AWS AgentCore Gateway as a Nuxeo MCP Server

I wanted to share the easiest way I have found to use MCP with Nuxeo in AWS. MCP has been everywhere lately, and since I recently worked on this, I wanted to make sure more people know about this option. Nuxeo already has its own MCP server, and Hyland published it here if you want to look at that route first: https://github.com/nuxeo/nuxeo-mcp-server

But if you are already in AWS, I think AgentCore Gateway is a really good option. You can set up a managed gateway that exposes tools over MCP and point it to your Nuxeo REST API through an OpenAPI schema. For this use case, it is actually very straightforward.

There are really only 3 points to configure / pay attention to.

Point 1. Inbound auth

This is the authentication between the agent and your gateway. In my case, I used JWT with a specific clientId because that is the standard for us. But you can also use IAM-based access, or even no authorization if you are intentionally exposing an open endpoint.

Point 2. Outbound auth

This is the authentication between the gateway and your Nuxeo server.

For Nuxeo, you have 2 practical options.

Outbound auth, Option A: OAuth with Nuxeo

In AgentCore Identity, you can create a new OAuth client. You need to provide the client ID, secret, token endpoint, and authorization endpoint. Then register the client in Nuxeo as documented here.

The endpoints are the standard Nuxeo ones:

$NUXEO_SERVER/nuxeo/oauth2/authorize
$NUXEO_SERVER/nuxeo/oauth2/token

You still need a valid Nuxeo account, but the authentication flow is done through OAuth.

Outbound auth, Option B: API key style auth

If you do not want to use OAuth, you can inject the Authorization header on the outbound call. That means you can pass a Nuxeo token, or even use Basic auth by sending the base64-encoded username:password value in the Authorization header. So yes, you can keep this very simple if that matches your setup.

Point 3. The schema

This is the part that defines the tools your agent will see. For the target type, choose REST API with an OpenAPI schema.

The important detail is to keep the wrapper simple and give each operation a clear operationId, because that is what shows up as the tool name for the agent. I did not want to paste the full YAML directly here because it makes the post too long, but I uploaded the full OpenAPI wrapper publicly so people can use it as a starting point: https://maretha-tehnical-documentation.s3.us-east-1.amazonaws.com/nuxeo-openapi.yaml

Mine is basically a thin wrapper around common Nuxeo endpoints like /me, /id/{docId}, /path/{docPath}, /search/lang/NXQL/execute, and /automation/{operationId}.

Honestly, any decent agent can help generate most of this wrapper for you very quickly. I generated mine with Claude and then adjusted it.

Once that is done, you just take the gateway URL from the Gateway resource and connect your agent to it with the right authentication in place. I also went a step further and added the ability to create documents from files, with S3 direct upload on my side.

Unfortunately LinkedIn does not make it easy to attach multiple files or enough screenshots for a post like this, but I was able to test Claude against my gateway and create files through it.

If your goal is to let an agent interact with Nuxeo without giving it direct credentials to the server and controlling the APIs it has access to, this is a really practical setup. It is managed, pretty easy to set up, and you do not have to worry about hosting or deploying your own MCP layer. Give it a try :)

← All insights