Scaling Enterprise AI Data Access via Serverless MCP on AWS
Learn how a serverless Model Context Protocol server on Amazon ECS Fargate connects AI agents to data lakes using configuration-driven metadata files.
Organizations building applications powered by artificial intelligence face a recurring challenge: giving large language model agents access to enterprise data lakes without duplicating integration logic across every agent and application. Most teams begin by wiring agents directly to databases and APIs, with no shared gateway such as a Model Context Protocol server in between. Each new dataset demands custom code, and each agent reimplements its own access control. As the number of datasets or agents grows, permission enforcement drifts, and onboarding a new data source becomes a multi-day engineering effort.
To solve this for planning teams across Amazon's North America Sort Center network, engineers built a serverless Model Context Protocol server on Amazon Elastic Container Service with AWS Fargate. The server acts as a centralized, agent-agnostic gateway between AI agents and the enterprise data lake. Exposing a new dataset requires only a JSON metadata file that the server discovers automatically on the next pipeline sync. Developers looking to experiment with various workloads can try top AI models cheaply through one API at https://apixoai.online.
Architecture and Design Goals
The system design addresses fragmented data access patterns and unsustainable onboarding models. The architecture separates concerns into four layers: client, MCP server, tools, and knowledge-base refresh. Each layer is independently scalable and deployable.
A metadata catalog underpins the tools layer, storing schema descriptions, column-level semantics, and table relationships that the AI agent references when generating SQL. The knowledge-base refresh layer keeps that catalog current, indexing new dataset metadata as it arrives using AWS Lambda and Amazon Bedrock Knowledge Bases. When requests flow through, an Application Load Balancer with AWS WAF routes traffic to Amazon Cognito for JWT authentication, while Amazon DynamoDB handles session state.
The MCP server runs on its own ECS Fargate cluster, isolated from the client layer. Powered by FastMCP, a Python framework for building MCP servers, it handles query analysis, tool selection, and execution using Amazon Bedrock. Amazon Bedrock Guardrails filters harmful content, enforces grounding checks, and blocks prompt injection attempts.
Metadata-Driven Onboarding
The infrastructure relies on configuration-driven extensibility. Adding a dataset requires a metadata JSON file describing the table and an optional context mapping entry. The file captures the table's schema, business context, and column-level semantics, serving as the single source of truth for the AI agent.
The business description field carries engine-specific query hints, such as wrapping string literals in date functions, which reduces SQL validation failures. The column details pair each column name and type with a natural language description and sample values. This gives the agent schema awareness and real data patterns, such as understanding that a warehouse ID holds specific alphanumeric codes rather than full facility names.
What it means for developers
For developers and engineering teams, this architectural pattern shifts extensibility from a coding task to a configuration problem. Instead of writing custom integration code, query validation, and tool wrappers for every new table, teams can onboard datasets by dropping in a single JSON metadata file.
Because the MCP server exposes a standardized JSON-RPC interface via FastMCP, any MCP-compatible client—including Amazon Q Developer or IDE extensions—can connect without custom adapters. Centralized permission enforcement means access control happens at the server layer. Tools enforce strict SELECT-only queries to prevent write operations, and Amazon CloudWatch logs every invocation to provide a single audit point. This allows multiple agents to share the same tools and security controls without redundant implementation work.
Security and Scaling
The architecture uses layered security. The MCP server sits in private subnets behind an internal Application Load Balancer, making it unreachable directly from the internet. User identity is validated upstream at the client layer, and all tool interactions pass through centralized guardrails.
Scaling is handled automatically across services. The client and MCP server layers scale via Amazon ECS Service Auto Scaling based on CPU and memory thresholds, while Amazon Athena and Amazon Bedrock scale according to query concurrency and inference requests without requiring manual infrastructure changes.
Source: Serverless MCP server for AI agent data lake access on Amazon ECS Fargate | Amazon Web Services — AWS Machine Learning. Written by the Apixo team from that report.
One key for Claude, GPT, GLM, DeepSeek and more. Pay per token with crypto.
Get your API key
