@aws/agentcore 1.0.0-preview.13 → 1.0.0-preview.14

package/dist/assets/agents/AGENTS.md

@@ -122,6 +122,19 @@ When modifying JSON config files:
 4. Use CloudFormation-safe names (alphanumeric, start with letter)
 5. Run `agentcore validate` to verify changes
 
+## Harness Export
+
+`agentcore export harness` converts a harness configuration into a deployable Strands Python agent under `app/<agentName>/`.
+
+**After every export, you MUST read `app/<agentName>/EXPORT_NOTES.md` before proceeding.**
+
+This file lists any manual follow-up items required before the agent will deploy or run correctly — missing files to create, IAM policies to add, or configuration steps the exporter could not automate. A clean export produces "No manual steps required." Complete every item in the file before running `agentcore deploy`.
+
+```bash
+agentcore export harness --name <harnessName>   # generates app/<agentName>/EXPORT_NOTES.md
+cat app/<agentName>/EXPORT_NOTES.md             # read this before touching anything else
+```
+
 ## CLI Commands
 
 | Command | Description |
@@ -129,6 +142,7 @@ When modifying JSON config files:
 | `agentcore create` | Create a new project |
 | `agentcore add <resource>` | Add agent, memory, credential, gateway, evaluator, policy |
 | `agentcore remove <resource>` | Remove a resource |
+| `agentcore export harness` | Export a harness to a Strands runtime agent |
 | `agentcore dev` | Run agent locally with hot-reload |
 | `agentcore deploy` | Deploy to AWS |
 | `agentcore status` | Show deployment status |

package/dist/assets/cdk/bin/cdk.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { AgentCoreStack } from '../lib/cdk-stack';
-import { ConfigIO, type AwsDeploymentTarget } from '@aws/agentcore-cdk';
+import { AgentCoreStack, type HarnessConfig } from '../lib/cdk-stack';
+import { ConfigIO, HarnessSpecSchema, type AwsDeploymentTarget } from '@aws/agentcore-cdk';
 import { App, type Environment } from 'aws-cdk-lib';
 import * as path from 'path';
 import * as fs from 'fs';
@@ -56,40 +56,61 @@ async function main() {
     throw new Error('No deployment targets configured. Please define targets in agentcore/aws-targets.json');
   }
 
-  // Read harness configs for role creation.
+  // Read harness configs: the full validated spec drives the CFN resource; the
+  // role-scoped fields drive the IAM role + container build.
   const projectRoot = path.resolve(configRoot, '..');
-  const harnessConfigs: {
-    name: string;
-    executionRoleArn?: string;
-    memoryName?: string;
-    containerUri?: string;
-    hasDockerfile?: boolean;
-    dockerfile?: string;
-    codeLocation?: string;
-    tools?: { type: string; name: string }[];
-    apiKeyArn?: string;
-    efsAccessPoints?: { accessPointArn: string; mountPath: string }[];
-    s3AccessPoints?: { accessPointArn: string; mountPath: string }[];
-    apiFormat?: 'converse_stream' | 'responses' | 'chat_completions';
-  }[] = [];
-  for (const entry of specAny.harnesses ?? []) {
+
+  // Read non-S3 KB connector-config files and pass their parsed contents to the
+  // L3 verbatim. The L3 does not read files; it expects the parsed
+  // connectorParameters keyed by the data source's connectorConfigFile path.
+  const connectorParametersByFile: Record<string, Record<string, unknown>> = {};
+  for (const kb of specAny.knowledgeBases ?? []) {
+    for (const ds of kb.dataSources ?? []) {
+      if (ds.type !== 'S3' && ds.connectorConfigFile) {
+        const abs = path.resolve(projectRoot, ds.connectorConfigFile);
+        try {
+          connectorParametersByFile[ds.connectorConfigFile] = JSON.parse(fs.readFileSync(abs, 'utf-8'));
+        } catch (err) {
+          throw new Error(
+            `Could not read connector config '${ds.connectorConfigFile}' for knowledge base '${kb.name}' at ${abs}: ${err instanceof Error ? err.message : err}`
+          );
+        }
+      }
+    }
+  }
+
+  // Harness is preview-gated. The CLI bundle bakes the preview flag at build time and
+  // forwards it to this child process via AGENTCORE_PREVIEW (see toolkit-lib/wrapper.ts).
+  // This app is built separately and cannot see that build-time define, so it gates on the
+  // env var. Absent/anything-but-'1' defaults to off so a stale harnesses[] entry in a
+  // non-preview build never synthesizes an AWS::BedrockAgentCore::Harness resource.
+  const previewEnabled = process.env.AGENTCORE_PREVIEW === '1';
+
+  const harnessConfigs: HarnessConfig[] = [];
+  for (const entry of previewEnabled ? (specAny.harnesses ?? []) : []) {
     const harnessDir = path.resolve(projectRoot, entry.path);
     const harnessPath = path.resolve(harnessDir, 'harness.json');
     try {
-      const harnessSpec = JSON.parse(fs.readFileSync(harnessPath, 'utf-8'));
+      const harnessSpec = HarnessSpecSchema.parse(JSON.parse(fs.readFileSync(harnessPath, 'utf-8')));
       harnessConfigs.push({
         name: entry.name,
         executionRoleArn: harnessSpec.executionRoleArn,
-        memoryName: harnessSpec.memory?.name,
+        // Only an `existing` memory ref carries a name to wire IAM against; managed memory is
+        // owned by the harness (no sibling) and disabled has none — both resolve to undefined.
+        memoryName: harnessSpec.memory?.mode === 'existing' ? harnessSpec.memory.name : undefined,
         containerUri: harnessSpec.containerUri,
         hasDockerfile: !!harnessSpec.dockerfile,
         dockerfile: harnessSpec.dockerfile,
         codeLocation: harnessSpec.dockerfile ? harnessDir : undefined,
         tools: harnessSpec.tools,
+        skills: harnessSpec.skills,
         apiKeyArn: harnessSpec.model?.apiKeyArn,
         efsAccessPoints: harnessSpec.efsAccessPoints,
         s3AccessPoints: harnessSpec.s3AccessPoints,
         apiFormat: harnessSpec.model?.apiFormat,
+        // Full spec + dir drive the AWS::BedrockAgentCore::Harness CFN resource.
+        spec: harnessSpec,
+        harnessDir,
       });
     } catch (err) {
       throw new Error(
@@ -156,6 +177,7 @@ async function main() {
       spec,
       mcpSpec,
       credentials,
+      connectorParametersByFile,
       harnesses: harnessConfigs.length > 0 ? harnessConfigs : undefined,
       paymentSpec,
       env,

package/dist/assets/cdk/lib/cdk-stack.ts

@@ -6,24 +6,18 @@ import {
   type AgentCoreProjectSpec,
   type AgentCoreMcpSpec,
   type CustomJWTAuthorizerConfig,
+  type HarnessDeploymentConfig,
 } from '@aws/agentcore-cdk';
 import { CfnOutput, Stack, type StackProps } from 'aws-cdk-lib';
 import * as iam from 'aws-cdk-lib/aws-iam';
 import { Construct } from 'constructs';
 
-export interface HarnessConfig {
-  name: string;
-  executionRoleArn?: string;
-  memoryName?: string;
-  containerUri?: string;
-  hasDockerfile?: boolean;
-  dockerfile?: string;
-  codeLocation?: string;
-  tools?: { type: string; name: string }[];
-  apiKeyArn?: string;
-  efsAccessPoints?: { accessPointArn: string; mountPath: string }[];
-  s3AccessPoints?: { accessPointArn: string; mountPath: string }[];
-}
+/**
+ * Harness deployment config: role-scoped fields (for IAM role + container build)
+ * plus the full validated spec + its config directory so the L3 construct can
+ * synthesize the AWS::BedrockAgentCore::Harness resource.
+ */
+export type HarnessConfig = HarnessDeploymentConfig;
 
 export interface PaymentConnectorSpec {
   name: string;
@@ -59,6 +53,11 @@ export interface AgentCoreStackProps extends StackProps {
    * Harness role configurations.
    */
   harnesses?: HarnessConfig[];
+  /**
+   * Parsed connectorParameters for non-S3 KB data sources, keyed by
+   * connectorConfigFile path. Forwarded to AgentCoreApplication.
+   */
+  connectorParametersByFile?: Record<string, Record<string, unknown>>;
   /**
    * Payment specifications with resolved credential provider ARNs.
    */
@@ -98,7 +97,7 @@ export class AgentCoreStack extends Stack {
   constructor(scope: Construct, id: string, props: AgentCoreStackProps) {
     super(scope, id, props);
 
-    const { spec, mcpSpec, credentials, harnesses, paymentSpec } = props;
+    const { spec, mcpSpec, credentials, harnesses, connectorParametersByFile, paymentSpec } = props;
 
     // Create AgentCoreApplication with all agents and harness roles
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -106,6 +105,12 @@ export class AgentCoreStack extends Stack {
     if (harnesses?.length) {
       appProps.harnesses = harnesses;
     }
+    if (connectorParametersByFile && Object.keys(connectorParametersByFile).length > 0) {
+      appProps.connectorParametersByFile = connectorParametersByFile;
+    }
+    if (credentials) {
+      appProps.credentials = credentials;
+    }
     this.application = new AgentCoreApplication(this, 'Application', appProps as any);
 
     // Create AgentCoreMcp if there are gateways configured

package/dist/assets/cdk/test/cdk.test.ts

@@ -14,13 +14,14 @@ test('AgentCoreStack synthesizes with empty spec', () => {
       credentials: [],
       evaluators: [],
       onlineEvalConfigs: [],
+      configBundles: [],
       policyEngines: [],
       payments: [],
-      configBundles: [],
       agentCoreGateways: [],
       mcpRuntimeTools: [],
       unassignedTargets: [],
       datasets: [],
+      knowledgeBases: [],
     },
   });
   const template = Template.fromStack(stack);

package/dist/assets/container/python/Dockerfile

@@ -1,5 +1,9 @@
 FROM public.ecr.aws/docker/library/python:3.12-slim-trixie
 
+{{#if gitSkills}}
+RUN apt-get update && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/*
+
+{{/if}}
 RUN pip install --no-cache-dir uv
 
 ARG UV_DEFAULT_INDEX

package/dist/assets/python/a2a/strands/capabilities/memory/session.py

@@ -24,8 +24,11 @@ def get_memory_session_manager(session_id: Optional[str], actor_id: str) -> Opti
 {{#if (includes memoryProviders.[0].strategies "USER_PREFERENCE")}}
         f"/users/{actor_id}/preferences": RetrievalConfig(top_k=3, relevance_score=0.5),
 {{/if}}
+{{#if (includes memoryProviders.[0].strategies "EPISODIC")}}
+        f"/episodes/{actor_id}/{session_id}": RetrievalConfig(top_k=5, relevance_score=0.5),
+{{/if}}
 {{#if (includes memoryProviders.[0].strategies "SUMMARIZATION")}}
-        f"/summaries/{actor_id}": RetrievalConfig(top_k=3, relevance_score=0.5),
+        f"/summaries/{actor_id}/{session_id}": RetrievalConfig(top_k=3, relevance_score=0.5),
 {{/if}}
     }
 {{/if}}

package/dist/assets/python/agui/strands/capabilities/memory/session.py

@@ -24,8 +24,11 @@ def get_memory_session_manager(session_id: Optional[str], actor_id: str) -> Opti
 {{#if (includes memoryProviders.[0].strategies "USER_PREFERENCE")}}
         f"/users/{actor_id}/preferences": RetrievalConfig(top_k=3, relevance_score=0.5),
 {{/if}}
+{{#if (includes memoryProviders.[0].strategies "EPISODIC")}}
+        f"/episodes/{actor_id}/{session_id}": RetrievalConfig(top_k=5, relevance_score=0.5),
+{{/if}}
 {{#if (includes memoryProviders.[0].strategies "SUMMARIZATION")}}
-        f"/summaries/{actor_id}": RetrievalConfig(top_k=3, relevance_score=0.5),
+        f"/summaries/{actor_id}/{session_id}": RetrievalConfig(top_k=3, relevance_score=0.5),
 {{/if}}
     }
 {{/if}}

package/dist/assets/python/http/googleadk/base/mcp_client/client.py

@@ -34,20 +34,20 @@ def get_all_gateway_mcp_toolsets() -> list[MCPToolset]:
     {{#each gatewayProviders}}
     url = os.environ.get("{{envVarName}}")
     if url:
-        {{#if (eq authType "AWS_IAM")}}
+{{#if (eq authType "AWS_IAM")}}
         session = create_aws_session()
         auth = SigV4HTTPXAuth(session.get_credentials(), "bedrock-agentcore", session.region_name)
-        toolsets.append(MCPToolset(connection_params=StreamableHTTPConnectionParams(
+        toolsets.append(MCPToolset(tool_name_prefix="{{snakeCase name}}", connection_params=StreamableHTTPConnectionParams(
             url=url,
             httpx_client_factory=lambda **kwargs: httpx.AsyncClient(auth=auth, **kwargs)
         )))
-        {{else if (eq authType "CUSTOM_JWT")}}
+{{else if (eq authType "CUSTOM_JWT")}}
         token = _get_bearer_token_{{snakeCase name}}()
         headers = {"Authorization": f"Bearer {token}"} if token else None
-        toolsets.append(MCPToolset(connection_params=StreamableHTTPConnectionParams(url=url, headers=headers)))
-        {{else}}
-        toolsets.append(MCPToolset(connection_params=StreamableHTTPConnectionParams(url=url)))
-        {{/if}}
+        toolsets.append(MCPToolset(tool_name_prefix="{{snakeCase name}}", connection_params=StreamableHTTPConnectionParams(url=url, headers=headers)))
+{{else}}
+        toolsets.append(MCPToolset(tool_name_prefix="{{snakeCase name}}", connection_params=StreamableHTTPConnectionParams(url=url)))
+{{/if}}
     else:
         logger.warning("{{envVarName}} not set — {{name}} gateway tools unavailable")
     {{/each}}

package/dist/assets/python/http/googleadk/base/pyproject.toml

@@ -11,7 +11,7 @@ requires-python = ">=3.10"
 dependencies = [
     "opentelemetry-distro",
     "opentelemetry-exporter-otlp",
-    "google-adk >= 1.17.0, < 2.0.0",
+    "google-adk >= 1.35.0, < 2.0.0",
     "google-genai >= 1.0.0, < 2.0.0",
     "bedrock-agentcore >= 1.0.3",
     "botocore[crt] >= 1.35.0",

package/dist/assets/python/http/langchain_langgraph/base/mcp_client/client.py

@@ -32,23 +32,25 @@ def get_all_gateway_mcp_client() -> MultiServerMCPClient | None:
     {{#each gatewayProviders}}
     url = os.environ.get("{{envVarName}}")
     if url:
-        {{#if (eq authType "AWS_IAM")}}
+{{#if (eq authType "AWS_IAM")}}
         session = create_aws_session()
         auth = SigV4HTTPXAuth(session.get_credentials(), "bedrock-agentcore", session.region_name)
-        servers["{{name}}"] = {"transport": "streamable_http", "url": url, "auth": auth}
-        {{else if (eq authType "CUSTOM_JWT")}}
+        servers["{{snakeCase name}}"] = {"transport": "streamable_http", "url": url, "auth": auth}
+{{else if (eq authType "CUSTOM_JWT")}}
         token = _get_bearer_token_{{snakeCase name}}()
         headers = {"Authorization": f"Bearer {token}"} if token else None
-        servers["{{name}}"] = {"transport": "streamable_http", "url": url, "headers": headers}
-        {{else}}
-        servers["{{name}}"] = {"transport": "streamable_http", "url": url}
-        {{/if}}
+        servers["{{snakeCase name}}"] = {"transport": "streamable_http", "url": url, "headers": headers}
+{{else}}
+        servers["{{snakeCase name}}"] = {"transport": "streamable_http", "url": url}
+{{/if}}
     else:
         logger.warning("{{envVarName}} not set — {{name}} gateway tools unavailable")
     {{/each}}
     if not servers:
         return None
-    return MultiServerMCPClient(servers)
+    # tool_name_prefix namespaces each gateway's tools by server key so multiple
+    # gateways exposing the same tool (e.g. x_amz_bedrock_agentcore_search) don't collide.
+    return MultiServerMCPClient(servers, tool_name_prefix=True)
 {{else}}
 {{#if isVpc}}
 # VPC mode: external MCP endpoints are not reachable without a NAT gateway.

package/dist/assets/python/http/langchain_langgraph/base/pyproject.toml

@@ -13,7 +13,7 @@ dependencies = [
     "opentelemetry-instrumentation-langchain >= 0.59.0",
     "langgraph >= 1.0.2",
     "mcp >= 1.19.0",
-    "langchain-mcp-adapters >= 0.1.11",
+    "langchain-mcp-adapters >= 0.2.0",
     "langchain >= 1.0.3",
     "bedrock-agentcore >= 1.8.0",
     "botocore[crt] >= 1.35.0",

package/dist/assets/python/http/openaiagents/base/main.py

@@ -1,6 +1,9 @@
 {{#if needsOs}}
 import os
 {{/if}}
+{{#if hasGateway}}
+from contextlib import AsyncExitStack
+{{/if}}
 from agents import Agent, Runner, function_tool
 from bedrock_agentcore.runtime import BedrockAgentCoreApp
 from model.load import load_model
@@ -111,15 +114,22 @@ async def main(query):
     try:
         {{#if hasGateway}}
         if mcp_servers:
-            agent = Agent(
-                name="{{ name }}",
-                model="gpt-4.1",
-                instructions=INSTRUCTIONS,
-                mcp_servers=mcp_servers,
-                tools=tools
-            )
-            result = await Runner.run(agent, query)
-            return result
+            # Connect every gateway server before the run; include_server_in_tool_names
+            # namespaces each server's tools so multiple gateways exposing the same tool
+            # (e.g. x_amz_bedrock_agentcore_search) don't collide.
+            async with AsyncExitStack() as stack:
+                for server in mcp_servers:
+                    await stack.enter_async_context(server)
+                agent = Agent(
+                    name="{{ name }}",
+                    model="gpt-4.1",
+                    instructions=INSTRUCTIONS,
+                    mcp_servers=mcp_servers,
+                    tools=tools,
+                    mcp_config={"include_server_in_tool_names": True},
+                )
+                result = await Runner.run(agent, query)
+                return result
         else:
             agent = Agent(
                 name="{{ name }}",

package/dist/assets/python/http/openaiagents/base/mcp_client/client.py

@@ -33,20 +33,20 @@ def get_all_gateway_mcp_servers() -> list[MCPServerStreamableHttp]:
     {{#each gatewayProviders}}
     url = os.environ.get("{{envVarName}}")
     if url:
-        {{#if (eq authType "AWS_IAM")}}
+{{#if (eq authType "AWS_IAM")}}
         session = create_aws_session()
         auth = SigV4HTTPXAuth(session.get_credentials(), "bedrock-agentcore", session.region_name)
         servers.append(MCPServerStreamableHttp(
             name="{{name}}",
             params={"url": url, "httpx_client_factory": lambda **kwargs: httpx.AsyncClient(auth=auth, **kwargs)}
         ))
-        {{else if (eq authType "CUSTOM_JWT")}}
+{{else if (eq authType "CUSTOM_JWT")}}
         token = _get_bearer_token_{{snakeCase name}}()
         headers = {"Authorization": f"Bearer {token}"} if token else {}
         servers.append(MCPServerStreamableHttp(name="{{name}}", params={"url": url, "headers": headers}))
-        {{else}}
+{{else}}
         servers.append(MCPServerStreamableHttp(name="{{name}}", params={"url": url}))
-        {{/if}}
+{{/if}}
     else:
         logger.warning("{{envVarName}} not set — {{name}} gateway tools unavailable")
     {{/each}}

package/dist/assets/python/http/openaiagents/base/pyproject.toml

@@ -10,7 +10,7 @@ readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
     "aws-opentelemetry-distro",
-    "openai-agents >= 0.4.2",
+    "openai-agents >= 0.16.0",
     "bedrock-agentcore >= 1.8.0",
     "botocore[crt] >= 1.35.0",
     {{#if hasGateway}}{{#if (includes gatewayAuthTypes "AWS_IAM")}}"mcp-proxy-for-aws >= 1.1.0",