bug(tool): agentcore add tool --gateway <name> fails to find gateway in deployed state

[rostcheck]

Description

agentcore add tool --type agentcore_gateway --gateway <name> fails with Gateway '<name>' not found in deployed state. Deploy it first or use --gateway-arn. even when the gateway is confirmed deployed via agentcore status.

This is the same root cause as #1658 (fixed in #1663 for PolicyPrimitive.ts), but the fix was not applied to src/cli/commands/add/tool-action.ts. The automated reviewer on #1663 flagged this file explicitly as a remaining instance.

Note this was found via Step 5 in Lab 2 of the "Best Practices for Agentic AI with AgentCore in Financial Services" workshop

Steps to Reproduce

Note this was appears via Step 5 in Lab 2 of the "Best Practices for Agentic AI with AgentCore in Financial Services" workshop

1. Create a project with a gateway (HTTP / protocolType: "None"):

   agentcore add gateway --name my-gateway \
     --authorizer-type CUSTOM_JWT \
     --discovery-url $COGNITO_DISCOVERY_URL \
     --allowed-clients $COGNITO_CLIENT_ID \
     --allowed-scopes $COGNITO_SCOPE

2. Add gateway targets and deploy:

   agentcore add gateway-target --type lambda-function-arn --name MyTool \
     --lambda-arn $LAMBDA_ARN --tool-schema-file schema.json --gateway my-gateway
   agentcore deploy -y

3. Confirm the gateway is deployed:

   agentcore status
   # Output:
   # Gateways
   #   my-gateway: Deployed (1 target) (projectname-my-gateway-xxxxxxxx)

4. Attempt to add the gateway as a tool to a harness:

   agentcore add tool --harness MyHarness \
     --type agentcore_gateway \
     --name my-gateway \
     --gateway my-gateway \
     --outbound-auth oauth \
     --provider-arn $CRED_ARN \
     --scopes $SCOPE \
     --grant-type CLIENT_CREDENTIALS

5. Observe error:

   Gateway 'my-gateway' not found in deployed state. Deploy it first or use --gateway-arn.
   

Expected Behavior

The CLI should resolve the gateway name from deployed state (searching both resources.mcp.gateways and resources.gateways) and proceed.

Actual Behavior

The CLI only checks resources.mcp.gateways, missing HTTP gateways stored under resources.gateways.

CLI Version

1.0.0-preview.19

Operating System

Linux

Additional Context

Root Cause

In src/cli/commands/add/tool-action.ts (~line 165):

const gatewayState = targetState?.resources?.mcp?.gateways?.[options.gateway];

This only searches the MCP gateway map. The findDeployedGateway() helper introduced in #1663 (in src/cli/primitives/deployed-gateways.ts) correctly merges both maps but is not used here.

Suggested Fix

Replace the manual lookup with the existing helper:

- const targetState = deployedState.targets[targetNames[0]!];
- const gatewayState = targetState?.resources?.mcp?.gateways?.[options.gateway];
+ import { findDeployedGateway } from '../../primitives/deployed-gateways';
+ const gatewayState = findDeployedGateway(deployedState, options.gateway);

This also fixes a secondary issue: the current code only searches targetNames[0] (the first target), while findDeployedGateway searches across all targets.

Workaround

Use --gateway-arn with the full ARN instead of --gateway with the local name:

agentcore add tool --harness MyHarness \
  --type agentcore_gateway \
  --name my-gateway \
  --gateway-arn arn:aws:bedrock-agentcore:us-west-2:123456789012:gateway/projectname-my-gateway-xxxxxxxx \
  --outbound-auth oauth \
  --provider-arn $CRED_ARN \
  --scopes $SCOPE \
  --grant-type CLIENT_CREDENTIALS

Environment

• CLI version: 0.21.1
• OS: Amazon Linux 2023 (EC2)
• Node: 20.x

Related

• bug(policy): --generate flag fails to find gateway in deployed state #1658 — same bug pattern in PolicyPrimitive.ts (fixed)
• fix(policy): resolve HTTP gateways for policy generation and guardrails (#1658) #1663 — PR that fixed bug(policy): --generate flag fails to find gateway in deployed state #1658; automated reviewer flagged tool-action.ts:165 as an unfixed instance