feat(gateway): add read-only gateway commands

README.md

@@ -68,6 +68,15 @@ agentcore                          # interactive TUI
 ├── memory                         # inspect AgentCore Memories
 │   ├── get                        # fetch a Memory by id
 │   └── list                       # list Memories (server-side paginated)
+├── gateway                        # inspect AgentCore Gateways
+│   ├── get                        # get a Gateway by id
+│   ├── list                       # list Gateways (server-side paginated)
+│   ├── target
+│   │   ├── get                    # get a Target under a Gateway
+│   │   └── list                   # list Targets under a Gateway
+│   └── rule
+│       ├── get                    # get a Rule under a Gateway
+│       └── list                   # list Rules under a Gateway
 ├── eval                           # evaluate and optimize AgentCore agents
 │   └── evaluator                  # manage AgentCore evaluators
 │       ├── llm-as-a-judge         # LLM-as-a-Judge evaluators
@@ -128,6 +137,14 @@ agentcore memory get --id <memoryId>
 agentcore memory get --id <memoryId> --view without_decryption
 agentcore memory list --max-results 20
 
+# Inspect Gateway resources without project configuration or deployment
+agentcore gateway get --id <gatewayId>
+agentcore gateway list --max-results 20
+agentcore gateway target get --gateway-id <gatewayId> --target-id <targetId>
+agentcore gateway target list --gateway-id <gatewayId> --max-results 20
+agentcore gateway rule get --gateway-id <gatewayId> --rule-id <ruleId>
+agentcore gateway rule list --gateway-id <gatewayId> --max-results 20
+
 # Manage API key credential providers
 agentcore identity api-key-credential-provider create --name my-provider --api-key <key>
 agentcore identity api-key-credential-provider get --name my-provider

src/components/RouterScreen.test.tsx

@@ -19,6 +19,8 @@ describe("menu rendering", () => {
     expect(frame).toContain("inspect AgentCore Runtimes");
     expect(frame).toContain("memory");
     expect(frame).toContain("manage AgentCore Memories");
+    expect(frame).toContain("gateway");
+    expect(frame).toContain("inspect AgentCore Gateways");
     expect(frame).toContain("config");
     expect(frame).toContain("read/write global config values");
     r.unmount();

src/core/core.test.ts

@@ -191,6 +191,7 @@ test("exposes feature sub-clients", () => {
   });
   expect(core.harness).toBeDefined();
   expect(core.memory).toBeDefined();
+  expect(core.gateway).toBeDefined();
 });
 
 test("getRuntime sends the abort signal to the control client", async () => {

src/core/gateway.tsx

@@ -0,0 +1,93 @@
+import {
+  GetGatewayCommand,
+  GetGatewayRuleCommand,
+  GetGatewayTargetCommand,
+  ListGatewayRulesCommand,
+  ListGatewaysCommand,
+  ListGatewayTargetsCommand,
+  type GetGatewayResponse,
+  type GetGatewayRuleResponse,
+  type GetGatewayTargetResponse,
+  type ListGatewayRulesResponse,
+  type ListGatewaysResponse,
+  type ListGatewayTargetsResponse,
+} from "@aws-sdk/client-bedrock-agentcore-control";
+import type { CoreGatewayClient } from "../handlers/gateway/types";
+import type { AwsClients, CoreOptions } from "./types";
+import { toClientConfig } from "./utils";
+
+export class GatewayClient implements CoreGatewayClient {
+  constructor(private readonly clients: AwsClients) {}
+
+  async getGateway(id: string, options: CoreOptions): Promise<GetGatewayResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new GetGatewayCommand({ gatewayIdentifier: id }));
+  }
+
+  async listGateways(
+    nextToken: string | undefined,
+    maxResults: number | undefined,
+    options: CoreOptions,
+  ): Promise<ListGatewaysResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new ListGatewaysCommand({ nextToken, maxResults }));
+  }
+
+  async getGatewayTarget(
+    gatewayId: string,
+    targetId: string,
+    options: CoreOptions,
+  ): Promise<GetGatewayTargetResponse> {
+    return this.clients.control(toClientConfig(options)).send(
+      new GetGatewayTargetCommand({
+        gatewayIdentifier: gatewayId,
+        targetId,
+      }),
+    );
+  }
+
+  async listGatewayTargets(
+    gatewayId: string,
+    nextToken: string | undefined,
+    maxResults: number | undefined,
+    options: CoreOptions,
+  ): Promise<ListGatewayTargetsResponse> {
+    return this.clients.control(toClientConfig(options)).send(
+      new ListGatewayTargetsCommand({
+        gatewayIdentifier: gatewayId,
+        nextToken,
+        maxResults,
+      }),
+    );
+  }
+
+  async getGatewayRule(
+    gatewayId: string,
+    ruleId: string,
+    options: CoreOptions,
+  ): Promise<GetGatewayRuleResponse> {
+    return this.clients.control(toClientConfig(options)).send(
+      new GetGatewayRuleCommand({
+        gatewayIdentifier: gatewayId,
+        ruleId,
+      }),
+    );
+  }
+
+  async listGatewayRules(
+    gatewayId: string,
+    nextToken: string | undefined,
+    maxResults: number | undefined,
+    options: CoreOptions,
+  ): Promise<ListGatewayRulesResponse> {
+    return this.clients.control(toClientConfig(options)).send(
+      new ListGatewayRulesCommand({
+        gatewayIdentifier: gatewayId,
+        nextToken,
+        maxResults,
+      }),
+    );
+  }
+}

src/core/index.tsx

@@ -2,6 +2,7 @@ import { BedrockAgentCoreControlClient } from "@aws-sdk/client-bedrock-agentcore
 import { BedrockAgentCoreClient } from "@aws-sdk/client-bedrock-agentcore";
 import { IAMClient } from "@aws-sdk/client-iam";
 import { EvalClient } from "./eval";
+import { GatewayClient } from "./gateway";
 import { HarnessClient } from "./harness";
 import { IdentityClient } from "./identity";
 import { MemoryClient } from "./memory";
@@ -54,6 +55,7 @@ export class CoreClient implements AwsClients {
   readonly identity: IdentityClient = new IdentityClient(this);
   readonly memory: MemoryClient = new MemoryClient(this);
   readonly runtime: RuntimeClient;
+  readonly gateway: GatewayClient = new GatewayClient(this);
   readonly eval: EvalClient = new EvalClient(this);
 
   readonly projectManager: ProjectManager;

src/handlers/gateway/__fixtures__/GetGatewayCommand.4216a59651bb046a.json

@@ -0,0 +1,20 @@
+{
+  "gatewayArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:gateway/agentcore-cli-gateway-read-fixture-a-l6opkbe2kd",
+  "gatewayId": "agentcore-cli-gateway-read-fixture-a-l6opkbe2kd",
+  "createdAt": {
+    "$date": "2026-07-29T22:19:37.409Z"
+  },
+  "updatedAt": {
+    "$date": "2026-07-29T22:19:37.971Z"
+  },
+  "status": "READY",
+  "name": "agentcore-cli-gateway-read-fixture-a",
+  "authorizerType": "NONE",
+  "gatewayUrl": "https://agentcore-cli-gateway-read-fixture-a-l6opkbe2kd.gateway.bedrock-agentcore.us-west-2.amazonaws.com/mcp",
+  "description": "AgentCore CLI persistent Gateway read fixture",
+  "roleArn": "arn:aws:iam::685197708687:role/AgentCoreCliGatewayReadFixtureRole",
+  "protocolType": "MCP",
+  "workloadIdentityDetails": {
+    "workloadIdentityArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:workload-identity-directory/default/workload-identity/agentcore-cli-gateway-read-fixture-a-l6opkbe2kd"
+  }
+}

src/handlers/gateway/__fixtures__/GetGatewayCommand.fe70727e83c9acf1.json

@@ -0,0 +1,6 @@
+{
+  "$error": {
+    "name": "ResourceNotFoundException",
+    "message": "Failed to retrieve gateway because it doesn't exist. Retry the request with a different resource identifier."
+  }
+}

src/handlers/gateway/__fixtures__/GetGatewayRuleCommand.137147fc065772f4.json

@@ -0,0 +1,6 @@
+{
+  "$error": {
+    "name": "ResourceNotFoundException",
+    "message": "GatewayRule 00000000-0000-4000-8000-000000000000 not found"
+  }
+}

src/handlers/gateway/__fixtures__/GetGatewayRuleCommand.e2b99534dc4a233f.json

@@ -0,0 +1,31 @@
+{
+  "ruleId": "d396c3f4-4591-41b3-a4d5-816e03c32419",
+  "gatewayArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:gateway/agentcore-cli-gateway-read-rule-fixture-lhpid2reoy",
+  "priority": 10,
+  "actions": [
+    {
+      "routeToTarget": {
+        "staticRoute": {
+          "targetName": "agentcore-cli-gateway-read-http-target"
+        }
+      }
+    }
+  ],
+  "createdAt": {
+    "$date": "2026-07-30T00:13:42.602Z"
+  },
+  "status": "ACTIVE",
+  "conditions": [
+    {
+      "matchPaths": {
+        "anyOf": [
+          "/agentcore-cli-gateway-read-http-target/*"
+        ]
+      }
+    }
+  ],
+  "description": "AgentCore CLI persistent Gateway Rule read fixture A1",
+  "updatedAt": {
+    "$date": "2026-07-30T00:13:42.602Z"
+  }
+}

src/handlers/gateway/__fixtures__/GetGatewayTargetCommand.212e9693cb8e4550.json

@@ -0,0 +1,6 @@
+{
+  "$error": {
+    "name": "ResourceNotFoundException",
+    "message": "Failed to retrieve target because it doesn't exist. Retry the request with a different resource identifier."
+  }
+}

src/handlers/gateway/__fixtures__/GetGatewayTargetCommand.d547517995d9266e.json

@@ -0,0 +1,23 @@
+{
+  "gatewayArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:gateway/agentcore-cli-gateway-read-fixture-a-l6opkbe2kd",
+  "targetId": "KALJACI9HO",
+  "createdAt": {
+    "$date": "2026-07-29T22:20:22.462Z"
+  },
+  "updatedAt": {
+    "$date": "2026-07-29T22:20:25.484Z"
+  },
+  "status": "READY",
+  "name": "agentcore-cli-gateway-read-target-a1",
+  "targetConfiguration": {
+    "mcp": {
+      "mcpServer": {
+        "endpoint": "https://mcp.context7.com/mcp"
+      }
+    }
+  },
+  "description": "AgentCore CLI persistent Gateway Target read fixture",
+  "lastSynchronizedAt": {
+    "$date": "2026-07-29T22:20:25.286Z"
+  }
+}

src/handlers/gateway/__fixtures__/ListGatewayRulesCommand.11f078b3d9015781.json

@@ -0,0 +1,35 @@
+{
+  "gatewayRules": [
+    {
+      "ruleId": "545ee264-f3e0-4333-ad31-0a260d0c0a7a",
+      "gatewayArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:gateway/agentcore-cli-gateway-read-rule-fixture-lhpid2reoy",
+      "priority": 20,
+      "actions": [
+        {
+          "routeToTarget": {
+            "staticRoute": {
+              "targetName": "agentcore-cli-gateway-read-http-target"
+            }
+          }
+        }
+      ],
+      "createdAt": {
+        "$date": "2026-07-30T00:13:42.856Z"
+      },
+      "status": "ACTIVE",
+      "conditions": [
+        {
+          "matchPaths": {
+            "anyOf": [
+              "/agentcore-cli-gateway-read-http-target/*"
+            ]
+          }
+        }
+      ],
+      "description": "AgentCore CLI persistent Gateway Rule read fixture A2",
+      "updatedAt": {
+        "$date": "2026-07-30T00:13:42.856Z"
+      }
+    }
+  ]
+}

src/handlers/gateway/__fixtures__/ListGatewayRulesCommand.aea3eebbdd6782a6.json

@@ -0,0 +1,36 @@
+{
+  "gatewayRules": [
+    {
+      "ruleId": "d396c3f4-4591-41b3-a4d5-816e03c32419",
+      "gatewayArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:gateway/agentcore-cli-gateway-read-rule-fixture-lhpid2reoy",
+      "priority": 10,
+      "actions": [
+        {
+          "routeToTarget": {
+            "staticRoute": {
+              "targetName": "agentcore-cli-gateway-read-http-target"
+            }
+          }
+        }
+      ],
+      "createdAt": {
+        "$date": "2026-07-30T00:13:42.602Z"
+      },
+      "status": "ACTIVE",
+      "conditions": [
+        {
+          "matchPaths": {
+            "anyOf": [
+              "/agentcore-cli-gateway-read-http-target/*"
+            ]
+          }
+        }
+      ],
+      "description": "AgentCore CLI persistent Gateway Rule read fixture A1",
+      "updatedAt": {
+        "$date": "2026-07-30T00:13:42.602Z"
+      }
+    }
+  ],
+  "nextToken": "{\"qualified_gateway_id\":\"685197708687/agentcore-cli-gateway-read-rule-fixture-lhpid2reoy/default\",\"sort_key\":\"PRIORITY#0000000010000\"}"
+}

src/handlers/gateway/__fixtures__/ListGatewayTargetsCommand.7eb952b3b7e51b55.json

@@ -0,0 +1,21 @@
+{
+  "items": [
+    {
+      "targetId": "KALJACI9HO",
+      "name": "agentcore-cli-gateway-read-target-a1",
+      "status": "READY",
+      "createdAt": {
+        "$date": "2026-07-29T22:20:22.462Z"
+      },
+      "updatedAt": {
+        "$date": "2026-07-29T22:20:25.484Z"
+      },
+      "description": "AgentCore CLI persistent Gateway Target read fixture",
+      "lastSynchronizedAt": {
+        "$date": "2026-07-29T22:20:25.286Z"
+      },
+      "targetType": "MCP_SERVER"
+    }
+  ],
+  "nextToken": "AQICAHjoR4+rRMkqrOqAClU4WXRl/BYNcFGMZzyZmTV8TePbugFWJqzdVKbd+myGJJE2QPzmAAABPjCCAToGCSqGSIb3DQEHBqCCASswggEnAgEAMIIBIAYJKoZIhvcNAQcBMB4GCWCGSAFlAwQBLjARBAxlGRbqXmW0GWjjpXQCARCAgfJloMkFwZZZ2tYdIS8tEp+oLT2WKDuRe9YKoYsiePXCXtW0HZ0DjtknJUqWnL7Jy3LrAvV0vMhSGYGjFyAwzRMpV+5o2gp8SGOZ0TW9u9+n9Mi8AidSRpGsiww/ZtISfm4ltKUo48nsnWTheeTstx28BOX9wUANsIXKIuFobJtbBzRrTBPQfE7kO3A5xBKTu44mg5l3t5aCnq6SYNAXiVEBtc0uw8i6XGOp+rh7Ux5mMeYJvRj0tSeHRmMu2nq+T9s+fv35h4yaMXyCn9un7JH+RhlnEwLuJklDOIMnYLEGmGM6o96+WvWvVsb0uufyVUVg7A=="
+}

src/handlers/gateway/__fixtures__/ListGatewayTargetsCommand.bfef00ff066f3fe6.json

@@ -0,0 +1,20 @@
+{
+  "items": [
+    {
+      "targetId": "ZZHBZX71VQ",
+      "name": "agentcore-cli-gateway-read-target-a2",
+      "status": "READY",
+      "createdAt": {
+        "$date": "2026-07-29T22:20:25.993Z"
+      },
+      "updatedAt": {
+        "$date": "2026-07-29T22:20:29.823Z"
+      },
+      "description": "AgentCore CLI persistent Gateway Target read fixture",
+      "lastSynchronizedAt": {
+        "$date": "2026-07-29T22:20:29.628Z"
+      },
+      "targetType": "MCP_SERVER"
+    }
+  ]
+}