Enterprise identity on Amazon Bedrock AgentCore with Lark (Feishu) as the IdP. A Gateway Request Interceptor forwards the user's identity and injects a per-user credential — the agent never holds it — so downstream MCP tools act as the user against Lark and reach only what that user can.
Lark Identity on AgentCore is a reference implementation showing how an agent on Amazon Bedrock AgentCore can carry a user's Lark identity and permissions to downstream MCP tools. It lets agents accessed through Lark chat or an embedded web interface use per-user Lark credentials through a Gateway Request Interceptor, without holding those credentials themselves.
aws-samples/sample-lark-identity-on-agentcore-interceptor
MCP server Claude CodeCodexCursor +2 ✓ vendor
MCP server "lark-agent-cdk" as configured in aws-samples/sample-lark-identity-on-agentcore-interceptor. Runs locally from the lark-agent-cdk Python package.