From the source
Eon replaced per-tool credentials and local Model Context Protocol servers with a single authenticated gateway on 
- The company's engineers investigate production incidents that span container logs, Grafana metrics,
GitHub pull requests and cloud-provider health status in a single session, and each new tool previously added another credential to configure, secure and rotate.
- Eon says new engineers now reach all their investigation tools in about two minutes, down from the roughly two days it took to configure credentials and local MCP servers.
- The architecture federates corporate single sign-on through Amazon Cognito, which mints the JSON Web Token handed to the gateway, while agents authenticate with Cognito client_credentials grants directly against it.
- Cedar policies in ENFORCE mode decide which principals can invoke which tools: read operations go to selected groups rather than every authenticated user, write operations are limited to low-impact collaboration actions such as commenting on a pull request or ticket, and production tools are read-only.
- Eon considered a centralized reverse proxy with custom authentication, but chose AgentCore Gateway because identity separation, cross-account connectivity and policy enforcement came as managed capabilities instead of code it would have to build and maintain.
aws.amazon.com