agentcore-harness

name

agentcore-harness

description

Wire an agent into the Amazon Bedrock AgentCore harness — Runtime (hosting/front-door), Memory (short + long-term), Gateway (APIs→MCP tools), Identity (workload creds), and Observability (CloudWatch/OTEL). Use when deploying an agent to AgentCore, adding AgentCore Memory/Gateway/Identity, or instrumenting AgentCore observability. Triggers on "AgentCore", "bedrock-agentcore", "BedrockAgentCoreApp", "AgentCore Memory/Gateway/Identity/Runtime", "deploy agent to AWS".

Amazon Bedrock AgentCore Harness

AgentCore is the production harness around an agent. In this repo, Temporal owns durable execution of the agent loop; AgentCore owns hosting + the surrounding capabilities.

The Python SDK is bedrock-agentcore (used by the runtime entrypoint + harness helpers). Deploy with the @aws/agentcore npm CLI (agentcore create / deploy / invoke, config in agentcore/agentcore.json, CDK-based, ARM64 containers). The old bedrock-agentcore-starter-toolkit pip package + YAML config is deprecated — do not use it. Control-plane API shapes change; verify each call against the bedrock-agentcore and aws-docs MCP servers (get_runtime_guide, search_agentcore_docs / fetch_agentcore_doc) before writing it rather than trusting memorized signatures. All components below are GA as of mid-2026.

Components & what each gives you

Component	Role here
Runtime	Serverless front door. A BedrockAgentCoreApp entrypoint receives the request and starts/queries the Temporal workflow. MicroVM session isolation; up to 8h; built-in tracing.
Memory	Short-term (per-session conversation) + long-term (SEMANTIC extraction across sessions). Recall prior incidents.
Gateway	Turn the target service's REST API (or a Lambda) into MCP tools with managed inbound/outbound auth.
Identity	Workload identity for the agent + outbound credential providers (OAuth/API key) for tools.
Observability	OTEL → CloudWatch traces/metrics; correlate with Temporal workflow history.

Runtime entrypoint (the front door → Temporal)

from bedrock_agentcore.runtime import BedrockAgentCoreApp
from temporalio.client import Client

app = BedrockAgentCoreApp()

@app.entrypoint
async def handler(request):
    # Non-blocking: START the workflow and return its id. Don't await the result —
    # a human-approval wait outlives the Runtime session. Poll with action="status".
    client = await Client.connect(TEMPORAL_ADDRESS, namespace=TEMPORAL_NAMESPACE)
    handle = await client.start_workflow(
        "SREAgentWorkflow", request.get("prompt"),
        id=f"sre-{request.get('session_id')}", task_queue="sre-agent",
    )
    return {"workflow_id": handle.id, "run_id": handle.result_run_id}

if __name__ == "__main__":
    app.run(port=8080)

Keep the entrypoint non-blocking — start the workflow and return a workflow_id, with status/approve/deny actions — because a Runtime session idle-times out (~15 min) long before a human-approval wait resolves. Deploy as an ARM64 container via agentcore create → agentcore deploy (see infra/Dockerfile.runtime, infra/deploy.md). Confirm exact commands via the bedrock-agentcore MCP server (get_runtime_guide).

Memory, Gateway, Identity, Observability

• Memory: create a memory store with strategies (SEMANTIC, SUMMARIZATION); use a MemorySessionManager to add_turns(...) and search_long_term_memories(...). Strands also has a first-class AgentCoreMemorySessionManager integration.
• Gateway: create a gateway, add a target (HTTP/OpenAPI, Lambda, or MCP server), then expose its MCP endpoint to the agent. Use it to register the target service's REST API as tools.
• Identity: create OAuth2 / API-key credential providers for outbound tool auth; the deployed agent gets a workload identity automatically (creds via MMDS inside Runtime).
• Observability: enable on deploy; emit OTEL spans/metrics that land in CloudWatch. Tag spans with the Temporal workflow_id/run_id to stitch the agent trace to the durable execution history.

Deploy checklist

1. AWS account + region; Bedrock AgentCore permissions; execution role trusting bedrock-agentcore.amazonaws.com.
2. pip install bedrock-agentcore (SDK) and npm install -g @aws/agentcore (deploy CLI).
3. Provision Memory, Gateway, Identity (capture their IDs into .env).
4. Deploy the Runtime entrypoint as an ARM64 container (agentcore create → agentcore deploy); Observability is enabled on deploy.
5. Point the Runtime at Temporal Cloud (it can't reach localhost); deploy the Temporal worker separately (Fargate or Lambda) against the same namespace + task queue.