How we built an MCP bridge to give our AgentCore-hosted AI agent access to local MCP tools
Cloud agents just got a local toolkit. AWS shows how to tunnel MCP servers from your laptop into Bedrock AgentCore—no VPN, no open ports.
Why it matters
Practical infrastructure for bridging the cloud-local gap in agentic systems. This solves a real deployment friction point: agents in the cloud need secure, frictionless access to user-local tools and data. The MCP bridge pattern is becoming table-stakes for enterprise agent adoption.
The key facts
11 to knowAWS Bedrock AgentCore + MCP bridge architecture
Cloud-to-local tunneling via WebSocket + browser extension + Chrome native messaging
Signed message authentication (no open ports, no VPN required)
Solves agent access to local tools and files in production deployments
Published as technical guide on AWS ML blog (August 2026)
Amazon Bedrock AgentCore agents can now securely access local MCP servers
Bridge uses signed messages over WebSocket tunneling via browser extension
No open ports or VPN required for local tool access
Solves cloud-agent-to-local-tool connectivity problem
Uses Chrome native messaging for secure local communication
MCP (Model Context Protocol) as agent-tool standard
Go to the source
AWS Machine Learning Blogaws.amazon.com
Publisher excerpt: AI agents on Amazon Bedrock AgentCore run in the cloud, but users' tools and files live on their laptops. Learn how to build a secure MCP bridge that lets a cloud-hosted agent call local MCP servers by tunneling signed messages over the existing WebSocket connection through a browser extension and…