and now broadly adopted, standardizes how AI agents connect to external tools and data sources. Amazon's implementation demonstrates that MCP can serve as a production-grade governance layer, not just a developer convenience. For enterprises building AI agents, the lesson is clear: centralize data access before agent sprawl makes it unmanageable.
Shamil has a low tolerance for AI that only works in controlled demos. He covers agentic systems and generative AI with the skepticism of someone who has seen too many “revolutionary” tools quietly disappear six months after launch.
