AWS shows how AgentCore can deliver the same MCP tools and interactive widgets across compatible AI hosts
The reference architecture separates tool execution, self-contained HTML resources, and existing business services behind a managed MCP endpoint.
Key takeaways
AWS published a technical walkthrough for running MCP Apps on Amazon Bedrock AgentCore on September 11. In the reference architecture, an AI host discovers MCP tools and resources, invokes a tool through WAF and AgentCore Gateway, and receives structured content from business logic implemented with Lambda and DynamoDB. When a tool points to a resource URI, the host reads self-contained widget HTML and renders it in a sandboxed iframe with the structured result injected through the MCP Apps lifecycle. AWS presents MCP Apps as a host-agnostic standard, so one server can provide the same tools and widgets to compatible AI hosts. The production guidance still requires strict argument validation, trust-boundary controls, caller restrictions, monitoring, and cost review.
Direct answer
AWS published a technical walkthrough for running MCP Apps on Amazon Bedrock AgentCore on September 11. In the reference architecture, an AI host discovers MCP tools and resources, invokes a tool through WAF and AgentCore Gateway, and receives structured content from business logic implemented with Lambda and DynamoDB. When a tool points to a resource URI, the host reads self-contained widget HTML and renders it in a sandboxed iframe with the structured result injected through the MCP Apps lifecycle. AWS presents MCP Apps as a host-agnostic standard, so one server can provide the same tools and widgets to compatible AI hosts. The production guidance still requires strict argument validation, trust-boundary controls, caller restrictions, monitoring, and cost review.
Verified facts
The sample runs an MCP server on AgentCore Runtime behind one AgentCore Gateway endpoint, with WAF providing IP allowlisting, managed rules, and rate limiting.
AI hosts discover capabilities through tools/list and resources/list; tool calls return structured data, while associated resources provide self-contained HTML rendered in a sandboxed iframe.
Lambda and DynamoDB implement the sample rental service while the MCP layer remains a thin protocol adapter; AWS says existing services can connect through HTTP or SDK calls.
What changed
- MCP tools can ship interactive resources alongside structured results
- One MCP server can serve multiple AI hosts that support the Apps extension
- Protocol adaptation stays separate from business services, storage, and widget resources
- The external endpoint, runtime identity, and widget sandbox create layered trust boundaries
Impact for AI users
The pattern turns rich conversational UI into a portable protocol resource instead of a host-specific integration. A product team can keep its existing business services and add a thin MCP adapter that associates selected tools with widget resource URIs. Because hosts may cache resources and widgets receive structured business data, teams need an explicit versioning and cache strategy, a narrow content security policy, repeated validation at the service boundary, and least-privilege invocation roles. The sample is an implementation reference, not evidence that an unchanged demo configuration is production-ready.
Operating checklist
- Choose one frequent read-only workflow and define its tool input schema, structured result, and optional widget resource URI.
- Keep the MCP adapter focused on protocol translation while authorization, inventory, and transaction rules remain in existing business services.
- Revalidate arguments at both the gateway and service boundaries, and restrict runtime principals, source IPs, and request rates.
- Test tool discovery, text-only fallback, widget caching, error paths, and accessibility in at least two compatible AI hosts.
AI frontier news and analysis, AI software and model tools, AI skill tutorials and validation methods, and AI account and permission guidance
FAQ
Must business logic be rewritten inside AgentCore?
No. AWS treats the MCP server as a thin protocol layer, while business logic can remain in Lambda, ECS, EKS, or another existing service.
Does every tool call render an interactive widget?
No. Only tools associated with a resource URI enter the widget-rendering phase; some sample operations return text directly.
Will one widget automatically work in every chat product?
Only hosts that support the MCP Apps extension are candidates, and each host's capabilities, sandbox constraints, caching, and fallback behavior still need testing.
Summary
The useful pattern is the boundary between tools, widgets, and business services. Validate a read-only workflow across hosts first, then add state-changing operations gradually rather than porting an entire application at once.
This AI-assisted article is checked by ENHE AI automation for official sources, bilingual fields, media rights, page safety, and historical duplication before publication.
What this means for everyday users
The pattern turns rich conversational UI into a portable protocol resource instead of a host-specific integration. A product team can keep its existing business services and add a thin MCP adapter that associates selected tools with widget resource URIs. Because hosts may cache resources and widgets receive structured business data, teams need an explicit versioning and cache strategy, a narrow content security policy, repeated validation at the service boundary, and least-privilege invocation roles. The sample is an implementation reference, not evidence that an unchanged demo configuration is production-ready.
Tools you may use
Related tutorials
[[zh]][[/zh]][[en]]Review a public website[[/en]]
SearchScope SEO/GEO
[[zh]][[/zh]][[en]]Access and usage guide[[/en]]
AI Prompt Management System | 418 Bilingual Prompts for Writing, SEO and AI Creation
High-Frequency AI Prompts for Work, Learning, and Teaching guide
High-Frequency AI Prompts for Work, Learning, and Teaching
Related Tools And Tutorials
Use the following ENHE AI sections to continue from the news signal into tool selection, account-service guidance, or practical learning.
Related reading
Bayer Shares Production Lessons From 22 Specialist Agents: HTTP Success Is Not Task Success
AWS published Bayer Crop Science’s Agentic Decision Engine case study on October 23, 2026. The production system runs 22 specialist agents over governed analytics workflows, models, logs, and visualization tools. This article turns the architecture into five reusable acceptance checks for enterprise agent teams: persist the state needed to resume work, define identity and authorization at every boundary, scope each agent’s tool catalog, distinguish transport success from task success, and release to a gated group before broader access. It also explains why Bayer’s adoption and resolution figures are evidence about one implementation, not promises for another organization. The focus is operational proof, least privilege, rollback, and observable outcomes rather than prompt polish.
Nine-Stage AI Agent Evaluation Checklist: From First Commit to Production Drift
AWS published a nine-stage production AI-agent evaluation framework built around Amazon Bedrock AgentCore on October 16, 2026. It follows an agent from defining quality and comparing experiments through merge checks, deployment gates, canary scoring, adversarial testing, drift detection, live pulse monitoring, and feedback-driven improvement. The framework evaluates five dimensions—safety, quality, performance, cost, and operational control—at tool, individual-agent, and multi-agent levels. This durable guide converts the public framework into a vendor-neutral checklist for ordinary teams, with minimum evidence, ownership, and stop conditions designed to catch soft failures where latency and uptime remain normal while answer quality quietly declines over time.
Three agents produce a track together on persistent AgentCore runtimes
On September 30, AWS published a hands-on example in which three specialized agents collaborate to render, generate, and clear a music track on Amazon Bedrock AgentCore Runtime Instances. The sample colocates agents on one GPU-backed instance, gives them persistent shared storage, and uses a shared session ID for handoffs and resumable work. AWS says Runtime Instances can host agents built with different frameworks; the walkthrough uses Strands and a file-backed session manager. It is an implementation example, not evidence of unattended production readiness. Deploying it provisions cloud resources such as runtimes, storage, and container repositories, so teams should estimate ongoing charges, narrow IAM permissions, and test cleanup and failure isolation before adapting the pattern.
AWS connects AgentCore evaluations to GitHub Actions for pre-merge agent regression gates
AWS published a reference workflow on September 8 for integrating Amazon Bedrock AgentCore Evaluations with GitHub Actions. The pipeline deploys a development agent and an OAuth-protected MCP server, invokes representative prompts, collects OpenTelemetry traces, and scores behavior before allowing a pull request to proceed. AWS describes built-in dimensions such as helpfulness, correctness, goal success, tool selection, tool parameters, and trajectory order, with custom and code-based evaluators available. The post compares three authentication patterns: evaluating stored traces, using a pre-authorized test user, or issuing machine-to-machine credentials for CI. Its implementation uses the third pattern. Teams should validate that CI credentials cannot escape their intended environment, that evaluation samples cover important failures, and that score variance, latency, evaluator cost, and rollback behavior are visible before treating the threshold as a release gate.
AWS AgentCore Adds Persistent Runtime Instances for Production Agents
AWS announced AgentCore Runtime instances on August 6, 2026. The feature provides persistent, managed EC2 infrastructure for production AI agents, with multi-agent collaboration, GPU support, and sessions lasting up to 14 days. That addresses long-running state and resource continuity, but it does not remove operational responsibility. A safe first trial asks whether a task truly needs hours or days of state, then uses minimal permissions, non-sensitive data, an automatic termination rule, and a cost record covering CPU, GPU, idle time, network access, and session duration. Teams should validate isolation, logging, human approval, backup, and rollback before connecting a persistent runtime to real production data.
AWS Shows AgentCore Policy Workflows with Tenant Isolation and Versioned Skills
AWS’s August 7, 2026 machine-learning case study describes how Cohere Health uses Amazon Bedrock AgentCore to turn clinical prior-authorization policies into structured data. The architecture combines Runtime microVM isolation, Gateway for unified tool access, Memory for session history, and the Agent Skills open standard for versioned domain capabilities. Skills are evaluated with reference data and expert review before release. The reusable lesson is not to automate medical judgment with one prompt. It is to separate tenants, tools, data sources, versions, feedback, and approval, then begin with public or de-identified documents before connecting sensitive business data. Keep the same evidence trail when the workflow changes.