Amazon API Gateway is the managed REST and HTTP API service in AWS. If your backend services run in AWS, API Gateway is likely the front door — managing authentication, throttling, and routing for everything from Lambda functions to ECS containers. The Naftiko capability for Amazon API Gateway exposes the gateway management surface as AI-consumable tools, letting agents reason about your API inventory and extend it programmatically.
What the Capability Covers
The api-gateway-management capability wraps the Amazon API Gateway management API, covering REST API discovery and creation. It is the foundation for composing more targeted capabilities around stage management, deployment automation, and integration configuration.
MCP Tools Available
list-rest-apis— List all REST APIs deployed in your Amazon API Gatewaycreate-rest-api— Create a new REST API with specified name, description, and endpoint type
Capability Specification
naftiko: 1.0.0-alpha1
info:
label: Amazon API Gateway Management
description: Workflow capability for managing API Gateway REST APIs including lifecycle management, stage deployment, and configuration.
tags:
- Amazon
- API Gateway
- AWS
- API Management
binds:
- namespace: env
keys:
AWS_ACCESS_KEY_ID: AWS_ACCESS_KEY_ID
AWS_SECRET_ACCESS_KEY: AWS_SECRET_ACCESS_KEY
AWS_REGION: AWS_REGION
capability:
consumes:
- namespace: amazon-api-gateway
type: http
# The API Gateway control plane accepts only SigV4-signed requests, and
# SigV4 is not one of Naftiko's `authentication` types. Requests are
# routed through the official awslabs/aws-sigv4-proxy sidecar, which
# signs with its own IAM credentials — hence no `authentication` block.
baseUri: http://localhost:8080
inputParameters:
- name: host
in: header
value: "apigateway.{{AWS_REGION}}.amazonaws.com"
resources:
- name: rest-apis
path: "/restapis"
operations:
- name: get-rest-apis
method: GET
- name: create-rest-api
method: POST
exposes:
- type: mcp
port: 9090
namespace: api-gateway-management-mcp
transport: http
description: MCP server for AI-assisted API Gateway management.
tools:
- name: list-rest-apis
description: List all REST APIs configured in Amazon API Gateway.
hints:
readOnly: true
openWorld: false
call: amazon-api-gateway.get-rest-apis
outputParameters:
- type: object
mapping: $.
- name: create-rest-api
description: Create a new REST API in Amazon API Gateway.
hints:
readOnly: false
openWorld: false
call: amazon-api-gateway.create-rest-api
with:
body: tools.body
outputParameters:
- type: object
mapping: $.
Running It
Because the API Gateway control plane requires SigV4 signing — which Naftiko does not implement as an authentication type — the capability runs alongside the official AWS SigV4 proxy, which signs outgoing requests with its own IAM credentials.
docker pull ghcr.io/naftiko/framework:latest
# Set AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION in your .env file
# 1. The signing sidecar — signs and forwards to the host in the Host header
docker run -d --name sigv4-proxy -p 8080:8080 \
--env-file .env \
public.ecr.aws/aws-observability/aws-sigv4-proxy:latest \
--name apigateway --region "$AWS_REGION"
# 2. The capability, pointed at the proxy
docker run -p 9090:9090 --network host \
-v ./capabilities/api-gateway-management.yaml:/app/capability.yaml \
--env-file .env \
ghcr.io/naftiko/framework:latest /app/capability.yaml
With list-rest-apis available as an MCP tool, an AI agent can build a complete inventory of your AWS API surface as part of a broader discovery or governance workflow. The Amazon API Gateway capability is part of the Naftiko Fleet.
