AWS Bedrock AgentCore

AWS Bedrock AgentCore MCP Server

Documentation on AgentCore platform services.

What is an MCP Server?⁠

MCP Info

Image Building Info

Attribute	Details
Dockerfile	https://github.com/awslabs/mcp/blob/636aca8e109b5559006044f035bb89c16e9e5410/src/amazon-bedrock-agentcore-mcp-server/Dockerfile⁠
Commit	636aca8e109b5559006044f035bb89c16e9e5410
Docker Image built by	Docker Inc.
Docker Scout Health Score
Verify Signature	COSIGN_REPOSITORY=mcp/signatures cosign verify mcp/amazon-bedrock-agentcore-mcp-server --key https://raw.githubusercontent.com/docker/keyring/refs/heads/main/public/mcp/latest.pub
Licence	Apache License 2.0

Available Tools (122)

Tools Details

Tool: browser_click

Click an element identified by its accessibility ref.

Use refs from the most recent browser_snapshot or navigation result. If the ref is not found, returns an error with the current page snapshot so you can retry with a correct ref.

Tool: browser_close

Close the current page.

Closes the active page in the browser session. If multiple tabs are open, subsequent tools will use the remaining tab. Use stop_browser_session to fully terminate the session.

Tool: browser_console_messages

Get recent browser console messages.

Returns console log, warning, and error messages captured since the Playwright connection was established. Useful for debugging JavaScript errors or inspecting application logging.

Tool: browser_evaluate

Execute a JavaScript expression in the page context.

The expression is evaluated in the browser and its return value is serialized to JSON. Use this for extracting data, reading page state, or performing custom interactions. You can use fetch() to make HTTP requests from the browser's origin and cookies.

Tool: browser_fill_form

Fill multiple form fields in one action.

Clears each field before filling. Optionally clicks a submit button after all fields are filled. Returns the page snapshot after completion.

Tool: browser_handle_dialog

Configure how JavaScript dialogs are handled for a session.

Sets a persistent handler for JavaScript dialogs (alert, confirm, prompt, beforeunload). Once set, all subsequent dialogs in the session are automatically accepted or dismissed. Call again to change the behavior.

Tool: browser_hover

Hover over an element identified by its accessibility ref.

Useful for triggering tooltips, dropdown menus, or hover states. Returns the page snapshot after hovering.

Tool: browser_mouse_wheel

Scroll the page by the specified pixel amounts.

Default scrolls down by 500px (roughly half a viewport). Use negative delta_y to scroll up. Returns the page snapshot after scrolling.

Tool: browser_navigate

Navigate to a URL in the browser.

Loads the specified URL and returns an accessibility tree snapshot of the loaded page. Use the element refs in the snapshot for subsequent interaction tools.

Tool: browser_navigate_back

Navigate back in browser history.

Returns an accessibility tree snapshot of the previous page.

Tool: browser_navigate_forward

Navigate forward in browser history.

Returns an accessibility tree snapshot of the next page.

Tool: browser_network_requests

List recent network requests and their status.

Returns a summary of network requests made by the page, including URL, HTTP method, status code, and resource type. Useful for debugging API calls or monitoring page loading.

Tool: browser_press_key

Press a keyboard key or key combination.

Simulates a key press on the page (not a specific element). Supports modifier combinations like "Control+a" or "Meta+c". Returns the page snapshot after the key press.

Tool: browser_resize

Resize the browser viewport.

Changes the viewport dimensions of the active page. Useful for testing responsive layouts or viewing content at different sizes. Returns the page snapshot at the new size.

Tool: browser_select_option

Select an option from a dropdown or combobox.

Provide one of: value (option value attribute), label (visible text), or index (zero-based position). Returns the page snapshot after selection.

Tool: browser_snapshot

Capture an accessibility tree snapshot of the current page.

Returns a structured text view of the page with element refs. Use the refs (e.g., e1, e2) in interaction tools like browser_click and browser_type to target specific elements.

Example output:

• heading "Sign In" [ref=e1]
• textbox "Email" [ref=e2]
• textbox "Password" [ref=e3]
• button "Sign In" [ref=e4] Parameters|Type|Description -|-|- session_id|string|Browser session identifier selector|stringoptional|Optional CSS selector to scope the snapshot to a specific section of the page (e.g., "main", "[role=main]", "#content"). If omitted, captures the full page.

Tool: browser_tabs

Manage browser tabs: list, create, select, or close tabs.

Actions:

• "list": Show all open tabs with their titles and URLs.
• "new": Open a new tab, optionally navigating to a URL.
• "select": Switch the active tab (subsequent tools use this tab).
• "close": Close a tab by its index. Parameters|Type|Description -|-|- session_id|string|Browser session identifier action|stringoptional|Tab action to perform: "list" to show all tabs, "new" to open a new tab, "select" to switch to a tab by index, "close" to close a tab by index. tab_index|stringoptional|Zero-based tab index for "select" and "close" actions url|stringoptional|URL to open in a new tab (for "new" action)

Tool: browser_take_screenshot

Capture a visual screenshot of the page.

Returns the screenshot as a base64-encoded PNG image. Use this when you need to visually inspect the page rather than reading the accessibility tree.

Tool: browser_type

Type text into an element identified by its accessibility ref.

By default, clears the existing content before typing. Set clear_first=False to append to existing text. Set submit=True to press Enter after typing.

Tool: browser_upload_file

Upload files to a file input element identified by its ref.

Resolves the ref to a file input locator and sets the specified file paths. For cloud AgentCore sessions, paths refer to files on the remote VM. For local Playwright connections, paths refer to files on the local filesystem.

Tool: browser_wait_for

Wait for text to appear or an element to become visible.

Provide either text or selector. Returns the page snapshot after the condition is met. Raises an error if the timeout is exceeded.

Tool: create_agent_runtime

Create a new AgentCore Runtime to host an agent or tool.

This is a one-time setup operation that creates AWS infrastructure (IAM role binding, container deployment, endpoint). The DEFAULT endpoint is created automatically. Subsequent updates create new immutable versions.

Cost note: Creating a runtime provisions infrastructure. You are not billed until sessions are invoked, but the runtime definition and its resources persist until deleted.

Tool: create_agent_runtime_endpoint

Create a custom endpoint for an AgentCore Runtime.

Endpoints provide stable access points to specific runtime versions. The DEFAULT endpoint is created automatically; use this for additional environments (dev, staging, prod).

This is a configuration operation with no per-use cost.

Tool: delete_agent_runtime

Delete an AgentCore Runtime and all its versions.

All endpoints must be deleted first. Active sessions will be terminated. This operation cannot be undone.

Tool: delete_agent_runtime_endpoint

Delete a runtime endpoint. Cannot delete the DEFAULT endpoint.

This operation cannot be undone.

Tool: download_file

Download a file from the sandboxed code interpreter session.

Reads the content of a file at the specified path in the session's sandbox.

Tool: execute_code

Execute code in a sandboxed code interpreter session.

Runs Python, JavaScript, or TypeScript code in the session's sandbox. The execution context (variables, imports) persists across calls within the same session unless clear_context is True.

Tool: execute_command

Execute a shell command in a sandboxed code interpreter session.

Runs a shell command in the session's sandbox environment.

Tool: fetch_agentcore_doc

Fetch full document content by URL.

Retrieves complete AgentCore documentation content from URLs found via search_agentcore_docs or provided directly. Use this to get full documentation pages including:

• Complete platform overview and service documentation
• Detailed getting started guides with step-by-step instructions
• Full API reference documentation
• Comprehensive tutorial and example code
• Complete deployment and configuration instructions
• Integration guides for various frameworks (Strands, LangGraph, CrewAI, etc.)

This provides the full content when search snippets aren't sufficient for understanding or implementing AgentCore features.

Tool: gateway_create

Create a new AgentCore Gateway resource.

COST WARNING: Creating a gateway provisions AWS infrastructure and incurs AWS charges. Gateway invocations are billed separately per request. A workload identity is also auto-created alongside the gateway.

The gateway starts in CREATING status and transitions to READY when ready for invocation. Use gateway_get to check status. The returned gatewayUrl is the endpoint for MCP invocations; tools are added via gateway_target_create.

Returns the created gateway details including its ID, ARN, URL, and auto-created workload identity ARN.

Tool: gateway_delete

Delete an AgentCore Gateway.

WARNING: This permanently deletes the gateway. All associated targets and the auto-created workload identity are removed. Agents pointing to this gateway's URL will fail to invoke. This action cannot be undone.

Note: You may need to delete gateway targets first if the gateway has any; otherwise the API will return a ConflictException.

Tool: gateway_get

Get details of an AgentCore Gateway.

Returns the gateway including status, authorizer configuration, URL, protocol settings, and associated workload identity. This is a read-only operation with no cost implications.

Tool: gateway_list

List all AgentCore Gateways in the account.

Returns gateway summaries with IDs, names, authorizer types, status, and timestamps. This is a read-only operation with no cost implications.

Tool: gateway_resource_policy_delete

Delete the resource-based policy attached to a gateway.

WARNING: This removes all permissions granted by the resource policy. Principals that relied on the policy for access will no longer be able to invoke the gateway. This action cannot be undone.

Tool: gateway_resource_policy_get

Get the resource-based policy attached to a gateway.

Returns the raw JSON policy document. This is a read-only operation with no cost implications.

Tool: gateway_resource_policy_put

Create or update a resource-based policy on a gateway.

COST WARNING: The policy itself is free, but misconfigured policies can expose a gateway to unintended principals — review carefully before applying.

Creates or replaces the resource policy attached to the specified gateway. Use this to grant cross-account access or to restrict access beyond what inbound authorization provides.

Tool: gateway_target_create

Create a new gateway target to expose tools through a gateway.

COST WARNING: Target creation is free, but tool invocations through the gateway (Lambda calls, REST API calls, MCP server calls) incur per-request costs against the underlying services. For mcpServer targets, target creation triggers an implicit synchronization that calls the MCP server's tools/list — this may take several minutes for large tool sets.

The target starts in CREATING status and transitions to READY when available. For mcpServer targets, status may also go through SYNCHRONIZING. Use gateway_target_get to check status.

Security note: Credential material (API keys, OAuth secrets) is NOT accepted directly — only provider ARNs. Create the credential provider separately using the agentcore CLI or the AgentCore Identity service so secrets never flow through LLM context.

Tool: gateway_target_delete

Delete a gateway target.

WARNING: This permanently removes the target from the gateway. Tools exposed via this target will no longer be available to agents. This action cannot be undone.

Tool: gateway_target_get

Get details of a gateway target.

Returns the target including status, credential provider config, target configuration, metadata configuration, and sync timestamps. This is a read-only operation with no cost implications.

Tool: gateway_target_list

List all targets attached to a gateway.

Returns target summaries with IDs, names, status, and timestamps. This is a read-only operation with no cost implications.

Tool: gateway_target_synchronize

Explicitly synchronize gateway targets with their upstream tool catalog.

COST WARNING: Synchronization calls the MCP server's tools/list endpoint and re-indexes the tool catalog (including rebuilding semantic search embeddings if enabled). This incurs compute costs and can take several minutes for large tool sets. The API returns a 202 response and processes asynchronously — monitor progress via gateway_target_get.

Use this for mcpServer targets when the upstream MCP server has added, removed, or changed tools. CreateGatewayTarget and UpdateGatewayTarget already trigger implicit synchronization, so this is only needed when the upstream catalog changes independently.

Tool: gateway_target_update

Update an existing gateway target.

COST WARNING: For mcpServer targets, updating triggers implicit synchronization with the MCP server's tools/list endpoint, which can take several minutes for large tool sets.

Updates the target configuration, credentials, metadata, or description. Returns the updated target details.

Tool: gateway_update

Update an AgentCore Gateway.

COST WARNING: Adding or enabling interceptors adds Lambda invocation costs on every gateway request. Policy engine enforcement may also affect latency and cost profile.

Note: UpdateGateway requires all fields that were part of the create call — even ones you aren't changing — or the existing values will be replaced. Fetch with gateway_get first, then pass through the existing values for fields you don't want to change.

Returns the updated gateway details.

Tool: get_agent_runtime

Get details of an AgentCore Runtime including its configuration.

This is a read-only operation with no cost implications.

Tool: get_agent_runtime_endpoint

Get details of a specific runtime endpoint.

Read-only, no cost implications.

Tool: get_browser_session

Get the status and metadata of a browser session.

Returns session status, stream endpoints, viewport dimensions, and creation timestamp.

Tool: get_code_interpreter_session

Get the status and details of a code interpreter session.

Tool: get_gateway_guide

Get the comprehensive AgentCore Gateway guide.

Returns a detailed reference covering: prerequisites, tool cost tiers, excluded operations and security notes, CLI commands, agentcore.json schema, target types, common patterns, debugging, troubleshooting, IAM permissions, and migration notes.

This is a read-only operation with no cost implications.

Tool: get_identity_guide

Get the comprehensive AgentCore Identity guide.

Returns a detailed reference covering: prerequisites, cost tiers, data-plane exclusion rationale, CLI commands, agentcore.json schema, OAuth2 provider config shapes, common patterns, troubleshooting, IAM permissions, and migration notes.

This is a read-only operation with no cost implications.

Tool: get_memory_guide

Get the comprehensive AgentCore Memory guide.

Returns a detailed reference covering: CLI commands, agentcore.json schema, memory strategies, cost tiers, common patterns, troubleshooting, IAM permissions, and migration notes.

This is a read-only operation with no cost implications.

Tool: get_policy_guide

Get the comprehensive AgentCore Policy guide.

Returns a detailed reference covering: CLI commands, agentcore.json schema, Cedar policy concepts, policy generation workflow, cost tiers, common patterns, troubleshooting, IAM permissions, and migration notes.

This is a read-only operation with no cost implications.

Tool: get_runtime_guide

Get a comprehensive reference guide for AgentCore Runtime.

Covers CLI commands, agentcore.json schema, protocol contracts, session lifecycle, IAM permissions, cost tiers, common patterns, troubleshooting, and migration notes.

Read-only, no cost implications.

Tool: identity_create_api_key_provider

Create an API key credential provider in AgentCore Identity.

COST WARNING: Creates a secret in AWS Secrets Manager (backing the credential provider) and incurs Secrets Manager storage charges.

SECURITY NOTE: The api_key parameter value flows through LLM context when this tool is called by an AI assistant. For production secrets, strongly prefer the CLI: agentcore add credential --name --api-key The CLI accepts the key without it entering LLM conversation history. Use this MCP tool for test credentials, automation from controlled contexts, or when the key is already known to the caller.

Returns the created provider's ARN and Secrets Manager secret ARN.

Tool: identity_create_oauth2_provider

Create an OAuth2 credential provider in AgentCore Identity.

COST WARNING: Creates a secret in AWS Secrets Manager (holding the client_secret) and incurs Secrets Manager storage charges.

SECURITY NOTE: The clientSecret inside oauth2_provider_config_input flows through LLM context when this tool is called by an AI assistant. For production secrets, strongly prefer the CLI: agentcore add credential --name --type oauth
--discovery-url --client-id
--client-secret --scopes <scope1,scope2> The CLI accepts the secret without it entering LLM conversation history. Use this MCP tool for test providers, automation from controlled contexts, or when the client_secret is already known to the caller.

The response includes a callbackUrl — the OAuth2 redirect URI you must register with the external provider.

Tool: identity_create_workload_identity

Create a new AgentCore workload identity.

COST WARNING: Creates a workload identity resource in AgentCore Identity. Workload identities themselves are free, but the workload access tokens they issue are used to retrieve stored credentials from the token vault.

Returns the created workload identity details including its ARN.

Tool: identity_delete_api_key_provider

Permanently delete an API key credential provider.

WARNING: This permanently deletes the credential provider and its backing secret. Any agents or workloads retrieving the key via this provider will fail. This action cannot be undone.

Tool: identity_delete_oauth2_provider

Permanently delete an OAuth2 credential provider.

WARNING: This permanently deletes the credential provider and its backing secret. Any agents or workloads retrieving tokens via this provider will fail. Any stored 3LO user consents tied to this provider are lost. This action cannot be undone.

Tool: identity_delete_resource_policy

Permanently delete the resource-based policy on an AgentCore resource.

WARNING: Removes ALL access-control statements from the target resource. After deletion, only principals authorized by identity-based IAM policies (not resource-based policies) can invoke or manage the resource. This action cannot be undone.

Tool: identity_delete_workload_identity

Permanently delete an AgentCore workload identity.

WARNING: This permanently deletes the workload identity. Any agents or code relying on this identity will no longer be able to authenticate. This action cannot be undone.

Tool: identity_get_api_key_provider

Get metadata for an API key credential provider.

Returns the provider ARN, the ARN of the backing Secrets Manager secret, and timestamps. Does NOT return the API key value itself — that is only retrievable at runtime by workloads with a valid workload identity token (via the SDK, not via MCP).

This is a read-only operation with no cost implications.

Tool: identity_get_oauth2_provider

Get metadata for an OAuth2 credential provider.

Returns the provider ARN, vendor, callback URL, Secrets Manager secret ARN, OAuth2 discovery output, and timestamps. Does NOT return the client_secret value — that is stored in Secrets Manager and only used server-side during token exchanges.

This is a read-only operation with no cost implications.

Tool: identity_get_resource_policy

Get the resource-based policy attached to an AgentCore resource.

Returns the policy as a JSON object. If no policy is attached, returns a success response with an empty policy. This is a read-only operation with no cost implications.

Tool: identity_get_token_vault

Get details of an AgentCore Identity token vault.

Returns the token vault ID, KMS configuration (key type and key ARN), and last-modified timestamp. This is a read-only operation with no cost implications.

Tool: identity_get_workload_identity

Get details of an AgentCore workload identity.

Returns the workload identity including allowed OAuth2 return URLs, ARN, and timestamps. This is a read-only operation with no cost implications.

Tool: identity_list_api_key_providers

List API key credential providers in the account.

Returns provider summaries with names, ARNs, and timestamps. Does NOT return API key values. This is a read-only operation with no cost implications.

Tool: identity_list_oauth2_providers

List OAuth2 credential providers in the account.

Returns provider summaries with names, ARNs, vendors, and timestamps. Does NOT return client secrets. This is a read-only operation with no cost implications.

Tool: identity_list_workload_identities

List AgentCore workload identities in the account.

Returns workload identity summaries with names and ARNs. This is a read-only operation with no cost implications.

Tool: identity_put_resource_policy

Create or replace the resource-based policy on an AgentCore resource.

ACCESS CONTROL WARNING: This modifies who can invoke or manage the target resource. Overly permissive policies (e.g. broad Principal wildcards or cross-account access) can expose the resource to unintended callers. Review policy documents carefully before applying, and prefer least-privilege statements scoped to specific principals and actions.

This is an idempotent replace — it overwrites any existing policy on the resource.

Tool: identity_set_token_vault_cmk

Set the customer master key (CMK) for an AgentCore Identity token vault.

COST WARNING: Switching to a CustomerManagedKey incurs AWS KMS charges for every encryption and decryption request against secrets in the vault (each stored credential). Switching back to ServiceManagedKey stops these KMS charges.

SECURITY NOTE: This operation changes how credentials stored in the vault are encrypted. Ensure the KMS key policy grants the AgentCore service principal the necessary permissions (kms:Decrypt, kms:Encrypt, kms:GenerateDataKey, kms:DescribeKey) before switching to a CustomerManagedKey, or stored credentials will become inaccessible.

Tool: identity_update_api_key_provider

Update the API key stored in an existing credential provider.

COST WARNING: Rotates the secret in AWS Secrets Manager. Continues to incur Secrets Manager storage charges.

SECURITY NOTE: The api_key parameter value flows through LLM context when this tool is called by an AI assistant. For production key rotation, strongly prefer the CLI: agentcore add credential --name --api-key (re-running add with the same name rotates the key without the value entering LLM conversation history).

Returns updated provider metadata. The provider ARN is stable.

Tool: identity_update_oauth2_provider

Update an OAuth2 credential provider's configuration.

COST WARNING: Rotates the secret in AWS Secrets Manager. Continues to incur Secrets Manager storage charges.

SECURITY NOTE: The clientSecret inside oauth2_provider_config_input flows through LLM context when this tool is called by an AI assistant. For production secret rotation, strongly prefer the CLI (re-running agentcore add credential with the same name rotates the credential without the value entering LLM history).

Returns updated provider metadata. The provider ARN and callback URL are stable.

Tool: identity_update_workload_identity

Update an AgentCore workload identity.

Replaces the allowed OAuth2 return URLs list. This is a config change only — the workload identity ARN and name are immutable.

Tool: install_packages

Install Python packages in a sandboxed code interpreter session.

Uses pip to install the specified packages in the session's sandbox.

Tool: invoke_agent_runtime

Invoke an agent hosted in AgentCore Runtime.

Sends a request to the agent and returns the response. Each invocation uses or creates a microVM session identified by runtime_session_id.

BILLABLE OPERATION: This creates or reuses a microVM session that incurs AWS compute charges for the duration of the session. Sessions auto-terminate after the configured idle timeout (default 15 minutes). Use stop_runtime_session to terminate early and save costs.

Tool: list_agent_runtime_endpoints

List all endpoints for an AgentCore Runtime.

Read-only, no cost implications.

Tool: list_agent_runtime_versions

List all versions of a specific AgentCore Runtime.

This is a read-only operation with no cost implications.

Tool: list_agent_runtimes

List all AgentCore Runtimes in the account.

This is a read-only operation with no cost implications.

Tool: list_browser_sessions

List active browser sessions.

Returns a summary of all browser sessions for the specified browser resource, including session IDs, status, and creation times.

Tool: list_code_interpreter_sessions

List code interpreter sessions with optional filtering.

Tool: memory_batch_create_records

Batch create memory records in an AgentCore Memory resource.

COST WARNING: Creating memory records consumes storage and indexing resources. Each record incurs charges.

Creates up to 100 memory records in a single call. Each record must include content, namespaces, a request identifier, and a timestamp.

Tool: memory_batch_delete_records

Batch delete memory records from an AgentCore Memory resource.

WARNING: This permanently deletes up to 100 memory records in a single call. This action cannot be undone.

Tool: memory_batch_update_records

Batch update memory records in an AgentCore Memory resource.

Updates up to 100 memory records in a single call. Each record must include its ID and a timestamp.

Tool: memory_create

Create a new AgentCore Memory resource.

COST WARNING: Creating a memory resource provisions AWS infrastructure. This incurs AWS charges. Memory strategies that process events (extraction, consolidation) consume additional compute resources.

The memory resource starts in CREATING status and transitions to ACTIVE when ready. Use memory_get to check status.

Returns the created memory resource details including its ID.

Tool: memory_create_event

Create an event in an AgentCore Memory resource (short-term memory).

COST WARNING: Creating events triggers background long-term memory extraction if strategies are configured. This consumes compute resources and incurs AWS charges.

Events represent interactions (messages, tool calls) within a session. They are immutable and timestamped.

Tool: memory_delete

Delete an AgentCore Memory resource.

WARNING: This permanently deletes the memory resource and all associated data (events, memory records, strategies). This action cannot be undone.

Tool: memory_delete_event

Permanently delete an event from an AgentCore Memory resource.

WARNING: This permanently removes the event. This action cannot be undone. Already-extracted long-term memory records are not affected.

Tool: memory_delete_record

Permanently delete a memory record from an AgentCore Memory resource.

WARNING: This permanently removes the memory record. This action cannot be undone.

Tool: memory_get

Get details of an AgentCore Memory resource.

Returns the memory resource including status, strategies, configuration, and timestamps. This is a read-only operation with no cost implications.

Tool: memory_get_event

Get a specific event from an AgentCore Memory resource.

Retrieves full event details including payload and metadata. This is a read-only operation with no cost implications.

Tool: memory_get_record

Get a specific memory record from an AgentCore Memory resource.

Returns the full record including content, metadata, namespaces, and strategy ID. This is a read-only operation.

Tool: memory_list

List all AgentCore Memory resources in the account.

Returns memory summaries with IDs, ARNs, status, and timestamps. This is a read-only operation with no cost implications.

Tool: memory_list_actors

List all actors in an AgentCore Memory resource.

Returns actor summaries (actor IDs) for the memory. This is a read-only operation with no cost implications.

Tool: memory_list_events

List events in an AgentCore Memory resource.

Lists events for a specific actor and session with optional filtering by branch or metadata. This is a read-only operation.

Tool: memory_list_extraction_jobs

List memory extraction jobs for an AgentCore Memory resource.

Returns extraction job metadata including status, actor/session IDs, and failure reasons. This is a read-only operation.

Tool: memory_list_records

List memory records in an AgentCore Memory resource.

Returns memory record summaries filtered by namespace and optionally by strategy. This is a read-only operation.

Tool: memory_list_sessions

List sessions for an actor in an AgentCore Memory resource.

Returns session summaries with session IDs, actor IDs, and creation timestamps. This is a read-only operation.

Tool: memory_retrieve_records

Semantic search for memory records in an AgentCore Memory resource.

COST WARNING: Semantic search invokes embedding and retrieval infrastructure. Each call incurs compute charges.

Searches long-term memory records by semantic similarity to the query. Returns results ordered by relevance score. Use this to retrieve contextually relevant memories for agent responses.

Tool: memory_start_extraction_job

Start (or restart) a memory extraction job.

COST WARNING: Extraction jobs consume compute resources to process events and produce memory records. This incurs AWS charges.

Typically used to retry previously failed extraction jobs. The job processes events and produces structured long-term memory records.

Tool: memory_update

Update an AgentCore Memory resource.

COST WARNING: Adding new memory strategies may increase processing costs as new strategies will process incoming events.

Can update description, event expiry, execution role, and strategies (add, modify, or delete). Returns the updated memory details.

Tool: policy_create

Create a Cedar policy within an AgentCore Policy Engine.

COST WARNING: Creating a policy invokes the validation pipeline and provisions a billable policy resource. This incurs AWS charges.

Policies are validated against the Cedar schema derived from the parent policy engine's associated Gateway tools. Create is asynchronous — the policy starts in CREATING and transitions to ACTIVE or CREATE_FAILED. Poll with policy_get.

Tool: policy_delete

Delete a Cedar policy.

WARNING: This permanently deletes the policy. Delete is asynchronous — status transitions through DELETING. This action cannot be undone.

Tool: policy_engine_create

Create a new AgentCore Policy Engine.

COST WARNING: Creating a policy engine provisions AWS infrastructure and incurs AWS charges. The engine starts in CREATING status and transitions to ACTIVE when ready. Use policy_engine_get to poll the status.

Returns the created policy engine details including its ID and ARN.

Tool: policy_engine_delete

Delete an AgentCore Policy Engine.

WARNING: This permanently deletes the policy engine. The engine must not have any associated policies before deletion — delete all policies first with policy_delete, then delete the engine. This action cannot be undone.

Tool: policy_engine_get

Get details of an AgentCore Policy Engine.

Returns the policy engine including status, encryption config, and timestamps. This is a read-only operation with no cost implications.

Tool: policy_engine_list

List AgentCore Policy Engines in the account.

Returns policy engine summaries with IDs, ARNs, status, and timestamps. This is a read-only operation with no cost implications.

Tool: policy_engine_update

Update an AgentCore Policy Engine.

Currently only the description can be updated. The engine's name and encryption configuration are immutable after creation.

Tool: policy_generation_get

Get details of an AgentCore Policy Generation.

Returns the generation including status, findings, and resource context. Use to poll after policy_generation_start. This is a read-only operation with no cost implications.

Tool: policy_generation_list

List policy generations within a Policy Engine.

Returns policy generation summaries with IDs, ARNs, status, resource context, and timestamps. Generated assets auto-delete after 7 days. This is a read-only operation with no cost implications.

Tool: policy_generation_list_assets

List Cedar policies and findings produced by policy generation.

Returns generated policy assets — each with its Cedar definition (if translatable), the original natural-language fragment, and validation findings (VALID, INVALID, NOT_TRANSLATABLE, ALLOW_ALL, ALLOW_NONE, DENY_ALL, DENY_NONE). Use assets with VALID findings in policy_create via the "policyGeneration" definition variant. This is a read-only operation with no cost implications.

Tool: policy_generation_start

Start an AI-powered Cedar policy generation from natural language.

COST WARNING: Policy generation invokes foundation models and consumes significant compute resources. This is typically the most expensive Policy operation per call. Each invocation incurs AWS charges.

The generation is asynchronous — starts in GENERATING and transitions to GENERATED or GENERATE_FAILED. Poll with policy_generation_get. Generated assets auto-delete after 7 days. To persist a generated policy, reference its asset in policy_create via the "policyGeneration" union variant.

Tool: policy_get

Get details of a Cedar policy.

Returns the full policy including its Cedar definition, status, and timestamps. This is a read-only operation with no cost implications. Use to poll status after create/update/delete.

Tool: policy_list

List Cedar policies within a Policy Engine.

Returns policy summaries with IDs, ARNs, definitions, status, and timestamps. Optionally filter by target resource scope (e.g. a Gateway ARN). This is a read-only operation with no cost implications.

Tool: policy_update

Update a Cedar policy.

COST WARNING: Updating a policy re-invokes the validation pipeline and consumes compute resources. This incurs AWS charges.

Update is asynchronous — status transitions through UPDATING. Poll with policy_get.

Tool: search_agentcore_docs

Search curated AgentCore documentation and return ranked results with snippets.

This tool provides access to the complete Amazon Bedrock AgentCore documentation including:

Platform Overview:

• What is Bedrock AgentCore, security overview, quotas and limits

Platform Services:

• AgentCore Runtime (serverless deployment and scaling)
• AgentCore Memory (persistent knowledge with event and semantic memory)
• AgentCore Code Interpreter (secure code execution in isolated sandboxes)
• AgentCore Browser (fast, secure cloud-based browser for web interaction)
• AgentCore Gateway (transform existing APIs into agent tools)
• AgentCore Observability (real-time monitoring and tracing)
• AgentCore Identity (secure authentication and access management)

Getting Started:

• Prerequisites & environment setup
• Building your first agent or transforming existing code
• Local development & testing
• Deployment to AgentCore using CLI
• Troubleshooting & enhancement

Examples & Tutorials:

• Basic agent creation, memory integration, tool usage
• Streaming responses, error handling, authentication
• Customer service agents, code review assistants, data analysis
• Multi-agent workflows and integrations

API Reference:

• Data plane and control API documentation

Use this to find relevant AgentCore documentation for any development question.

Tool: start_browser_session

Start a cloud browser session via Amazon Bedrock AgentCore.

Creates an isolated browser session running in a Firecracker microVM. Returns the session ID and automation stream URL for subsequent browser interaction tools.

Usage:

1. Call this tool first to start a browser session.
2. Use the returned session_id with browser interaction tools (browser_navigate, browser_click, browser_snapshot, etc.).
3. Call stop_browser_session when done. Parameters|Type|Description -|-|- browser_identifier|stringoptional|AgentCore browser resource identifier. Use "aws.browser.v1" for the default browser. extensions|stringoptional|List of browser extensions to load from S3 into the session. profile_configuration|stringoptional|Profile configuration for persisting cookies and local storage across sessions. Pass a profile identifier created via the AgentCore control plane. proxy_configuration|stringoptional|Proxy configuration for routing browser traffic through external proxy servers. Supports multiple proxies with domain-based routing and bypass rules. region|stringoptional|AWS region for AgentCore APIs timeout_seconds|integeroptional|Session idle timeout in seconds — the session expires after this many seconds of inactivity (no tool calls). Default 900 (15 min), max 28800 (8 hours). Active sessions persist as long as there is interaction within each timeout window. viewport_height|integeroptional|Browser viewport height in pixels viewport_width|integeroptional|Browser viewport width in pixels

Tool: start_code_interpreter_session

Start a new sandboxed code interpreter session.

Creates a new session that can execute code, run commands, and manage files in an isolated environment. The session remains active until explicitly stopped or until the timeout expires (default DEFAULT_SESSION_TIMEOUT_SECONDS).

Tool: stop_browser_session

Stop a browser session and release resources.

Terminates the browser session and its underlying microVM. The session cannot be resumed after stopping.

Tool: stop_code_interpreter_session

Stop a running code interpreter session and release its resources.

Tool: stop_runtime_session

Stop a running runtime session to release its microVM.

Use this to terminate sessions early and save costs instead of waiting for the idle timeout (default 15 minutes). This is the recommended cleanup action after your agent conversation is complete.

This is a cost-saving operation that prevents runaway charges from idle sessions.

Tool: update_agent_runtime

Update an AgentCore Runtime, creating a new immutable version.

The DEFAULT endpoint automatically points to the new version. Custom endpoints must be updated separately.

Cost note: Updating creates a new version. Active sessions continue using the previous version until they terminate.

Tool: update_agent_runtime_endpoint

Update an endpoint to point to a different runtime version.

Enables zero-downtime version transitions and rollbacks. Configuration-only, no per-use cost.

Tool: upload_file

Upload a file to the sandboxed code interpreter session.

Creates or overwrites a file at the specified path in the session's sandbox with the given content. Path must be relative (e.g. 'data/input.csv'). The SDK raises ValueError for absolute paths.

For binary files, pass the content as a base64-encoded string. The sandbox can then decode it, e.g. via import base64; data = base64.b64decode(content).

Use this MCP Server

{
  "mcpServers": {
    "amazon-bedrock-agentcore": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "mcp/amazon-bedrock-agentcore-mcp-server"
      ]
    }
  }
}

Why is it safer to run MCP Servers with Docker?⁠