AI NewsAI NewsAmazon Bedrock AgentCoreMCP Apps交互组件

AWS shows how AgentCore can deliver the same MCP tools and interactive widgets across compatible AI hosts

The reference architecture separates tool execution, self-contained HTML resources, and existing business services behind a managed MCP endpoint.

ENHE AI5 min3 views
AWS shows how AgentCore can deliver the same MCP tools and interactive widgets across compatible AI hosts

Key takeaways

AWS published a technical walkthrough for running MCP Apps on Amazon Bedrock AgentCore on September 11. In the reference architecture, an AI host discovers MCP tools and resources, invokes a tool through WAF and AgentCore Gateway, and receives structured content from business logic implemented with Lambda and DynamoDB. When a tool points to a resource URI, the host reads self-contained widget HTML and renders it in a sandboxed iframe with the structured result injected through the MCP Apps lifecycle. AWS presents MCP Apps as a host-agnostic standard, so one server can provide the same tools and widgets to compatible AI hosts. The production guidance still requires strict argument validation, trust-boundary controls, caller restrictions, monitoring, and cost review.

The sample runs an MCP server on AgentCore Runtime behind one AgentCore Gateway endpoint, with WAF providing IP allowlisting, managed rules, and rate limiting.
AI hosts discover capabilities through tools/list and resources/list; tool calls return structured data, while associated resources provide self-contained HTML rendered in a sandboxed iframe.
Lambda and DynamoDB implement the sample rental service while the MCP layer remains a thin protocol adapter; AWS says existing services can connect through HTTP or SDK calls.

Direct answer

AWS published a technical walkthrough for running MCP Apps on Amazon Bedrock AgentCore on September 11. In the reference architecture, an AI host discovers MCP tools and resources, invokes a tool through WAF and AgentCore Gateway, and receives structured content from business logic implemented with Lambda and DynamoDB. When a tool points to a resource URI, the host reads self-contained widget HTML and renders it in a sandboxed iframe with the structured result injected through the MCP Apps lifecycle. AWS presents MCP Apps as a host-agnostic standard, so one server can provide the same tools and widgets to compatible AI hosts. The production guidance still requires strict argument validation, trust-boundary controls, caller restrictions, monitoring, and cost review.

Verified facts

The sample runs an MCP server on AgentCore Runtime behind one AgentCore Gateway endpoint, with WAF providing IP allowlisting, managed rules, and rate limiting.

AI hosts discover capabilities through tools/list and resources/list; tool calls return structured data, while associated resources provide self-contained HTML rendered in a sandboxed iframe.

Lambda and DynamoDB implement the sample rental service while the MCP layer remains a thin protocol adapter; AWS says existing services can connect through HTTP or SDK calls.

AWS shows how AgentCore can deliver the same MCP tools and interactive widgets across compatible AI hosts cover infographic
ENHE AI original composite: a topic-specific real-work scene with fact-checked editorial copy.

What changed

  • MCP tools can ship interactive resources alongside structured results
  • One MCP server can serve multiple AI hosts that support the Apps extension
  • Protocol adaptation stays separate from business services, storage, and widget resources
  • The external endpoint, runtime identity, and widget sandbox create layered trust boundaries
AWS shows how AgentCore can deliver the same MCP tools and interactive widgets across compatible AI hosts team operating flow
A four-step path from announcement to testable, reversible, auditable operations.

Impact for AI users

The pattern turns rich conversational UI into a portable protocol resource instead of a host-specific integration. A product team can keep its existing business services and add a thin MCP adapter that associates selected tools with widget resource URIs. Because hosts may cache resources and widgets receive structured business data, teams need an explicit versioning and cache strategy, a narrow content security policy, repeated validation at the service boundary, and least-privilege invocation roles. The sample is an implementation reference, not evidence that an unchanged demo configuration is production-ready.

Operating checklist

  1. Choose one frequent read-only workflow and define its tool input schema, structured result, and optional widget resource URI.
  2. Keep the MCP adapter focused on protocol translation while authorization, inventory, and transaction rules remain in existing business services.
  3. Revalidate arguments at both the gateway and service boundaries, and restrict runtime principals, source IPs, and request rates.
  4. Test tool discovery, text-only fallback, widget caching, error paths, and accessibility in at least two compatible AI hosts.

AI frontier news and analysis, AI software and model tools, AI skill tutorials and validation methods, and AI account and permission guidance

FAQ

Must business logic be rewritten inside AgentCore?

No. AWS treats the MCP server as a thin protocol layer, while business logic can remain in Lambda, ECS, EKS, or another existing service.

Does every tool call render an interactive widget?

No. Only tools associated with a resource URI enter the widget-rendering phase; some sample operations return text directly.

Will one widget automatically work in every chat product?

Only hosts that support the MCP Apps extension are candidates, and each host's capabilities, sandbox constraints, caching, and fallback behavior still need testing.

Summary

The useful pattern is the boundary between tools, widgets, and business services. Validate a read-only workflow across hosts first, then add state-changing operations gradually rather than porting an entire application at once.

This AI-assisted article is checked by ENHE AI automation for official sources, bilingual fields, media rights, page safety, and historical duplication before publication.

What this means for everyday users

The pattern turns rich conversational UI into a portable protocol resource instead of a host-specific integration. A product team can keep its existing business services and add a thin MCP adapter that associates selected tools with widget resource URIs. Because hosts may cache resources and widgets receive structured business data, teams need an explicit versioning and cache strategy, a narrow content security policy, repeated validation at the service boundary, and least-privilege invocation roles. The sample is an implementation reference, not evidence that an unchanged demo configuration is production-ready.

Tools you may use

Related tutorials

Related Tools And Tutorials

Use the following ENHE AI sections to continue from the news signal into tool selection, account-service guidance, or practical learning.

Related reading

AWS connects AgentCore evaluations to GitHub Actions for pre-merge agent regression gates

AWS published a reference workflow on September 8 for integrating Amazon Bedrock AgentCore Evaluations with GitHub Actions. The pipeline deploys a development agent and an OAuth-protected MCP server, invokes representative prompts, collects OpenTelemetry traces, and scores behavior before allowing a pull request to proceed. AWS describes built-in dimensions such as helpfulness, correctness, goal success, tool selection, tool parameters, and trajectory order, with custom and code-based evaluators available. The post compares three authentication patterns: evaluating stored traces, using a pre-authorized test user, or issuing machine-to-machine credentials for CI. Its implementation uses the third pattern. Teams should validate that CI credentials cannot escape their intended environment, that evaluation samples cover important failures, and that score variance, latency, evaluator cost, and rollback behavior are visible before treating the threshold as a release gate.

AWS AgentCore Adds Persistent Runtime Instances for Production Agents

AWS announced AgentCore Runtime instances on August 6, 2026. The feature provides persistent, managed EC2 infrastructure for production AI agents, with multi-agent collaboration, GPU support, and sessions lasting up to 14 days. That addresses long-running state and resource continuity, but it does not remove operational responsibility. A safe first trial asks whether a task truly needs hours or days of state, then uses minimal permissions, non-sensitive data, an automatic termination rule, and a cost record covering CPU, GPU, idle time, network access, and session duration. Teams should validate isolation, logging, human approval, backup, and rollback before connecting a persistent runtime to real production data.

AWS Shows AgentCore Policy Workflows with Tenant Isolation and Versioned Skills

AWS’s August 7, 2026 machine-learning case study describes how Cohere Health uses Amazon Bedrock AgentCore to turn clinical prior-authorization policies into structured data. The architecture combines Runtime microVM isolation, Gateway for unified tool access, Memory for session history, and the Agent Skills open standard for versioned domain capabilities. Skills are evaluated with reference data and expert review before release. The reusable lesson is not to automate medical judgment with one prompt. It is to separate tenants, tools, data sources, versions, feedback, and approval, then begin with public or de-identified documents before connecting sensitive business data. Keep the same evidence trail when the workflow changes.

AWS Expands Bedrock AgentCore as Agent Knowledge Retrieval Becomes Managed Infrastructure

AWS announced several Amazon Bedrock AgentCore updates at AWS Summit New York on June 17, 2026. The releases include Managed Knowledge Base, Web Search on AgentCore, AgentCore harness general availability, policy integrations and optimization capabilities, showing that production AI agents are becoming managed infrastructure around knowledge, execution and governance.

A production gate for OpenAI webhooks: signature verification, fast acknowledgement, idempotency, and replay testing

OpenAI webhooks deliver subscribed events as HTTP POST requests to a project-level endpoint. The documentation says the signing secret appears when the endpoint is created and cannot be viewed again, so it must be stored securely for server-side verification. Official SDK helpers can unwrap and verify an event using the raw request body, request headers, and secret. A receiver should return a successful 2xx response within a few seconds and offload non-trivial processing to a background worker. Failed or slow deliveries are retried with exponential backoff for up to 72 hours, while 3xx redirects are treated as failures. Rare duplicate deliveries are possible, so webhook-id should serve as an idempotency key. A release gate should exercise invalid signatures, duplicates, backlog, replay, and recovery before enabling side effects.

Mistral and Cloudera target sovereign enterprise AI with customer-controlled training, inference, and operations

Mistral and Cloudera announced a sovereign enterprise AI partnership on September 10. The companies plan to integrate Mistral models with Cloudera's hybrid data platform across public cloud, private cloud, on-premises, and fully air-gapped environments. Mistral says enterprises will be able to train customized models on proprietary data inside controlled environments while retaining ownership of their data and resulting intelligence. The announcement addresses 30 exabytes of customer-managed data on Cloudera's platform and describes customer control over data, open weights, training, inference, infrastructure, jurisdiction, governance, observability, and the learning loop. It does not identify specific model versions, delivery dates, pricing, certifications, or measured customer outcomes, so buyers still need to translate the sovereignty language into testable contractual and technical controls.

Sources

Table of contents

Latest Insights