feat(gateway): add read-only gateway commands

Author: aidandaly24

README.md

@@ -65,6 +65,15 @@ agentcore                          # interactive TUI
 │   └── endpoint
 │       ├── get                    # get a Runtime endpoint by qualifier
 │       └── list                   # list a Runtime's endpoints
+├── gateway                        # inspect AgentCore Gateways
+│   ├── get                        # get a Gateway by id
+│   ├── list                       # list Gateways (server-side paginated)
+│   ├── target
+│   │   ├── get                    # get a Target under a Gateway
+│   │   └── list                   # list Targets under a Gateway
+│   └── rule
+│       ├── get                    # get a Rule under a Gateway
+│       └── list                   # list Rules under a Gateway
 ├── eval                           # evaluate and optimize AgentCore agents
 │   └── evaluator                  # manage AgentCore evaluators
 │       ├── llm-as-a-judge         # LLM-as-a-Judge evaluators
@@ -120,6 +129,14 @@ agentcore runtime version list --id <runtimeId> --max-results 20
 agentcore runtime endpoint get --id <runtimeId> --qualifier DEFAULT
 agentcore runtime endpoint list --id <runtimeId> --max-results 20
 
+# Inspect Gateway resources without project configuration or deployment
+agentcore gateway get --id <gatewayId>
+agentcore gateway list --max-results 20
+agentcore gateway target get --gateway-id <gatewayId> --target-id <targetId>
+agentcore gateway target list --gateway-id <gatewayId> --max-results 20
+agentcore gateway rule get --gateway-id <gatewayId> --rule-id <ruleId>
+agentcore gateway rule list --gateway-id <gatewayId> --max-results 20
+
 # Manage API key credential providers
 agentcore identity api-key-credential-provider create --name my-provider --api-key <key>
 agentcore identity api-key-credential-provider get --name my-provider

src/components/RouterScreen.test.tsx

@@ -17,6 +17,8 @@ describe("menu rendering", () => {
     expect(frame).toContain("manage agentcore harnesses");
     expect(frame).toContain("runtime");
     expect(frame).toContain("inspect AgentCore Runtimes");
+    expect(frame).toContain("gateway");
+    expect(frame).toContain("inspect AgentCore Gateways");
     expect(frame).toContain("config");
     expect(frame).toContain("read/write global config values");
     r.unmount();

src/core/core.test.ts

@@ -182,14 +182,15 @@ test("data() caches independently of control()", () => {
   expect(dataBuilt).toBe(1);
 });
 
-test("exposes a harness sub-client", () => {
+test("exposes feature sub-clients", () => {
   const core = new CoreClient({
     createControlClient: fakeControl,
     createDataClient: fakeData,
     createIamClient: fakeIam,
     logger: createSilentLogger(),
   });
   expect(core.harness).toBeDefined();
+  expect(core.gateway).toBeDefined();
 });
 
 test("getRuntime sends the abort signal to the control client", async () => {

src/core/gateway.tsx

@@ -0,0 +1,93 @@
+import {
+  GetGatewayCommand,
+  GetGatewayRuleCommand,
+  GetGatewayTargetCommand,
+  ListGatewayRulesCommand,
+  ListGatewaysCommand,
+  ListGatewayTargetsCommand,
+  type GetGatewayResponse,
+  type GetGatewayRuleResponse,
+  type GetGatewayTargetResponse,
+  type ListGatewayRulesResponse,
+  type ListGatewaysResponse,
+  type ListGatewayTargetsResponse,
+} from "@aws-sdk/client-bedrock-agentcore-control";
+import type { CoreGatewayClient } from "../handlers/gateway/types";
+import type { AwsClients, CoreOptions } from "./types";
+import { toClientConfig } from "./utils";
+
+export class GatewayClient implements CoreGatewayClient {
+  constructor(private readonly clients: AwsClients) {}
+
+  async getGateway(id: string, options: CoreOptions): Promise<GetGatewayResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new GetGatewayCommand({ gatewayIdentifier: id }));
+  }
+
+  async listGateways(
+    nextToken: string | undefined,
+    maxResults: number | undefined,
+    options: CoreOptions,
+  ): Promise<ListGatewaysResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new ListGatewaysCommand({ nextToken, maxResults }));
+  }
+
+  async getGatewayTarget(
+    gatewayId: string,
+    targetId: string,
+    options: CoreOptions,
+  ): Promise<GetGatewayTargetResponse> {
+    return this.clients.control(toClientConfig(options)).send(
+      new GetGatewayTargetCommand({
+        gatewayIdentifier: gatewayId,
+        targetId,
+      }),
+    );
+  }
+
+  async listGatewayTargets(
+    gatewayId: string,
+    nextToken: string | undefined,
+    maxResults: number | undefined,
+    options: CoreOptions,
+  ): Promise<ListGatewayTargetsResponse> {
+    return this.clients.control(toClientConfig(options)).send(
+      new ListGatewayTargetsCommand({
+        gatewayIdentifier: gatewayId,
+        nextToken,
+        maxResults,
+      }),
+    );
+  }
+
+  async getGatewayRule(
+    gatewayId: string,
+    ruleId: string,
+    options: CoreOptions,
+  ): Promise<GetGatewayRuleResponse> {
+    return this.clients.control(toClientConfig(options)).send(
+      new GetGatewayRuleCommand({
+        gatewayIdentifier: gatewayId,
+        ruleId,
+      }),
+    );
+  }
+
+  async listGatewayRules(
+    gatewayId: string,
+    nextToken: string | undefined,
+    maxResults: number | undefined,
+    options: CoreOptions,
+  ): Promise<ListGatewayRulesResponse> {
+    return this.clients.control(toClientConfig(options)).send(
+      new ListGatewayRulesCommand({
+        gatewayIdentifier: gatewayId,
+        nextToken,
+        maxResults,
+      }),
+    );
+  }
+}

src/core/index.tsx

@@ -2,6 +2,7 @@ import { BedrockAgentCoreControlClient } from "@aws-sdk/client-bedrock-agentcore
 import { BedrockAgentCoreClient } from "@aws-sdk/client-bedrock-agentcore";
 import { IAMClient } from "@aws-sdk/client-iam";
 import { EvalClient } from "./eval";
+import { GatewayClient } from "./gateway";
 import { HarnessClient } from "./harness";
 import { IdentityClient } from "./identity";
 import { RuntimeClient } from "./runtime";
@@ -52,6 +53,7 @@ export class CoreClient implements AwsClients {
   readonly harness: HarnessClient = new HarnessClient(this);
   readonly identity: IdentityClient = new IdentityClient(this);
   readonly runtime: RuntimeClient;
+  readonly gateway: GatewayClient = new GatewayClient(this);
   readonly eval: EvalClient = new EvalClient(this);
 
   readonly projectManager: ProjectManager;

src/handlers/gateway/__fixtures__/GetGatewayCommand.4216a59651bb046a.json

@@ -0,0 +1,20 @@
+{
+  "gatewayArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:gateway/agentcore-cli-gateway-read-fixture-a-l6opkbe2kd",
+  "gatewayId": "agentcore-cli-gateway-read-fixture-a-l6opkbe2kd",
+  "createdAt": {
+    "$date": "2026-07-29T22:19:37.409Z"
+  },
+  "updatedAt": {
+    "$date": "2026-07-29T22:19:37.971Z"
+  },
+  "status": "READY",
+  "name": "agentcore-cli-gateway-read-fixture-a",
+  "authorizerType": "NONE",
+  "gatewayUrl": "https://agentcore-cli-gateway-read-fixture-a-l6opkbe2kd.gateway.bedrock-agentcore.us-west-2.amazonaws.com/mcp",
+  "description": "AgentCore CLI persistent Gateway read fixture",
+  "roleArn": "arn:aws:iam::685197708687:role/AgentCoreCliGatewayReadFixtureRole",
+  "protocolType": "MCP",
+  "workloadIdentityDetails": {
+    "workloadIdentityArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:workload-identity-directory/default/workload-identity/agentcore-cli-gateway-read-fixture-a-l6opkbe2kd"
+  }
+}

src/handlers/gateway/__fixtures__/GetGatewayCommand.fe70727e83c9acf1.json

@@ -0,0 +1,6 @@
+{
+  "$error": {
+    "name": "ResourceNotFoundException",
+    "message": "Failed to retrieve gateway because it doesn't exist. Retry the request with a different resource identifier."
+  }
+}

src/handlers/gateway/__fixtures__/GetGatewayRuleCommand.137147fc065772f4.json

@@ -0,0 +1,6 @@
+{
+  "$error": {
+    "name": "ResourceNotFoundException",
+    "message": "GatewayRule 00000000-0000-4000-8000-000000000000 not found"
+  }
+}

src/handlers/gateway/__fixtures__/GetGatewayRuleCommand.e2b99534dc4a233f.json

@@ -0,0 +1,31 @@
+{
+  "ruleId": "d396c3f4-4591-41b3-a4d5-816e03c32419",
+  "gatewayArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:gateway/agentcore-cli-gateway-read-rule-fixture-lhpid2reoy",
+  "priority": 10,
+  "actions": [
+    {
+      "routeToTarget": {
+        "staticRoute": {
+          "targetName": "agentcore-cli-gateway-read-http-target"
+        }
+      }
+    }
+  ],
+  "createdAt": {
+    "$date": "2026-07-30T00:13:42.602Z"
+  },
+  "status": "ACTIVE",
+  "conditions": [
+    {
+      "matchPaths": {
+        "anyOf": [
+          "/agentcore-cli-gateway-read-http-target/*"
+        ]
+      }
+    }
+  ],
+  "description": "AgentCore CLI persistent Gateway Rule read fixture A1",
+  "updatedAt": {
+    "$date": "2026-07-30T00:13:42.602Z"
+  }
+}

src/handlers/gateway/__fixtures__/GetGatewayTargetCommand.212e9693cb8e4550.json

@@ -0,0 +1,6 @@
+{
+  "$error": {
+    "name": "ResourceNotFoundException",
+    "message": "Failed to retrieve target because it doesn't exist. Retry the request with a different resource identifier."
+  }
+}