Gateway enableSemanticSearch: false synthesizes invalid SearchType: NONE

[rhprasad0]

Description

AgentCore CLI accepts a Gateway configured with enableSemanticSearch: false, but the generated CDK construct synthesizes ProtocolConfiguration.Mcp.SearchType: NONE.

CloudFormation rejects that value. Its AWS::BedrockAgentCore::Gateway reference makes SearchType optional and lists SEMANTIC as the only allowed value:

https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-bedrockagentcore-gateway-mcpgatewayconfiguration.html

This creates a cross-layer validation gap: agentcore validate succeeds, synthesis completes, and the deployment then fails on the generated CloudFormation property. If the service or construct cannot represent a disabled state, the CLI should reject false locally rather than generate an unsupported enum value.

Steps to Reproduce

1. In a CLI-generated AgentCore project, add the following Gateway entry to agentcore/agentcore.json:

   {
     "name": "example-gateway",
     "protocolType": "MCP",
     "description": "Minimal reproduction",
     "targets": [
       {
         "name": "web-search",
         "targetType": "connector",
         "connectorId": "web-search",
         "configurations": [
           {
             "name": "WebSearch",
             "description": "",
             "parameterValues": {},
             "parameterOverrides": []
           }
         ]
       }
     ],
     "authorizerType": "AWS_IAM",
     "enableSemanticSearch": false,
     "exceptionLevel": "NONE"
   }

2. Validate the project:

   agentcore validate

   Result: Valid.

3. Run a deployment dry run:

   agentcore deploy --dry-run --target default --yes

4. To inspect the exact template, synthesize the generated CDK project and open agentcore/cdk/cdk.out/*.template.json:

   cd agentcore/cdk
   npm run build
   npx cdk synth

   The Gateway resource contains:

   ProtocolConfiguration:
     Mcp:
       SearchType: NONE

5. Deploy the project:

   agentcore deploy --target default --yes

   CloudFormation rejects the Gateway because NONE is not an allowed SearchType.

Expected Behavior

enableSemanticSearch: false should produce a service-valid disabled configuration. If the current AgentCore service or CDK contract cannot represent that state, the CLI should reject the value with an actionable local error. It should never synthesize the unsupported SearchType: NONE value.

As defense in depth, agentcore validate or deployment preflight should catch any local configuration that would synthesize an unsupported CloudFormation enum value.

Actual Behavior

• agentcore validate accepts enableSemanticSearch: false.
• The generated CDK construct maps it to SearchType: NONE.
• CloudFormation rejects the generated Gateway configuration.

CLI Version

0.24.0

Operating System

Linux

Additional Context

Generated construct version: @aws/agentcore-cdk 0.1.0-alpha.45.

Verified workaround (enables semantic search)

Removing enableSemanticSearch allows the schema default (true) to apply. This does not preserve the requested disabled state, but it unblocks deployment. With the property omitted:

• synthesis emitted SearchType: SEMANTIC and no Gateway SearchType: NONE;
• CloudFormation deployment completed;
• the Gateway and Web Search target reached READY;
• IAM/SigV4-authenticated MCP listing and a controlled connector call succeeded.

This workaround changes behavior: semantic search is enabled. tools/list advertised both x_amz_bedrock_agentcore_search and the configured Web Search connector, so clients that need a deterministic tool set must explicitly filter the discovered surface.

Regression clue

Review discussion on #855 described enableSemanticSearch: false as causing the CDK path to omit ProtocolConfiguration. The current SearchType: NONE behavior therefore looks like a regression, but I have not established a pinned last-good/first-bad release boundary.

Suggested fix and regression coverage

• Map false to the service's valid disabled representation, or reject false locally if no such representation is currently supported.
• Never synthesize SearchType: NONE.
• Add a synthesis test asserting that enableSemanticSearch: false does not emit an unsupported search value.
• Add a CloudFormation-contract check to agentcore validate or deployment preflight as defense in depth.
• Cover both enabled and disabled Gateway configurations in end-to-end tests.

No account IDs, ARNs, Gateway endpoints, stack identifiers, credentials, or raw provider responses are included in this report.

[notgitika]

We have merged in a fix for this issue and it will be released in our next release