Architecting Zero-Trust Model Context Protocol (MCP) Request Signatures & HMAC-SHA256 Tool Call Nonces with AWS Secrets Manager, KMS, and Amazon Bedrock Agents

01 Why Standard MCP Tool Invocations Lack Authentication & Integrity

The Model Context Protocol (MCP) standardizes how LLM agents discover and invoke external tools across distributed boundaries. However, default MCP implementations over JSON-RPC 2.0 (whether over HTTP POST, Server-Sent Events, or WebSockets) treat the underlying transport as implicitly trusted or rely solely on static bearer tokens in HTTP headers.

In enterprise environments where agents interact across multiple AWS VPCs, on-premises datacenters, and third-party SaaS APIs, static tokens introduce critical vulnerabilities:

To resolve these vulnerabilities, enterprise AI architectures must adopt cryptographic request signatures, timestamp drift validation, and single-use cryptographic nonces to enforce zero-trust end-to-end payload integrity.

02 End-to-End Cryptographic Request Signature Flow & Nonce Envelope

The AIConnect Zero-Trust MCP Signature protocol operates by wrapping standard JSON-RPC 2.0 payloads in a cryptographic envelope. Before transmitting an invocation to an MCP tool server, the Bedrock Agent or orchestration runtime constructs a canonical request string comprising:

• HTTP Method & Path: e.g., POST /v1/mcp/tools/execute
• Agent Workload Identity: e.g., agent-id-finops-production-us-east-1
• Epoch Millisecond Timestamp: e.g., 1730332800000 (max drift ±60 seconds)
• Single-Use Nonce: Cryptographically generated UUIDv4 e.g., c3b29f04-89f7-4182-9964-b03a30c5e7b2
• Payload SHA-256 Digest: Base64-encoded SHA-256 hash of the exact raw JSON-RPC body bytes

+-----------------------+           +------------------------------+           +------------------------+
|  Amazon Bedrock Agent |           |   AWS Secrets Manager / KMS  |           |   MCP Tool Server      |
|  (Orchestration Loop) |           |   (Signing Key Rotation)     |           |   (FastAPI / Go Mesh)  |
+-----------+-----------+           +--------------+---------------+           +-----------+------------+
            |                                      |                                       |
            | 1. Retrieve Active Key ID            |                                       |
            |------------------------------------->|                                       |
            |<-------------------------------------|                                       |
            |    Key Version & Secret Value        |                                       |
            |                                                                              |
            | 2. Generate Nonce (UUIDv4) + Epoch Timestamp + SHA256(Body)                  |
            | 3. Compute HMAC-SHA256(StringToSign, SecretKey)                              |
            |                                                                              |
            | 4. POST /v1/mcp/tools/execute [Headers: Signature, Nonce, Timestamp]         |
            |----------------------------------------------------------------------------->|
            |                                                                              |
            |                                              5. Check Nonce Uniqueness       |
            |                                                 in Redis (SETNX with TTL)    |
            |                                              6. Verify Timestamp Drift       |
            |                                              7. Verify HMAC-SHA256 Signature |
            |                                                                              |
            | 8. Execute Tool Logic & Return JSON-RPC Response                             |
            |<-----------------------------------------------------------------------------|
    

03 AWS Secrets Manager & KMS Customer Managed Key (CMK) Rotation

Signing secrets cannot remain static. An enterprise-grade architecture integrates automated key rotation via AWS Secrets Manager and an AWS Lambda rotation function. The secret payload in Secrets Manager maintains two active keys simultaneously: active_key and previous_key.

This dual-key configuration allows zero-downtime key rotation. When a key rotates:

1. The rotation Lambda creates a new 256-bit cryptographic secret generated via AWS KMS GenerateRandom.
2. The new secret is staged under version stage AWSPENDING.
3. MCP servers and agents refresh their local in-memory key cache from Secrets Manager via IAM authenticated calls.
4. When promoted to AWSCURRENT, outgoing agent requests immediately sign with the new key version ID. MCP tool servers continue accepting signatures generated by previous_key during a 15-minute grace period.

04 Anti-Replay Attacks & Distributed Redis Nonce Caching

Even with valid signatures, an adversary who captures an in-flight tool request could replay it within the valid timestamp window. To prevent replay attacks entirely, the MCP tool validator implements atomic nonce tracking using Amazon ElastiCache for Redis.

When a request arrives at the MCP server:

05 Production TypeScript MCP Request Signer for Bedrock Agents

Below is the production TypeScript implementation of the MCP client signer used by agent runtimes and Bedrock tool handlers:

import * as crypto from 'crypto';
import { v4 as uuidv4 } from 'uuid';

export interface MCPSignedRequest {
  url: string;
  method: 'POST';
  headers: Record<string, string>;
  body: string;
}

export class MCPRequestSigner {
  private agentId: string;
  private keyId: string;
  private secretKey: string;

  constructor(agentId: string, keyId: string, secretKey: string) {
    this.agentId = agentId;
    this.keyId = keyId;
    this.secretKey = secretKey;
  }

  /**
   * Constructs an HMAC-SHA256 signed HTTP request for MCP tool execution
   */
  public signRequest(url: string, jsonRpcPayload: object): MCPSignedRequest {
    const rawBody = JSON.stringify(jsonRpcPayload);
    const parsedUrl = new URL(url);
    const path = parsedUrl.pathname;
    const timestamp = Date.now().toString();
    const nonce = uuidv4();

    // 1. Compute SHA-256 digest of request body
    const bodyDigest = crypto.createHash('sha256').update(rawBody, 'utf8').digest('hex');

    // 2. Build canonical string to sign
    const stringToSign = [
      'POST',
      path,
      this.agentId,
      timestamp,
      nonce,
      bodyDigest
    ].join('
');

    // 3. Compute HMAC-SHA256 signature
    const signature = crypto
      .createHmac('sha256', this.secretKey)
      .update(stringToSign, 'utf8')
      .digest('hex');

    return {
      url,
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'X-AIConnect-Agent-Id': this.agentId,
        'X-AIConnect-Key-Id': this.keyId,
        'X-AIConnect-Timestamp': timestamp,
        'X-AIConnect-Nonce': nonce,
        'X-AIConnect-Signature': signature
      },
      body: rawBody
    };
  }
}

06 Production Python FastAPI / MCP Server Signature & Nonce Validator

On the receiving MCP tool server, an asynchronous FastAPI dependency validates signatures, timestamp drift, and Redis nonce uniqueness before the JSON-RPC request is dispatched:

import hmac
import hashlib
import time
from fastapi import Request, HTTPException, Security, Depends
from redis.asyncio import Redis

# In-memory key store synced with AWS Secrets Manager
KEY_STORE = {
    "key-2026-v1": "4f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a",
    "key-2026-v2": "8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b"
}

redis_client = Redis.from_url("redis://localhost:6379/0", decode_responses=True)

async def verify_mcp_signature(request: Request):
    agent_id = request.headers.get("X-AIConnect-Agent-Id")
    key_id = request.headers.get("X-AIConnect-Key-Id")
    timestamp_str = request.headers.get("X-AIConnect-Timestamp")
    nonce = request.headers.get("X-AIConnect-Nonce")
    received_sig = request.headers.get("X-AIConnect-Signature")

    if not all([agent_id, key_id, timestamp_str, nonce, received_sig]):
        raise HTTPException(status_code=401, detail="Missing cryptographic authentication headers")

    # 1. Validate Timestamp Drift (Max 60 Seconds)
    try:
        timestamp_ms = int(timestamp_str)
    except ValueError:
        raise HTTPException(status_code=401, detail="Invalid timestamp format")

    now_ms = int(time.time() * 1000)
    if abs(now_ms - timestamp_ms) > 60000:
        raise HTTPException(status_code=401, detail="Signature timestamp out of permissible drift window (+/- 60s)")

    # 2. Validate Anti-Replay Nonce via Redis Atomic SETNX
    redis_key = f"mcp:nonce:{agent_id}:{nonce}"
    is_unique = await redis_client.set(redis_key, "1", ex=120, nx=True)
    if not is_unique:
        raise HTTPException(status_code=403, detail="Replay attack detected: Nonce has already been consumed")

    # 3. Retrieve Secret Key from Store
    secret_key = KEY_STORE.get(key_id)
    if not secret_key:
        raise HTTPException(status_code=401, detail="Unrecognized or expired signing key ID")

    # 4. Read Raw Request Body & Compute SHA-256 Digest
    raw_body = await request.body()
    body_digest = hashlib.sha256(raw_body).hexdigest()

    # 5. Reconstruct Canonical StringToSign
    path = request.url.path
    string_to_sign = f"POST
{path}
{agent_id}
{timestamp_str}
{nonce}
{body_digest}"

    # 6. Verify HMAC-SHA256 Signature (Constant-Time Comparison)
    expected_sig = hmac.new(
        secret_key.encode('utf-8'),
        string_to_sign.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(expected_sig, received_sig):
        raise HTTPException(status_code=401, detail="Cryptographic signature verification failed")

    return {"agent_id": agent_id, "key_id": key_id, "verified": True}

07 Threat Modeling: Mitigating Man-in-the-Middle, Replay & Prompt Forgery

Evaluating the security posture of an agent tool mesh requires examining threat vectors against STRIDE criteria: