DEV Community: Vadym Kazulkin

Building AI Agents with Embabel, Spring AI and Amazon Bedrock AgentCore - Part 3 Develop Agents as web application with Embabel

Vadym Kazulkin — Mon, 03 Aug 2026 13:00:00 +0000

Introduction

In part 2, we developed our first AI agents with the Embabel shell. We learned many concepts of this framework, such as agents, actions, and goals. In this article, we'll slightly adjust our application to convert it into a web application.

Implement AI agents as a web application with Embabel

You can look at my GitHub embabel-1.x-conference-app-agent-local repository for the example. We'll completely reuse the implementation of both agents, the CreateTalksAndApplyForConferencesAgent and the SearchForTalksAndApplyForConferencesAgent that we implemented in part 2.

Those agents are capable of responding to the following prompts:

"Please provide me with the list of conferences, including their IDs, with Java topics happening in 2027, with the call for papers open today. Also, provide me with the list of my talks with this topic in the title. Finally, for each conference and talk retrieved, apply individually for the conference." SearchForTalksAndApplyForConferencesAgent is responsible for responding to this prompt.
"Please create a talk with a cool title (max 60 characters long) and description (max 300 characters long) about using Spring AI on the Amazon Bedrock AgentCore service. Then provide me with the list of conferences, including their IDs, with Java topics happening in 2026 and 2027, with the call for papers open today. Finally, for each conference, apply individually for it with the talk just created." CreateTalksAndApplyForConferencesAgent is responsible for responding to this prompt.

First, let's check that we declared the following dependencies in pom.xml:

 <dependency>
    <groupId>com.embabel.agent</groupId>
    <artifactId>embabel-agent-starter-bedrock</artifactId>
    <version>${embabel-agent.version}</version>
 </dependency>
 <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
 </dependency>

Also, make sure not to declare the embabel-agent-starter-shell dependency, as we don't use Embabel shell in this article.

All we need to do now is to additionally implement the EmbabelAgentController controller.

Let's first implement a generic endpoint that will accept both prompts. Let's first autowire and create some objects coming from Embabel that we'll use for this:

@RestController
public class EmbabelAgentController {

private final AgentPlatform agentPlatform;
private final AgentInvocation<Domain.ConferenceApplications> invocation;

private final ProcessOptions processOptions = new ProcessOptions()
     .withVerbosity(new Verbosity()
     .withShowPrompts(true)
     .withShowLlmResponses(true)
     .withShowPlanning(true)
     .withDebug(true));


public EmbabelAgentController(AgentPlatform agentPlatform) {
      this.agentPlatform = agentPlatform;

      this.invocation = AgentInvocation
            .builder(agentPlatform)
        .options(processOptions)
        .build(Domain.ConferenceApplications.class);
  }
...

}

First, we autowire the Embabel's AgentPlatform object and use it to create the AgentInvocation object. We additionally pass the ProcessOption object that is configured to show planning, LLM responses, and prompts. We also pass the type of the response - the domain object returned after the agents achieve their goals; in our case, the Domain.ConferenceApplications class:

Now, let's implement the endpoint itself:

@GetMapping(value = "/generic", consumes = "text/plain")
public Domain.ConferenceApplications genericPrompt(@RequestParam String prompt) {
    var inputs = Map.of("request", new UserInput(prompt)); 
    return this.invocation.run(inputs)
         .last(Domain.ConferenceApplications.class);    
}

Here we wrap the prompt into Embabel's UserInput object that we put into the map with all inputs required to run the agent. Then we use the AgentInvocation object to run the agent with the specified input synchronously. We can also invoke runAsync to run the agent asynchronously. Finally, we retrieve the result of the agent invocation with the specified type.

Let's build the application with mvn clean package and run it locally with mvn spring-boot:run. We'll send the prompt number 1 to this endpoint. What we'll see is that Embabel picked the wrong agent, CreateTalksAndApplyForConferencesAgent, to run. Why? As we don't use the Embabel shell, Embabel doesn't analyze the prompt and compute the score to determine what exact agent to run. It currently only looks into the return type of all agents and picks the first one that matches the type defined in the AgentInvocation object. But both our agents have the same return type Domain.ConferenceApplications. Their goals, in the end, are the same: to apply for the conferences. With that, for our 2 agents, there is a 50% probability that Embabel will pick the wrong agent to run.

How can we fix that? For example, we can define the endpoint per agent. Let's do this:

@GetMapping(value = "/applyToConferencesWithExistingTalks", consumes = "text/plain")
public Domain.ConferenceApplications applyToConferencesWithExistingTalks(@RequestParam String prompt) {
    return this.invokeAgent(prompt,
       SearchForTalksAndApplyForConferencesAgent.AGENT_NAME);   
}

@GetMapping(value = "/applyToConferencesWithNewTalks", consumes = "text/plain")
public Domain.ConferenceApplications applyToConferencesWithNewTalks(@RequestParam String prompt) {
    return this.invokeAgent(prompt,
        CreateTalksAndApplyForConferencesAgent.AGENT_NAME); 
}

I additionally wrote 2 helper methods, invokeAgent and getAgentByName, to simplify the agent search by name and its subsequent invocation:

private Domain.ConferenceApplications invokeAgent(String prompt, String agentName) {        
     var inputs = Map.of("request", new UserInput(prompt));
     var agent = this.getAgentByName(agentName);
     var agentProcess = this.agentPlatform.createAgentProcess(agent,
 processOptions, inputs);
     return agentProcess.run().last(Domain.ConferenceApplications.class);
}

private Agent getAgentByName(String agentName) {
     var optionalAgent = this.agentPlatform.agents()
        .stream()
        .filter(a -> a.getName().equals(agentName))
        .findFirst();

     if( optionalAgent.isEmpty()) {
       throw new RuntimeException("agent with the name "+agentName+ " not found");
     }

    return optionalAgent.get();
}

Let's explain what happens in the invokeAgent method. We first invoke the getAgentByName method. It searches in the collection of agents that the agent platform knows for one that has a specified name. All classes annotated with Embabel's Agent annotation will be registered in the agent platform. Then we use the AgentPlatform object to create the AgentProcess and pass the found agent, the already described process options, and inputs to it. Then we run the AgentProcess and return its last output of type Domain.ConferenceApplications.class.

Now we send prompt number 1 (see above) to the applyToConferencesWithExistingTalks endpoint and prompt number 2 to the applyToConferencesWithNewTalks endpoint. We'll see something similar as a result, as we saw in part 2.

For example, here I use httpie to send prompt number 1:
http GET http://localhost:8080/applyToConferencesWithExistingTalks?prompt="Please provide me with the list of conferences including their IDs with Java topic happening in 2026 and 2027 with call for papers open today. Also provide me with the list of my talks with this topic in the title. Finally, for each conference and talk retrieved, apply individually for the conference." Content-Type:text/plain.

Here is the response of the agent:

Having one endpoint per Embabel agent has its pros and cons. The biggest disadvantage is that a service like AgentCore Runtime exposes only one HTTP POST /invocations endpoint to send the prompt to the web application. This means that we'll need to think about how to design, implement, and deploy each Embabel agent on a separate AgentCore Runtime. Each agent belonging to the same web application will have a lot of shared logic with other agents. This is not very convenient. The biggest advantage is that you can scale each Embabel agent individually. AgentCore Runtime will do it for you.

It's worth checking for the upcoming version of Embabel whether there are other options available to invoke the agent.

Conclusion

In this article, we covered how to develop a web application with Embabel.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.

Building AI Agents with Embabel, Spring AI and Amazon Bedrock AgentCore - Part 2 Develop Agents with Embabel shell

Vadym Kazulkin — Mon, 27 Jul 2026 15:35:30 +0000

Introduction

In part 1, we addressed some challenges when developing AI agents with Spring AI frameworks only. We start exploring how Embabel is capable of addressing and solving those challenges. Throughout this series, we'll start improving the agent developed in the Provide MCP tools for Conference application via AgentCore Gateway article using the Embabel framework. First, we'll use the Embabel shell, then the web application. You can look at my GitHub embabel-1.x-conference-app-agent-local repository for the example. I updated them to use the recently released Embabel version 1.0.0.

Implement AI agents with Embabel shell

In this article, we'll implement 2 AI agents capable of responding to the following prompts:

"Please provide me with the list of conferences, including their IDs, with Java topics happening in 2027, with the call for papers open today. Also, provide me with the list of my talks with this topic in the title. Finally, for each conference and talk retrieved, apply individually for the conference."
"Please create a talk with a cool title (max 60 characters long) and description (max 300 characters long) about using Spring AI on the Amazon Bedrock AgentCore service. Then provide me with the list of conferences, including their IDs, with Java topics happening in 2026 and 2027, with the call for papers open today. Finally, for each conference, apply individually for it with the talk just created."

As our sample application also supports only searching for the conference as an attendee, not as a speaker, you can similarly implement those agents.

Before we start, we need to understand the following key concepts of the Embabel framework:

Actions: Steps an agent takes
Goals: What an agent is trying to achieve
Conditions: Conditions to assess before executing an action or determining that a goal has been achieved. Conditions are reassessed after each action is executed.
Domain model: Objects underpinning the flow and informing Actions, Goals and Conditions.
Plan: A sequence of actions to achieve a goal. Plans are dynamically formulated by the system, not the programmer. The system replans after the completion of each action, allowing it to adapt to new information as well as observe the effects of the previous action. This is effectively an OODA loop.

Now let's first define the actions for our agent - steps an agent takes.
We can split our first agent into the following actions:

Request: "Please provide me with the list of conferences, including their IDs, with Java topics happening in 2027, with the call for papers open today". LLM responds to it.
Request: "Provide me with the list of my talks with this topic in the title". LLM responds to it.
Request: "For each conference and talk retrieved, apply individually for the conference". This request means that the LLM uses its responses from the first 2 requests as the request and responds to it.

And we can split our second agent into the following actions:

Request: "Please create a talk with a cool title (max 60 characters long) and description (max 300 characters long) about using Spring AI on the Amazon Bedrock AgentCore service". LLM responds to it.
Request: "Provide me with the list of my talks with this topic in the title". LLM responds to it.
Request: "For each conference and talk, apply individually for the conference". This request means that the LLM uses its responses from the first 2 requests as the request and responds to it.

In this particular case, steps 2 and 3 are mainly the same for our 2 agents. The difference lies in step 1, where we either retrieve an existing talk(s) or create a new one. Your case might be different, so the design of the agents and their actions might also be different.

First, let's declare some important dependencies in pom.xml to use the Embabel framework (I use version 1.0.0) and its shell:

 <dependency>
    <groupId>com.embabel.agent</groupId>
    <artifactId>embabel-agent-starter-bedrock</artifactId>
    <version>${embabel-agent.version}</version>
 </dependency>
 <dependency>
    <groupId>com.embabel.agent</groupId>
    <artifactId>embabel-agent-starter-shell</artifactId>
    <version>${embabel-agent.version}</version>
 </dependency>

Also, make sure not to declare the spring-boot-starter-web dependency, as we'll implement a web application in the next article.

The EmbabelConferenceApplication is the main entry point of our application. Here we also load Amazon Bedrock models, which we declared in the additional-bedrock.yaml:

@Configuration
class AdditionalBedrockModels {
@Bean
   BedrockModelLoader bedrockModels() {
   return new BedrockModelLoader(new DefaultResourceLoader(), "classpath:models/additional-bedrock.yaml");
   }
}

In the Domain class, we declared a domain object (Java record) for each request and response, which corresponds to the agent actions described above. For example, for the action to search for the talks, those domain objects look like this:

// Request to LLM to create the talk
public record ConferenceSearchRequest(String topic, LocalDate startDate, 
  LocalDate endDate, LocalDate callForPapersOpenOnThistDate) 
}


// Response from LLM for the talk creation request
public record Conference (Integer conferenceId, String name, Set<String> topics, String homepage, LocalDate startDate, LocalDate endDate, LocalDate callForPapersStartDate, LocalDate callForPapersEndDate,  String city, String linkToCallforPapers) {
}

Now let's design those 2 agents. We defined the common actions for both of them in the AbstractConferenceAgent class. We defined individual agent-specific actions in the CreateTalksAndApplyForConferencesAgent and SearchForTalksAndApplyForConferencesAgent classes, respectively.

Let's explain the talk search agent action from the SearchForTalksAndApplyForConferencesAgent class in more detail. First of all, we annotate each agent with Embabel's Agent annotation, for example:

@Agent(name=SearchForTalksAndApplyForConferencesAgent.AGENT_NAME , description = "search for the talk(s), search for the conference(s) by the given criteria (all, by the topic, by the date range, and by call for papers being open on some date), and apply for them with the found talks")
public final class SearchForTalksAndApplyForConferencesAgent extends AbstractConferenceAgent {
 ....
}

Here we give the agent a name and description.

The first question is how we can break down a big unstructured prompt into the 3 actions that we described above? Let's start with the action to search for the talk first. The answer is: we can ask LLMs to do this job. Even cheap models are already capable of doing this. Here is how this looks for the action: "Please provide me with the list of conferences, including their IDs, with Java topics happening in 2027, with the call for papers open today"

@Action
Domain.TalkSearchRequest extractTalkSearchRequest(UserInput userInput, OperationContext context) {
return  context.ai()
   .withLlm(LlmOptions.withModel("us.amazon.nova-pro-v1:0"))
     .createObject("""
Create a talk search request from this user input, extracting the optional parameters like talk title substring, conference start and end date, and whether the call for papers is still open on a certain date. 
Don't include any other information in the request.
Here is the user input:
     %s""".formatted(userInput.getContent()), Domain.TalkSearchRequest.class);
}

Let's explain step by step what's happening here. The extractTalkSearchRequest method is an action, which the Agent executes. That's why we annotated it with the Embabel Action annotation. This method also takes 2 parameters, both coming from the Embabel framework:

UserInput object, which represents the unstructured user prompt
OperationContext, which gives us access to the AI functionality

We first invoke the ai() method of the context object and then provide the LLM to do the job. We can either pass the concrete model AI or use other options that are available, like using the default LLM, LLM by role, and others. As a result, we get back the Embabel implementation of the PromptRunnerOperations. Or, we can declare such LLMs in the application.properties, for example :

embabel.models.default-llm=us.anthropic.claude-sonnet-4-6
embabel.models.llms.best=us.anthropic.claude-sonnet-4-6
embabel.models.llms.balanced=us.amazon.nova-pro-v1:0

By invoking the createObject() method on the PromptRunnerOperations implementation, we pass the user prompt and instruction to the LLM on how to split this prompt into one subtask or action. It should only contain the information about the talk search criteria. Additionally, we pass the domain object, in this case, the object of type Domain.TalkSearchRequest. Embabel will make the best effort to map the LLM response to this domain object, which additionally provides us with type safety.

The next step is to implement the talk search itself. For this, we define another action in the SearchForTalksAndApplyForConferencesAgent class:

@Action
Domain.Talks talkSearch(Domain.TalkSearchRequest talkSearchRequest, Ai ai) {        
return config.speaker()     
    .promptRunner(ai)            
    .withPromptContributors(List.of(talkSearchRequest))
    .withToolGroup(this.getMcpToolGroupByName("get-talks-by-"))
    .createObject("Search for the talks with the given criteria", Domain.Talks.class);
}

Please note that the object of the Domain.TalkSearchRequest type, which is the output of the previous action, is now the input of this action. Also, we inject the Ai object coming from the Embabel framework this time directly. Let's first ignore the config.speaker invocation, which we'll explain later. Here we pass the prompt, which contains the properties required to search for the talk. When with createObject() method invocation, we once again pass the prompt and the domain object, which should match the outcome, in this case, the object of type Domain.Talks.

To respond to this prompt, the agent needs tools. Please review the articles Develop local MCP client for Conference application and Provide MCP tools for Conference application via AgentCore Gateway to understand the whole setup. I implemented very similar code to initialize the MCP client connected to the Bedrock AgentCore Gateway in the McpToolService class. MCP client is then exposed as a Spring bean in the EmbabelConferenceApplication class:

@Bean 
@Primary
public McpSyncClient geMcpClient() {
    return this.mcpToolService.getMcpClient();
}

By invoking the withToolGroup(this.getMcpToolGroupByName("get-talks-by-")) method on the PromptRunner (see above), we achieved another goal that we described in part 1. We not only split the prompt into individual actions, but are now also able to provide exact MCP tool(s) required to execute it. Embabel provides the ToolGroup abstraction for this. In this case, we give the LLM only the tools whose names consist of the get-talks-by- substring. I implemented the MCP tool filtering in the AbstractConferenceAgent class:

protected ToolGroup getMcpToolGroupByName(String name) {
    var  toolGroupDescription=  ToolGroupDescription.Companion.invoke(
         "A collection of tools to interact with 
         the MCP conference search service",
         "location",""
   );

  var noOp= ToolCallContextMcpMetaConverter.Companion.noOp();   

  return new McpToolGroup(
          toolGroupDescription,
          "Vadym",
          name,
          Set.of(ToolGroupPermission.INTERNET_ACCESS),
          List.of(mcpClient),
          callback -> filterMcpTool(callback, name),
          noOp
      );
}

private boolean filterMcpTool (ToolCallback toolCallback, String name) {
    // not passing name means return true -> pass all tools
      if(name==null) return true;
      return toolCallback.getToolDefinition().name().contains(name);
 }

The downside is that if we were to rename the MCP tools, we'd need to adjust their names here also. The alternative is to use semantic search for the tools. The alternative is to use semantic search for the tools.

Now let's come back to the config.speaker() method invocation, which we saw in the talkSearch action. Embabel gives the possibility to create different roles and attach different LLMs to them. In our case, we have 2 roles: conference attendee and conference speaker. We can define these roles either programmatically or in the application.properties:

conference.attendee.llm.role=best
conference.attendee.persona.role=Conference attendee
conference.attendee.persona.goal=Conduct a thorough conference search with the information (topics, conference dates) provided so I decide which to attend.
conference.attendee.persona.backstory=As a Conference Attendee Specialist, your mission is to find a suitable conference that matches the given request


conference.speaker.llm.role=best
conference.speaker.persona.role=Conference speaker
conference.speaker.persona.goal=Conduct the search for the talks or create the talk with the given criteria with the conference application for those talks
conference.speaker.persona.backstory=As a Conference Speaker Specialist, your mission is to search for the talk or create the talk with the given criteria with the conference application for those talks

We also link each role to the LLM model by referencing the previously defined LLM strategy (in our case, by the name best). See the LLM definition once again:

embabel.models.default-llm=us.anthropic.claude-sonnet-4-6
embabel.models.llms.best=us.anthropic.claude-sonnet-4-6
embabel.models.llms.balanced=us.amazon.nova-pro-v1:0

In our case, the best LLM strategy will use the us.anthropic.claude-sonnet-4-6 model.
Next, we defined ConferenceConfig to have access to the roles and actors:

@Validated
@ConfigurationProperties(prefix = "conference")
public record ConferenceConfig(Actor<RoleGoalBackstory> attendee,   
    Actor<RoleGoalBackstory> speaker) {
}

The conference prefix, together with Actor definitions, determines the mapping to the roles. For example, Actor speaker matched the conference.speaker role definition in the application.properties.

Finally, we injected the ConferenceConfig object (as config) into the constructor of each agent.

Similarly, we split the initial prompt into other individual steps or actions for searching for conferences. See the extractConferenceSearchRequest and conferenceSearch agents in the AbstractConferenceAgent class. Also, the last step (applying for conferences with talks) looks similar. See the applyForConference action in the same class. There are 2 things to notice here:

We don't ask the LLM to split the prompt. This is because the input to this action is the output of 2 actions before: talkSearch and conferenceSearch, and 2 domain objects, Domain.Conferences and Domain.Talks respectively. Both become the input to the PromptContributors.
This agent is additionally annotated with the AchievesGoal annotation to outline that this action execution is the final step that the agent should take in the workflow. See the complete code:

@Action
@AchievesGoal(description = "apply for the conferences with their IDs and talk IDs and provide status of the application")
    Domain.ConferenceApplications applyForConference(Domain.Conferences conferences, Domain.Talks talks, Ai ai) {
     return config.speaker()
         .promptRunner(ai)
         .withPromptContributors(List.of(conferences, talks))
         .withToolGroup(this.getMcpToolGroupByName("apply-to-conference"))
         .createObject("Apply for the conference with the given criteria", Domain.ConferenceApplications.class);
 }

We're completely done with the SearchForTalksAndApplyForConferencesAgent agent.

The implementation of the agent CreateTalksAndApplyForConferencesAgent looks very similar. The biggest difference is the first step: instead of searching for the existing talks, the talk is created. See the extractTalkCreationRequest and createTalks actions.

Now come the biggest questions:

How is Embabel capable of identifying which agent to execute?
How is Embabel capable of identifying the order of actions to execute for the individual agent? We only defined the last action to finally achieve the goal properly by annotation.

Let's build the application with mvn clean package and run it locally with mvn spring-boot:run. We see that Embabel starts the shell, and we can execute the prompt by running:

x 'Please provide me with the list of conferences, including their IDs, with Java topics happening in 2027, with the call for papers open today. Also, provide me with the list of my talks with this topic in the title. Finally, for each conference and talk retrieved, apply individually for the conference.'

Let's see what happens next:

Embabel identifies 2 agents, takes their description to compute the score, and chooses a concrete agent to execute based on the user input (prompt). I assume Embabel also uses an LLM for it. As a result, it computed: As a result, it computed :

SearchForExistingTalksAndApplyForConferencesAgent: 0,97
CreateNewTalksAndApplyForConferencesAgent: 0,05

So, the SearchForExistingTalksAndApplyForConferencesAgent agent is clearly a winner.

Next, we see that Embabel formulates a plan to achieve the goal:

The sequence of agent actions to execute is a correct one :

Embabel could also come up with the plan to first search for the conferences, then for the talks, and then to apply. Both plans are valid. How does Embabel create such a plan? The system, not the programmer, dynamically formulates plans. The system replans after the completion of each action, allowing it to adapt to new information as well as observe the effects of the previous action. This is effectively an OODA loop. Emabebl analyzes the input and output types of each agent that we defined. This also helps to formulate the plan.

We see how Embabel executes those individual actions in the identified order. It logs all structured outputs of each action. The final output looks like this:

It found 2 talks and 1 conference to apply those talks that matched the criteria that we defined in the prompt. Finally, Embabel provides the statistics of the LLM used, the number of input (prompt) and output (completion) tokens spent. We also see the total cost of the agent execution. Embabel maintains the LLM pricing database. I don't expect this information to be very accurate, but it provides some indication. We also see the MCP tool names that the LLM used during the agent execution, their response times, and the number of failures.

If we execute the prompt x 'Please create a talk with a cool title (max 60 characters long) and description (max 300 characters long) about using Spring AI on the Amazon Bedrock AgentCore service. Then provide me with the list of conferences, including their IDs, with Java topics happening in 2026 and 2027, with the call for papers open today. Finally, for each conference, apply individually for it with the talk just created.', we'll see that Embabel chooses to execute the CreateNewTalksAndApplyForConferencesAgent agent :

It then formulates the plan and executes the actions to achieve the goal:

Finally, it provides the same statistics, which we previously explained:

There are many more features that Embabel provides, like retries, which we'll explore in later articles.

Conclusion

In this article, we developed our first AI agents with the Embabel shell. We learned many concepts of this framework, such as agents, actions, and goals. In the next article, we'll slightly adjust our application to convert it into a web application.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.

Building AI Agents with Embabel, Spring AI and Amazon Bedrock AgentCore - Part 1 Introduction to the series and to the Embabel framework

Vadym Kazulkin — Mon, 20 Jul 2026 14:28:13 +0000

Introduction to the series and to the Embabel framework

In my article series Building AI Agents with Spring AI and Amazon Bedrock AgentCore, we've already covered how to build AI Agents with Spring AI and Amazon Bedrock AgentCore. You'll need to go through at least its first 4 parts to be able to follow this article series. I'll reuse that sample application for this series. Why might the abstractions provided by Spring AI frameworks alone not be enough? Let's look at the prompt that we sent to our application in Provide MCP tools for Conference application via AgentCore Gateway:

"Please provide me with the list of conferences, including their IDs, with Java topics happening in 2027, with the call for papers open today. Also, provide me with the list of my talks with this topic in the title. Finally, for each conference and talk retrieved, apply individually for the conference."

The prompt is highly unstructured. We set here at least 3 pairs of requests to the LLM and their responses:

Request: "Please provide me with the list of conferences, including their IDs, with Java topics happening in 2027, with the call for papers open today". LLM responds to it.
Request: "Provide me with the list of my talks with this topic in the title". LLM responds to it.
Request: "For each conference and talk retrieved, apply individually for the conference". This request means that the LLM uses its responses from the first 2 requests as the request and responds to it.

The thing is that we, as humans, can think logically, but not every LLM can break this prompt down into such individual pieces. So, it might require a strong and more expensive model to be able to do it. If we can automatically break down the problem into subtasks so the prompt will become structured, the LLM will have better chances at doing its job right. Spring AI has a function CallResponseSpec.entity method for the synchronous LLM call to at least convert the response to structured output. But again, this is not enough, as we need to break down the initial prompt into a set of structured subtasks first.

The next challenge is that in the same article, we exposed 7 MCP tools through the Bedrock AgentCore Gateway. And we gave all of them to the LLM all at once. This is because the LLM can't respond to any request without using the correct tool. And there is always only 1 correct tool out of 7 per request. It not only blows up the content window, but there is also a high chance that the LLM will hallucinate. It may not only break down the prompt correctly, but may also select the wrong tool to respond to the request.

Wouldn't it be better if we could break down the prompt as described above and give the LLM exactly the correct tool per request? See the parts 2 and 4 to see how we defined and exposed those MCP tools. For the first request, it will be the "conference search tool by topic, date, and call for papers open" tool. Then, for the second tool - "get talks by title substring" tool. For the third - "apply to conferences with conference ID and talk ID" tool.

With Spring AI, we can filter the tools, as we explained in part 3. But it's not enough as long as we can't break down the big prompt into individual subtasks, which may require suitable tool(s). If we implement prompt handling in a not structured way, it's not trivial to implement the tool filtering. This is because different prompts may require different tools depending on their content.

The same challenges have another prompt from the same article: "Please create a talk with a cool title (max 60 characters long) and description (max 300 characters long) about using Spring AI on the Amazon Bedrock AgentCore service. Then provide me with the list of conferences, including their IDs, with Java topics happening in 2026 and 2027, with the call for papers open today. Finally, for each conference, apply individually for it with the talk just created."

The only difference from the previous prompt is that we ask the LLM to create a new talk instead of extracting the existing talk(s). For this, the LLM will need to use the "create new talk" tool.

Also, our application has 2 different actors. First, these are conference attendees who are interested in searching for and attending the conference. Second, these are the conference speakers who apply to the conference with their talk(s). Maybe those actors should use a different LLM model that suits each role the best.

Welcome to the Embabel. It's a framework for authoring agentic flows on the JVM that seamlessly mixes LLM-prompted interactions with code and domain models. It supports intelligent finding the path towards goals. Embabel builds on the Spring AI framework.

I give some links to the resources, which will help you to grasp the concepts of this framework quickly.

Embabel user guide
Embabel Agentic AI Framework Release 1.0.0: New Features by Igor Dayen
The AI Generation Is Coming of Age: Enterprise JVM Agents with Embabel by Rod Johnson
Developing AI Agents in Java with Embabel (Getting Started) by Dan Vega
Embabel Tools & MCP Servers: Optimize Your Java AI Agents by Dan Vega

We'll explore in the next articles that Embabel is capable of addressing and solving those challenges that we described above. Throughout this series, We'll improve the agent developed in the Provide MCP tools for Conference application via AgentCore Gateway article using the Embabel framework. First, we'll use the Embabel shell, then the web application. You can already look at my GitHub embabel-1.x-conference-app-agent-local repository for the example.

The reasons I decided to create a separate series for using the Embabel framework are:

Embabel recently became generally available (GA), and the current version is 1.0.0. I expect a lot of new functionality to be added soon. I don't want to mix the Embabel and Spring AI content, even though Embabel builds on Spring AI.
Embabel currently doesn't support Spring Boot 4.x and Spring AI 2.x version. So, also here I'll need to update my examples when that version support is there.
It's unclear whether it's possible to integrate spring-ai-agentcore into Embabel. For example, spring-ai-agentcore-runtime-starter, which we demonstrated for Spring AI in the article Deploy MCP client on AgentCore Runtime using Spring AI AgentCore Starter. And especially spring-ai-agentcore-memory, which we demonstrated in the articles Use Spring AI AgentCore short-term Memory for MCP client on AgentCore Runtime and Use Spring AI AgentCore long-term Memory for MCP client on AgentCore Runtime.

Stay tuned!

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.

Building AI Agents with Spring AI and Amazon Bedrock AgentCore - Part 9 Configure AgentCore Observability

Vadym Kazulkin — Mon, 13 Jul 2026 12:03:51 +0000

Introduction

In part 6, we introduced our sample application spring-ai-2.0-ac-conference-app-agent-bedrock-agentcore-runtime using Spring AI AgentCore. Later, in parts 7 and 8, we added AgentCore short- and long-term Memory, respectively, using Spring AI AgentCore Memory.

In this part of the series, we'll explore how to configure AgentCore Observability. I've already covered this topic in my other article series when we used the Strands Agents SDK. I refer to my following articles:

Even though the CloudWatch Generative AI Observability service UI now looks different and has more capabilities, CloudWatch Logging and Monitoring configuration looks the same for our application and is provided out of the box. For the CloudWatch metrics, please review the article Amazon Bedrock AgentCore generated observability data for the current state of the exposed metrics. Also, make sure to enable Log delivery for Application and Usage Logs and Tracing for all AgentCore Services involved. In our case, these are:

Runtime (2 of them, as we host the MCP server and the Agent there)
Gateway
Memory (both short- and long-term).
Identity (please make sure to do so for the Runtime and Gateway Identity)

Enabling AgentCore Tracing

If we follow the steps described above and enable tracing for all AgentCore services in use, we'll only see the basic AgentCore metrics, but completely miss Sessions and Traces. The reason for this is that we provided the examples using the Strands Agents SDK. It works well with AgentCore Observability (baked by CloudWatch Generative AI Observability). We only had to add the dependency to aws-opentelemetry-distro and instrument our code, as shown below in the Dockerfile. Strands Agent has all the information on where to send the metrics and traces to the default OTEL provider, AWS CloudWatch. But how does it work for Java applications based on Spring AI and hosted on AgentCore Runtime?

To view the metrics in CloudWatch Generative AI observability, we need to add the AWS Distro for OpenTelemetry (ADOT) SDK to our agent code. ADOT is a secure, production-ready, AWS-supported distribution of the OpenTelemetry project. Part of the Cloud Native Computing Foundation, OpenTelemetry provides open source APIs, libraries, and agents to collect distributed traces and metrics for application monitoring. With ADOT, we can instrument our applications just once to send correlated metrics and traces to multiple AWS and Partner monitoring solutions. In our case, we will send the metrics to the CloudWatch GenAI Observability service.

AWS offers AWS Distro for OpenTelemetry Java with the AWS Distro for OpenTelemetry (ADOT). To get started, see the AWS Distro for OpenTelemetry Java documentation. Let's add it to our sample application. To do so, we need to modify the Dockerfile of our sample application. We first have to download the aws-opentelemetry-agent and then run it as the Java agent to instrument the code on the fly:

ADD https://github.com/aws-observability/aws-otel-java-instrumentation/releases/latest/download/aws-opentelemetry-agent.jar /opt/aws-opentelemetry-agent.jar

ENV JAVA_TOOL_OPTIONS=-javaagent:/opt/aws-opentelemetry-agent.jar

The documentation also says that the second component is required to receive the metrics and traces: the AWS Distro for OpenTelemetry Collector. In all the examples AWS provides, the collector is a sidecar application deployed with Docker Compose. Unfortunately, it's not possible to use Docker Compose for the AgentCore Runtime. We only provide the reference to the image in the Amazon Elastic Container Registry (ECR) repository that the AgentCore Runtime pulls and runs for us.

It took me a while to figure out how to achieve this, and I even created the issue for it. There is a so-called collector-less Observability for the Amazon Bedrock AgentCore resources. As of now, unfortunately, not all parameters to be configured are described in this article. But I combined this information with the article Exporting collector-less telemetry using AWS Distro for OpenTelemetry (ADOT) SDK to achieve the goal:

ADD https://github.com/aws-observability/aws-otel-java-instrumentation/releases/latest/download/aws-opentelemetry-agent.jar /opt/aws-opentelemetry-agent.jar

ENV JAVA_TOOL_OPTIONS=-javaagent:/opt/aws-opentelemetry-agent.jar \
AGENT_OBSERVABILITY_ENABLED=true \
OTEL_RESOURCE_ATTRIBUTES=spring_ai_ac_conference_application_runtime,aws.log.group.names=
/aws/bedrock-agentcore/runtimes/spring_ai_ac_conference_application_runtime-a00QWV3i7t \
OTEL_EXPORTER_OTLP_LOGS_HEADERS=x-aws-log-group=/aws/bedrock-agentcore/runtimes/spring_ai_ac_conference_application_runtime-a00QWV3i7t,x-aws-log-stream=runtime-logs,x-aws-metric-namespace=bedrock-agentcore \
OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf \
OTEL_EXPORTER_OTLP_TRACES_PROTOCOL=http/protobuf \
OTEL_TRACES_EXPORTER=otlp \
OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=https://xray.us-east-1.amazonaws.com/v1/traces \
OTEL_EXPORTER_OTLP_LOGS_PROTOCOL=http/protobuf \
OTEL_LOGS_EXPORTER=otlp \
OTEL_EXPORTER_OTLP_LOGS_ENDPOINT=https://logs.us-east-1.amazonaws.com/v1/logs

Besides the already described steps to download the aws-opentelemetry-agent and run it as the Java agent to instrument the code, we configured the following:

AGENT_OBSERVABILITY_ENABLED=true to indicate that we use Agent Observability and would like to view the traces in the CloudWatch Generative AI Observability and not in X-Ray.
OTEL_EXPORTER_OTLP_PROTOCOL, OTEL_EXPORTER_OTLP_TRACES_PROTOCOL, and OTEL_EXPORTER_OTLP_LOGS_PROTOCOL to all be http/protobuf.
OTEL_EXPORTER_OTLP_TRACES_ENDPOINT and OTEL_EXPORTER_OTLP_LOGS_ENDPOINT as regional endpoints for traces and logs. If you deploy your application in another region other than us-east-1, you need to adjust the URL.
OTEL_RESOURCE_ATTRIBUTES to be service.name=spring_ai_ac_conference_application_runtime,aws.log.group.names=/aws/bedrock-agentcore/runtimes/spring_ai_ac_conference_application_runtime-a00QWV3i7t. Please adjust service.name value to how you named the service in AgentCore Runtime. I called it spring_ai_ac_conference_application_runtime. For the suffix of the aws.log.group.names use your AgentCore Runtime ID (in my case spring_ai_ac_conference_application_runtime-a00QWV3i7t). AWS Log Group Name for AgentCore Runtime always follows the pattern: /aws/bedrock-agentcore/runtimes/{RUNTIME_ID}.
OTEL_EXPORTER_OTLP_LOGS_HEADERS to be x-aws-log-group=/aws/bedrock-agentcore/runtimes/spring_ai_ac_conference_application_runtime-a00QWV3i7t,x-aws-log-stream=runtime-logs,x-aws-metric-namespace=bedrock-agentcore. The same as above: for the suffix of the x-aws-log-group use your AgentCore Runtime ID again.

Then, after rebuilding and redeploying the application, we can see similar metrics and traces as provided in the articles using Strands Agents SDK above. There are, of course, some differences in the collected metadata. This is because we use the AWS OpenTelemetry Agent distribution for Java and not for Python, as in the articles above. Here are some selected screenshots taken from the CloudWatch GenAI Observability: Bedrock AgentCore Observability for the prompt "Please provide me with the list of conferences, including their IDs, with the Java topic happening in 2027, with the call for papers open today. Also, provide me with the list of my talks with this topic in the title. Finally, for each conference and talk retrieved, apply individually for the conference.", which I sent :

All sessions view:

All traces view:

All spans view:

Session ID view:

Tree view of the Trace ID:

Trajectory view of the Trace ID:

Timeline view of the Trace ID:

This is how to enable observability for Amazon Bedrock AgentCore Runtime hosted agents. If you don't host your application on AgentCore, you can still use CloudWatch to enable observability for non-Amazon Bedrock AgentCore-hosted agents.

Conclusion

In this article, we described how to configure AgentCore Observability in a collector-less way. This involves running the Java aws-opentelemetry-agent agent to instrument the code and set a bunch of environment variables in the Dockerfile. Please also make sure you have activated logging and tracing for both AgentCore Gateway and Runtime.

In the next article, we'll explore how to configure the same AgentCore observability with the help of spring-ai-agentcore-otel-extension.

Please also check out my other series on Building AI Agents with Embabel, Spring AI, and Amazon Bedrock AgentCore.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.

Building AI Agents with Spring AI and Amazon Bedrock AgentCore - Part 8 Use Spring AI AgentCore long-term Memory for MCP client on AgentCore Runtime

Vadym Kazulkin — Mon, 06 Jul 2026 14:07:04 +0000

Introduction

In part 7, we explained how to add and use AgentCore short-term Memory to our application with the help of Spring AI AgentCore Memory. In this article, we'll use AgentCore long-term Memory instead.

We'll once again build on the spring-ai-2.0-ac-conference-app-agent-bedrock-agentcore-runtime sample application, which we introduced in part 6. Please review part 7 to better understand the base concept of Spring AI AgentCore Memory and how to add it to our application.

Create Bedrock AgentCore long-term Memory

I've written the article Amazon Bedrock AgentCore Runtime - Part 7 Using AgentCore long-term Memory with Strands Agents SDK about what AgentCore long-term Memory is and how to create one with the Python SDK. Also provided an example of how to use it with Strands Agent SDK. I refer to this article to understand the basics.

To run examples, we've already deployed our sample application on AgentCore Runtime by executing the RuntimeWithMCPStack stack in part 6. Next, let's create AgentCore long-term Memory with CDK for Java by executing the LongTermMemoryStack stack. First, let's look at what is happening there:

public class LongTermMemoryStack extends Stack {

 public LongTermMemoryStack(Construct scope, String appName,  StackProps stackProps) {
    super(scope, id, stackProps);   
    var memory = Memory.Builder.create(this, "long-term-memory")
    .memoryName("long_term_memory_for_conference_application")
    .description("Long-Term Memory for Conference Application")
    .expirationDuration(Duration.days(7))
    .memoryStrategies(List.of(MemoryStrategy.usingBuiltInSummarization(),
                      MemoryStrategy.usingBuiltInSemantic()))
    .build();                 

    CfnOutput.Builder.create(this, "LongTermMemoryIdOutput").value(memory.getMemoryId()).build();           
    }  
}

We use Bedrock AgentCore Memory.Builder to set the memory name, description, expiration duration, and then create the memory. By defining the memory strategies, we outline that we'll create the AgentCore long-term memory. We used the semantic and summarization built-in memory strategies. You can also set the currently supported user preference and episodic memory strategies instead. The MemoryStrategy class offers usingBuiltInUserPreference and usingBuiltInEpisodic methods for this purpose. You can also configure the Custom Memory Strategy.

You can deploy the stack with the command: cdk deploy spring-ai-ac-conference-application-lt-memory-stack -c awsAccountId={YOUR_AWS_ACCOUNT_ID}.

This is how the created long-term memory looks in the AgentCore Memory UI:

And this is how the default namespaces look:

If you're not satisfied with the built-in configuration, for example, default namespaces, you can set your own. Here is an example of how to create a semantic memory strategy:

 MemoryStrategy.usingSemantic(ManagedStrategyProps.builder()
     .name("name")
     .namespaces(List.of("namespace1", "namespace2"))
     .build());

Other memory strategies work the same; just use the corresponding using* method. But I always start with the built-in memory strategies.

Also, the Memory ID will be printed out, which we will need to configure in our Spring AI application. We can find the same Memory ID in the service UI above.

Finally, we need to configure the following IAM permissions to allow our application running on AgentCoreRuntime to access this AgentCore Memory:

{
 "Sid": "BedrockAgentCoreLongTermMemory",
   "Effect": "Allow",
   "Action": [
       "bedrock-agentcore:ListEvents",
       "bedrock-agentcore:CreateEvent",
       "bedrock-agentcore:RetrieveMemoryRecords",
       "bedrock-agentcore:GetMemory"
      ],
   "Resource": [
         "arn:aws:bedrock-agentcore:{YOUR_AWS_REGION}:{YOUR_AWS_ACCOUNT_ID}:memory/{YOUR_LONG_TERM_MEMORY_ID}"
      ]
}

Configure Bedrock AgentCore long-term Memory in our sample application

To configure Bedrock AgentCore long-term Memory in our sample application, we need to make some changes to it. First, we need to configure some long-term memory-related properties in the application.properties:

agentcore.memory.memory-id={YOUR_LONG_TERM_MEMORY_ID}
agentcore.memory.long-term.auto-discovery=true

The first required property is the AgentCore Memory ID we just created. By setting agentcore.memory.long-term.auto-discovery to true, we use the recommended AgentCore long-term Memory autodiscovery option.

Autodiscovery behavior is:

Queries AWS to discover all strategies configured in your memory
Creates advisors only for supported types: SEMANTIC, SUMMARIZATION, USER_PREFERENCE, EPISODIC
Skips CUSTOM strategy types (not supported by autodiscovery)
Uses the first namespace if a strategy has multiple namespaces
Uses default topK values for each strategy type

We can also override the specific settings for discovered strategies by providing explicit configuration. See the link above to find out how to do this. Another option is to use the AgentCore long-term Memory explicit configuration option, in which we need to specify each strategy manually.

Next, we need to ensure that we set ChatMemory to the ChatClient in the SpringAIAgentController. I'll provide the generic constructor, capable of dealing with no AgentCore Memory configured or short-term or long-term memory configured:

public SpringAIAgentController(ChatClient.Builder builder, 
ChatMemory chatMemory, List<AgentCoreLongTermMemoryAdvisor> ltmAdvisors) {
   var options = ToolCallingChatOptions.builder()
      .model("us.anthropic.claude-sonnet-4-6")
      .maxTokens(2000);

   this.chatClient = builder.defaultOptions(options)      
           .defaultAdvisors(this.getAllMemoryAdvisors(chatMemory, ltmAdvisors))
         .build())
         .build();          
....
}

private List<Advisor> getAllMemoryAdvisors(ChatMemory chatMemory, List<AgentCoreLongTermMemoryAdvisor> ltmAdvisors) { 
   Advisor chatMemoryAdvisor= MessageChatMemoryAdvisor.builder(chatMemory).build();
   var cltmAdvisors=(List<Advisor>)(List<?>) ltmAdvisors;  
   var allAdvisors=new ArrayList<Advisor>();
   allAdvisors.addAll(cltmAdvisors);
   if(chatMemoryAdvisor!=null) {
      allAdvisors.add(chatMemoryAdvisor);
   }
   return allAdvisors;
}

Short-term Spring AI AgentCore Memory implements the Spring AI ChatMemoryRepository interface. This doesn't work for long-term Spring AI AgentCore Memory. For this, we inject the list of AgentCoreLongTermMemoryAdvisor. Then we use the Advisors API to build the complete list of Advisors in the getAllMemoryAdvisors method. We use MessageChatMemoryAdvisor with the ChatMemory to build the short-term memory advisor, and then we add the long-term advisors to the list. We then provide this complete list of memory advisors as an input to the defaultAdvisors method of the ChatClient.Builder. Even if we don't configure the AgentCore short-term or long-term Memory (or both), the same code still works without throwing any exceptions. MessageChatMemoryAdvisor, and List of AgentCoreLongTermMemoryAdvisors or both will be null in such a case, which Spring AI treats the same way as not setting any advisors. That's all the changes we need to make to our application to use the AgentCore long-term memory.

The last step is exactly the same as for the short-term memory: to include a custom ChatMemory Conversation ID in the ChatClient. According to the documentation, ChatMemory.CONVERSATION_ID parameter is required for all memory advisors. Calls that omit this parameter will throw an IllegalArgumentException at runtime, as there is no default conversation ID.
The Spring AI AgentCore long-term Memory supports flexible conversation ID formats:

Simple: user123 → actor: user123, session: default-session
With Session: user123:session456 → actor: user123, session: session456

This is how the code looks for it in the SpringAIAgentController:

private final String CONVERSATION_ID="default-actor-id-12345678:default-session-id-12345678";

@AgentCoreInvocation
public Flux<String> invoceAsync(PromptRequest promptRequest, AgentCoreContext agentCoreContext) {
    var token = getAuthTokenViaHttpClient();
    ...
    var client = McpClient.async(getMcpClientTransport(token)).build();
    client.initialize();

    var asyncMcpToolCallbackProvider = AsyncMcpToolCallbackProvider.builder()
      .mcpClients(client)
  ...


    var content = this.chatClient.prompt()
       .user(promptRequest.prompt())
       .advisors(a -> a.param(ChatMemory.CONVERSATION_ID, CONVERSATION_ID))
       .tools(new DateTimeTools(),asyncMcpToolCallbackProvider.getToolCallbacks()).stream()
       .content();

As shown above, we defined a static CONVERSATION_ID. However, if you'd like to use individual IDs depending on the actor or user providing the prompt, you can add the login functionality and set the individual user ID. Finally, we set the value of the conversation ID as the parameter of the memory advisor.

Then we need to rebuild the Docker image of our application and deploy it to the Amazon ECR. After it, we need to configure the correct ecrImageURI in the cdk.json. We covered those concepts in parts 2 and 4.

Finally, we need to redeploy the AgentCore Runtime stack with the command: cdk deploy spring-ai-ac-conference-application-agentcore-runtime-stack -c awsAccountId={YOUR_AWS_ACCOUNT_ID}.

Now, we can use the InvokeRuntimeAgent class to send prompts to our agent running on AgentCore Runtime. We described this in part 5 and can reuse these prompts to apply the talks to the conferences.

But now, similarly to the example of the short-term memory in part 7, we can ask such questions as: "You recently applied for some conferences for me. Can you provide me with the details?" The agent will give us a reply, which shows that it provided the answer using the AgentCore long-term Memory:

The reply is very similar to one provided in part 7 for the long-term memory.

Conclusion

In this article, we explained how to add and use AgentCore long-term Memory to our application with the help of Spring AI AgentCore Memory. In the next article, we'll add AgentCore Observability to our application.

Please also check out my other series on Building AI Agents with Embabel, Spring AI, and Amazon Bedrock AgentCore.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.

Building AI Agents with Spring AI and Amazon Bedrock AgentCore - Part 7 Use Spring AI AgentCore short-term Memory for MCP client on AgentCore Runtime

Vadym Kazulkin — Mon, 29 Jun 2026 14:00:35 +0000

Introduction

In part 6, we used Spring AI AgentCore Starter in our sample application to deploy and run our MCP client on AgentCore Runtime. We used several useful features of the Spring AI AgentCore Starter, like annotation-based auto-configuration, smart health checks, and rate limiting.

Until now, our agent deployed on AgentCore Runtime was stateless. If we apply for conferences with some talks and then ask the agent in the next conversation about which talks we applied for which conferences, the agent won't be able to answer. In this article, we'll add the AgentCore Memory to our application. We'll start with the short-term memory and later add the long-term memory. Then, we'll show how to use Spring AI AgentCore Memory, which provides the Spring AI ChatMemory integration with the Amazon Bedrock AgentCore Memory service.

We'll build on the spring-ai-2.0-ac-conference-app-agent-bedrock-agentcore-runtime sample application, which we introduced in part 6.

Spring AI AgentCore Memory

Spring AI AgentCore Memory provides Spring AI ChatMemory integration with the Amazon Bedrock AgentCore Memory service.
Its features currently include:

Spring AI Integration: Implements ChatMemoryRepository interface
Auto-configuration: Zero-configuration setup with Spring Boot
Short-Term Memory: Conversation history with MessageWindowChatMemory
Long-Term Memory: 4 consolidation strategies (Semantic, User Preference, Summary, Episodic)

To use Spring AI AgentCore Memory in our application, we need to add one more dependency to the pom.xml:

<dependency>
    <groupId>org.springaicommunity</groupId>
    <artifactId>spring-ai-agentcore-memory</artifactId>
</dependency>

As stated above, in this article, we'll cover short-term memory, leaving the long-term memory to the next article.

Create Bedrock AgentCore short-term Memory

I've written the article Amazon Bedrock AgentCore Runtime - Part 6 Using AgentCore short-term Memory with Strands Agents SDK about what AgentCore short-term Memory is and how to create one with the Python SDK. Also provided an example of how to use it with the Strands Agent SDK. I refer to this article to understand the basics.

To run examples, we've already deployed our sample application on AgentCore Runtime by executing the RuntimeWithMCPStack stack in part 6. Next, let's create AgentCore short-term Memory with CDK for Java by executing the ShortTermMemoryStack stack. First, let's look at what is happening there:

public class ShortTermMemoryStack extends Stack {

 public ShortTermMemoryStack(Construct scope, String appName,  StackProps stackProps) {
    super(scope, id, stackProps);   
    var memory = Memory.Builder.create(this, "short-term-memory-1")
              .memoryName("short_term_memory_for_conference_application")
              .description("Short-Term Memory for Conference Application")
              .expirationDuration(Duration.days(7))
              .build();   

    CfnOutput.Builder.create(this, "ShortTermMemoryIdOutput").value(memory.getMemoryId()).build();           
    }  
}

We use Bedrock AgentCore Memory.Builder to set the memory name, description and expiration duration, and then create the memory.

You can deploy the stack with the command: cdk deploy spring-ai-ac-conference-application-st-memory-stack -c awsAccountId={YOUR_AWS_ACCOUNT_ID}.

As we don't set any memory strategy, the short-term memory will be created like this:

Also, the Memory ID will be printed out, which we will need to configure in our Spring AI application. We can find the same Memory ID in the service UI above.

Finally, we need to configure the following IAM permissions to allow our application running on AgentCoreRuntime to access this AgentCore Memory:

{
 "Sid": "BedrockAgentCoreShortTermMemory",
   "Effect": "Allow",
   "Action": [
       "bedrock-agentcore:ListEvents",
       "bedrock-agentcore:CreateEvent",
       "bedrock-agentcore:RetrieveMemoryRecords"
      ],
   "Resource": [
         "arn:aws:bedrock-agentcore:{YOUR_AWS_REGION}:{YOUR_AWS_ACCOUNT_ID}:memory/{YOUR_SHORT_TERM_MEMORY_ID}"
      ]
}

Configure Bedrock AgentCore short-term Memory in our sample application

To configure Bedrock AgentCore short-term Memory in our sample application, we need to make some changes to it. First, we need to configure some short-term memory-related properties in the application.properties:

agentcore.memory.memory-id={YOUR_SHORT_TERM_MEMORY_ID}
agentcore.memory.total-events-limit=10 #Max events to retrieve (context window), default 100
agentcore.memory.default-session=default-session-id-12345678 #Default session name, default name is default-session
agentcore.memory.page-size=50  #API pagination size, default value is 50
agentcore.memory.ignore-unknown-roles=false #Handle unknown message roles, default value is false

The only required property is the AgentCore Memory ID we just created. All others are optional, with default values described in the Spring AI AgentCore Memory Configuration Reference.

Next, we need to ensure that we set ChatMemory to the ChatClient in the SpringAIAgentController. We've already set it up like this:

public SpringAIAgentController(ChatClient.Builder builder, ChatMemory chatMemory) {
var options = ToolCallingChatOptions.builder()
   .model("us.anthropic.claude-sonnet-4-6")
   .maxTokens(2000);

this.chatClient = builder.defaultOptions(options)
          //short term memory         
         .defaultAdvisors(MessageChatMemoryAdvisor.builder(chatMemory)
         .build())
         .build();          
....
}

Short-term Spring AI AgentCore Memory implements the Spring AI ChatMemoryRepository interface. That's why, when we provide the memory configuration as above, Spring AI injects the correct implementation of the ChatMemory into the constructor. Then we use the Advisors API to build MessageChatMemoryAdvisor with the ChatMemory and to provide it as an input to the defaultAdvisors method of the ChatClient.Builder. Even if we don't configure the AgentCore short-term Memory, the same code still works without throwing any exceptions. MessageChatMemoryAdvisor will be null, which Spring AI treats the same way as not setting any advisors. That's all the changes we need to make to our application to use the AgentCore short-term memory.

In addition, we need to include a custom ChatMemory Conversation ID in the ChatClient. According to the documentation, the ChatMemory.CONVERSATION_ID parameter is required for all memory advisors. Calls that omit this parameter will throw an IllegalArgumentException at runtime, as there is no default conversation ID.
The Spring AI AgentCore long-term Memory supports flexible conversation ID formats:

Simple: user123 → actor: user123, session: default-session
With Session: user123:session456 → actor: user123, session: session456

This is how the code looks for it in the SpringAIAgentController:

private final String CONVERSATION_ID="default-actor-id-12345678:default-session-id-12345678";

@AgentCoreInvocation
public Flux<String> invoceAsync(PromptRequest promptRequest, AgentCoreContext agentCoreContext) {
    var token = getAuthTokenViaHttpClient();
    ...
    var client = McpClient.async(getMcpClientTransport(token)).build();
    client.initialize();

    var asyncMcpToolCallbackProvider = AsyncMcpToolCallbackProvider.builder()
     .mcpClients(client)
    ...

    var content = this.chatClient.prompt()
       .user(promptRequest.prompt())
       .advisors(a -> a.param(ChatMemory.CONVERSATION_ID, CONVERSATION_ID))
       .tools(new DateTimeTools(),asyncMcpToolCallbackProvider.getToolCallbacks())
       .stream()
       .content();

Finally, we need to redeploy the AgentCore Runtime stack with the command: cdk deploy spring-ai-ac-conference-application-agentcore-runtime-stack -c awsAccountId={YOUR_AWS_ACCOUNT_ID}.

Now, we can use the InvokeRuntimeAgent class to send prompts to our agent running on AgentCore Runtime. We described this in part 5 and can reuse these prompts to apply the talks to the conferences.

But now, additionally, we can ask such questions as: "You recently applied for some conferences for me. Can you provide me with the details?" The agent will give us a reply similar to the reply shown below, which shows that it provided the answer using the AgentCore short-term Memory:

Conclusion

In this article, we explained how to add and use AgentCore short-term Memory to our application with the help of Spring AI AgentCore Memory. In the next article, we'll use AgentCore long-term Memory instead.

Please also check out my other series on Building AI Agents with Embabel, Spring AI, and Amazon Bedrock AgentCore.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.

Building AI Agents with Spring AI and Amazon Bedrock AgentCore - Part 6 Deploy MCP client on AgentCore Runtime using Spring AI AgentCore Starter

Vadym Kazulkin — Mon, 22 Jun 2026 14:25:38 +0000

Introduction

In part 5, we looked at how to deploy and run our MCP client on AgentCore Runtime. Starting from this article, we'll look at the Spring AI AgentCore functionality. In this article, we'll use Spring AI AgentCore Starter in our sample application to deploy and run our MCP client on AgentCore Runtime. As Spring AI 2.0 and Spring Boot 4.1 have both already gone GA, I updated our application to use them; see pom.xml. For this, I created a new spring-ai-2.0-ac-conference-app-agent-bedrock-agentcore-runtime. It consists of the agent and Infrastructure as Code (IaC) subfolders.

Differences in the implementation of the MCP client for the Conference application between Spring AI 1.1 and 2.0

I have noticed several major differences in the implementation of the MCP client for the Conference application. We developed it mainly in part 3, and then adjusted it in part 4 and part 5. See SpringAIAgentController for the full version of the controller.

The first one is that ChatClient now requires passing the ChatOptions.Builder object to the defaultOptions method instead of the ChatOptions object itself:

var options = ToolCallingChatOptions.builder()
        .model("us.anthropic.claude-sonnet-4-6")
        .maxTokens(2000);

this.chatClient = builder.defaultOptions(options)
        ...
        .build();

Next, the biggest difference is that instead of using WebClient from the Spring Webflux dependency, Spring AI 2.0 now uses HttpRequest.Builder from the java.net.http module to create an MCP HTTP Streamable transport. Also, the implementation of this protocol is now in the HttpClientStreamableHttpTransport class, which was adjusted to use the java.net.http module. In Spring AI 1.*, the class name was WebClientStreamableHttpTransport:

private McpClientTransport getMcpClientTransport(String token) {

 var mcpServerConfig= this.getMCPServerConfig();
 var headerValue = "Bearer " + token;

 var httpRequestBuilder = HttpRequest.newBuilder()
     .header("Authorization", headerValue);

 return HttpClientStreamableHttpTransport.builder(mcpServerConfig.baseUrl)
     .connectTimeout(Duration.ofMinutes(3))
     .endpoint(mcpServerConfig.endpoint)        
     .requestBuilder(httpRequestBuilder)
     .build();
}

It also requires splitting the MCP endpoint URL into 2 parts: base URL (domain) and endpoint itself (/mcp), which we did in the application.properties:

amazon.bedrock.agentcore.gateway.base.url=https://spring-ai-conference-search-agentcore-gateway-xizwpytsgm.gateway.bedrock-agentcore.us-east-1.amazonaws.com
amazon.bedrock.agentcore.gateway.endpoint=/mcp

Lastly, Spring AI 2.0 introduced some changes to how to use the MCP tools. This is how the code looked in the previous Spring AI 1.x versions:

return this.chatClient.prompt().user(prompt)
   .tools(new DateTimeTools())
   .toolCallbacks(asyncMcpToolCallbackProvider.getToolCallbacks())
   .stream().content();

The code in Spring AI 2.0 uses the tools method, capable of accepting the local tools as well as tool callbacks as its parameters:

return this.chatClient.prompt().user(prompt)
    .tools(new DateTimeTools(),asyncMcpToolCallbackProvider.getToolCallbacks())
    .stream().content();

Also, we need to additionally define the ToolCallingManager Spring bean in the main SpringAIConferenceAppOnAgentCoreRuntimeApplication class:

@Bean ToolCallingManager toolCallingManager() {
   return ToolCallingManager.builder().build();
}

Everything else remains the same as described in parts 3-5.

Spring AI AgentCore SDK

Spring AI AgentCore SDK is an open-source library that brings Amazon Bedrock AgentCore capabilities into Spring AI through familiar patterns: annotations, auto-configuration, and composable advisors. We'll start by using Spring AI AgentCore Starter in this article and then cover Spring AI AgentCore Memory in subsequent articles.

Spring AI AgentCore Starter

Spring AI AgentCore Starter is a Spring Boot starter that enables existing Spring Boot applications to conform to the Amazon Bedrock AgentCore Runtime contract with minimal configuration. Its features currently include:

Auto-configuration: Automatically sets up AgentCore endpoints when added as a dependency
Annotation-based: Simple @AgentCoreInvocation annotation to mark agent methods
SSE Streaming: Server-Sent Events support with Flux return types
Smart health checks: Built-in /ping endpoint with Spring Boot Actuator integration
Async task tracking: Convenient methods for background task tracking
Rate limiting: Built-in Bucket4j throttling for invocations and ping endpoints

Let's add the relevant dependencies to pom.xml:

<dependencyManagement>
   <dependencies>
       <dependency>
            <groupId>org.springaicommunity</groupId>
            <artifactId>spring-ai-agentcore-bom</artifactId>
            <version>${spring-ai-agentcore-version}</version> 
            <type>pom</type>
            <scope>import</scope>
       </dependency>
   </dependencies>
</dependencyManagement>
...
<dependencies>
  <dependency>
     <groupId>org.springaicommunity</groupId>
     <artifactId>spring-ai-agentcore-runtime-starter</artifactId>
  </dependency>
  <dependency>
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-actuator</artifactId>
  </dependency>
</dependencies>

By adding the spring-ai-agentcore-runtime-starter dependency, we can now use org.springaicommunity.agentcore.annotation.AgentCoreInvocation annotation to annotate the method. Exactly this method we'll expose as a /invocation POST endpoint on the Bedrock AgentCore Runtime. Please note that only one method per application can be annotated with this annotation. Next, we need to do a small adjustment to the SpringAIAgentController to use this annotation:

@AgentCoreInvocation
public Flux<String> invoceAsync(PromptRequest promptRequest, AgentCoreContext agentCoreContext) {
...
return this.chatClient.prompt()
         .user(promptRequest.prompt())
         .tools(new DateTimeTools(),asyncMcpToolCallbackProvider.getToolCallbacks())
         .stream().content();
}

PromptRequest is a Java record representing a prompt:

public record PromptRequest(String prompt){};

Spring AI Starter also supports rate limiting. The starter includes built-in rate limiting using Bucket4j to protect against excessive requests. However, rate limiting is deactivated by default and will be active only if limits are defined in application.properties:

agentcore.throttle.invocations-limit=20
agentcore.throttle.ping-limit=250

The provided rate limit response is an HTTP response code 429:
({"error":"Rate limit exceeded"}).
Rate limits are also applied per client IP address and reset every minute.

Next, please comment out all application properties starting with agentcore.memory, as we'll need them in the upcoming article where we'll cover Bedrock AgentCore Memory.

By adding the dependency to the spring-boot-starter-actuator, we enabled health monitoring. We no longer need to implement the intelligent /ping endpoint ourselves.

Without Spring Boot Actuator:

Returns static "Healthy" status
Always responds with HTTP 200

With Spring Boot Actuator:

Integrates with Actuator health checks
Maps Actuator status to AgentCore format: UP → "Healthy" (HTTP 200), DOWN → "Unhealthy" (HTTP 503), Other → "Unknown" (HTTP 503)
Tracks status change timestamps
Thread-safe concurrent access

Then, let's briefly cover the IaC part with CDK for Java, which I implemented in the RuntimeWithMCPStack stack. It's completely identical to the IaC that we described in part 5. I wanted to have a separate IaC stack (also including an IAM role and ECR repository) for this Spring AI 2.0 and Spring AI AgentCore application. Also, please comment out the ShortTermMemoryStack and LongTermMemoryStack execution in the CDKApp class. We'll cover those later.

You can deploy the stack with the command: cdk deploy spring-ai-ac-conference-application-agentcore-runtime-stack -c awsAccountId={YOUR_AWS_ACCOUNT_ID}.

Finally, please visit the above-mentioned part 5 for more details on how to deploy this application on AgentCore Runtime and send prompts to it. All the prompts remain valid, as this is the same application, but using Spring AI AgentCore now.

Conclusion

In this article, we used Spring AI AgentCore Starter in our sample application to deploy and run our MCP client on AgentCore Runtime. We used several useful features of the Spring AI AgentCore Starter, like annotation-based auto-configuration, smart health checks, and rate limiting.

Until now, our agent deployed on AgentCore Runtime was stateless. If we apply for the conferences with some talks and then ask the agent in the next conversation about which talks we applied for which conferences, the agent won't be able to answer. In the next article, we'll add the AgentCore Memory to our application. We'll start with the short-term memory and later add the long-term memory. Then, we'll show how to use Spring AI AgentCore Memory, which provides the Spring AI ChatMemory integration with the Amazon Bedrock AgentCore Memory service.

Please also check out my other series on Building AI Agents with Embabel, Spring AI, and Amazon Bedrock AgentCore.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.

Serverless applications on AWS with Lambda using Java 25, API Gateway and Aurora DSQL - Part 7 Lambda performance optimization approaches

Vadym Kazulkin — Mon, 15 Jun 2026 14:51:59 +0000

Introduction

In the previous articles of the series about how to develop, run, and optimize Serverless applications on AWS with Lambda using Java 25, API Gateway, and Aurora DSQL database, we used:

Managed Java 25 runtime
GraalVM Native Image deployed as Lambda Custom Runtime

We also did Lambda performance (cold and warm starts) measurements with the following settings:

Lambda functions used 1024 MB of memory
Java compilation option "-XX:+TieredCompilation -XX:TieredStopAtLevel=1"
Lambda x86_64 architecture used

In this article, we'll introduce some additional Lambda performance (cold and warm starts) optimization approaches to apply to our sample application. You'll need to measure the performance by yourself to figure out whether they will provide the desired Lambda performance improvements.

Please keep in mind that you can also deploy our sample application on AWS Lambda as a (Docker) Container Image. I didn't cover this approach, but you can look into my article series Lambda function using Docker Container Image for a step-by-step introduction on how to do it. I used DynamoDB as a database in this example. The cold start will be quite big. Lambda SnapStart isn't available for the Lambda deployment as a Container Image. Instead, you can use Ahead-of-Time (AOT) and CDS caches for the Container Image and then measure the Lambda performance.

Lambda performance optimization approaches

We can apply the following approaches to the managed Java runtime and GraalVM Native Image. For the managed Java runtime, it includes enabling SnapStart and applying the priming techniques on top:

Try out different Lambda memory settings. We performed all measurements with 1024 MB of memory for the Lambda function. With different memory settings, you might become better at the price-performance trade-off.
Try out setting Lambda arm64 architecture using AWS Graviton2 processor, which supports SnapStart since July 2024. This can provide a better cost-performance trade-off compared to x86 architecture.

We can apply the following approaches primarily only to the managed Java runtime on Lambda. This includes SnapStart being enabled and applying the priming techniques on top:

Try out different Java compilation options for the Lambda function. We performed all measurements until now with the compilation option "-XX:+TieredCompilation -XX:TieredStopAtLevel=1". We can provide other compilation options to the Lambda function using an environment variable called JAVA_TOOL_OPTIONS. This can have different cold and warm starts trade-offs. For GraalVM Native Image, the choice of Java compilation method doesn't have much impact on the Lambda performance. This is because our application is already compiled natively.
Further exclude unused dependencies. With that, we can especially reduce the cold start times (also for SnapStart enabled). In the case of GraalVM Native Image, only reachable Java classes, functions, and methods will become a part of the Native Image, so including unused dependencies may not help that much.

We can apply the following approach primarily to the managed Java runtime on Lambda with SnapStart enabled:

Search for further Lambda SnapStart priming potential in addition to those we introduced in this series. For this, you can use AWS Lambda Profiler Extension for Java. I described it in my article Improving Lambda performance with Lambda SnapStart and priming.

We can apply the following approach primarily to the GraalVM Native Image :

Try out Profile-Guided Optimizations to see whether you can further improve Lambda performance. The difficulty of trying out this technique is that you'll need to do some additional semi-automated steps to run your application either with the Lambda emulator locally or in an extra environment to obtain the profile of your application, which you'll then need to use to generate the optimized Native Image. You can use Lambda extension for it, but it still requires a lot of additional work. This is the work AWS did for us in case Lambda SnapStart is enabled. I really appreciate that I don't need to care about generating, encrypting, storing, and restoring the snapshots/profiles.

Conclusion

In this article, we introduced additional Lambda performance optimization approaches that we can use in our sample application. Try them out on your own to figure out whether they will provide the desired Lambda performance improvements.

Please also watch out for another series where I use a NoSQL serverless Amazon DynamoDB database instead of Aurora DSQL to do the same Lambda performance measurements.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.

Serverless applications on AWS with Lambda using Java 25, API Gateway and DynamoDB - Part 7 Lambda performance optimization approaches

Vadym Kazulkin — Tue, 09 Jun 2026 15:04:06 +0000

Introduction

In the previous articles of the series about how to develop, run, and optimize Serverless applications on AWS with Lambda using Java 25, API Gateway, and DynamoDB, we used:

Managed Java 25 runtime
GraalVM Native Image deployed as Lambda Custom Runtime

We also did Lambda performance (cold and warm starts) measurements with the following settings:

Lambda functions used 1024 MB of memory
Java compilation option "-XX:+TieredCompilation -XX:TieredStopAtLevel=1"
Lambda x86_64 architecture used
Default Apache HTTP Client (version 4.5) used to connect to the DynamoDB

Please keep in mind that you can also deploy our sample application on AWS Lambda as a (Docker) Container Image. I didn't cover this approach, but you can look into my article series Lambda function using Docker Container Image for a step-by-step introduction on how to do it. The cold start will be quite big. Lambda SnapStart isn't available for the Lambda deployment as a Container Image. Instead, you can use Ahead-of-Time (AOT) and CDS caches for the Container Image and then measure the Lambda performance.

Lambda performance optimization approaches

To find a good balance between the cold and warm start times of the Lambda function, you can try out the optimization techniques introduced below. I have not taken any additional measurements with our sample application with Java and GraalVM 25, but have done so using older Java, GraalVM, and dependency versions. I'll provide references to my relevant articles. Measurements that I did back then might already be outdated, so I strongly recommend you to re-measure.

We can apply the following approaches to the managed Java runtime and GraalVM Native Image. For the managed Java runtime, it includes enabling SnapStart and applying the priming techniques on top:

Try out different Lambda memory settings. We performed all measurements with 1024 MB of memory for the Lambda function. With different memory settings, you might become better at the price-performance trade-off. See my article Measuring cold and warm starts and deployment time with Java 21 using different Lambda memory settings for further examples, performance measurements, and conclusions.
Try out setting Lambda arm64 architecture using the AWS Graviton2 processor, which supports SnapStart since July 2024. This can provide a better cost-performance trade-off compared to x86 architecture. See my article AWS Lambda performance with Java 21: x86 vs arm64 - Initial measurements for some insights.
Try out different synchronous HTTP clients to establish an HTTP connection to DynamoDB. We performed all measurements until now with the default synchronous Apache HTTP Client version 4.5. There are other options like UrlConnection and AWS CRT HTTP clients, which provide different performance trade-offs for the cold and warm start. See my article Measuring cold and warm starts with Java 21 using different synchronous HTTP clients for further examples, performance measurements, and conclusions. GraalVM Native Image also supports the AWS CRT HTTP Client, and I did some measurements using a pure Java Lambda function in my article Measuring cold and warm starts with GraalVM 23 and AWS CRT HTTP Client. Recently, also Apache 5.x based HTTP client has been released, so you can try it out.
Explore whether an asynchronous HTTP client for DynamoDB is an option for your use case. The default asynchronous HTTP Client is NettyNio. There is another option, the AWS CRT async HTTP client, which provides different performance trade-offs for the cold and warm starts. See my article Measuring cold and warm starts with Java 21 using different asynchronous HTTP clients for further examples, performance measurements, and conclusions.

We can apply the following approaches primarily only to the managed Java runtime on Lambda. This includes SnapStart being enabled and applying the priming techniques on top:

Try out different Java compilation options for the Lambda function. We performed all measurements until now with the compilation option "-XX:+TieredCompilation -XX:TieredStopAtLevel=1". We can provide other compilation options to the Lambda function using an environment variable called JAVA_TOOL_OPTIONS. This can have different cold and warm starts trade-offs. See my article Measuring cold and warm starts with Java 21 using different compilation options for further examples, performance measurements, and conclusions. For GraalVM Native Image, the choice of Java compilation method doesn't have much impact on the Lambda performance. This is because our application is already compiled natively.
Further exclude unused dependencies. With that, we can especially reduce the cold start times (also for SnapStart enabled); see my article Measuring cold starts with Java 21 using different deployment artifact sizes. In the case of GraalVM Native Image, only reachable Java classes, functions, and methods will become a part of the Native Image, so including unused dependencies may not help that much.

We can apply the following approach primarily to the managed Java runtime on Lambda with SnapStart enabled:

Search for further Lambda SnapStart priming potential in addition to those we introduced in this series. For this, you can use AWS Lambda Profiler Extension for Java. I described it in my article Improving Lambda performance with Lambda SnapStart and priming.

We can apply the following approach primarily to the GraalVM Native Image :

Try out Profile-Guided Optimizations to see whether you can further improve Lambda performance. The difficulty of trying out this technique is that you'll need to do some additional semi-automated steps to run your application either with the Lambda emulator locally or in an extra environment to obtain the profile of your application, which you'll then need to use to generate the optimized Native Image. You can use Lambda extension for it, but it still requires a lot of additional work. This is the work AWS did for us in case Lambda SnapStart is enabled. I really appreciate that I don't need to care about generating, encrypting, storing, and restoring the snapshots/profiles.

Conclusion

Please also watch out for another series where I use a relational serverless Amazon Aurora DSQL database and additionally the Hibernate ORM framework instead of DynamoDB to do the same Lambda performance measurements.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.

AWS Lambda Managed Instances with Java 25 and AWS SAM – Part 7 Implement scheduled scaling

Vadym Kazulkin — Mon, 01 Jun 2026 15:36:09 +0000

Implement scheduled scaling

Recently, Amazon EventBridge Scheduler added 619 new SDK API actions. One of these actions adjusts the Lambda function's minimum and maximum execution environments for Lambda Managed Instances (LMI) on a recurring or one-time schedule. This is useful for predictable traffic patterns, such as scaling up before peak hours and scaling down during off-peak hours. We can use CloudFormation or the latest versions of AWS CDK or AWS CLI to perform this action. In our example, we'll use AWS CLI to adjust the Lambda Function Scaling Configuration, for which we'll use the PutFunctionScalingConfig API as a universal target. We'll use the Lambda function with the name GetProductByIdJava25WithLMI, which we introduced in part 1.

First of all, let's create an SQS dead-letter queue, which we'll use for our action:

aws sqs create-queue --queue-name scheduler-dlq

Next, let's create an EventBridge Scheduler IAM execution role with the name scale-lambda-managed-instances-eventbridge-scheduler-role. This role grants permission to call the lambda:PutFunctionScalingConfig and send the message to the dead-letter queue on our target function.

This is how the trusted policy looks for the IAM role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "scheduler.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

And this is how the IAM policy looks (use the ARNs of the Lambda function and SQS dead-letter queue here):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "lambda:PutFunctionScalingConfig"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:lambda:{aws_region}:{aws_account_id}:function:GetProductByIdJava25WithLMI:$LATEST.PUBLISHED"
        },
        {
            "Effect": "Allow",
            "Action": [
                "sqs:SendMessage"
            ],
            "Resource": [
                "arn:aws:sqs:{aws_region}:{aws_account_id}:scheduler-dlq"
            ]
        }
    ]
}

Please replace the values of {aws_region} and {aws_account_id} with your own values, and adjust the Lambda function and SQS Queue names if needed.

Now, let's create the scheduler:

aws scheduler create-schedule \
  --name "ScaleLambdaManagedInstances" \
  --schedule-expression "at(2026-05-18T08:10:00)" \
  --flexible-time-window '{"Mode": "OFF"}' \
  --target '{
     {"DeadLetterConfig": {"Arn": "arn:aws:sqs:{aws_region}:{aws_account_id}:scheduler-dlq"},
    "Arn": "arn:aws:scheduler:::aws-sdk:lambda:PutFunctionScalingConfig",
    "RoleArn": "arn:aws:iam::{aws_account_id}:role/scale-lambda-managed-instances-eventbridge-scheduler-role",
    "Input": "{\"FunctionName\": \"GetProductByIdJava25WithLMI\", \"Qualifier\": \"$LATEST.PUBLISHED\", \"FunctionScalingConfig\": {\"MinExecutionEnvironments\": 5, \"MaxExecutionEnvironments\": 10}}"
  }'

Let's explain what happens here:

First, we create the schedule with the name ScaleLambdaManagedInstances using a one-time schedule (executes at 08:10 on May 18, 2026). You can use other Schedule types in EventBridge Scheduler, like cron-based expressions.
Then, we target the PutFunctionScalingConfig Scheduler API as a universal target.
Next, we specify the SQS dead-letter queue ARN created above
Then, we specify the IAM execution Role ARN created above
Next, we specify the new MinExecutionEnvironments and MaxExecutionEnvironments values in the Input payload
Finally, as the scheduler input, we specify the name of the Lambda function and its qualifier (usually $LATEST.PUBLISHED), for which we'd like to change the Function Scaling Configuration. In our case, we set MinExecutionEnvironments to 5 and MaxExecutionEnvironments to 10.
We can also optionally set the retry policy and encryption.

After creating the schedule, we'll see something similar in the Amazon EventBridge Scheduler Service:

After the scheduler has run, we can verify that the Lambda function Scaling Configuration has changed:

It's also very important to configure the dead-letter queue. First, I didn't do it and configured the Lambda function Resource ARN in the IAM policy like arn:aws:lambda:{aws_region}:{aws_account_id}:function:GetProductByIdJava25WithLMI. I observed that the scheduler hasn't been invoked and saw the errors in Amazon CloudWatch.
By configuring the dead-letter queue, I saw the exact error message:

ERROR_CODE: AccessDeniedException
ERROR_MESSAGE :

User: arn:aws:sts::{aws_account_id}:assumed-role/scale-lambda-managed-instances-eventbridge-scheduler-role/f375e2c757da339a8d593587ce800265 
is not authorized to perform: lambda:PutFunctionScalingConfig on resource: 
arn:aws:lambda:{aws_region}:{aws_account_id}:function:GetProductByIdJava25WithLMI:$LATEST.PUBLISHED 
because no identity-based policy allows the lambda:PutFunctionScalingConfig action

With that, it was clear to me that I needed to append $LATEST.PUBLISHED to the ARN of the Lambda function. Please also use Troubleshooting Amazon EventBridge Scheduler, in case you experience some issues.

Here, we scaled up the capacity at the given time, and in the same way we can scale it down. Things to pay attention to:

For workloads with predictable peaks, create multiple schedules to match your traffic pattern: one to scale up your function before peak hours, and another to scale down after peak hours. Each schedule follows the same pattern with updated MinExecutionEnvironments and MaxExecutionEnvironments values.
Scheduled scaling adjusts the provisioned floor and ceiling of execution environments, but actual scaling between min and max still responds to CPU utilization and concurrency saturation.
If your traffic more than doubles within 5 minutes of a scheduled scale-up, you might still experience throttling as capacity is provisioned.
When scaling to zero to deactivate a function, remember that reactivation requires an explicit PutFunctionScalingConfig call with non-zero values.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.

Building AI Agents with Spring AI and Amazon Bedrock AgentCore - Part 5 Deploy MCP client for Conference application on AgentCore Runtime

Vadym Kazulkin — Tue, 26 May 2026 14:40:49 +0000

Introduction

In part 2, we explained how to deploy and run our conference search application on the Amazon Bedrock AgentCore Runtime as the MCP server. In this article, we'll develop the (MCP-) client, capable of talking to our application running on AgentCore Runtime. Later, in part 3, we developed the (MCP-) client, capable of talking to our application running on AgentCore Runtime. In part 4, we looked at how to provide the MCP Tools for the Conference application via AgentCore Gateway in a centralized way.

As we saw in previous articles, the local MCP client for the Conference application, to talk to AgentCore Runtime or Gateway, became quite big. If we have many customers using such a client, changing and operating it can become quite challenging. That's why, in this article, we look at how to deploy and run our MCP client on AgentCore Runtime.

Update from July, 2026. After I published this article, Spring AI 2.0 became generally available. The changes that I need to make for that are the same that I described in part 4. Please also check out my spring-ai-2.0-conference-app-agent-bedrock-agentcore-runtime repository with the updated sample application.

Implement the MCP client for the Conference application to be deployable on AgentCore Runtime

We'll reuse the MCP client based on Spring AI that we implemented in parts 3 and 4. But as we need to make some small changes to deploy it on AgentCore Runtime, I created a new spring-ai-1.1-conference-app-agent-bedrock-agentcore-runtime. It consists of the agent and Infrastructure as Code subfolders.

Let's first look at the changes that we need to make to the client. AgentCore Runtime also supports the HTTP protocol contract, which we'll use to deploy our MCP client and talk to it. This contract puts some requirements on the client:

Container requirements:

Host : 0.0.0.0
Port : 8080 - Standard port for HTTP-based agent communication
Platform : ARM64 Docker container - Required for compatibility with the AgentCore Runtime environment. I usually borrow t4g small EC2 instance on AWS to build it.

Path requirements:

/invocations endpoint: POST endpoint for agent interactions
/ping endpoint: GET endpoint for health checks

You can read more about this topic in the HTTP protocol contract article.

The only changes we need to make to our REST Controller are to implement these path requirements. If we use asynchronous communication, the entry point looks like:

@PostMapping(value = "/invocations", consumes = { "*/*" })
public Flux<String> invocations(@RequestBody String prompt) {
   var token = getAuthTokenViaHttpClient();
   var client = McpClient.async(getMcpClientTransport(token)).build();
   ...
  var toolCallbacks = concatWithStream(asyncMcpToolCallbackProvider
 .getToolCallbacks(), ToolCallbacks.from(new DateTimeTools()));

  return this.chatClient.prompt().user(prompt)
    .toolCallbacks(toolCallbacks)
        .stream().content();
}

For synchronous communication, the entry point looks like:

@PostMapping(value = "/invocations", consumes = { "*/*" })
public String invocations(@RequestBody String prompt) {
   var token = getAuthTokenViaHttpClient();
   var client = McpClient.async(getMcpClientTransport(token)).build();
   ...
  var toolCallbacks = concatWithStream(asyncMcpToolCallbackProvider
 .getToolCallbacks(), ToolCallbacks.from(new DateTimeTools()));

  return this.chatClient.prompt().user(prompt)
    .toolCallbacks(toolCallbacks)
        .call().content();
}

For adding the path to /ping, we have different options. We can either add such a simple method:

@GetMapping("/ping")
public String ping() {
   return "{\"status\": \"healthy\"}";
}

Or use Spring Boot Actuator service and add some properties to the application.properties:

management.endpoints.web.exposure.include=health
management.endpoints.web.base-path=/
management.endpoints.web.path-mapping.health=ping

As we need to deploy our MCP client as an ARM64 Docker container, I also added a simple Docker file:

FROM amazoncorretto:25

COPY target/spring-ai-1.1-conference-app-agent-bedrock-agentcore-runtime-0.0.1-SNAPSHOT.jar app.jar
ENTRYPOINT ["java","-jar","/app.jar"]

Let's build the Docker file and upload it to the Amazon Elastic Container Registry:

# build the application
mvn clean package 

# build the Docker image
sudo docker build --no-cache -t spring-ai-conference-app-agent-bedrock-agentcore-runtime:v1 

# Login to ECR
aws ecr get-login-password --region {region} | sudo docker login --username AWS --password-stdin {account_id}.dkr.ecr.{region}.amazonaws.com  

# Create ECR repository (if it doesn't exist)
aws ecr create-repository --repository-name spring-ai-conference-app-agent-bedrock-agentcore-runtime --image-scanning-configuration scanOnPush=true --region {region}  

# Tag the Docker image
sudo docker tag spring-ai-conference-app-agent-bedrock-agentcore-runtime:v1 {account_id}.dkr.ecr.{region}.amazonaws.com/spring-ai-conference-app-agent-bedrock-agentcore-runtime:v1

# Push the Docker Image to the ECR repository
sudo docker push {account_id}.dkr.ecr.{region}.amazonaws.com/spring-ai-conference-app-agent-bedrock-agentcore-runtime:v1

Please replace AWS {account_id} and {region} with our own values. Also, your version may not be v1 but a different one.

We can also build the Docker image by using Buildpack support built into Spring instead of a Dockerfile. Just use the Maven task spring-boot:build-image.

We don't need to make any other changes on the MCP client itself.

Let's now cover the IaC part with CDK for Java, which I implemented in RuntimeWithMCPStack stack. We've already covered many steps in creating the CDK App and Stack, and even the AgentCore Runtime with the MCP protocol in part 2. For a more detailed explanation, I refer to this article.

First, let's take a look at the creation of the AgentCore Runtime:

 Runtime.Builder.create(this, "MCPRuntime-125")
   .runtimeName(appName.replace("-", "_")+ "_runtime")
   .protocolConfiguration(ProtocolType.HTTP)
   .description("AgenCore Runtime with MCP protocol for running conference app")
      ...
   .build();

Here we set some common properties, such as the runtime name, description, and protocol (in our case, HTTP).

Now let's look at the relevant code parts to assign this code artifact to the AgentCore Runtime:

var ecrImageURI= ConventionalDefaults.
    getContextVariableValueWithReplacedAccountId(this, "ecrImageURIForConferenceSearchAndApplicationAgent");            

var agentRuntimeArtifact =    
    AgentRuntimeArtifact.fromImageUri(ecrImageURI);
   ....

Runtime.Builder.create(this, "MCPRuntime-125")
    .agentRuntimeArtifact(agentRuntimeArtifact)
    ...
    .build();

First, we get the value of the variable ecrImageURI, which points to the imageURI in the ECR we pushed previously. This is typically done in the cdk.json:

{
  "app": "mvn -e -q compile exec:java",
  "context": {
      ""ecrImageUR": "{AWS_ACCOUNT_ID}.dkr.ecr.us-east-1.amazonaws.com/spring-ai-conference-app-agent-bedrock-agentcore-runtime:v1"
 }
}

Please adjust the value so that it matches your imageURI. We use the placeholder {AWS_ACCOUNT_ID} there. The reason for it is that I don't want to expose the AWS account ID publicly. That's why I wrote the following utility method getContextVariableValueWithReplacedAccountId in the ConventionalDefaults class to replace the placeholder with the real value:

static String getContextVariableValueWithReplacedAccountId(Stack stack, String contextVariableName) {
   var awsAccountId=(String)stack.getNode().tryGetContext("awsAccountId");
   if(awsAccountId == null || awsAccountId.trim().isEmpty()) {
      System.out.println("please provide your aws account id as as content to the call, for example: cdk deploy -c awsAccountId=1234567890101");
    }
   var contextVariableValue= getContextVariableValue(stack, contextVariableName);
   return replaceAWSAccountID(contextVariableValue, awsAccountId);
 }

static String getContextVariableValue(Stack stack, String contextVariableName) {
   return (String)stack.getNode().tryGetContext(contextVariableName);
 }

private static String replaceAWSAccountID(String configParam, String awsAccountId) {
   return configParam.replace("{AWS_ACCOUNT_ID}", awsAccountId);
}

Then we create AgentRuntimeArtifact from the image URI and set it as AgentCore Runtime agentRuntimeArtifact property.

Now let's cover the next part - defining the IAM execution role. It's very difficult to automate this part as it takes plenty of time. If I find it, I'll provide the IaC part in the future :). I refer you to the article IAM Permissions for AgentCore Runtime for more information. You can also read my article Amazon Bedrock AgentCore Runtime - Part 2 Using Bedrock AgentCore Runtime Starter Toolkit with Strands Agents SDK, where I explained this part. In that article, we developed the agent in Python with the Strands Agents framework and deployed it on AgentCore Runtime.

Once we have defined the IAM role, we need to configure it in the cdk.json:

{
  "app": "mvn -e -q compile exec:java",
  "context": {
      "roleArnForTheAgentCoreRuntime": "arn:aws:iam::{AWS_ACCOUNT_ID}:role/service-role/spring-ai-conference-search-application-agentcore-runtime-role",
    ....
   }
}

We use the placeholder for the AWS account ID as explained above. Here is the relevant code to grab the value of the roleArnForTheAgentCoreRuntime variable and set it to the execution role of the Runtime from the RuntimeWithMCPStack:

var roleArnForTheAgentCoreRuntime=ConventionalDefaults
   .getContextVariableValueWithReplacedAccountId(this, "roleArnForTheAgentCoreRuntime");

var role=Role.fromRoleArn(this,"roleArnForTheAgentCoreRuntimeRole", roleArnForTheAgentCoreRuntime);

Runtime.Builder.create(this, "MCPRuntime-123")
   .runtimeName(appName.replace("-", "_")+ "_runtime")
   ...
  .executionRole(role)
  .authorizerConfiguration(RuntimeAuthorizerConfiguration.usingIAM())
  .build();

Here, we also use an IAM authorizer for the inbound AgentCore Runtime authentication. This is the default authentication and authorization mechanism that works automatically without additional configuration. You can also use JSON Web Tokens (JWT) as we showed in part 2.

Now we are ready to deploy our MCP client on the AgentCore Runtime. The command to do it is:

cdk deploy -c awsAccountId={YOUR_AWS_ACCOUINT_ID}

Here is how the AgentCore Runtime looks in the console after its creation:

We'll need the Runtime ARN, which we see in the output of this command. Or we can grab it in the service console.

Now we still need to write a client that communicates with our MCP client on the Runtime. I provided such an InvokeRuntimeAgent client written in Java, but you can use any programming language for which AWS provides a (bedrockagentcore) SDK:

private static final String AGENT_RUNTIME_ARN="arn:aws:bedrock-agentcore:us-east-1:{AWS_ACCOUNT_ID}:runtime/spring_ai_conference_search_application_runtime-143wvBghklZ";

void main() throws Exception {

 String payload =
   "{\"prompt\":\"Please provide me with the list of conferences, including their IDs, 
with the Java topic happening in 2027, with the call for papers open today. 
Also, provide me with the list of my talks with this topic in the title. 
Finally, for each conference and talk retrieved, apply individually for the conference.\"}";

  var httpClient=ApacheHttpClient.builder()
      .connectionTimeout(Duration.ofMinutes(5))
      .socketTimeout(Duration.ofMinutes(5))
      .build();

  var bedrockAgentCoreClient = BedrockAgentCoreClient.builder()
      .region(Region.US_EAST_1)
      .httpClient(httpClient)
      .build();

  var invokeAgentRuntimeRequest = InvokeAgentRuntimeRequest.builder()                 
     .agentRuntimeArn(replaceAWSAccountID(AGENT_RUNTIME_ARN))                               
     .qualifier("DEFAULT")
     .contentType("application/json")
     .payload(SdkBytes.fromUtf8String(payload)).build();
      try (var responseStream = bedrockAgentCoreClient
     .invokeAgentRuntime(invokeAgentRuntimeRequest)) {
     var text = new String(responseStream.readAllBytes(), StandardCharsets.UTF_8); 
        System.out.println(text);
}

Let's go step-by-step through it. First of all, we define RUNTIME_ARN, which we deployed in the step before. Please still use the {AWS_ACCOUNT_ID} placeholder, which will be dynamically replaced with your AWS Account ID. When we create BedrockAgentCoreClient. We also explicitly set the Apache HTTP client with the extended connection and socket timeouts. Default 30-second timeouts maybe to short for communication with the Runtime. Then we create InvokeAgentRuntimeRequest and set the agent Runtime ARN, qualifier (always DEFAULT), content type, and payload. The payload is our prompt. You can see the examples of the prompts in part 4 as we're communicating with the same MCP client, but deployed elsewhere. When we invoke the invokeAgentRuntime method on the bedrockAgentCoreClient by providing the invokeAgentRuntimeRequest and convert the agent response to a string.

Conclusion

In this article, we looked at how to deploy and run our MCP client on AgentCore Runtime. With that, our MCP client now scales nicely within the Runtime.

Of course, you can create a nicer client by providing UI for entering the prompt and providing the agent response as a result. My goal was only to demonstrate how to implement such a client. Now we can change and redeploy our MCP client based on Spring AI on the AgentCore Runtime as often as we want. The client code remains unchanged as long as the Runtime ARN remains unchanged.

Starting from the next article, we'll look at the Spring AI AgentCore functionality. Spring AI AgentCore SDK is an open-source library that brings Amazon Bedrock AgentCore capabilities into Spring AI through familiar patterns: annotations, auto-configuration, and composable advisors.

Please also check out my other series on Building AI Agents with Embabel, Spring AI, and Amazon Bedrock AgentCore.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.

Building AI Agents with Spring AI and Amazon Bedrock AgentCore - Part 4 Provide MCP tools for Conference application via AgentCore Gateway

Vadym Kazulkin — Mon, 18 May 2026 14:09:12 +0000

Introduction

In part 2, we explained how to deploy and run our conference search application on the Amazon Bedrock AgentCore Runtime as the MCP server. In this article, we'll develop the (MCP-) client, capable of talking to our application running on AgentCore Runtime. Later, in part 3, we developed the (MCP-) client, capable of talking to our application running on AgentCore Runtime. In this article, we'll look at another alternative to AgentCore Runtime to host MCP servers on AgentCore Gateway.

Update from June, 2026. After I published this article, Spring AI 2.0 became generally available. At the bottom of this article, I'll provide the required changes to make this example work with this version.

Provide the MCP Tools for the Conference application via AgentCore Gateway

Let's imagine a hypothetical situation: we not only want to search for the conferences, but also create, search, and apply for the talks for them. With this, our conference application now supports not only the attendee role but also the speaker role. This is the reason why I added functionality to support conference search by the open call for papers criteria, see part 2. This is required for conference speakers to determine whether it's still possible to apply for the conference with their talks.

When searching for conferences, we didn't have a public API, which is why we created MCP. On the other hand, for creating, searching, and applying the talks for the conferences, we indeed have a public API. Let's assume this API is hosted on the Amazon API Gateway. But it could also be any external application that exposes an OpenAPI specification. How to implement such a use case? Of course, we can use Amazon Bedrock AgentCore Gateway to securely connect our API to the AgentCore Gateway. The AgentCore Gateway can expose API functionality as MCP tools. But with this, we'll need to authenticate and hold the connection to multiple sources: AgentCore Runtime and Gateway. Without a centralized approach, customers face significant challenges: discovering and sharing tools across organizations becomes fragmented, managing authentication across multiple MCP servers grows increasingly complex, and maintaining separate gateway instances for each server quickly becomes unmanageable.

The centralized approach, which exposes all the tools from the central (MCP server) endpoint, would be a much better solution for our use case. Luckily, AgentCore Gateway helps to solve these challenges by treating existing MCP servers as native targets. This gives us a single point of control for routing, authentication, and tool management. It makes it as simple to integrate MCP servers as to add other targets to the gateway. AgentCore made it possible by supporting multiple targets. Those are, as of now: OpenAPI, Smithy, Amazon API Gateway, AWS Lambda, MCP Servers, and Integrations:

Conference Talks and Applications Demo

For creating, searching, and applying the talks for the conferences, I implemented a small conference-talks-and-applications-demo:

I currently don't use any database to store the talks and conference applications for simplicity reasons. My goal is only to demonstrate the approach.

I maintain a static list of the talks in the GetConferenceTalksByTitleSubstring class. The search consists of looking for the provided substring of the title.
When creating a new talk, I generate its random ID between 1 and 100 in the CreateConferenceTalk class and return the talk with ID, title, and description.
When applying for a talk for a specific conference, I simply acknowledge that the application is created in the CreateConferenceTalk class.

I prefer to use AWS SAM as IaC for pure Serverless applications. Unfortunately, AWS SAM doesn't provide any IaC for Amazon Bedrock AgentCore yet. Also, SAM has some limitations, as it's, for example, not possible to create the response codes for each API. And those response codes are required by the OpenAPI specification to be present. That's why I created OpenAPI spec on my own for it. We can refer to this specification when defining the API like this:

MyApi:
  Type: AWS::Serverless::Api
  Properties:
    StageName: !Ref Stage
    DefinitionBody:
        Fn::Transform
           Name: AWS::Include
           Parameters:
             Location: ConferenceTalksAndApplicationsAppAPI-OpenAPISpec.yaml

We also secured our API with an API key, whose value is by definition passed as the HTTP header parameter "x-api-key". This will play a role when we configure the outbound authentication of the AgentCore Gateway API Gateway target:

MyApiKey: 
  Type: AWS::ApiGateway::ApiKey
  ....
  Properties: 
    Name: "ConferenceTalksAndApplicationsAppAPIKey"
    Description: "ConferenceTalksAndApplicationsApp API Key"
    Enabled: true
    GenerateDistinctId: false
    Value: a6ZbcDgjkQW10BN56ASR25
    ...

We also defined an API stage with the name prod. Now, we can deploy this application by executing sam deploy -g, and we will see the individual URL in the response. For example, https://k370s19lk3.execute-api.us-east-1.amazonaws.com/prod. We'll need the REST API ID, which in our case is k370s19lk3, later when creating the IaC for the AgentCore Gateway.

Create AgentCore Gateway with different targets

In part 2, we started to create the IaC for the Conference (Search) application. It consisted mainly of the AgentCore Runtime with the MCP protocol and everything needed for that, like the Cognito User (Client) Pool. We used CDK for Java for it. We'll now call this application the Conference application, as we are extending its functionality beyond the search. Our goal is now to create AgentCore Gateway with 2 targets:

existing AgentCore Runtime with MCP protocol for the conference search (MCP) tools
conference talks and applications demo deployed on Amazon Gateway API to expose all its APIs as (MCP) tools.

You can find the full source code in the GatewayTargetStack class.

Let's go step-by-step through it. We first create the AgentCore Gateway itself:

var gateway= Gateway.Builder.create(this, "Gateway-123")
      .gatewayName(appName.replace("_", "-")+ "-gateway")
      .authorizerConfiguration(CustomJwtAuthorizer.Builder
        .create().allowedClients(
          List.of(UserClientPoolStack.
               userPoolClient.getUserPoolClientId()))
      .discoveryUrl(UserClientPoolStack.COGNITO_DISCOVERY_URL).build())
            .role(RuntimeWithMCPStack.role)
            .description("AgenCore Runtime with MCP protocol for running conference search app")
           .build();

The most interesting part is configuring the custom JWT authorizer as an inbound authentication. Here we reuse the Cognito User (Client) Pool created in part 2. We set the same user client pool ID and discovery URL. We also reuse the same AWS IAM role that we used to create AgentCore Runtime in part 2. Please also read the Getting started with Policy in AgentCore in addition to the resources from part 2 on how to create one.

Now, let's create the AgentCore Gateway target of our MCP Server running on AgentCore Runtime:

GatewayTarget.Builder.create(this, "MCP-Target-123")           
     .targetConfiguration(McpServerTargetConfiguration.create(endpoint))         
     .credentialProviderConfigurations(oauthCredentialProviderConfigs)
         .gatewayTargetName("mcp-target")
         .description("AgentCore Runtime MCP Server Target ")
         .gateway(gateway)
         .build();

We set McpServerTargetConfiguration, which defines that the Gateway target is the MCP Server running on AgentCore Runtime. Also, we set the target name and description, and provide the AgentCore Gateway to which this target belongs. We need to set the endpoint URL, which always follows the same schema:

var endpoint="https://bedrock-agentcore."+region + 
        ".amazonaws.com/runtimes/" +
        RuntimeWithMCPStack.runtime.getAgentRuntimeId()+
       "/invocations? 
       qualifier=DEFAULT&accountId="+Stack.of(this).getAccount();

We obtain the runtime ID property from the created AgentCore Runtime in the RuntimeWithMCPStack stack. The next part is to configure the outbound authentication. This means configuring how the AgentCore Gateway MCP target authenticates with the AgentCore Runtime with the MCP protocol. For this, we need to use AgentCore Identity.
As described in the following issue, it's currently not possible to create the AgentCore Identity with CloudFormation. That's why CDK also can't provide this functionality. That's why we need to create it manually and then provide the configuration for this stack. Let's secure it with the existing OAuth Client. Let's go to AgentCore Identity and click on "Add Outbound Auth" -> "Add OAuth Client". Then select "Custom Provider" -> "Discovery URL" :

We can reuse the Cognito User Pool Client ID, Client Secret, and Discovery URL from part 2.

After we created the AgentCore Identity, let's grab its ARN:

The Client Secret will be automatically stored as a Secret in the AWS Secrets Manager. Let's also grab the Secret ARN:

Now, let's configure both in the cdk.json :

{
  "app": "mvn -e -q compile exec:java",
  "context": {
      "agentcoreIdentityOutboundOAuthArn": "arn:aws:bedrock-agentcore:us-east-1:{AWS_ACCOUNT_ID}:token-vault/default/oauth2credentialprovider/resource-provider-oauth-gateway",
      "oAuthSecretArn": "arn:aws:secretsmanager:us-east-1:{AWS_ACCOUNT_ID}:secret:bedrock-agentcore-identity!default/oauth2/resource-provider-oauth-gateway-ba3b089d-toYfaV",
  ....
   }
}

Please replace both values with your individual ARNs. I explained in part 2 how we handle the AWS Account ID. Now, let's create and configure the credential provider:

// CloudFormation, see the issue https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/2391
  var oAuthProviderArn = ConventionalDefaults.getContextVariableValueWithReplacedAccountId(this, "agentcoreIdentityOutboundOAuthArn");
  var oAuthSecretArn = ConventionalDefaults.getContextVariableValueWithReplacedAccountId(this, "oAuthSecretArn");

  var oauthCredentialProviderConfigs = List.of(GatewayCredentialProvider
      .fromOauthIdentityArn(OAuthConfiguration.builder()
          .providerArn(oAuthProviderArn)
          .secretArn(oAuthSecretArn)
          .scopes(List.of())
          .build()));

  GatewayTarget.Builder.create(this, "MCP-Target-123")           
  .credentialProviderConfigurations(oauthCredentialProviderConfigs)
  ...
 .build();

We grab the AgentCore Identity and Secret ARNs and use them to create an OAuth Credential Provider. We then set it when creating the AgentCore Target credential provider configuration.

Now we are done with creating the AgentCore MCP Target. The next step is to create an Amazon API Gateway target. Please also read the article AgentCore Gateway Amazon API Gateway stages to gain an understanding of how AgentCore Gateway obtains the OpenAPI spec from the Amazon API Gateway stage.

First of all, let's define the API stage name in the cdk.json:

{
  "app": "mvn -e -q compile exec:java",
  "context": {
      "restApiStageName": "prod"
   }
}

We'll pass the restApiId via the console parameter. We created it above when we deployed the conference talks and applications demo. Similar to AWS Account ID, which is public, we don't want to configure it in cdk.json:

  var restApiId=(String)this.getNode().tryGetContext("restApiId");

  var restApiStageName=ConventionalDefaults.getContextVariableValue(this, "restApiStageName");

  GatewayTarget.Builder.create(this, "APIGATEWAY-Target-123")         
    .targetConfiguration((ApiGatewayTargetConfiguration.Builder.create()
    .restApi(RestApi.fromRestApiId(this, "APIGATEWAY-ID", restApiId))
         .stage(restApiStageName).build()))
            ...
           .gatewayTargetName("apigateway-target")
           .description("Amazon ApiGateway Target ")
           .gateway(gateway)
           .build();

Here, we create the AgentCore Gateway Target as an Amazon API Gateway Target, set the target name and description. We also provide the REST API ID, stage, and AgentCore Gateway to which this target belongs.

We can define the tool filters. With that, we can shrink what Amazon API Gateway APIs will be exposed as MCP tools:

GatewayTarget.Builder.create(this, "APIGATEWAY-Target-123")           
  .targetConfiguration((ApiGatewayTargetConfiguration.Builder.create()
     .apiGatewayToolConfiguration(ApiGatewayToolConfiguration.builder()
       .toolFilters(List.of(
        ApiGatewayToolFilter.builder()
            .filterPath("/talks/{titleSubstring}")                                
                .methods(List.of(ApiGatewayHttpMethod.GET))                 
                .build(),
        ApiGatewayToolFilter.builder()
                .filterPath("/apply")
                .methods(List.of(ApiGatewayHttpMethod.POST))
                .build(),
        ApiGatewayToolFilter.builder()
                .filterPath("/talks")                    
                .methods(List.of(ApiGatewayHttpMethod.POST))
                .build()))

In our example, we expose all 3 APIs (/apply, /talks, //talks/{titleSubstring}) as MCP tools.

Next, let's use the tool override to give the MCP tools the proper names and descriptions:

GatewayTarget.Builder.create(this, "APIGATEWAY-Target-123")           
  .targetConfiguration((ApiGatewayTargetConfiguration.Builder.create()
     .apiGatewayToolConfiguration(ApiGatewayToolConfiguration.builder()
      .toolOverrides(List.of(
          ApiGatewayToolOverride.builder()
            .method(ApiGatewayHttpMethod.POST)
            .name("apply-to-conferences-w-conference-id-talk-id")
            .path("/apply")
            .description("apply to the conference with conference Id and talk Id")
            .build(), 
         ApiGatewayToolOverride.builder()
           .method(ApiGatewayHttpMethod.POST)
           .name("create-new-talk")
           .path("/talks")
           .description("create a new talk with talk Id, title and description")
           .build(),                    
         ApiGatewayToolOverride.builder()
           .method(ApiGatewayHttpMethod.GET)
           .name("get-talks-by-title-substring")
           .path("/talks/{titleSubstring}")
           .description("get talks by their title substring")
           .build()))

With that, the LLM can easily find the right tool for the job.

The last part is to define how AgentCore Gateway handles the outbound authentication to the Amazon API Gateway. As described above and in the following issue, it's currently not possible to create the AgentCore Identity with CloudFormation. That's why CDK also can't provide this functionality. That's why we need to create it manually and then provide the configuration for this stack. Let's secure this Target with the API Key, as it is how we secured our Amazon Gateway API. Let's go to AgentCore Identity and click on "Add Outbound Auth" -> "Add API Key" :

Please use the same API Key that we used to secure our API. We defined it in the SAM template.

After we created the AgentCore Identity, let's grab its ARN:

The Client Secret will be automatically stored as a Secret in the AWS Secrets Manager. Let's also grab the Secret ARN:

Now, let's configure both in the cdk.json:

{
  "app": "mvn -e -q compile exec:java",
  "context": {
      "agentcoreIdentityOutboundApiKeyArn": "arn:aws:bedrock-agentcore:us-east-1:{AWS_ACCOUNT_ID}:token-vault/default/apikeycredentialprovider/resource-provider-api-key-gateway",
      "apiKeySecretArn": "arn:aws:secretsmanager:us-east-1:{AWS_ACCOUNT_ID}:secret:bedrock-agentcore-identity!default/apikey/resource-provider-api-key-gateway-02d581b0-L9scmD",  ....
   }
}

Please replace both values with your individual ARNs. I explained in part 2 how we handle the AWS Account ID. Now, let's create and configure the credential provider:

var apiKeyProviderArn = ConventionalDefaults.getContextVariableValueWithReplacedAccountId(this, "agentcoreIdentityOutboundApiKeyArn");

var apiKeySecretArn = ConventionalDefaults.getContextVariableValueWithReplacedAccountId(this, "apiKeySecretArn");

var apiKeyProviderConfigs = List.of(GatewayCredentialProvider          
     .fromApiKeyIdentityArn(ApiKeyCredentialProviderProps.builder()
               .providerArn(apiKeyProviderArn)
               .secretArn(apiKeySecretArn)
               .credentialLocation(ApiKeyCredentialLocation                    
                   .header(ApiKeyAdditionalConfiguration.builder()
                     .credentialParameterName("x-api-key")
                     .credentialPrefix(" ")
                     .build()))
               .build()));

GatewayTarget.Builder.create(this, "APIGATEWAY-Target-123")           
  .targetConfiguration((ApiGatewayTargetConfiguration.Builder.create()
  ...
  .credentialProviderConfigurations(apiKeyProviderConfigs)
  ...
  build();

We grab the AgentCore Identity and Secret ARNs and use them to create an API Key Credential Provider. Then we define to set the credentials within the HTTP header with the name x-api-key. This is how we secured the Amazon API Gateway. Another option that AgentCore Gateway supports is to set them as query parameters. We then set them when creating the AgentCore Target credential provider configuration.

To deploy the AgentCore Gateway, please invoke cdk deploy spring-ai-conference-search-agentcore-gateway-with-mcp-server-target-stack -c awsAccountId={YOUR_AWS_ACCOUNT_ID} -c restApiId={YOUR_API_ID}:

After having successfully executed the AgentCore Gateway deployment, we'll see our Gateway in the console:

We need to grab the Gateway URL, which ends with /mcp. We also see both Gateway targets we created:

This AgentCore Gateway exposes 7 MCP tools in total:

4 tools for the conference search provided by the MCP server from part 2 and deployed on AgentCore Runtime.
3 tools to create a talk, search for existing talks, and apply for the conference with the talk. These 3 tools are provided through the Amazon API Gateway we deployed in this article.

Now, let's extend our Conference Application MCP client that we developed in part 3, so it can use this AgentCore Gateway MCP endpoint.

The important remaining topic is designing the IAM role and permissions so that AgentCore Gateway can handle inbound and outbound authentication and communicate with the Amazon API Gateway. I'll refer you to the articles, which cover those topics:

Extend our local Conference Application MCP client

In part 3, we developed a generic local MCP client capable of talking to each MCP server. I decided to extend it to be able to configure the AgentCore Gateway endpoint. This gives us the following options:

by configuring the amazon.bedrock.agentcore.runtime.id property in the application.properties to be not a blank string, we'll still connect to the MCP server running on AgentCore Runtime. It exposes only 4 MCP tools for the conference search.
by configuring the amazon.bedrock.agentcore.gateway.url property in the application.properties to be not a blank string, we'll connect to the AgentCore Gateway created previously, which exposes all 7 MCP tools. This is how we'll use it to show what is possible with that. Please make sure that amazon.bedrock.agentcore.runtime.id= is set to an empty string.
by configuring both properties, amazon.bedrock.agentcore.runtime.id takes precedence. This is how I implemented the logic in the SpringAIAgentController class:

private String getMCPServerEndpoint() {
   if(!AGENTCORE_RUNTIME_ID.isBlank()) {
    return "https://bedrock-agentcore." + awsRegion + ".amazonaws.com/runtimes/"
       + AGENTCORE_RUNTIME_ID + "/invocations?qualifier=DEFAULT&accountId=" + this.getAccountId();
    } else if (!AGENTCORE_GATEWAY_URL.isBlank()) {
       return AGENTCORE_GATEWAY_URL;
    } else throw new RuntimeException(" no AgentCore Runtime Id or AgentCore Gateway URL defined");
}

You can change this logic if you wish.

Now we can use CURL or HTTPie to send some prompts. For example:

Here is an example of the request with HTTPie:

http GET http://localhost:8080/conference?prompt="Please provide me with the list of conferences, including their IDs, with Java topics happening in 2027, with the call for papers open today. Also, provide me with the list of my talks with this topic in the title. Finally, for each conference and talk retrieved, apply individually for the conference." Content-Type:text/plain.

Here is the correct LLM response:

Let's try another prompt:

http GET http://localhost:8080/conference?prompt="Please create a talk with a cool title (max 60 characters long) and description (max 300 characters long) about using Spring AI on the Amazon Bedrock AgentCore service. Then provide me with the list of conferences, including their IDs, with Java topics happening in 2026 and 2027, with the call for papers open today. Finally, for each conference, apply individually for it with the talk just created." Content-Type:text/plain.

Here is the correct LLM response again:

Cool, we created AgentCore Gateway, which gives us centralized access to the MCP tools that we need or the agent needs to accomplish the goal.

Conclusion

In this article, we looked at how to provide the MCP Tools for the Conference application via AgentCore Gateway in a centralized way.

As we saw in this and previous articles, the local MCP client for the Conference application, to talk to AgentCore Runtime or Gateway, became quite big. If we have many customers using such a client, changing and operating it can become quite challenging. That's why, in the next article, we look at how to deploy and run our MCP client on AgentCore Runtime.

Update to Spring AI 2.0

After I published this article, Spring AI 2.0 became generally available. I also used the opportunity to update the example to use Spring Boot version 4.1. You can find the working example in my spring-ai-2.0-conference-app-agent-local.

I have noticed several major differences in the implementation of the MCP local client in the SpringAIAgentController controller.

The first one is that ChatClient now requires passing the ChatOptions.Builder object to the defaultOptions method instead of the ChatOptions object itself:

var options = ToolCallingChatOptions.builder()
        .model("us.anthropic.claude-sonnet-4-6")
        .maxTokens(2000);

this.chatClient = builder.defaultOptions(options)
        ...
        .build();

private McpClientTransport getMcpClientTransport(String token) {

 var mcpServerConfig= this.getMCPServerConfig();
 var headerValue = "Bearer " + token;

 var httpRequestBuilder = HttpRequest.newBuilder()
     .header("Authorization", headerValue);

 return HttpClientStreamableHttpTransport.builder(mcpServerConfig.baseUrl)
     .connectTimeout(Duration.ofMinutes(3))
     .endpoint(mcpServerConfig.endpoint)        
     .requestBuilder(httpRequestBuilder)
     .build();
}

It also requires splitting the MCP endpoint URL into 2 parts: base URL (domain) and endpoint itself (/mcp), which we did in the application.properties:

amazon.bedrock.agentcore.gateway.base.url=https://spring-ai-conference-search-agentcore-gateway-xizwpytsgm.gateway.bedrock-agentcore.us-east-1.amazonaws.com
amazon.bedrock.agentcore.gateway.endpoint=/mcp

Lastly, Spring AI 2.0 introduced some changes to how to use the MCP tools. This is how the code looked in the previous Spring AI 1.x versions:

return this.chatClient.prompt().user(prompt)
   .tools(new DateTimeTools())
   .toolCallbacks(asyncMcpToolCallbackProvider.getToolCallbacks())
   .stream().content();

The code in Spring AI 2.0 uses the tools method, capable of accepting the local tools as well as tool callbacks as its parameters:

return this.chatClient.prompt().user(prompt)
    .tools(new DateTimeTools(),syncMcpToolCallbackProvider.getToolCallbacks())
    .stream().content();

Also, we need to additionally define the ToolCallingManager Spring bean in the main SpringAIConferenceLocalMCPClient class:

@Bean ToolCallingManager toolCallingManager() {
   return ToolCallingManager.builder().build();
}

Everything else remains the same.

Please also check out my other series on Building AI Agents with Embabel, Spring AI, and Amazon Bedrock AgentCore.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.