@aws/nx-plugin-mcp 0.120.0 → 0.121.0

package/docs/guides/connection/smithy-rdb.mdx

@@ -0,0 +1,161 @@
+---
+title: Smithy API to Relational Database
+description: Connect a Smithy API to a Relational Database
+when:
+  sourceType: smithy
+  targetType: ts#rdb
+---
+import { FileTree } from '@astrojs/starlight/components';
+import Link from '@components/link.astro';
+import RunGenerator from '@components/run-generator.astro';
+import GeneratorParameters from '@components/generator-parameters.astro';
+import NxCommands from '@components/nx-commands.astro';
+import Snippet from '@components/snippet.astro';
+
+The `connection` generator wires a <Link path="guides/ts-smithy-api">Smithy API</Link> to a <Link path="guides/ts-rdb">Relational Database</Link> project, injecting a Prisma client into the service context so all operation implementations can access the database.
+
+## Prerequisites
+
+Before using this generator, ensure you have:
+
+1. A <Link path="guides/ts-smithy-api">`ts#smithy-api`</Link> project (TypeScript backend)
+2. A <Link path="guides/ts-rdb">`ts#rdb`</Link> project
+
+## Usage
+
+### Run the Generator
+
+<RunGenerator generator="connection" />
+
+Select your Smithy API backend project as the source and your relational database project as the target.
+
+### Options
+
+<GeneratorParameters generator="connection" />
+
+## Generator Output
+
+The generator modifies three existing files in your Smithy API backend:
+
+<FileTree>
+
+- packages/api/src
+  - context.ts `db` property added to `ServiceContext`
+  - handler.ts Prisma client created inside `lambdaHandler`, passed to `serviceHandler.handle`
+  - local-server.ts Prisma client created inside the request handler, passed to `serviceHandler.handle`
+
+</FileTree>
+
+Additionally, it updates the API's `serve-local` target to start the database automatically.
+
+## How It Works
+
+### ServiceContext
+
+The generator adds a typed `db` property to `ServiceContext` in `context.ts`:
+
+```ts title="packages/api/src/context.ts" {1,7}
+import { getPrisma as getMyDb } from ':my-scope/my-db';
+
+export interface ServiceContext {
+  tracer: Tracer;
+  logger: Logger;
+  metrics: Metrics;
+  myDb: Awaited<ReturnType<typeof getMyDb>>;
+}
+```
+
+### Lambda Handler
+
+The Prisma client is instantiated inside `lambdaHandler` and passed through the service context:
+
+```ts title="packages/api/src/handler.ts" {1,10}
+import { getPrisma as getMyDb } from ':my-scope/my-db';
+
+export const lambdaHandler = async (event: APIGatewayProxyEvent) => {
+  const httpRequest = convertEvent(event);
+  const myDb = await getMyDb();
+  const httpResponse = await serviceHandler.handle(httpRequest, {
+    tracer,
+    logger,
+    metrics,
+    myDb,
+  });
+  return convertVersion1Response(httpResponse);
+};
+```
+
+### Using the Database in Operations
+
+Access `db` from the context in your operation implementations:
+
+```ts title="packages/api/src/operations/list-users.ts" {8}
+import { ListUsersOperationInput, ListUsersOperationOutput } from '../generated/ssdk/index.js';
+import { ServiceContext } from '../context.js';
+
+export const listUsers = async (
+  input: ListUsersOperationInput,
+  ctx: ServiceContext,
+): Promise<ListUsersOperationOutput> => {
+  const users = await ctx.myDb.user.findMany();
+  return { users };
+};
+```
+
+## Multiple Databases
+
+Running the generator again with a different target adds the second database alongside the first. Both clients are added to `ServiceContext` and instantiated in `handler.ts`:
+
+```ts title="packages/api/src/context.ts" {5,6}
+export interface ServiceContext {
+  tracer: Tracer;
+  logger: Logger;
+  metrics: Metrics;
+  myDb: Awaited<ReturnType<typeof getMyDb>>;
+  otherDb: Awaited<ReturnType<typeof getOtherDb>>;
+}
+```
+
+```ts title="packages/api/src/handler.ts" {1,2,7,8}
+const myDb = await getMyDb();
+const otherDb = await getOtherDb();
+const httpResponse = await serviceHandler.handle(httpRequest, {
+  tracer,
+  logger,
+  metrics,
+  myDb,
+  otherDb,
+});
+```
+
+## Infrastructure
+
+<Snippet name="connection/rdb-api-infrastructure" parentHeading="Infrastructure" />
+
+### SSL Requirements When Connecting Without RDS Proxy
+
+<Snippet name="connection/lambda-rdb-ssl-requirements" parentHeading="SSL Requirements When Connecting Without RDS Proxy" />
+
+## Local Development
+
+The generator applies the same Prisma client injection inside the request handler in `local-server.ts`:
+
+```ts title="packages/api/src/local-server.ts" {1,5,10}
+import { getPrisma as getMyDb } from ':my-scope/my-db';
+
+const server = createServer(async function (req, res) {
+  const httpRequest = convertRequest(req);
+  const myDb = await getMyDb();
+  const httpResponse = await serviceHandler.handle(httpRequest, {
+    tracer,
+    logger,
+    metrics,
+    myDb,
+  });
+  return writeResponse(httpResponse, res);
+});
+```
+
+<NxCommands commands={["serve-local <api-project-name>"]} />
+
+This starts both the API and the local database. The `SERVE_LOCAL=true` environment variable is set automatically, so the Prisma client connects to the local Docker database instead of Aurora.

package/docs/guides/connection/trpc-rdb.mdx

@@ -0,0 +1,127 @@
+---
+title: tRPC API to Relational Database
+description: Connect a tRPC API to a Relational Database
+when:
+  sourceType: ts#trpc-api
+  targetType: ts#rdb
+---
+import { FileTree } from '@astrojs/starlight/components';
+import Link from '@components/link.astro';
+import RunGenerator from '@components/run-generator.astro';
+import GeneratorParameters from '@components/generator-parameters.astro';
+import NxCommands from '@components/nx-commands.astro';
+import Snippet from '@components/snippet.astro';
+
+The `connection` generator wires a <Link path="guides/trpc">tRPC API</Link> to a <Link path="guides/ts-rdb">Relational Database</Link> project, generating a type-safe tRPC middleware plugin that makes a Prisma client available in your procedure context.
+
+## Prerequisites
+
+Before using this generator, ensure you have:
+
+1. A <Link path="guides/trpc">`ts#trpc-api`</Link> project
+2. A <Link path="guides/ts-rdb">`ts#rdb`</Link> project
+
+## Usage
+
+### Run the Generator
+
+<RunGenerator generator="connection" />
+
+Select your tRPC API project as the source and your relational database project as the target.
+
+### Options
+
+<GeneratorParameters generator="connection" />
+
+## Generator Output
+
+The generator creates a middleware file in your tRPC API project:
+
+<FileTree>
+
+- packages/api/src
+  - middleware
+    - \<db-name>.ts tRPC plugin exposing the Prisma client in procedure context
+
+</FileTree>
+
+Additionally, it updates your tRPC API's `serve-local` target to start the database automatically when running locally.
+
+## Using the Middleware
+
+### Register the Plugin
+
+Add the generated plugin to your tRPC router so all procedures using it gain access to the database:
+
+```ts title="packages/api/src/router.ts" {2,5}
+import { t } from './init.js';
+import { createMyDbPlugin } from './middleware/my-db.js';
+
+export const authenticatedProcedure = t.procedure
+  .concat(createMyDbPlugin());
+```
+
+### Access the Database in Procedures
+
+The plugin merges `IMyDbContext` into your procedure context, making `myDb` available as an optional property:
+
+```ts title="packages/api/src/procedures/users.ts" {8,12}
+import { z } from 'zod';
+import { authenticatedProcedure } from '../router.js';
+
+export const listUsers = authenticatedProcedure
+  .output(z.array(z.object({ id: z.string(), name: z.string() })))
+  .query(async ({ ctx }) => {
+    // ctx.myDb is the Prisma client — typed as Awaited<ReturnType<typeof getPrisma>>
+    return await ctx.myDb!.user.findMany();
+  });
+```
+
+### MySQL: Disconnect After Each Request
+
+When the target database uses the MySQL engine, the generated middleware wraps `opts.next()` in a `try/finally` block that calls `$disconnect()`:
+
+```ts title="packages/api/src/middleware/my-db.ts" {6}
+return t.procedure.use(async (opts) => {
+  const myDb = await getPrisma();
+  try {
+    return await opts.next({ ctx: { ...opts.ctx, myDb } });
+  } finally {
+    await myDb.$disconnect();
+  }
+});
+```
+
+This addresses the MySQL adapter holding the Node.js event loop open after a query, which would otherwise prevent Lambda from flushing streaming responses. Disconnecting in `finally` releases the event loop so the response can complete. See <Link path="guides/ts-rdb#mysql-api-gateway-streaming-mode">MySQL: API Gateway Streaming Mode</Link> for details.
+
+PostgreSQL does not require this — its adapter uses a connection pool configured with `allowExitOnIdle: true`.
+
+:::caution[MySQL: IAM Token Expiry]
+RDS IAM tokens expire after **15 minutes**. The MySQL adapter captures the token at connection time. If your Lambda stays warm long enough for the token to expire, new connection attempts may fail. Check for connection errors and call `getPrisma()` again to obtain a fresh client with a new token. See <Link path="guides/ts-rdb#mysql-iam-token-expiry">MySQL: IAM Token Expiry</Link> for details and workarounds.
+:::
+
+## Multiple Databases
+
+You can connect additional databases by running the generator again with a different target. Each database gets its own plugin and context interface:
+
+```ts title="packages/api/src/router.ts"
+export const dbProcedure = t.procedure
+  .concat(createMyDbPlugin())
+  .concat(createOtherDbPlugin());
+```
+
+## Infrastructure
+
+<Snippet name="connection/rdb-api-infrastructure" parentHeading="Infrastructure" />
+
+### SSL Requirements When Connecting Without RDS Proxy
+
+<Snippet name="connection/lambda-rdb-ssl-requirements" parentHeading="SSL Requirements When Connecting Without RDS Proxy" />
+
+## Local Development
+
+The generator configures your tRPC API's `serve-local` target to depend on the database's `serve-local` target, so running:
+
+<NxCommands commands={["serve-local <api-project-name>"]} />
+
+will automatically start the local database alongside your API.

package/docs/guides/connection/ts-agent-a2a.mdx

@@ -0,0 +1,106 @@
+---
+title: TypeScript Agent to A2A Agent
+description: Connect a TypeScript Agent to a remote A2A agent
+when:
+  sourceType: ts#agent
+  targetType:
+    - ts#agent
+    - py#agent
+---
+import { FileTree } from '@astrojs/starlight/components';
+import Link from '@components/link.astro';
+import RunGenerator from '@components/run-generator.astro';
+import GeneratorParameters from '@components/generator-parameters.astro';
+import NxCommands from '@components/nx-commands.astro';
+import Snippet from '@components/snippet.astro';
+
+The `connection` generator can connect your <Link path="guides/ts-agent">TypeScript Agent</Link> to a remote [A2A](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-a2a.html) agent — either <Link path="guides/ts-agent">TypeScript</Link> or <Link path="guides/py-agent">Python</Link> — so your agent can delegate to another agent as a tool.
+
+The generator sets up all the necessary wiring so your agent can discover and invoke the remote A2A agent, both when deployed to AWS (via Bedrock AgentCore) and when running locally.
+
+## Prerequisites
+
+Before using this generator, ensure you have:
+
+1. A TypeScript project with a <Link path="guides/ts-agent">Strands Agent</Link> component (any protocol)
+2. A project with an Agent component generated with `--protocol=A2A` and `--auth=IAM` (either <Link path="guides/ts-agent">`ts#agent`</Link> or <Link path="guides/py-agent">`py#agent`</Link>)
+3. Both components created with `computeType: BedrockAgentCoreRuntime`
+
+## Usage
+
+### Run the Generator
+
+<RunGenerator generator="connection" />
+
+Select your host agent project as the source and your A2A agent project as the target. If your projects contain multiple components, specify the `sourceComponent` and `targetComponent` options to disambiguate.
+
+### Options
+
+<GeneratorParameters generator="connection" />
+
+## Generator Output
+
+The generator creates a shared `agent-connection` package and modifies your agent code:
+
+<FileTree>
+
+- packages/common/agent-connection
+  - src
+    - app
+      - \<target-agent-name>-client.ts High-level client for the connected A2A agent
+    - core
+      - agentcore-a2a-client.ts Low-level AgentCore A2A client with SigV4 authentication
+    - index.ts Exports all clients
+  - project.json
+  - tsconfig.json
+
+</FileTree>
+
+Additionally, it:
+- Transforms your agent's `agent.ts` to register the remote A2A agent as a Strands `tool`
+- Updates the agent's `serve-local` target to depend on the target agent's `serve-local` target
+- Installs required dependencies
+
+## Using the Connected A2A Agent
+
+The generator transforms your agent's `agent.ts` to wrap the remote A2A agent as a tool:
+
+```ts title="packages/example/src/my-agent/agent.ts" {2,5-11,14}
+import { Agent, tool } from '@strands-agents/sdk';
+import { RemoteAgentClient } from ':my-scope/agent-connection';
+import { z } from 'zod';
+
+export const getAgent = async (sessionId: string) => {
+  const remoteAgent = await RemoteAgentClient.create(sessionId);
+  const remoteAgentTool = tool({
+    name: 'askRemoteAgent',
+    description: 'Delegate a question to the remote RemoteAgent A2A agent and return its reply.',
+    inputSchema: z.object({ prompt: z.string() }),
+    callback: async ({ prompt }) => (await remoteAgent.invoke(prompt)).toString(),
+  });
+  return new Agent({
+    systemPrompt: '...',
+    tools: [remoteAgentTool],
+  });
+};
+```
+
+The `sessionId` parameter is plumbed through from the caller, ensuring consistency for [Bedrock AgentCore Observability](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability.html).
+
+Under the hood, `RemoteAgentClient.create(sessionId)` returns a Strands `A2AAgent` configured with a SigV4-signing `clientFactory` when deployed to AWS, and a plain `http://localhost:<port>/` endpoint when `SERVE_LOCAL=true`.
+
+## Infrastructure
+
+<Snippet name="connection/a2a-infrastructure" parentHeading="Infrastructure" />
+
+## Local Development
+
+The generator configures the host agent's `serve-local` target to:
+1. Start the connected A2A agent(s) automatically
+2. Set `SERVE_LOCAL=true` so the generated client connects directly to `http://localhost:<port>/` instead of AgentCore
+
+Run the agent locally with:
+
+<NxCommands commands={["<agent-name>-serve-local <project-name>"]} />
+
+This will start both the host agent and all connected A2A agents, with the host agent calling the remote agents over plain HTTP on their assigned local ports.

package/docs/guides/connection/ts-agent-mcp.mdx

@@ -0,0 +1,144 @@
+---
+title: TypeScript Agent to MCP
+description: Connect a TypeScript Agent to an MCP server
+when:
+  sourceType: ts#agent
+  targetType:
+    - ts#mcp-server
+    - py#mcp-server
+---
+import { FileTree } from '@astrojs/starlight/components';
+import Link from '@components/link.astro';
+import RunGenerator from '@components/run-generator.astro';
+import GeneratorParameters from '@components/generator-parameters.astro';
+import NxCommands from '@components/nx-commands.astro';
+import Infrastructure from '@components/infrastructure.astro';
+
+The `connection` generator can connect your <Link path="guides/ts-agent">TypeScript Agent</Link> to an MCP server (either <Link path="guides/ts-mcp-server">TypeScript</Link> or <Link path="guides/py-mcp-server">Python</Link>).
+
+The generator sets up all the necessary wiring so your agent can discover and invoke the MCP server's tools, both when deployed to AWS (via Bedrock AgentCore) and when running locally.
+
+## Prerequisites
+
+Before using this generator, ensure you have:
+
+1. A TypeScript project with a <Link path="guides/ts-agent">Strands Agent</Link> component
+2. A project with an MCP server component (either <Link path="guides/ts-mcp-server">`ts#mcp-server`</Link> or <Link path="guides/py-mcp-server">`py#mcp-server`</Link>)
+3. Both components created with `computeType: BedrockAgentCoreRuntime`
+
+## Usage
+
+### Run the Generator
+
+<RunGenerator generator="connection" />
+
+Select your agent project as the source and your MCP server project as the target. If your projects contain multiple components, specify the `sourceComponent` and `targetComponent` options to disambiguate.
+
+### Options
+
+<GeneratorParameters generator="connection" />
+
+## Generator Output
+
+The generator creates a shared `agent-connection` package and modifies your agent code:
+
+<FileTree>
+
+- packages/common/agent-connection
+  - src
+    - app
+      - \<mcp-server-name>-client.ts High-level client for the connected MCP server
+    - core
+      - agentcore-mcp-client.ts Low-level AgentCore MCP client with SigV4/JWT authentication
+    - index.ts Exports all clients
+  - project.json
+  - tsconfig.json
+
+</FileTree>
+
+Additionally, it:
+- Transforms your agent's `agent.ts` to import and use the MCP server's tools
+- Updates the agent's `serve-local` target to depend on the MCP server's serve target
+- Installs required dependencies
+
+## Using the Connected MCP Server
+
+The generator transforms your agent's `agent.ts` to use the MCP server's tools:
+
+```ts title="packages/example/src/my-agent/agent.ts" {2,5,8}
+import { Agent, tool } from '@strands-agents/sdk';
+import { MyMcpServerClient } from ':my-scope/agent-connection';
+
+export const getAgent = async (sessionId: string) => {
+  const myMcpServerClient = await MyMcpServerClient.create(sessionId);
+  return new Agent({
+    systemPrompt: '...',
+    tools: [myMcpServerClient],
+  });
+};
+```
+
+The `sessionId` parameter is plumbed through from the caller, ensuring consistency for [Bedrock AgentCore Observability](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability.html).
+
+## Infrastructure
+
+<Infrastructure>
+<Fragment slot="cdk">
+After running the connection generator, you need to grant the agent permission to invoke the MCP server:
+
+```ts title="packages/infra/src/stacks/application-stack.ts" {5}
+const mcpServer = new MyMcpServer(this, 'MyMcpServer');
+const myAgent = new MyAgent(this, 'MyAgent');
+
+// Grant the agent permissions to invoke the MCP server
+mcpServer.grantInvokeAccess(myAgent);
+```
+
+The MCP server's AgentCore runtime ARN is automatically registered in the `agentcore` namespace of <Link path="guides/runtime-config">Runtime Configuration</Link> by the generated CDK construct, so the agent can discover it at runtime.
+</Fragment>
+<Fragment slot="terraform">
+After running the connection generator, you need to grant the agent permission to invoke the MCP server in your Terraform configuration:
+
+```hcl title="packages/infra/src/main.tf" {12-24}
+module "inventory_mcp_server" {
+  source = "../../common/terraform/src/app/mcp-servers/inventory-mcp"
+}
+
+module "story_agent" {
+  source = "../../common/terraform/src/app/agents/story-agent"
+}
+
+# Grant the agent permissions to invoke the MCP server
+resource "aws_iam_policy" "agent_invoke_mcp" {
+  name = "AgentInvokeMcpPolicy"
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect   = "Allow"
+      Action   = "bedrock-agentcore:InvokeAgent"
+      Resource = module.inventory_mcp_server.agent_core_runtime_arn
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "agent_invoke_mcp" {
+  role       = module.story_agent.agent_core_runtime_role_arn
+  policy_arn = aws_iam_policy.agent_invoke_mcp.arn
+}
+```
+
+The MCP server's AgentCore runtime ARN is automatically registered in the `agentcore` namespace of <Link path="guides/runtime-config">Runtime Configuration</Link> by the generated Terraform module, so the agent can discover it at runtime.
+</Fragment>
+</Infrastructure>
+
+## Local Development
+
+The generator configures the agent's `serve-local` target to:
+1. Start the connected MCP server(s) automatically
+2. Set `SERVE_LOCAL=true` so the generated client uses direct HTTP transport instead of AgentCore
+
+Run the agent locally with:
+
+<NxCommands commands={["<agent-name>-serve-local <project-name>"]} />
+
+This will start both the agent and all connected MCP servers, with the agent connecting to the MCP servers directly via HTTP on their assigned local ports.

package/docs/guides/connection/ts-agent-rdb.mdx

@@ -0,0 +1,141 @@
+---
+title: TypeScript Agent to Relational Database
+description: Connect a TypeScript Agent to a Relational Database
+when:
+  sourceType: ts#agent
+  targetType: ts#rdb
+---
+import { FileTree } from '@astrojs/starlight/components';
+import Link from '@components/link.astro';
+import RunGenerator from '@components/run-generator.astro';
+import GeneratorParameters from '@components/generator-parameters.astro';
+import NxCommands from '@components/nx-commands.astro';
+import Infrastructure from '@components/infrastructure.astro';
+import Snippet from '@components/snippet.astro';
+
+The `connection` generator wires a <Link path="guides/ts-agent">TypeScript Agent</Link> to a <Link path="guides/ts-rdb">Relational Database</Link> project, making a Prisma client available inside your agent factory.
+
+## Prerequisites
+
+Before using this generator, ensure you have:
+
+1. A <Link path="guides/ts-agent">`ts#agent`</Link> project
+2. A <Link path="guides/ts-rdb">`ts#rdb`</Link> project
+
+## Usage
+
+### Run the Generator
+
+<RunGenerator generator="connection" />
+
+Select your Agent project as the source and your relational database project as the target. If the project contains multiple agent components, specify `sourceComponent` to disambiguate.
+
+### Options
+
+<GeneratorParameters generator="connection" />
+
+## Generator Output
+
+The generator modifies two files in your agent's source directory:
+
+<FileTree>
+
+- packages/my-service/src/my-agent
+  - agent.ts Prisma client fetched inside `getAgent` and available to tools
+  - Dockerfile RDS CA bundle installed for SSL connections to Aurora
+
+</FileTree>
+
+Additionally, the agent's `<agent-name>-serve-local` target is updated to depend on the database's `serve-local` target.
+
+## How It Works
+
+The Prisma client is instantiated inside `getAgent()`. Since the `ts#agent` generator configures a single Agent per session, the client is also reused for the lifetime of the session.
+
+### Agent Definition
+
+`getAgent` is updated to import and call the Prisma getter at the top of its body:
+
+```ts title="packages/my-service/src/my-agent/agent.ts" {1,4}
+import { getPrisma as getMyDb } from ':my-scope/my-db';
+
+export const getAgent = async () => {
+  const myDb = await getMyDb();
+  // ...
+  return new Agent({ /* use myDb in tools */ });
+};
+```
+
+
+## Multiple Databases
+
+Running the generator again with a different target adds the second database alongside the first:
+
+```ts title="packages/my-service/src/my-agent/agent.ts" {1,2,5,6}
+import { getPrisma as getMyDb } from ':my-scope/my-db';
+import { getPrisma as getOtherDb } from ':my-scope/other-db';
+
+export const getAgent = async () => {
+  const myDb = await getMyDb();
+  const otherDb = await getOtherDb();
+  // ...
+  return new Agent({ /* use both clients in tools */ });
+};
+```
+
+## Infrastructure
+
+The generated agent construct implements `IGrantable` and `IConnectable`, so you can grant network and IAM access to the database directly on the construct.
+
+<Infrastructure>
+<Fragment slot="cdk">
+
+```ts title="packages/infra/src/stacks/application-stack.ts"
+import { MyDatabase } from ':my-scope/common-constructs';
+
+const db = new MyDatabase(this, 'Db', { vpc, ... });
+const myAgent = new MyAgent(this, 'MyAgent', { vpc, ... });
+
+db.allowDefaultPortFrom(myAgent);
+db.grantConnect(myAgent);
+```
+
+`allowDefaultPortFrom` opens the security group rule so the agent runtime can reach the database port. `grantConnect` grants IAM `rds-db:connect` permission to the agent's execution role.
+
+</Fragment>
+<Fragment slot="terraform">
+
+Pass the database module outputs into your agent module so it can reach the database and read its runtime configuration:
+
+```hcl title="packages/infra/src/main.tf"
+module "my_database" {
+  source              = "../../common/terraform/src/app/dbs/my-database"
+  vpc_id              = module.vpc.vpc_id
+  database_subnet_ids = module.vpc.private_isolated_subnet_ids
+}
+
+module "my_agent" {
+  source = "../../common/terraform/src/app/agents/my-agent"
+
+  appconfig_application_id     = module.my_database.appconfig_application_id
+  database_cluster_resource_id = module.my_database.cluster_resource_id
+  database_runtime_user        = module.my_database.database_runtime_user
+  database_security_group_id   = module.my_database.security_group_id
+  database_port                = module.my_database.cluster_port
+}
+```
+
+Ensure the agent's execution role has `rds-db:connect` permission and that its security group can reach the database security group on the database port.
+
+</Fragment>
+</Infrastructure>
+
+### SSL Requirements When Connecting Without RDS Proxy
+
+<Snippet name="connection/strands-agent-rdb-ssl-requirements" parentHeading="SSL Requirements When Connecting Without RDS Proxy" />
+
+## Local Development
+
+<NxCommands commands={["<agent-name>-serve-local <project-name>"]} />
+
+This starts the agent and all connected databases. The `SERVE_LOCAL=true` environment variable causes each Prisma client to connect to its local Docker database instead of Aurora.