Every time a Model Context Protocol (MCP) server published in the AWS Agent Registry, a capability of Amazon Bedrock AgentCore, gains a new tool or updates its schema, the registry record must be updated too. Without automated push-based sync, consumers discover stale metadata. For organizations managing multiple MCP servers across accounts, such a sync keeps catalog records current within an existing governance workflow.
In most enterprise deployments, a catalog’s value depends on its freshness. If a developer deploys a new tool on Monday, but the registry record still reflects last week’s schema, consumers lose trust in the catalog. Stale metadata directly reduces registry reliability, leading teams to inadvertently build dependencies on inaccurate information.
When an engineer adds a tool to an MCP server but forgets to update the catalog: Consumers miss out on the new capability entirely. Applications might call the tool using an outdated schema, causing unexpected runtime behavior or silent workflow deviations. Multiplied across teams, this lack of automation erodes trust in the registry. Organizations ultimately fall back on ad hoc discovery mechanisms like hardcoded endpoints, informal knowledge sharing, and stale documentation.
In this post, we outline an event-driven architecture that automates these updates using AWS CloudTrail, Amazon EventBridge, and AWS Lambda.
Architecture overview: The following solution brings these services together into an event-driven pipeline that detects runtime changes and synchronizes them to the registry automatically. The architecture supports both multi-account and single-account environments:
Single-account setup: For straightforward deployments, all components reside within Account A. Cross-account forwarding setup isn’t needed as events flow directly within Account A.
Multi-account setup: This involves two accounts where runtime events from Account B are securely forwarded to Account A. Account A (registry account) owns the #AWS Agent Registry, the Amazon #EventBridge rule, the push-sync #Lambda function, and CloudTrail logs. Account B (MCP server account) hosts the MCP server runtime and the Amazon Cognito OAuth provider used for authentication.
The sample uses two accounts, but you can scale the architecture for multiple accounts, with Account A as the registry account and multiple AWS accounts similar to Account B for different MCP servers.
The following diagram shows the end-to-end event flow for an update to an MCP server in Account B. The captured event is forwarded to Account A, where a Lambda function queries the MCP server for its tools and updates the matching registry record.
Figure 1: End-to-end event flow for a cross-account MCP server update, from the ...
[AgentUpdate Depth Analysis] AWS's push-based registry sync architecture essentially shifts service discovery from a pull model to an event-driven push model, directly addressing a critical pain point in the AI Agent ecosystem: real-time consistency of tool metadata. Compared to traditional polling or manual updates, the automated pipeline based on CloudTrail and EventBridge reduces latency from hours to seconds and naturally fits multi-account governance scenarios. Horizontally, similar ecosystems like LangChain's Tool Registry or OpenAI's Function Calling mostly rely on static description files or manual registration, lacking cloud-native event linkage. AWS's move deeply couples the Agent registry with underlying cloud operation logs, enabling any MCP server change to trigger cascading updates, laying the foundation for future autonomous discovery and dynamic orchestration among agents. In the long run, as agents can perceive toolset changes in real time, multi-agent collaboration will become more robust, but it also imposes higher requirements on event storm control and idempotency design. For enterprises, this means the registry is no longer a static catalog but a living infrastructure component whose reliability directly determines the stability of agent workflows.
