// MCP TOKEN COST

The AWS Bedrock AgentCore MCP Server MCP server costs 19,644 tokens before the first call.

Connect AWS Bedrock AgentCore MCP Server and its 117 tool definitions are loaded into the model's context on every request — 9.8% of a 200k window spent before your agent does anything.

QUICK ANSWER The AWS Bedrock AgentCore MCP Server MCP server's tool definitions consume 19,644 tokens — 10× the median MCP server (1,905 tokens). A scoped grant exposing only the tools you use cuts that roughly in proportion.

MEASURED FROM SCHEMAS 117 tools · 19,644 tokens · 9.8% of 200k · 2.0% of 1M Method →

// CONTEXT WINDOW SHARE

What that buys before your agent starts working.

Tool definitions are overhead: they occupy context on every request and compete with your code, documents and conversation history for the same window.

200K WINDOW 9.8%

1M WINDOW 2.0%

Corpus context: AWS Bedrock AgentCore MCP Server ranks #55 of 3,213 measured MCP servers by definition cost. The median is 1,905 tokens, p90 is 7,952, and the heaviest (Fusionauth) is 183,337 — 92% of a 200k window on its own.

// PER-TOOL BREAKDOWN

Where the 19,644 tokens go.

Each row is one tool definition as a tools/list entry — name, description and input schema — counted with o200k_base. Average: 168 tokens per tool.

Tool	Category	Tokens	% of server
gateway_create	Write	666	3.4%
gateway_target_create	Write	635	3.2%
identity_create_oauth2_provider	Write	531	2.7%
create_agent_runtime	Write	480	2.4%
search_agentcore_docs	Read	414	2.1%
gateway_update	Write	394	2.0%
policy_generation_start	Execute	357	1.8%
start_browser_session	Execute	353	1.8%
policy_create	Write	345	1.8%
update_agent_runtime	Write	344	1.8%
memory_create	Write	312	1.6%
memory_create_event	Write	301	1.5%
identity_put_resource_policy	Write	285	1.5%
upload_file	Write	278	1.4%
identity_set_token_vault_cmk	Write	270	1.4%
invoke_agent_runtime	Execute	263	1.3%
identity_create_api_key_provider	Write	263	1.3%
identity_update_oauth2_provider	Write	245	1.2%
policy_update	Write	240	1.2%
memory_retrieve_records	Read	233	1.2%
execute_code	Execute	222	1.1%
start_code_interpreter_session	Execute	219	1.1%
policy_engine_create	Write	216	1.1%
fetch_agentcore_doc	Read	215	1.1%
browser_tabs	Write	215	1.1%
memory_update	Write	215	1.1%
gateway_target_update	Write	213	1.1%
gateway_target_synchronize	Execute	211	1.1%
identity_update_api_key_provider	Write	210	1.1%
memory_list_events	Read	196	1.0%
browser_snapshot	Read	194	1.0%
identity_create_workload_identity	Write	191	1.0%
list_code_interpreter_sessions	Read	189	1.0%
policy_generation_list_assets	Read	188	1.0%
memory_batch_create_records	Write	187	1.0%
install_packages	Write	179	0.9%
create_agent_runtime_endpoint	Write	178	0.9%
gateway_resource_policy_put	Write	177	0.9%
stop_runtime_session	Execute	161	0.8%
browser_type	Write	161	0.8%
policy_list	Read	158	0.8%
stop_code_interpreter_session	Execute	157	0.8%
get_code_interpreter_session	Read	157	0.8%
memory_list_extraction_jobs	Read	155	0.8%
browser_click	Write	155	0.8%
memory_list_records	Read	154	0.8%
browser_fill_form	Write	154	0.8%
download_file	Read	150	0.8%
browser_select_option	Write	146	0.7%
browser_upload_file	Write	146	0.7%
browser_handle_dialog	Write	141	0.7%
browser_evaluate	Execute	139	0.7%
execute_command	Execute	139	0.7%
memory_get_event	Read	137	0.7%
browser_press_key	Write	135	0.7%
browser_mouse_wheel	Read	134	0.7%
browser_wait_for	Execute	133	0.7%
memory_delete_event	Destructive	131	0.7%
memory_batch_update_records	Write	131	0.7%
policy_engine_update	Write	128	0.7%
identity_update_workload_identity	Write	126	0.6%
memory_list_sessions	Read	125	0.6%
policy_generation_list	Read	124	0.6%
update_agent_runtime_endpoint	Write	124	0.6%
identity_get_api_key_provider	Read	122	0.6%
memory_start_extraction_job	Execute	120	0.6%
memory_batch_delete_records	Destructive	119	0.6%
gateway_delete	Destructive	118	0.6%
identity_get_oauth2_provider	Read	117	0.6%
memory_get_record	Read	112	0.6%
browser_resize	Write	111	0.6%
gateway_target_get	Read	109	0.6%
list_browser_sessions	Read	109	0.6%
memory_list_actors	Read	109	0.6%
policy_generation_get	Read	109	0.6%
identity_delete_oauth2_provider	Destructive	108	0.5%
gateway_target_list	Read	108	0.5%
policy_engine_get	Read	108	0.5%
stop_browser_session	Execute	107	0.5%
policy_get	Read	107	0.5%
identity_delete_resource_policy	Destructive	106	0.5%
get_browser_session	Read	106	0.5%
browser_take_screenshot	Read	105	0.5%
identity_get_token_vault	Read	105	0.5%
gateway_get	Read	104	0.5%
identity_list_oauth2_providers	Read	104	0.5%
gateway_resource_policy_delete	Destructive	102	0.5%
identity_list_api_key_providers	Read	101	0.5%
policy_engine_list	Read	100	0.5%
list_agent_runtime_versions	Read	99	0.5%
memory_delete_record	Destructive	98	0.5%
gateway_list	Read	97	0.5%
browser_navigate	Execute	95	0.5%
identity_get_resource_policy	Read	95	0.5%
list_agent_runtime_endpoints	Read	95	0.5%
gateway_target_delete	Destructive	94	0.5%
policy_delete	Destructive	94	0.5%
identity_delete_api_key_provider	Destructive	93	0.5%
identity_delete_workload_identity	Destructive	93	0.5%
policy_engine_delete	Destructive	93	0.5%
memory_list	Read	92	0.5%
identity_list_workload_identities	Read	91	0.5%
browser_hover	Read	87	0.4%
get_agent_runtime	Read	87	0.4%
browser_network_requests	Read	86	0.4%
identity_get_workload_identity	Read	85	0.4%
gateway_resource_policy_get	Read	81	0.4%
memory_get	Read	81	0.4%
list_agent_runtimes	Read	80	0.4%
browser_close	Write	80	0.4%
delete_agent_runtime_endpoint	Destructive	78	0.4%
browser_console_messages	Read	78	0.4%
memory_delete	Destructive	77	0.4%
get_agent_runtime_endpoint	Read	76	0.4%
delete_agent_runtime	Destructive	74	0.4%
browser_navigate_back	Execute	57	0.3%
browser_navigate_forward	Execute	57	0.3%

Computed over 117 of 122 catalogued tools — the remainder have no published input schema, so the true total is slightly higher.

// SCOPED GRANT

Most agents use a handful of these tools. They pay for all 117.

A PolicyLayer grant exposes only the tools you allow — ungranted definitions are filtered out of the tool list, so they never enter the context window. Estimates below assume typical-weight tools (168 tokens each).

Grant scope	Definition cost	Reduction
All 117 tools (no gateway)	19,644 tokens	—
3 granted tools	~504 tokens	−97%
5 granted tools	~839 tokens	−96%
10 granted tools	~1,679 tokens	−91%

Model your own stack in the token-cost calculator, or see the AWS Bedrock AgentCore MCP Server policy for what a sensible grant looks like.

//FAQ

AWS Bedrock AgentCore MCP Server token-cost questions.

How many tokens does the AWS Bedrock AgentCore MCP Server MCP server use?+

Its 117 tool definitions total 19,644 tokens — 9.8% of a 200k context window — measured with tiktoken o200k_base over the serialised tools/list payload. Exact counts vary slightly by client and model.

Why does AWS Bedrock AgentCore MCP Server consume tokens before I send a message?+

MCP clients load every connected server's tool definitions — name, description, and input schema — into the model's context so it knows what it can call. That payload is charged against your context window on every request, whether or not a tool is used.

How do I reduce AWS Bedrock AgentCore MCP Server's token usage?+

Expose fewer tools. A PolicyLayer grant scopes AWS Bedrock AgentCore MCP Server to only the tools you allow — ungranted definitions are filtered out of the tool list, so they never enter the context window. A grant of 3 typical tools costs roughly 504 tokens, a 97% reduction.

Does deferred tool loading fix this?+

Partially, in some clients. Claude Code defers MCP tool schemas behind a tool-search step by default, and VS Code has experimental grouping — but you still pay tokens per search and reload, and Cursor, Windsurf and Gemini CLI load definitions upfront. Reducing the exposed tool set cuts the cost in every client.

// METHOD & REVIEW

How these numbers were measured.

Serialisation

Each tool is serialised as a tools/list entry — name, description, input schema — from the schemas in the PolicyLayer scan database. Clients differ slightly in framing, so treat counts as close estimates.

Tokeniser

tiktoken o200k_base (GPT-4o/o-series). Anthropic's current tokeniser isn't published, so Claude's exact counts will differ; for English text and JSON schemas the totals are close enough to treat these as estimates.

Deferred loading

Some clients now defer schema loading (Claude Code's tool search; VS Code experimental grouping). You still pay per search and reload — and Cursor, Windsurf and Gemini CLI load everything upfront.

Computed 07-06-2026 from the PolicyLayer scan database over 117 of 122 catalogued AWS Bedrock AgentCore MCP Server tools. Counts refresh with every site build.

Expose only the tools you use — the rest never enter your context.

A PolicyLayer grant scopes AWS Bedrock AgentCore MCP Server to the tools you actually allow. Ungranted definitions never load, and every call that does run is checked against policy first.

SCOPE YOUR GRANT →

Free to start. No card required.

4,600+ MCP servers and 31,000+ tools scanned and risk-classified.