DEV Community: Vadym Kazulkin

Building AI Agents with Spring AI and Amazon Bedrock AgentCore - Part 9 Configure AgentCore Observability

Vadym Kazulkin — Mon, 13 Jul 2026 12:03:51 +0000

Introduction

In part 6, we introduced our sample application spring-ai-2.0-ac-conference-app-agent-bedrock-agentcore-runtime using Spring AI AgentCore. Later, in parts 7 and 8, we added AgentCore short- and long-term Memory, respectively, using Spring AI AgentCore Memory.

In this part of the series, we'll explore how to configure AgentCore Observability. I've already covered this topic in my other article series when we used the Strands Agents SDK. I refer to my following articles:

Even though the CloudWatch Generative AI Observability service UI now looks different and has more capabilities, CloudWatch Logging and Monitoring configuration looks the same for our application and is provided out of the box. For the CloudWatch metrics, please review the article Amazon Bedrock AgentCore generated observability data for the current state of the exposed metrics. Also, make sure to enable Log delivery for Application and Usage Logs and Tracing for all AgentCore Services involved. In our case, these are:

Runtime (2 of them, as we host the MCP server and the Agent there)
Gateway
Memory (both short- and long-term).
Identity (please make sure to do so for the Runtime and Gateway Identity)

Enabling AgentCore Tracing

If we follow the steps described above and enable tracing for all AgentCore services in use, we'll only see the basic AgentCore metrics, but completely miss Sessions and Traces. The reason for this is that we provided the examples using the Strands Agents SDK. It works well with AgentCore Observability (baked by CloudWatch Generative AI Observability). We only had to add the dependency to aws-opentelemetry-distro and instrument our code, as shown below in the Dockerfile. Strands Agent has all the information on where to send the metrics and traces to the default OTEL provider, AWS CloudWatch. But how does it work for Java applications based on Spring AI and hosted on AgentCore Runtime?

To view the metrics in CloudWatch Generative AI observability, we need to add the AWS Distro for OpenTelemetry (ADOT) SDK to our agent code. ADOT is a secure, production-ready, AWS-supported distribution of the OpenTelemetry project. Part of the Cloud Native Computing Foundation, OpenTelemetry provides open source APIs, libraries, and agents to collect distributed traces and metrics for application monitoring. With ADOT, we can instrument our applications just once to send correlated metrics and traces to multiple AWS and Partner monitoring solutions. In our case, we will send the metrics to the CloudWatch GenAI Observability service.

AWS offers AWS Distro for OpenTelemetry Java with the AWS Distro for OpenTelemetry (ADOT). To get started, see the AWS Distro for OpenTelemetry Java documentation. Let's add it to our sample application. To do so, we need to modify the Dockerfile of our sample application. We first have to download the aws-opentelemetry-agent and then run it as the Java agent to instrument the code on the fly:

ADD https://github.com/aws-observability/aws-otel-java-instrumentation/releases/latest/download/aws-opentelemetry-agent.jar /opt/aws-opentelemetry-agent.jar

ENV JAVA_TOOL_OPTIONS=-javaagent:/opt/aws-opentelemetry-agent.jar

The documentation also says that the second component is required to receive the metrics and traces: the AWS Distro for OpenTelemetry Collector. In all the examples AWS provides, the collector is a sidecar application deployed with Docker Compose. Unfortunately, it's not possible to use Docker Compose for the AgentCore Runtime. We only provide the reference to the image in the Amazon Elastic Container Registry (ECR) repository that the AgentCore Runtime pulls and runs for us.

It took me a while to figure out how to achieve this, and I even created the issue for it. There is a so-called collector-less Observability for the Amazon Bedrock AgentCore resources. As of now, unfortunately, not all parameters to be configured are described in this article. But I combined this information with the article Exporting collector-less telemetry using AWS Distro for OpenTelemetry (ADOT) SDK to achieve the goal:

ADD https://github.com/aws-observability/aws-otel-java-instrumentation/releases/latest/download/aws-opentelemetry-agent.jar /opt/aws-opentelemetry-agent.jar

ENV JAVA_TOOL_OPTIONS=-javaagent:/opt/aws-opentelemetry-agent.jar \
AGENT_OBSERVABILITY_ENABLED=true \
OTEL_RESOURCE_ATTRIBUTES=spring_ai_ac_conference_application_runtime,aws.log.group.names=
/aws/bedrock-agentcore/runtimes/spring_ai_ac_conference_application_runtime-a00QWV3i7t \
OTEL_EXPORTER_OTLP_LOGS_HEADERS=x-aws-log-group=/aws/bedrock-agentcore/runtimes/spring_ai_ac_conference_application_runtime-a00QWV3i7t,x-aws-log-stream=runtime-logs,x-aws-metric-namespace=bedrock-agentcore \
OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf \
OTEL_EXPORTER_OTLP_TRACES_PROTOCOL=http/protobuf \
OTEL_TRACES_EXPORTER=otlp \
OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=https://xray.us-east-1.amazonaws.com/v1/traces \
OTEL_EXPORTER_OTLP_LOGS_PROTOCOL=http/protobuf \
OTEL_LOGS_EXPORTER=otlp \
OTEL_EXPORTER_OTLP_LOGS_ENDPOINT=https://logs.us-east-1.amazonaws.com/v1/logs

Besides the already described steps to download the aws-opentelemetry-agent and run it as the Java agent to instrument the code, we configured the following:

AGENT_OBSERVABILITY_ENABLED=true to indicate that we use Agent Observability and would like to view the traces in the CloudWatch Generative AI Observability and not in X-Ray.
OTEL_EXPORTER_OTLP_PROTOCOL, OTEL_EXPORTER_OTLP_TRACES_PROTOCOL, and OTEL_EXPORTER_OTLP_LOGS_PROTOCOL to all be http/protobuf.
OTEL_EXPORTER_OTLP_TRACES_ENDPOINT and OTEL_EXPORTER_OTLP_LOGS_ENDPOINT as regional endpoints for traces and logs. If you deploy your application in another region other than us-east-1, you need to adjust the URL.
OTEL_RESOURCE_ATTRIBUTES to be service.name=spring_ai_ac_conference_application_runtime,aws.log.group.names=/aws/bedrock-agentcore/runtimes/spring_ai_ac_conference_application_runtime-a00QWV3i7t. Please adjust service.name value to how you named the service in AgentCore Runtime. I called it spring_ai_ac_conference_application_runtime. For the suffix of the aws.log.group.names use your AgentCore Runtime ID (in my case spring_ai_ac_conference_application_runtime-a00QWV3i7t). AWS Log Group Name for AgentCore Runtime always follows the pattern: /aws/bedrock-agentcore/runtimes/{RUNTIME_ID}.
OTEL_EXPORTER_OTLP_LOGS_HEADERS to be x-aws-log-group=/aws/bedrock-agentcore/runtimes/spring_ai_ac_conference_application_runtime-a00QWV3i7t,x-aws-log-stream=runtime-logs,x-aws-metric-namespace=bedrock-agentcore. The same as above: for the suffix of the x-aws-log-group use your AgentCore Runtime ID again.

Then, after rebuilding and redeploying the application, we can see similar metrics and traces as provided in the articles using Strands Agents SDK above. There are, of course, some differences in the collected metadata. This is because we use the AWS OpenTelemetry Agent distribution for Java and not for Python, as in the articles above. Here are some selected screenshots taken from the CloudWatch GenAI Observability: Bedrock AgentCore Observability for the prompt "Please provide me with the list of conferences, including their IDs, with the Java topic happening in 2027, with the call for papers open today. Also, provide me with the list of my talks with this topic in the title. Finally, for each conference and talk retrieved, apply individually for the conference.", which I sent :

All sessions view:

All traces view:

All spans view:

Session ID view:

Tree view of the Trace ID:

Trajectory view of the Trace ID:

Timeline view of the Trace ID:

This is how to enable observability for Amazon Bedrock AgentCore Runtime hosted agents. If you don't host your application on AgentCore, you can still use CloudWatch to enable observability for non-Amazon Bedrock AgentCore-hosted agents.

Conclusion

In this article, we described how to configure AgentCore Observability in a collector-less way. This involves running the Java aws-opentelemetry-agent agent to instrument the code and set a bunch of environment variables in the Dockerfile. Please also make sure you have activated logging and tracing for both AgentCore Gateway and Runtime.

In the next article, we'll explore how to configure the same AgentCore observability with the help of spring-ai-agentcore-otel-extension.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.

Building AI Agents with Spring AI and Amazon Bedrock AgentCore - Part 8 Use Spring AI AgentCore long-term Memory for MCP client on AgentCore Runtime

Vadym Kazulkin — Mon, 06 Jul 2026 14:07:04 +0000

Introduction

In part 7, we explained how to add and use AgentCore short-term Memory to our application with the help of Spring AI AgentCore Memory. In this article, we'll use AgentCore long-term Memory instead.

We'll once again build on the spring-ai-2.0-ac-conference-app-agent-bedrock-agentcore-runtime sample application, which we introduced in part 6. Please review part 7 to better understand the base concept of Spring AI AgentCore Memory and how to add it to our application.

Create Bedrock AgentCore long-term Memory

I've written the article Amazon Bedrock AgentCore Runtime - Part 7 Using AgentCore long-term Memory with Strands Agents SDK about what AgentCore long-term Memory is and how to create one with the Python SDK. Also provided an example of how to use it with Strands Agent SDK. I refer to this article to understand the basics.

To run examples, we've already deployed our sample application on AgentCore Runtime by executing the RuntimeWithMCPStack stack in part 6. Next, let's create AgentCore long-term Memory with CDK for Java by executing the LongTermMemoryStack stack. First, let's look at what is happening there:

public class LongTermMemoryStack extends Stack {

 public LongTermMemoryStack(Construct scope, String appName,  StackProps stackProps) {
    super(scope, id, stackProps);   
    var memory = Memory.Builder.create(this, "long-term-memory")
    .memoryName("long_term_memory_for_conference_application")
    .description("Long-Term Memory for Conference Application")
    .expirationDuration(Duration.days(7))
    .memoryStrategies(List.of(MemoryStrategy.usingBuiltInSummarization(),
                      MemoryStrategy.usingBuiltInSemantic()))
    .build();                 

    CfnOutput.Builder.create(this, "LongTermMemoryIdOutput").value(memory.getMemoryId()).build();           
    }  
}

We use Bedrock AgentCore Memory.Builder to set the memory name, description, expiration duration, and then create the memory. By defining the memory strategies, we outline that we'll create the AgentCore long-term memory. We used the semantic and summarization built-in memory strategies. You can also set the currently supported user preference and episodic memory strategies instead. The MemoryStrategy class offers usingBuiltInUserPreference and usingBuiltInEpisodic methods for this purpose. You can also configure the Custom Memory Strategy.

You can deploy the stack with the command: cdk deploy spring-ai-ac-conference-application-lt-memory-stack -c awsAccountId={YOUR_AWS_ACCOUNT_ID}.

This is how the created long-term memory looks in the AgentCore Memory UI:

And this is how the default namespaces look:

If you're not satisfied with the built-in configuration, for example, default namespaces, you can set your own. Here is an example of how to create a semantic memory strategy:

 MemoryStrategy.usingSemantic(ManagedStrategyProps.builder()
     .name("name")
     .namespaces(List.of("namespace1", "namespace2"))
     .build());

Other memory strategies work the same; just use the corresponding using* method. But I always start with the built-in memory strategies.

Also, the Memory ID will be printed out, which we will need to configure in our Spring AI application. We can find the same Memory ID in the service UI above.

Finally, we need to configure the following IAM permissions to allow our application running on AgentCoreRuntime to access this AgentCore Memory:

{
 "Sid": "BedrockAgentCoreLongTermMemory",
   "Effect": "Allow",
   "Action": [
       "bedrock-agentcore:ListEvents",
       "bedrock-agentcore:CreateEvent",
       "bedrock-agentcore:RetrieveMemoryRecords",
       "bedrock-agentcore:GetMemory"
      ],
   "Resource": [
         "arn:aws:bedrock-agentcore:{YOUR_AWS_REGION}:{YOUR_AWS_ACCOUNT_ID}:memory/{YOUR_LONG_TERM_MEMORY_ID}"
      ]
}

Configure Bedrock AgentCore long-term Memory in our sample application

To configure Bedrock AgentCore long-term Memory in our sample application, we need to make some changes to it. First, we need to configure some long-term memory-related properties in the application.properties:

agentcore.memory.memory-id={YOUR_LONG_TERM_MEMORY_ID}
agentcore.memory.long-term.auto-discovery=true

The first required property is the AgentCore Memory ID we just created. By setting agentcore.memory.long-term.auto-discovery to true, we use the recommended AgentCore long-term Memory autodiscovery option.

Autodiscovery behavior is:

Queries AWS to discover all strategies configured in your memory
Creates advisors only for supported types: SEMANTIC, SUMMARIZATION, USER_PREFERENCE, EPISODIC
Skips CUSTOM strategy types (not supported by autodiscovery)
Uses the first namespace if a strategy has multiple namespaces
Uses default topK values for each strategy type

We can also override the specific settings for discovered strategies by providing explicit configuration. See the link above to find out how to do this. Another option is to use the AgentCore long-term Memory explicit configuration option, in which we need to specify each strategy manually.

Next, we need to ensure that we set ChatMemory to the ChatClient in the SpringAIAgentController. I'll provide the generic constructor, capable of dealing with no AgentCore Memory configured or short-term or long-term memory configured:

public SpringAIAgentController(ChatClient.Builder builder, 
ChatMemory chatMemory, List<AgentCoreLongTermMemoryAdvisor> ltmAdvisors) {
   var options = ToolCallingChatOptions.builder()
      .model("us.anthropic.claude-sonnet-4-6")
      .maxTokens(2000);

   this.chatClient = builder.defaultOptions(options)      
           .defaultAdvisors(this.getAllMemoryAdvisors(chatMemory, ltmAdvisors))
         .build())
         .build();          
....
}

private List<Advisor> getAllMemoryAdvisors(ChatMemory chatMemory, List<AgentCoreLongTermMemoryAdvisor> ltmAdvisors) { 
   Advisor chatMemoryAdvisor= MessageChatMemoryAdvisor.builder(chatMemory).build();
   var cltmAdvisors=(List<Advisor>)(List<?>) ltmAdvisors;  
   var allAdvisors=new ArrayList<Advisor>();
   allAdvisors.addAll(cltmAdvisors);
   if(chatMemoryAdvisor!=null) {
      allAdvisors.add(chatMemoryAdvisor);
   }
   return allAdvisors;
}

Short-term Spring AI AgentCore Memory implements the Spring AI ChatMemoryRepository interface. This doesn't work for long-term Spring AI AgentCore Memory. For this, we inject the list of AgentCoreLongTermMemoryAdvisor. Then we use the Advisors API to build the complete list of Advisors in the getAllMemoryAdvisors method. We use MessageChatMemoryAdvisor with the ChatMemory to build the short-term memory advisor, and then we add the long-term advisors to the list. We then provide this complete list of memory advisors as an input to the defaultAdvisors method of the ChatClient.Builder. Even if we don't configure the AgentCore short-term or long-term Memory (or both), the same code still works without throwing any exceptions. MessageChatMemoryAdvisor, and List of AgentCoreLongTermMemoryAdvisors or both will be null in such a case, which Spring AI treats the same way as not setting any advisors. That's all the changes we need to make to our application to use the AgentCore long-term memory.

The last step is exactly the same as for the short-term memory: to include a custom ChatMemory Conversation ID in the ChatClient. According to the documentation, ChatMemory.CONVERSATION_ID parameter is required for all memory advisors. Calls that omit this parameter will throw an IllegalArgumentException at runtime, as there is no default conversation ID.
The Spring AI AgentCore long-term Memory supports flexible conversation ID formats:

Simple: user123 → actor: user123, session: default-session
With Session: user123:session456 → actor: user123, session: session456

This is how the code looks for it in the SpringAIAgentController:

private final String CONVERSATION_ID="default-actor-id-12345678:default-session-id-12345678";

@AgentCoreInvocation
public Flux<String> invoceAsync(PromptRequest promptRequest, AgentCoreContext agentCoreContext) {
    var token = getAuthTokenViaHttpClient();
    ...
    var client = McpClient.async(getMcpClientTransport(token)).build();
    client.initialize();

    var asyncMcpToolCallbackProvider = AsyncMcpToolCallbackProvider.builder()
      .mcpClients(client)
  ...


    var content = this.chatClient.prompt()
       .user(promptRequest.prompt())
       .advisors(a -> a.param(ChatMemory.CONVERSATION_ID, CONVERSATION_ID))
       .tools(new DateTimeTools(),asyncMcpToolCallbackProvider.getToolCallbacks()).stream()
       .content();

As shown above, we defined a static CONVERSATION_ID. However, if you'd like to use individual IDs depending on the actor or user providing the prompt, you can add the login functionality and set the individual user ID. Finally, we set the value of the conversation ID as the parameter of the memory advisor.

Then we need to rebuild the Docker image of our application and deploy it to the Amazon ECR. After it, we need to configure the correct ecrImageURI in the cdk.json. We covered those concepts in parts 2 and 4.

Finally, we need to redeploy the AgentCore Runtime stack with the command: cdk deploy spring-ai-ac-conference-application-agentcore-runtime-stack -c awsAccountId={YOUR_AWS_ACCOUNT_ID}.

Now, we can use the InvokeRuntimeAgent class to send prompts to our agent running on AgentCore Runtime. We described this in part 5 and can reuse these prompts to apply the talks to the conferences.

But now, similarly to the example of the short-term memory in part 7, we can ask such questions as: "You recently applied for some conferences for me. Can you provide me with the details?" The agent will give us a reply, which shows that it provided the answer using the AgentCore long-term Memory:

The reply is very similar to one provided in part 7 for the long-term memory.

Conclusion

In this article, we explained how to add and use AgentCore long-term Memory to our application with the help of Spring AI AgentCore Memory. In the next article, we'll add AgentCore Observability to our application.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.

Building AI Agents with Spring AI and Amazon Bedrock AgentCore - Part 7 Use Spring AI AgentCore short-term Memory for MCP client on AgentCore Runtime

Vadym Kazulkin — Mon, 29 Jun 2026 14:00:35 +0000

Introduction

In part 6, we used Spring AI AgentCore Starter in our sample application to deploy and run our MCP client on AgentCore Runtime. We used several useful features of the Spring AI AgentCore Starter, like annotation-based auto-configuration, smart health checks, and rate limiting.

Until now, our agent deployed on AgentCore Runtime was stateless. If we apply for conferences with some talks and then ask the agent in the next conversation about which talks we applied for which conferences, the agent won't be able to answer. In this article, we'll add the AgentCore Memory to our application. We'll start with the short-term memory and later add the long-term memory. Then, we'll show how to use Spring AI AgentCore Memory, which provides the Spring AI ChatMemory integration with the Amazon Bedrock AgentCore Memory service.

We'll build on the spring-ai-2.0-ac-conference-app-agent-bedrock-agentcore-runtime sample application, which we introduced in part 6.

Spring AI AgentCore Memory

Spring AI AgentCore Memory provides Spring AI ChatMemory integration with the Amazon Bedrock AgentCore Memory service.
Its features currently include:

Spring AI Integration: Implements ChatMemoryRepository interface
Auto-configuration: Zero-configuration setup with Spring Boot
Short-Term Memory: Conversation history with MessageWindowChatMemory
Long-Term Memory: 4 consolidation strategies (Semantic, User Preference, Summary, Episodic)

To use Spring AI AgentCore Memory in our application, we need to add one more dependency to the pom.xml:

<dependency>
    <groupId>org.springaicommunity</groupId>
    <artifactId>spring-ai-agentcore-memory</artifactId>
</dependency>

As stated above, in this article, we'll cover short-term memory, leaving the long-term memory to the next article.

Create Bedrock AgentCore short-term Memory

I've written the article Amazon Bedrock AgentCore Runtime - Part 6 Using AgentCore short-term Memory with Strands Agents SDK about what AgentCore short-term Memory is and how to create one with the Python SDK. Also provided an example of how to use it with the Strands Agent SDK. I refer to this article to understand the basics.

To run examples, we've already deployed our sample application on AgentCore Runtime by executing the RuntimeWithMCPStack stack in part 6. Next, let's create AgentCore short-term Memory with CDK for Java by executing the ShortTermMemoryStack stack. First, let's look at what is happening there:

public class ShortTermMemoryStack extends Stack {

 public ShortTermMemoryStack(Construct scope, String appName,  StackProps stackProps) {
    super(scope, id, stackProps);   
    var memory = Memory.Builder.create(this, "short-term-memory-1")
              .memoryName("short_term_memory_for_conference_application")
              .description("Short-Term Memory for Conference Application")
              .expirationDuration(Duration.days(7))
              .build();   

    CfnOutput.Builder.create(this, "ShortTermMemoryIdOutput").value(memory.getMemoryId()).build();           
    }  
}

We use Bedrock AgentCore Memory.Builder to set the memory name, description and expiration duration, and then create the memory.

You can deploy the stack with the command: cdk deploy spring-ai-ac-conference-application-st-memory-stack -c awsAccountId={YOUR_AWS_ACCOUNT_ID}.

As we don't set any memory strategy, the short-term memory will be created like this:

Also, the Memory ID will be printed out, which we will need to configure in our Spring AI application. We can find the same Memory ID in the service UI above.

Finally, we need to configure the following IAM permissions to allow our application running on AgentCoreRuntime to access this AgentCore Memory:

{
 "Sid": "BedrockAgentCoreShortTermMemory",
   "Effect": "Allow",
   "Action": [
       "bedrock-agentcore:ListEvents",
       "bedrock-agentcore:CreateEvent",
       "bedrock-agentcore:RetrieveMemoryRecords"
      ],
   "Resource": [
         "arn:aws:bedrock-agentcore:{YOUR_AWS_REGION}:{YOUR_AWS_ACCOUNT_ID}:memory/{YOUR_SHORT_TERM_MEMORY_ID}"
      ]
}

Configure Bedrock AgentCore short-term Memory in our sample application

To configure Bedrock AgentCore short-term Memory in our sample application, we need to make some changes to it. First, we need to configure some short-term memory-related properties in the application.properties:

agentcore.memory.memory-id={YOUR_SHORT_TERM_MEMORY_ID}
agentcore.memory.total-events-limit=10 #Max events to retrieve (context window), default 100
agentcore.memory.default-session=default-session-id-12345678 #Default session name, default name is default-session
agentcore.memory.page-size=50  #API pagination size, default value is 50
agentcore.memory.ignore-unknown-roles=false #Handle unknown message roles, default value is false

The only required property is the AgentCore Memory ID we just created. All others are optional, with default values described in the Spring AI AgentCore Memory Configuration Reference.

Next, we need to ensure that we set ChatMemory to the ChatClient in the SpringAIAgentController. We've already set it up like this:

public SpringAIAgentController(ChatClient.Builder builder, ChatMemory chatMemory) {
var options = ToolCallingChatOptions.builder()
   .model("us.anthropic.claude-sonnet-4-6")
   .maxTokens(2000);

this.chatClient = builder.defaultOptions(options)
          //short term memory         
         .defaultAdvisors(MessageChatMemoryAdvisor.builder(chatMemory)
         .build())
         .build();          
....
}

Short-term Spring AI AgentCore Memory implements the Spring AI ChatMemoryRepository interface. That's why, when we provide the memory configuration as above, Spring AI injects the correct implementation of the ChatMemory into the constructor. Then we use the Advisors API to build MessageChatMemoryAdvisor with the ChatMemory and to provide it as an input to the defaultAdvisors method of the ChatClient.Builder. Even if we don't configure the AgentCore short-term Memory, the same code still works without throwing any exceptions. MessageChatMemoryAdvisor will be null, which Spring AI treats the same way as not setting any advisors. That's all the changes we need to make to our application to use the AgentCore short-term memory.

In addition, we need to include a custom ChatMemory Conversation ID in the ChatClient. According to the documentation, the ChatMemory.CONVERSATION_ID parameter is required for all memory advisors. Calls that omit this parameter will throw an IllegalArgumentException at runtime, as there is no default conversation ID.
The Spring AI AgentCore long-term Memory supports flexible conversation ID formats:

Simple: user123 → actor: user123, session: default-session
With Session: user123:session456 → actor: user123, session: session456

This is how the code looks for it in the SpringAIAgentController:

private final String CONVERSATION_ID="default-actor-id-12345678:default-session-id-12345678";

@AgentCoreInvocation
public Flux<String> invoceAsync(PromptRequest promptRequest, AgentCoreContext agentCoreContext) {
    var token = getAuthTokenViaHttpClient();
    ...
    var client = McpClient.async(getMcpClientTransport(token)).build();
    client.initialize();

    var asyncMcpToolCallbackProvider = AsyncMcpToolCallbackProvider.builder()
     .mcpClients(client)
    ...

    var content = this.chatClient.prompt()
       .user(promptRequest.prompt())
       .advisors(a -> a.param(ChatMemory.CONVERSATION_ID, CONVERSATION_ID))
       .tools(new DateTimeTools(),asyncMcpToolCallbackProvider.getToolCallbacks())
       .stream()
       .content();

Finally, we need to redeploy the AgentCore Runtime stack with the command: cdk deploy spring-ai-ac-conference-application-agentcore-runtime-stack -c awsAccountId={YOUR_AWS_ACCOUNT_ID}.

Now, we can use the InvokeRuntimeAgent class to send prompts to our agent running on AgentCore Runtime. We described this in part 5 and can reuse these prompts to apply the talks to the conferences.

But now, additionally, we can ask such questions as: "You recently applied for some conferences for me. Can you provide me with the details?" The agent will give us a reply similar to the reply shown below, which shows that it provided the answer using the AgentCore short-term Memory:

Conclusion

In this article, we explained how to add and use AgentCore short-term Memory to our application with the help of Spring AI AgentCore Memory. In the next article, we'll use AgentCore long-term Memory instead.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.

Building AI Agents with Spring AI and Amazon Bedrock AgentCore - Part 6 Deploy MCP client on AgentCore Runtime using Spring AI AgentCore Starter

Vadym Kazulkin — Mon, 22 Jun 2026 14:25:38 +0000

Introduction

In part 5, we looked at how to deploy and run our MCP client on AgentCore Runtime. Starting from this article, we'll look at the Spring AI AgentCore functionality. In this article, we'll use Spring AI AgentCore Starter in our sample application to deploy and run our MCP client on AgentCore Runtime. As Spring AI 2.0 and Spring Boot 4.1 have both already gone GA, I updated our application to use them; see pom.xml. For this, I created a new spring-ai-2.0-ac-conference-app-agent-bedrock-agentcore-runtime. It consists of the agent and Infrastructure as Code (IaC) subfolders.

Differences in the implementation of the MCP client for the Conference application between Spring AI 1.1 and 2.0

I have noticed several major differences in the implementation of the MCP client for the Conference application. We developed it mainly in part 3, and then adjusted it in part 4 and part 5. See SpringAIAgentController for the full version of the controller.

The first one is that ChatClient now requires passing the ChatOptions.Builder object to the defaultOptions method instead of the ChatOptions object itself:

var options = ToolCallingChatOptions.builder()
        .model("us.anthropic.claude-sonnet-4-6")
        .maxTokens(2000);

this.chatClient = builder.defaultOptions(options)
        ...
        .build();

Next, the biggest difference is that instead of using WebClient from the Spring Webflux dependency, Spring AI 2.0 now uses HttpRequest.Builder from the java.net.http module to create an MCP HTTP Streamable transport. Also, the implementation of this protocol is now in the HttpClientStreamableHttpTransport class, which was adjusted to use the java.net.http module. In Spring AI 1.*, the class name was WebClientStreamableHttpTransport:

private McpClientTransport getMcpClientTransport(String token) {

 var mcpServerConfig= this.getMCPServerConfig();
 var headerValue = "Bearer " + token;

 var httpRequestBuilder = HttpRequest.newBuilder()
     .header("Authorization", headerValue);

 return HttpClientStreamableHttpTransport.builder(mcpServerConfig.baseUrl)
     .connectTimeout(Duration.ofMinutes(3))
     .endpoint(mcpServerConfig.endpoint)        
     .requestBuilder(httpRequestBuilder)
     .build();
}

It also requires splitting the MCP endpoint URL into 2 parts: base URL (domain) and endpoint itself (/mcp), which we did in the application.properties:

amazon.bedrock.agentcore.gateway.base.url=https://spring-ai-conference-search-agentcore-gateway-xizwpytsgm.gateway.bedrock-agentcore.us-east-1.amazonaws.com
amazon.bedrock.agentcore.gateway.endpoint=/mcp

Lastly, Spring AI 2.0 introduced some changes to how to use the MCP tools. This is how the code looked in the previous Spring AI 1.x versions:

return this.chatClient.prompt().user(prompt)
   .tools(new DateTimeTools())
   .toolCallbacks(asyncMcpToolCallbackProvider.getToolCallbacks())
   .stream().content();

The code in Spring AI 2.0 uses the tools method, capable of accepting the local tools as well as tool callbacks as its parameters:

return this.chatClient.prompt().user(prompt)
    .tools(new DateTimeTools(),asyncMcpToolCallbackProvider.getToolCallbacks())
    .stream().content();

Also, we need to additionally define the ToolCallingManager Spring bean in the main SpringAIConferenceAppOnAgentCoreRuntimeApplication class:

@Bean ToolCallingManager toolCallingManager() {
   return ToolCallingManager.builder().build();
}

Everything else remains the same as described in parts 3-5.

Spring AI AgentCore SDK

Spring AI AgentCore SDK is an open-source library that brings Amazon Bedrock AgentCore capabilities into Spring AI through familiar patterns: annotations, auto-configuration, and composable advisors. We'll start by using Spring AI AgentCore Starter in this article and then cover Spring AI AgentCore Memory in subsequent articles.

Spring AI AgentCore Starter

Spring AI AgentCore Starter is a Spring Boot starter that enables existing Spring Boot applications to conform to the Amazon Bedrock AgentCore Runtime contract with minimal configuration. Its features currently include:

Auto-configuration: Automatically sets up AgentCore endpoints when added as a dependency
Annotation-based: Simple @AgentCoreInvocation annotation to mark agent methods
SSE Streaming: Server-Sent Events support with Flux return types
Smart health checks: Built-in /ping endpoint with Spring Boot Actuator integration
Async task tracking: Convenient methods for background task tracking
Rate limiting: Built-in Bucket4j throttling for invocations and ping endpoints

Let's add the relevant dependencies to pom.xml:

<dependencyManagement>
   <dependencies>
       <dependency>
            <groupId>org.springaicommunity</groupId>
            <artifactId>spring-ai-agentcore-bom</artifactId>
            <version>${spring-ai-agentcore-version}</version> 
            <type>pom</type>
            <scope>import</scope>
       </dependency>
   </dependencies>
</dependencyManagement>
...
<dependencies>
  <dependency>
     <groupId>org.springaicommunity</groupId>
     <artifactId>spring-ai-agentcore-runtime-starter</artifactId>
  </dependency>
  <dependency>
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-actuator</artifactId>
  </dependency>
</dependencies>

By adding the spring-ai-agentcore-runtime-starter dependency, we can now use org.springaicommunity.agentcore.annotation.AgentCoreInvocation annotation to annotate the method. Exactly this method we'll expose as a /invocation POST endpoint on the Bedrock AgentCore Runtime. Please note that only one method per application can be annotated with this annotation. Next, we need to do a small adjustment to the SpringAIAgentController to use this annotation:

@AgentCoreInvocation
public Flux<String> invoceAsync(PromptRequest promptRequest, AgentCoreContext agentCoreContext) {
...
return this.chatClient.prompt()
         .user(promptRequest.prompt())
         .tools(new DateTimeTools(),asyncMcpToolCallbackProvider.getToolCallbacks())
         .stream().content();
}

PromptRequest is a Java record representing a prompt:

public record PromptRequest(String prompt){};

Spring AI Starter also supports rate limiting. The starter includes built-in rate limiting using Bucket4j to protect against excessive requests. However, rate limiting is deactivated by default and will be active only if limits are defined in application.properties:

agentcore.throttle.invocations-limit=20
agentcore.throttle.ping-limit=250

The provided rate limit response is an HTTP response code 429:
({"error":"Rate limit exceeded"}).
Rate limits are also applied per client IP address and reset every minute.

Next, please comment out all application properties starting with agentcore.memory, as we'll need them in the upcoming article where we'll cover Bedrock AgentCore Memory.

By adding the dependency to the spring-boot-starter-actuator, we enabled health monitoring. We no longer need to implement the intelligent /ping endpoint ourselves.

Without Spring Boot Actuator:

Returns static "Healthy" status
Always responds with HTTP 200

With Spring Boot Actuator:

Integrates with Actuator health checks
Maps Actuator status to AgentCore format: UP → "Healthy" (HTTP 200), DOWN → "Unhealthy" (HTTP 503), Other → "Unknown" (HTTP 503)
Tracks status change timestamps
Thread-safe concurrent access

Then, let's briefly cover the IaC part with CDK for Java, which I implemented in the RuntimeWithMCPStack stack. It's completely identical to the IaC that we described in part 5. I wanted to have a separate IaC stack (also including an IAM role and ECR repository) for this Spring AI 2.0 and Spring AI AgentCore application. Also, please comment out the ShortTermMemoryStack and LongTermMemoryStack execution in the CDKApp class. We'll cover those later.

You can deploy the stack with the command: cdk deploy spring-ai-ac-conference-application-agentcore-runtime-stack -c awsAccountId={YOUR_AWS_ACCOUNT_ID}.

Finally, please visit the above-mentioned part 5 for more details on how to deploy this application on AgentCore Runtime and send prompts to it. All the prompts remain valid, as this is the same application, but using Spring AI AgentCore now.

Conclusion

In this article, we used Spring AI AgentCore Starter in our sample application to deploy and run our MCP client on AgentCore Runtime. We used several useful features of the Spring AI AgentCore Starter, like annotation-based auto-configuration, smart health checks, and rate limiting.

Until now, our agent deployed on AgentCore Runtime was stateless. If we apply for the conferences with some talks and then ask the agent in the next conversation about which talks we applied for which conferences, the agent won't be able to answer. In the next article, we'll add the AgentCore Memory to our application. We'll start with the short-term memory and later add the long-term memory. Then, we'll show how to use Spring AI AgentCore Memory, which provides the Spring AI ChatMemory integration with the Amazon Bedrock AgentCore Memory service.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.

Serverless applications on AWS with Lambda using Java 25, API Gateway and Aurora DSQL - Part 7 Lambda performance optimization approaches

Vadym Kazulkin — Mon, 15 Jun 2026 14:51:59 +0000

Introduction

In the previous articles of the series about how to develop, run, and optimize Serverless applications on AWS with Lambda using Java 25, API Gateway, and Aurora DSQL database, we used:

Managed Java 25 runtime
GraalVM Native Image deployed as Lambda Custom Runtime

We also did Lambda performance (cold and warm starts) measurements with the following settings:

Lambda functions used 1024 MB of memory
Java compilation option "-XX:+TieredCompilation -XX:TieredStopAtLevel=1"
Lambda x86_64 architecture used

In this article, we'll introduce some additional Lambda performance (cold and warm starts) optimization approaches to apply to our sample application. You'll need to measure the performance by yourself to figure out whether they will provide the desired Lambda performance improvements.

Please keep in mind that you can also deploy our sample application on AWS Lambda as a (Docker) Container Image. I didn't cover this approach, but you can look into my article series Lambda function using Docker Container Image for a step-by-step introduction on how to do it. I used DynamoDB as a database in this example. The cold start will be quite big. Lambda SnapStart isn't available for the Lambda deployment as a Container Image. Instead, you can use Ahead-of-Time (AOT) and CDS caches for the Container Image and then measure the Lambda performance.

Lambda performance optimization approaches

We can apply the following approaches to the managed Java runtime and GraalVM Native Image. For the managed Java runtime, it includes enabling SnapStart and applying the priming techniques on top:

Try out different Lambda memory settings. We performed all measurements with 1024 MB of memory for the Lambda function. With different memory settings, you might become better at the price-performance trade-off.
Try out setting Lambda arm64 architecture using AWS Graviton2 processor, which supports SnapStart since July 2024. This can provide a better cost-performance trade-off compared to x86 architecture.

We can apply the following approaches primarily only to the managed Java runtime on Lambda. This includes SnapStart being enabled and applying the priming techniques on top:

Try out different Java compilation options for the Lambda function. We performed all measurements until now with the compilation option "-XX:+TieredCompilation -XX:TieredStopAtLevel=1". We can provide other compilation options to the Lambda function using an environment variable called JAVA_TOOL_OPTIONS. This can have different cold and warm starts trade-offs. For GraalVM Native Image, the choice of Java compilation method doesn't have much impact on the Lambda performance. This is because our application is already compiled natively.
Further exclude unused dependencies. With that, we can especially reduce the cold start times (also for SnapStart enabled). In the case of GraalVM Native Image, only reachable Java classes, functions, and methods will become a part of the Native Image, so including unused dependencies may not help that much.

We can apply the following approach primarily to the managed Java runtime on Lambda with SnapStart enabled:

Search for further Lambda SnapStart priming potential in addition to those we introduced in this series. For this, you can use AWS Lambda Profiler Extension for Java. I described it in my article Improving Lambda performance with Lambda SnapStart and priming.

We can apply the following approach primarily to the GraalVM Native Image :

Try out Profile-Guided Optimizations to see whether you can further improve Lambda performance. The difficulty of trying out this technique is that you'll need to do some additional semi-automated steps to run your application either with the Lambda emulator locally or in an extra environment to obtain the profile of your application, which you'll then need to use to generate the optimized Native Image. You can use Lambda extension for it, but it still requires a lot of additional work. This is the work AWS did for us in case Lambda SnapStart is enabled. I really appreciate that I don't need to care about generating, encrypting, storing, and restoring the snapshots/profiles.

Conclusion

In this article, we introduced additional Lambda performance optimization approaches that we can use in our sample application. Try them out on your own to figure out whether they will provide the desired Lambda performance improvements.

Please also watch out for another series where I use a NoSQL serverless Amazon DynamoDB database instead of Aurora DSQL to do the same Lambda performance measurements.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.

Serverless applications on AWS with Lambda using Java 25, API Gateway and DynamoDB - Part 7 Lambda performance optimization approaches

Vadym Kazulkin — Tue, 09 Jun 2026 15:04:06 +0000

Introduction

In the previous articles of the series about how to develop, run, and optimize Serverless applications on AWS with Lambda using Java 25, API Gateway, and DynamoDB, we used:

Managed Java 25 runtime
GraalVM Native Image deployed as Lambda Custom Runtime

We also did Lambda performance (cold and warm starts) measurements with the following settings:

Lambda functions used 1024 MB of memory
Java compilation option "-XX:+TieredCompilation -XX:TieredStopAtLevel=1"
Lambda x86_64 architecture used
Default Apache HTTP Client (version 4.5) used to connect to the DynamoDB

Please keep in mind that you can also deploy our sample application on AWS Lambda as a (Docker) Container Image. I didn't cover this approach, but you can look into my article series Lambda function using Docker Container Image for a step-by-step introduction on how to do it. The cold start will be quite big. Lambda SnapStart isn't available for the Lambda deployment as a Container Image. Instead, you can use Ahead-of-Time (AOT) and CDS caches for the Container Image and then measure the Lambda performance.

Lambda performance optimization approaches

To find a good balance between the cold and warm start times of the Lambda function, you can try out the optimization techniques introduced below. I have not taken any additional measurements with our sample application with Java and GraalVM 25, but have done so using older Java, GraalVM, and dependency versions. I'll provide references to my relevant articles. Measurements that I did back then might already be outdated, so I strongly recommend you to re-measure.

We can apply the following approaches to the managed Java runtime and GraalVM Native Image. For the managed Java runtime, it includes enabling SnapStart and applying the priming techniques on top:

Try out different Lambda memory settings. We performed all measurements with 1024 MB of memory for the Lambda function. With different memory settings, you might become better at the price-performance trade-off. See my article Measuring cold and warm starts and deployment time with Java 21 using different Lambda memory settings for further examples, performance measurements, and conclusions.
Try out setting Lambda arm64 architecture using the AWS Graviton2 processor, which supports SnapStart since July 2024. This can provide a better cost-performance trade-off compared to x86 architecture. See my article AWS Lambda performance with Java 21: x86 vs arm64 - Initial measurements for some insights.
Try out different synchronous HTTP clients to establish an HTTP connection to DynamoDB. We performed all measurements until now with the default synchronous Apache HTTP Client version 4.5. There are other options like UrlConnection and AWS CRT HTTP clients, which provide different performance trade-offs for the cold and warm start. See my article Measuring cold and warm starts with Java 21 using different synchronous HTTP clients for further examples, performance measurements, and conclusions. GraalVM Native Image also supports the AWS CRT HTTP Client, and I did some measurements using a pure Java Lambda function in my article Measuring cold and warm starts with GraalVM 23 and AWS CRT HTTP Client. Recently, also Apache 5.x based HTTP client has been released, so you can try it out.
Explore whether an asynchronous HTTP client for DynamoDB is an option for your use case. The default asynchronous HTTP Client is NettyNio. There is another option, the AWS CRT async HTTP client, which provides different performance trade-offs for the cold and warm starts. See my article Measuring cold and warm starts with Java 21 using different asynchronous HTTP clients for further examples, performance measurements, and conclusions.

We can apply the following approaches primarily only to the managed Java runtime on Lambda. This includes SnapStart being enabled and applying the priming techniques on top:

Try out different Java compilation options for the Lambda function. We performed all measurements until now with the compilation option "-XX:+TieredCompilation -XX:TieredStopAtLevel=1". We can provide other compilation options to the Lambda function using an environment variable called JAVA_TOOL_OPTIONS. This can have different cold and warm starts trade-offs. See my article Measuring cold and warm starts with Java 21 using different compilation options for further examples, performance measurements, and conclusions. For GraalVM Native Image, the choice of Java compilation method doesn't have much impact on the Lambda performance. This is because our application is already compiled natively.
Further exclude unused dependencies. With that, we can especially reduce the cold start times (also for SnapStart enabled); see my article Measuring cold starts with Java 21 using different deployment artifact sizes. In the case of GraalVM Native Image, only reachable Java classes, functions, and methods will become a part of the Native Image, so including unused dependencies may not help that much.

We can apply the following approach primarily to the managed Java runtime on Lambda with SnapStart enabled:

Search for further Lambda SnapStart priming potential in addition to those we introduced in this series. For this, you can use AWS Lambda Profiler Extension for Java. I described it in my article Improving Lambda performance with Lambda SnapStart and priming.

We can apply the following approach primarily to the GraalVM Native Image :

Try out Profile-Guided Optimizations to see whether you can further improve Lambda performance. The difficulty of trying out this technique is that you'll need to do some additional semi-automated steps to run your application either with the Lambda emulator locally or in an extra environment to obtain the profile of your application, which you'll then need to use to generate the optimized Native Image. You can use Lambda extension for it, but it still requires a lot of additional work. This is the work AWS did for us in case Lambda SnapStart is enabled. I really appreciate that I don't need to care about generating, encrypting, storing, and restoring the snapshots/profiles.

Conclusion

Please also watch out for another series where I use a relational serverless Amazon Aurora DSQL database and additionally the Hibernate ORM framework instead of DynamoDB to do the same Lambda performance measurements.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.

AWS Lambda Managed Instances with Java 25 and AWS SAM – Part 7 Implement scheduled scaling

Vadym Kazulkin — Mon, 01 Jun 2026 15:36:09 +0000

Implement scheduled scaling

Recently, Amazon EventBridge Scheduler added 619 new SDK API actions. One of these actions adjusts the Lambda function's minimum and maximum execution environments for Lambda Managed Instances (LMI) on a recurring or one-time schedule. This is useful for predictable traffic patterns, such as scaling up before peak hours and scaling down during off-peak hours. We can use CloudFormation or the latest versions of AWS CDK or AWS CLI to perform this action. In our example, we'll use AWS CLI to adjust the Lambda Function Scaling Configuration, for which we'll use the PutFunctionScalingConfig API as a universal target. We'll use the Lambda function with the name GetProductByIdJava25WithLMI, which we introduced in part 1.

First of all, let's create an SQS dead-letter queue, which we'll use for our action:

aws sqs create-queue --queue-name scheduler-dlq

Next, let's create an EventBridge Scheduler IAM execution role with the name scale-lambda-managed-instances-eventbridge-scheduler-role. This role grants permission to call the lambda:PutFunctionScalingConfig and send the message to the dead-letter queue on our target function.

This is how the trusted policy looks for the IAM role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "scheduler.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

And this is how the IAM policy looks (use the ARNs of the Lambda function and SQS dead-letter queue here):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "lambda:PutFunctionScalingConfig"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:lambda:{aws_region}:{aws_account_id}:function:GetProductByIdJava25WithLMI:$LATEST.PUBLISHED"
        },
        {
            "Effect": "Allow",
            "Action": [
                "sqs:SendMessage"
            ],
            "Resource": [
                "arn:aws:sqs:{aws_region}:{aws_account_id}:scheduler-dlq"
            ]
        }
    ]
}

Please replace the values of {aws_region} and {aws_account_id} with your own values, and adjust the Lambda function and SQS Queue names if needed.

Now, let's create the scheduler:

aws scheduler create-schedule \
  --name "ScaleLambdaManagedInstances" \
  --schedule-expression "at(2026-05-18T08:10:00)" \
  --flexible-time-window '{"Mode": "OFF"}' \
  --target '{
     {"DeadLetterConfig": {"Arn": "arn:aws:sqs:{aws_region}:{aws_account_id}:scheduler-dlq"},
    "Arn": "arn:aws:scheduler:::aws-sdk:lambda:PutFunctionScalingConfig",
    "RoleArn": "arn:aws:iam::{aws_account_id}:role/scale-lambda-managed-instances-eventbridge-scheduler-role",
    "Input": "{\"FunctionName\": \"GetProductByIdJava25WithLMI\", \"Qualifier\": \"$LATEST.PUBLISHED\", \"FunctionScalingConfig\": {\"MinExecutionEnvironments\": 5, \"MaxExecutionEnvironments\": 10}}"
  }'

Let's explain what happens here:

First, we create the schedule with the name ScaleLambdaManagedInstances using a one-time schedule (executes at 08:10 on May 18, 2026). You can use other Schedule types in EventBridge Scheduler, like cron-based expressions.
Then, we target the PutFunctionScalingConfig Scheduler API as a universal target.
Next, we specify the SQS dead-letter queue ARN created above
Then, we specify the IAM execution Role ARN created above
Next, we specify the new MinExecutionEnvironments and MaxExecutionEnvironments values in the Input payload
Finally, as the scheduler input, we specify the name of the Lambda function and its qualifier (usually $LATEST.PUBLISHED), for which we'd like to change the Function Scaling Configuration. In our case, we set MinExecutionEnvironments to 5 and MaxExecutionEnvironments to 10.
We can also optionally set the retry policy and encryption.

After creating the schedule, we'll see something similar in the Amazon EventBridge Scheduler Service:

After the scheduler has run, we can verify that the Lambda function Scaling Configuration has changed:

It's also very important to configure the dead-letter queue. First, I didn't do it and configured the Lambda function Resource ARN in the IAM policy like arn:aws:lambda:{aws_region}:{aws_account_id}:function:GetProductByIdJava25WithLMI. I observed that the scheduler hasn't been invoked and saw the errors in Amazon CloudWatch.
By configuring the dead-letter queue, I saw the exact error message:

ERROR_CODE: AccessDeniedException
ERROR_MESSAGE :

User: arn:aws:sts::{aws_account_id}:assumed-role/scale-lambda-managed-instances-eventbridge-scheduler-role/f375e2c757da339a8d593587ce800265 
is not authorized to perform: lambda:PutFunctionScalingConfig on resource: 
arn:aws:lambda:{aws_region}:{aws_account_id}:function:GetProductByIdJava25WithLMI:$LATEST.PUBLISHED 
because no identity-based policy allows the lambda:PutFunctionScalingConfig action

With that, it was clear to me that I needed to append $LATEST.PUBLISHED to the ARN of the Lambda function. Please also use Troubleshooting Amazon EventBridge Scheduler, in case you experience some issues.

Here, we scaled up the capacity at the given time, and in the same way we can scale it down. Things to pay attention to:

For workloads with predictable peaks, create multiple schedules to match your traffic pattern: one to scale up your function before peak hours, and another to scale down after peak hours. Each schedule follows the same pattern with updated MinExecutionEnvironments and MaxExecutionEnvironments values.
Scheduled scaling adjusts the provisioned floor and ceiling of execution environments, but actual scaling between min and max still responds to CPU utilization and concurrency saturation.
If your traffic more than doubles within 5 minutes of a scheduled scale-up, you might still experience throttling as capacity is provisioned.
When scaling to zero to deactivate a function, remember that reactivation requires an explicit PutFunctionScalingConfig call with non-zero values.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.

Building AI Agents with Spring AI and Amazon Bedrock AgentCore - Part 5 Deploy MCP client for Conference application on AgentCore Runtime

Vadym Kazulkin — Tue, 26 May 2026 14:40:49 +0000

Introduction

In part 2, we explained how to deploy and run our conference search application on the Amazon Bedrock AgentCore Runtime as the MCP server. In this article, we'll develop the (MCP-) client, capable of talking to our application running on AgentCore Runtime. Later, in part 3, we developed the (MCP-) client, capable of talking to our application running on AgentCore Runtime. In part 4, we looked at how to provide the MCP Tools for the Conference application via AgentCore Gateway in a centralized way.

As we saw in previous articles, the local MCP client for the Conference application, to talk to AgentCore Runtime or Gateway, became quite big. If we have many customers using such a client, changing and operating it can become quite challenging. That's why, in this article, we look at how to deploy and run our MCP client on AgentCore Runtime.

Implement the MCP client for the Conference application to be deployable on AgentCore Runtime

We'll reuse the MCP client based on Spring AI that we implemented in parts 3 and 4. But as we need to make some small changes to deploy it on AgentCore Runtime, I created a new spring-ai-1.1-conference-app-agent-bedrock-agentcore-runtime. It consists of the agent and Infrastructure as Code subfolders.

Let's first look at the changes that we need to make to the client. AgentCore Runtime also supports the HTTP protocol contract, which we'll use to deploy our MCP client and talk to it. This contract puts some requirements on the client:

Container requirements:

Host : 0.0.0.0
Port : 8080 - Standard port for HTTP-based agent communication
Platform : ARM64 Docker container - Required for compatibility with the AgentCore Runtime environment. I usually borrow t4g small EC2 instance on AWS to build it.

Path requirements:

/invocations endpoint: POST endpoint for agent interactions
/ping endpoint: GET endpoint for health checks

You can read more about this topic in the HTTP protocol contract article.

The only changes we need to make to our REST Controller are to implement these path requirements. If we use asynchronous communication, the entry point looks like:

@PostMapping(value = "/invocations", consumes = { "*/*" })
public Flux<String> invocations(@RequestBody String prompt) {
   var token = getAuthTokenViaHttpClient();
   var client = McpClient.async(getMcpClientTransport(token)).build();
   ...
  var toolCallbacks = concatWithStream(asyncMcpToolCallbackProvider
 .getToolCallbacks(), ToolCallbacks.from(new DateTimeTools()));

  return this.chatClient.prompt().user(prompt)
    .toolCallbacks(toolCallbacks)
        .stream().content();
}

For synchronous communication, the entry point looks like:

@PostMapping(value = "/invocations", consumes = { "*/*" })
public String invocations(@RequestBody String prompt) {
   var token = getAuthTokenViaHttpClient();
   var client = McpClient.async(getMcpClientTransport(token)).build();
   ...
  var toolCallbacks = concatWithStream(asyncMcpToolCallbackProvider
 .getToolCallbacks(), ToolCallbacks.from(new DateTimeTools()));

  return this.chatClient.prompt().user(prompt)
    .toolCallbacks(toolCallbacks)
        .call().content();
}

For adding the path to /ping, we have different options. We can either add such a simple method:

@GetMapping("/ping")
public String ping() {
   return "{\"status\": \"healthy\"}";
}

Or use Spring Boot Actuator service and add some properties to the application.properties:

management.endpoints.web.exposure.include=health
management.endpoints.web.base-path=/
management.endpoints.web.path-mapping.health=ping

As we need to deploy our MCP client as an ARM64 Docker container, I also added a simple Docker file:

FROM amazoncorretto:25

COPY target/spring-ai-1.1-conference-app-agent-bedrock-agentcore-runtime-0.0.1-SNAPSHOT.jar app.jar
ENTRYPOINT ["java","-jar","/app.jar"]

Let's build the Docker file and upload it to the Amazon Elastic Container Registry:

# build the application
mvn clean package 

# build the Docker image
sudo docker build --no-cache -t spring-ai-conference-app-agent-bedrock-agentcore-runtime:v1 

# Login to ECR
aws ecr get-login-password --region {region} | sudo docker login --username AWS --password-stdin {account_id}.dkr.ecr.{region}.amazonaws.com  

# Create ECR repository (if it doesn't exist)
aws ecr create-repository --repository-name spring-ai-conference-app-agent-bedrock-agentcore-runtime --image-scanning-configuration scanOnPush=true --region {region}  

# Tag the Docker image
sudo docker tag spring-ai-conference-app-agent-bedrock-agentcore-runtime:v1 {account_id}.dkr.ecr.{region}.amazonaws.com/spring-ai-conference-app-agent-bedrock-agentcore-runtime:v1

# Push the Docker Image to the ECR repository
sudo docker push {account_id}.dkr.ecr.{region}.amazonaws.com/spring-ai-conference-app-agent-bedrock-agentcore-runtime:v1

Please replace AWS {account_id} and {region} with our own values. Also, your version may not be v1 but a different one.

We can also build the Docker image by using Buildpack support built into Spring instead of a Dockerfile. Just use the Maven task spring-boot:build-image.

We don't need to make any other changes on the MCP client itself.

Let's now cover the IaC part with CDK for Java, which I implemented in RuntimeWithMCPStack stack. We've already covered many steps in creating the CDK App and Stack, and even the AgentCore Runtime with the MCP protocol in part 2. For a more detailed explanation, I refer to this article.

First, let's take a look at the creation of the AgentCore Runtime:

 Runtime.Builder.create(this, "MCPRuntime-125")
   .runtimeName(appName.replace("-", "_")+ "_runtime")
   .protocolConfiguration(ProtocolType.HTTP)
   .description("AgenCore Runtime with MCP protocol for running conference app")
      ...
   .build();

Here we set some common properties, such as the runtime name, description, and protocol (in our case, HTTP).

Now let's look at the relevant code parts to assign this code artifact to the AgentCore Runtime:

var ecrImageURI= ConventionalDefaults.
    getContextVariableValueWithReplacedAccountId(this, "ecrImageURIForConferenceSearchAndApplicationAgent");            

var agentRuntimeArtifact =    
    AgentRuntimeArtifact.fromImageUri(ecrImageURI);
   ....

Runtime.Builder.create(this, "MCPRuntime-125")
    .agentRuntimeArtifact(agentRuntimeArtifact)
    ...
    .build();

First, we get the value of the variable ecrImageURI, which points to the imageURI in the ECR we pushed previously. This is typically done in the cdk.json:

{
  "app": "mvn -e -q compile exec:java",
  "context": {
      ""ecrImageUR": "{AWS_ACCOUNT_ID}.dkr.ecr.us-east-1.amazonaws.com/spring-ai-conference-app-agent-bedrock-agentcore-runtime:v1"
 }
}

Please adjust the value so that it matches your imageURI. We use the placeholder {AWS_ACCOUNT_ID} there. The reason for it is that I don't want to expose the AWS account ID publicly. That's why I wrote the following utility method getContextVariableValueWithReplacedAccountId in the ConventionalDefaults class to replace the placeholder with the real value:

static String getContextVariableValueWithReplacedAccountId(Stack stack, String contextVariableName) {
   var awsAccountId=(String)stack.getNode().tryGetContext("awsAccountId");
   if(awsAccountId == null || awsAccountId.trim().isEmpty()) {
      System.out.println("please provide your aws account id as as content to the call, for example: cdk deploy -c awsAccountId=1234567890101");
    }
   var contextVariableValue= getContextVariableValue(stack, contextVariableName);
   return replaceAWSAccountID(contextVariableValue, awsAccountId);
 }

static String getContextVariableValue(Stack stack, String contextVariableName) {
   return (String)stack.getNode().tryGetContext(contextVariableName);
 }

private static String replaceAWSAccountID(String configParam, String awsAccountId) {
   return configParam.replace("{AWS_ACCOUNT_ID}", awsAccountId);
}

Then we create AgentRuntimeArtifact from the image URI and set it as AgentCore Runtime agentRuntimeArtifact property.

Now let's cover the next part - defining the IAM execution role. It's very difficult to automate this part as it takes plenty of time. If I find it, I'll provide the IaC part in the future :). I refer you to the article IAM Permissions for AgentCore Runtime for more information. You can also read my article Amazon Bedrock AgentCore Runtime - Part 2 Using Bedrock AgentCore Runtime Starter Toolkit with Strands Agents SDK, where I explained this part. In that article, we developed the agent in Python with the Strands Agents framework and deployed it on AgentCore Runtime.

Once we have defined the IAM role, we need to configure it in the cdk.json:

{
  "app": "mvn -e -q compile exec:java",
  "context": {
      "roleArnForTheAgentCoreRuntime": "arn:aws:iam::{AWS_ACCOUNT_ID}:role/service-role/spring-ai-conference-search-application-agentcore-runtime-role",
    ....
   }
}

We use the placeholder for the AWS account ID as explained above. Here is the relevant code to grab the value of the roleArnForTheAgentCoreRuntime variable and set it to the execution role of the Runtime from the RuntimeWithMCPStack:

var roleArnForTheAgentCoreRuntime=ConventionalDefaults
   .getContextVariableValueWithReplacedAccountId(this, "roleArnForTheAgentCoreRuntime");

var role=Role.fromRoleArn(this,"roleArnForTheAgentCoreRuntimeRole", roleArnForTheAgentCoreRuntime);

Runtime.Builder.create(this, "MCPRuntime-123")
   .runtimeName(appName.replace("-", "_")+ "_runtime")
   ...
  .executionRole(role)
  .authorizerConfiguration(RuntimeAuthorizerConfiguration.usingIAM())
  .build();

Here, we also use an IAM authorizer for the inbound AgentCore Runtime authentication. This is the default authentication and authorization mechanism that works automatically without additional configuration. You can also use JSON Web Tokens (JWT) as we showed in part 2.

Now we are ready to deploy our MCP client on the AgentCore Runtime. The command to do it is:

cdk deploy -c awsAccountId={YOUR_AWS_ACCOUINT_ID}

Here is how the AgentCore Runtime looks in the console after its creation:

We'll need the Runtime ARN, which we see in the output of this command. Or we can grab it in the service console.

Now we still need to write a client that communicates with our MCP client on the Runtime. I provided such an InvokeRuntimeAgent client written in Java, but you can use any programming language for which AWS provides a (bedrockagentcore) SDK:

private static final String AGENT_RUNTIME_ARN="arn:aws:bedrock-agentcore:us-east-1:{AWS_ACCOUNT_ID}:runtime/spring_ai_conference_search_application_runtime-143wvBghklZ";

void main() throws Exception {

 String payload =
   "{\"prompt\":\"Please provide me with the list of conferences, including their IDs, 
with the Java topic happening in 2027, with the call for papers open today. 
Also, provide me with the list of my talks with this topic in the title. 
Finally, for each conference and talk retrieved, apply individually for the conference.\"}";

  var httpClient=ApacheHttpClient.builder()
      .connectionTimeout(Duration.ofMinutes(5))
      .socketTimeout(Duration.ofMinutes(5))
      .build();

  var bedrockAgentCoreClient = BedrockAgentCoreClient.builder()
      .region(Region.US_EAST_1)
      .httpClient(httpClient)
      .build();

  var invokeAgentRuntimeRequest = InvokeAgentRuntimeRequest.builder()                 
     .agentRuntimeArn(replaceAWSAccountID(AGENT_RUNTIME_ARN))                               
     .qualifier("DEFAULT")
     .contentType("application/json")
     .payload(SdkBytes.fromUtf8String(payload)).build();
      try (var responseStream = bedrockAgentCoreClient
     .invokeAgentRuntime(invokeAgentRuntimeRequest)) {
     var text = new String(responseStream.readAllBytes(), StandardCharsets.UTF_8); 
        System.out.println(text);
}

Let's go step-by-step through it. First of all, we define RUNTIME_ARN, which we deployed in the step before. Please still use the {AWS_ACCOUNT_ID} placeholder, which will be dynamically replaced with your AWS Account ID. When we create BedrockAgentCoreClient. We also explicitly set the Apache HTTP client with the extended connection and socket timeouts. Default 30-second timeouts maybe to short for communication with the Runtime. Then we create InvokeAgentRuntimeRequest and set the agent Runtime ARN, qualifier (always DEFAULT), content type, and payload. The payload is our prompt. You can see the examples of the prompts in part 4 as we're communicating with the same MCP client, but deployed elsewhere. When we invoke the invokeAgentRuntime method on the bedrockAgentCoreClient by providing the invokeAgentRuntimeRequest and convert the agent response to a string.

Conclusion

In this article, we looked at how to deploy and run our MCP client on AgentCore Runtime. With that, our MCP client now scales nicely within the Runtime.

Of course, you can create a nicer client by providing UI for entering the prompt and providing the agent response as a result. My goal was only to demonstrate how to implement such a client. Now we can change and redeploy our MCP client based on Spring AI on the AgentCore Runtime as often as we want. The client code remains unchanged as long as the Runtime ARN remains unchanged.

Starting from the next article, we'll look at the Spring AI AgentCore functionality. Spring AI AgentCore SDK is an open-source library that brings Amazon Bedrock AgentCore capabilities into Spring AI through familiar patterns: annotations, auto-configuration, and composable advisors.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.

Building AI Agents with Spring AI and Amazon Bedrock AgentCore - Part 4 Provide MCP tools for Conference application via AgentCore Gateway

Vadym Kazulkin — Mon, 18 May 2026 14:09:12 +0000

Introduction

In part 2, we explained how to deploy and run our conference search application on the Amazon Bedrock AgentCore Runtime as the MCP server. In this article, we'll develop the (MCP-) client, capable of talking to our application running on AgentCore Runtime. Later, in part 3, we developed the (MCP-) client, capable of talking to our application running on AgentCore Runtime. In this article, we'll look at another alternative to AgentCore Runtime to host MCP servers on AgentCore Gateway.

Update from June, 2026. After I published this article, Spring AI 2.0 became generally available. At the bottom of this article, I'll provide the required changes to make this example work with this version.

Provide the MCP Tools for the Conference application via AgentCore Gateway

Let's imagine a hypothetical situation: we not only want to search for the conferences, but also create, search, and apply for the talks for them. With this, our conference application now supports not only the attendee role but also the speaker role. This is the reason why I added functionality to support conference search by the open call for papers criteria, see part 2. This is required for conference speakers to determine whether it's still possible to apply for the conference with their talks.

When searching for conferences, we didn't have a public API, which is why we created MCP. On the other hand, for creating, searching, and applying the talks for the conferences, we indeed have a public API. Let's assume this API is hosted on the Amazon API Gateway. But it could also be any external application that exposes an OpenAPI specification. How to implement such a use case? Of course, we can use Amazon Bedrock AgentCore Gateway to securely connect our API to the AgentCore Gateway. The AgentCore Gateway can expose API functionality as MCP tools. But with this, we'll need to authenticate and hold the connection to multiple sources: AgentCore Runtime and Gateway. Without a centralized approach, customers face significant challenges: discovering and sharing tools across organizations becomes fragmented, managing authentication across multiple MCP servers grows increasingly complex, and maintaining separate gateway instances for each server quickly becomes unmanageable.

The centralized approach, which exposes all the tools from the central (MCP server) endpoint, would be a much better solution for our use case. Luckily, AgentCore Gateway helps to solve these challenges by treating existing MCP servers as native targets. This gives us a single point of control for routing, authentication, and tool management. It makes it as simple to integrate MCP servers as to add other targets to the gateway. AgentCore made it possible by supporting multiple targets. Those are, as of now: OpenAPI, Smithy, Amazon API Gateway, AWS Lambda, MCP Servers, and Integrations:

Conference Talks and Applications Demo

For creating, searching, and applying the talks for the conferences, I implemented a small conference-talks-and-applications-demo:

I currently don't use any database to store the talks and conference applications for simplicity reasons. My goal is only to demonstrate the approach.

I maintain a static list of the talks in the GetConferenceTalksByTitleSubstring class. The search consists of looking for the provided substring of the title.
When creating a new talk, I generate its random ID between 1 and 100 in the CreateConferenceTalk class and return the talk with ID, title, and description.
When applying for a talk for a specific conference, I simply acknowledge that the application is created in the CreateConferenceTalk class.

I prefer to use AWS SAM as IaC for pure Serverless applications. Unfortunately, AWS SAM doesn't provide any IaC for Amazon Bedrock AgentCore yet. Also, SAM has some limitations, as it's, for example, not possible to create the response codes for each API. And those response codes are required by the OpenAPI specification to be present. That's why I created OpenAPI spec on my own for it. We can refer to this specification when defining the API like this:

MyApi:
  Type: AWS::Serverless::Api
  Properties:
    StageName: !Ref Stage
    DefinitionBody:
        Fn::Transform
           Name: AWS::Include
           Parameters:
             Location: ConferenceTalksAndApplicationsAppAPI-OpenAPISpec.yaml

We also secured our API with an API key, whose value is by definition passed as the HTTP header parameter "x-api-key". This will play a role when we configure the outbound authentication of the AgentCore Gateway API Gateway target:

MyApiKey: 
  Type: AWS::ApiGateway::ApiKey
  ....
  Properties: 
    Name: "ConferenceTalksAndApplicationsAppAPIKey"
    Description: "ConferenceTalksAndApplicationsApp API Key"
    Enabled: true
    GenerateDistinctId: false
    Value: a6ZbcDgjkQW10BN56ASR25
    ...

We also defined an API stage with the name prod. Now, we can deploy this application by executing sam deploy -g, and we will see the individual URL in the response. For example, https://k370s19lk3.execute-api.us-east-1.amazonaws.com/prod. We'll need the REST API ID, which in our case is k370s19lk3, later when creating the IaC for the AgentCore Gateway.

Create AgentCore Gateway with different targets

In part 2, we started to create the IaC for the Conference (Search) application. It consisted mainly of the AgentCore Runtime with the MCP protocol and everything needed for that, like the Cognito User (Client) Pool. We used CDK for Java for it. We'll now call this application the Conference application, as we are extending its functionality beyond the search. Our goal is now to create AgentCore Gateway with 2 targets:

existing AgentCore Runtime with MCP protocol for the conference search (MCP) tools
conference talks and applications demo deployed on Amazon Gateway API to expose all its APIs as (MCP) tools.

You can find the full source code in the GatewayTargetStack class.

Let's go step-by-step through it. We first create the AgentCore Gateway itself:

var gateway= Gateway.Builder.create(this, "Gateway-123")
      .gatewayName(appName.replace("_", "-")+ "-gateway")
      .authorizerConfiguration(CustomJwtAuthorizer.Builder
        .create().allowedClients(
          List.of(UserClientPoolStack.
               userPoolClient.getUserPoolClientId()))
      .discoveryUrl(UserClientPoolStack.COGNITO_DISCOVERY_URL).build())
            .role(RuntimeWithMCPStack.role)
            .description("AgenCore Runtime with MCP protocol for running conference search app")
           .build();

The most interesting part is configuring the custom JWT authorizer as an inbound authentication. Here we reuse the Cognito User (Client) Pool created in part 2. We set the same user client pool ID and discovery URL. We also reuse the same AWS IAM role that we used to create AgentCore Runtime in part 2. Please also read the Getting started with Policy in AgentCore in addition to the resources from part 2 on how to create one.

Now, let's create the AgentCore Gateway target of our MCP Server running on AgentCore Runtime:

GatewayTarget.Builder.create(this, "MCP-Target-123")           
     .targetConfiguration(McpServerTargetConfiguration.create(endpoint))         
     .credentialProviderConfigurations(oauthCredentialProviderConfigs)
         .gatewayTargetName("mcp-target")
         .description("AgentCore Runtime MCP Server Target ")
         .gateway(gateway)
         .build();

We set McpServerTargetConfiguration, which defines that the Gateway target is the MCP Server running on AgentCore Runtime. Also, we set the target name and description, and provide the AgentCore Gateway to which this target belongs. We need to set the endpoint URL, which always follows the same schema:

var endpoint="https://bedrock-agentcore."+region + 
        ".amazonaws.com/runtimes/" +
        RuntimeWithMCPStack.runtime.getAgentRuntimeId()+
       "/invocations? 
       qualifier=DEFAULT&accountId="+Stack.of(this).getAccount();

We obtain the runtime ID property from the created AgentCore Runtime in the RuntimeWithMCPStack stack. The next part is to configure the outbound authentication. This means configuring how the AgentCore Gateway MCP target authenticates with the AgentCore Runtime with the MCP protocol. For this, we need to use AgentCore Identity.
As described in the following issue, it's currently not possible to create the AgentCore Identity with CloudFormation. That's why CDK also can't provide this functionality. That's why we need to create it manually and then provide the configuration for this stack. Let's secure it with the existing OAuth Client. Let's go to AgentCore Identity and click on "Add Outbound Auth" -> "Add OAuth Client". Then select "Custom Provider" -> "Discovery URL" :

We can reuse the Cognito User Pool Client ID, Client Secret, and Discovery URL from part 2.

After we created the AgentCore Identity, let's grab its ARN:

The Client Secret will be automatically stored as a Secret in the AWS Secrets Manager. Let's also grab the Secret ARN:

Now, let's configure both in the cdk.json :

{
  "app": "mvn -e -q compile exec:java",
  "context": {
      "agentcoreIdentityOutboundOAuthArn": "arn:aws:bedrock-agentcore:us-east-1:{AWS_ACCOUNT_ID}:token-vault/default/oauth2credentialprovider/resource-provider-oauth-gateway",
      "oAuthSecretArn": "arn:aws:secretsmanager:us-east-1:{AWS_ACCOUNT_ID}:secret:bedrock-agentcore-identity!default/oauth2/resource-provider-oauth-gateway-ba3b089d-toYfaV",
  ....
   }
}

Please replace both values with your individual ARNs. I explained in part 2 how we handle the AWS Account ID. Now, let's create and configure the credential provider:

// CloudFormation, see the issue https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/2391
  var oAuthProviderArn = ConventionalDefaults.getContextVariableValueWithReplacedAccountId(this, "agentcoreIdentityOutboundOAuthArn");
  var oAuthSecretArn = ConventionalDefaults.getContextVariableValueWithReplacedAccountId(this, "oAuthSecretArn");

  var oauthCredentialProviderConfigs = List.of(GatewayCredentialProvider
      .fromOauthIdentityArn(OAuthConfiguration.builder()
          .providerArn(oAuthProviderArn)
          .secretArn(oAuthSecretArn)
          .scopes(List.of())
          .build()));

  GatewayTarget.Builder.create(this, "MCP-Target-123")           
  .credentialProviderConfigurations(oauthCredentialProviderConfigs)
  ...
 .build();

We grab the AgentCore Identity and Secret ARNs and use them to create an OAuth Credential Provider. We then set it when creating the AgentCore Target credential provider configuration.

Now we are done with creating the AgentCore MCP Target. The next step is to create an Amazon API Gateway target. Please also read the article AgentCore Gateway Amazon API Gateway stages to gain an understanding of how AgentCore Gateway obtains the OpenAPI spec from the Amazon API Gateway stage.

First of all, let's define the API stage name in the cdk.json:

{
  "app": "mvn -e -q compile exec:java",
  "context": {
      "restApiStageName": "prod"
   }
}

We'll pass the restApiId via the console parameter. We created it above when we deployed the conference talks and applications demo. Similar to AWS Account ID, which is public, we don't want to configure it in cdk.json:

  var restApiId=(String)this.getNode().tryGetContext("restApiId");

  var restApiStageName=ConventionalDefaults.getContextVariableValue(this, "restApiStageName");

  GatewayTarget.Builder.create(this, "APIGATEWAY-Target-123")         
    .targetConfiguration((ApiGatewayTargetConfiguration.Builder.create()
    .restApi(RestApi.fromRestApiId(this, "APIGATEWAY-ID", restApiId))
         .stage(restApiStageName).build()))
            ...
           .gatewayTargetName("apigateway-target")
           .description("Amazon ApiGateway Target ")
           .gateway(gateway)
           .build();

Here, we create the AgentCore Gateway Target as an Amazon API Gateway Target, set the target name and description. We also provide the REST API ID, stage, and AgentCore Gateway to which this target belongs.

We can define the tool filters. With that, we can shrink what Amazon API Gateway APIs will be exposed as MCP tools:

GatewayTarget.Builder.create(this, "APIGATEWAY-Target-123")           
  .targetConfiguration((ApiGatewayTargetConfiguration.Builder.create()
     .apiGatewayToolConfiguration(ApiGatewayToolConfiguration.builder()
       .toolFilters(List.of(
        ApiGatewayToolFilter.builder()
            .filterPath("/talks/{titleSubstring}")                                
                .methods(List.of(ApiGatewayHttpMethod.GET))                 
                .build(),
        ApiGatewayToolFilter.builder()
                .filterPath("/apply")
                .methods(List.of(ApiGatewayHttpMethod.POST))
                .build(),
        ApiGatewayToolFilter.builder()
                .filterPath("/talks")                    
                .methods(List.of(ApiGatewayHttpMethod.POST))
                .build()))

In our example, we expose all 3 APIs (/apply, /talks, //talks/{titleSubstring}) as MCP tools.

Next, let's use the tool override to give the MCP tools the proper names and descriptions:

GatewayTarget.Builder.create(this, "APIGATEWAY-Target-123")           
  .targetConfiguration((ApiGatewayTargetConfiguration.Builder.create()
     .apiGatewayToolConfiguration(ApiGatewayToolConfiguration.builder()
      .toolOverrides(List.of(
          ApiGatewayToolOverride.builder()
            .method(ApiGatewayHttpMethod.POST)
            .name("apply-to-conferences-w-conference-id-talk-id")
            .path("/apply")
            .description("apply to the conference with conference Id and talk Id")
            .build(), 
         ApiGatewayToolOverride.builder()
           .method(ApiGatewayHttpMethod.POST)
           .name("create-new-talk")
           .path("/talks")
           .description("create a new talk with talk Id, title and description")
           .build(),                    
         ApiGatewayToolOverride.builder()
           .method(ApiGatewayHttpMethod.GET)
           .name("get-talks-by-title-substring")
           .path("/talks/{titleSubstring}")
           .description("get talks by their title substring")
           .build()))

With that, the LLM can easily find the right tool for the job.

The last part is to define how AgentCore Gateway handles the outbound authentication to the Amazon API Gateway. As described above and in the following issue, it's currently not possible to create the AgentCore Identity with CloudFormation. That's why CDK also can't provide this functionality. That's why we need to create it manually and then provide the configuration for this stack. Let's secure this Target with the API Key, as it is how we secured our Amazon Gateway API. Let's go to AgentCore Identity and click on "Add Outbound Auth" -> "Add API Key" :

Please use the same API Key that we used to secure our API. We defined it in the SAM template.

After we created the AgentCore Identity, let's grab its ARN:

The Client Secret will be automatically stored as a Secret in the AWS Secrets Manager. Let's also grab the Secret ARN:

Now, let's configure both in the cdk.json:

{
  "app": "mvn -e -q compile exec:java",
  "context": {
      "agentcoreIdentityOutboundApiKeyArn": "arn:aws:bedrock-agentcore:us-east-1:{AWS_ACCOUNT_ID}:token-vault/default/apikeycredentialprovider/resource-provider-api-key-gateway",
      "apiKeySecretArn": "arn:aws:secretsmanager:us-east-1:{AWS_ACCOUNT_ID}:secret:bedrock-agentcore-identity!default/apikey/resource-provider-api-key-gateway-02d581b0-L9scmD",  ....
   }
}

Please replace both values with your individual ARNs. I explained in part 2 how we handle the AWS Account ID. Now, let's create and configure the credential provider:

var apiKeyProviderArn = ConventionalDefaults.getContextVariableValueWithReplacedAccountId(this, "agentcoreIdentityOutboundApiKeyArn");

var apiKeySecretArn = ConventionalDefaults.getContextVariableValueWithReplacedAccountId(this, "apiKeySecretArn");

var apiKeyProviderConfigs = List.of(GatewayCredentialProvider          
     .fromApiKeyIdentityArn(ApiKeyCredentialProviderProps.builder()
               .providerArn(apiKeyProviderArn)
               .secretArn(apiKeySecretArn)
               .credentialLocation(ApiKeyCredentialLocation                    
                   .header(ApiKeyAdditionalConfiguration.builder()
                     .credentialParameterName("x-api-key")
                     .credentialPrefix(" ")
                     .build()))
               .build()));

GatewayTarget.Builder.create(this, "APIGATEWAY-Target-123")           
  .targetConfiguration((ApiGatewayTargetConfiguration.Builder.create()
  ...
  .credentialProviderConfigurations(apiKeyProviderConfigs)
  ...
  build();

We grab the AgentCore Identity and Secret ARNs and use them to create an API Key Credential Provider. Then we define to set the credentials within the HTTP header with the name x-api-key. This is how we secured the Amazon API Gateway. Another option that AgentCore Gateway supports is to set them as query parameters. We then set them when creating the AgentCore Target credential provider configuration.

To deploy the AgentCore Gateway, please invoke cdk deploy spring-ai-conference-search-agentcore-gateway-with-mcp-server-target-stack -c awsAccountId={YOUR_AWS_ACCOUNT_ID} -c restApiId={YOUR_API_ID}:

After having successfully executed the AgentCore Gateway deployment, we'll see our Gateway in the console:

We need to grab the Gateway URL, which ends with /mcp. We also see both Gateway targets we created:

This AgentCore Gateway exposes 7 MCP tools in total:

4 tools for the conference search provided by the MCP server from part 2 and deployed on AgentCore Runtime.
3 tools to create a talk, search for existing talks, and apply for the conference with the talk. These 3 tools are provided through the Amazon API Gateway we deployed in this article.

Now, let's extend our Conference Application MCP client that we developed in part 3, so it can use this AgentCore Gateway MCP endpoint.

The important remaining topic is designing the IAM role and permissions so that AgentCore Gateway can handle inbound and outbound authentication and communicate with the Amazon API Gateway. I'll refer you to the articles, which cover those topics:

Extend our local Conference Application MCP client

In part 3, we developed a generic local MCP client capable of talking to each MCP server. I decided to extend it to be able to configure the AgentCore Gateway endpoint. This gives us the following options:

by configuring the amazon.bedrock.agentcore.runtime.id property in the application.properties to be not a blank string, we'll still connect to the MCP server running on AgentCore Runtime. It exposes only 4 MCP tools for the conference search.
by configuring the amazon.bedrock.agentcore.gateway.url property in the application.properties to be not a blank string, we'll connect to the AgentCore Gateway created previously, which exposes all 7 MCP tools. This is how we'll use it to show what is possible with that. Please make sure that amazon.bedrock.agentcore.runtime.id= is set to an empty string.
by configuring both properties, amazon.bedrock.agentcore.runtime.id takes precedence. This is how I implemented the logic in the SpringAIAgentController class:

private String getMCPServerEndpoint() {
   if(!AGENTCORE_RUNTIME_ID.isBlank()) {
    return "https://bedrock-agentcore." + awsRegion + ".amazonaws.com/runtimes/"
       + AGENTCORE_RUNTIME_ID + "/invocations?qualifier=DEFAULT&accountId=" + this.getAccountId();
    } else if (!AGENTCORE_GATEWAY_URL.isBlank()) {
       return AGENTCORE_GATEWAY_URL;
    } else throw new RuntimeException(" no AgentCore Runtime Id or AgentCore Gateway URL defined");
}

You can change this logic if you wish.

Now we can use CURL or HTTPie to send some prompts. For example:

"Please provide me with the list of conferences, including their IDs, with Java topics happening in 2027, with the call for papers open today. Also, provide me with the list of my talks with this topic in the title. Finally, for each conference and talk retrieved, apply individually for the conference".

Here is an example of the request with HTTPie:

http GET http://localhost:8080/conference?prompt="Please provide me with the list of conferences, including their IDs, with Java topics happening in 2027, with the call for papers open today. Also, provide me with the list of my talks with this topic in the title. Finally, for each conference and talk retrieved, apply individually for the conference." Content-Type:text/plain.

Here is the correct LLM response:

Let's try another prompt:

http GET http://localhost:8080/conference?prompt="Please create a talk with a cool title (max 60 characters long) and description (max 300 characters long) about using Spring AI on the Amazon Bedrock AgentCore service. Then provide me with the list of conferences, including their IDs, with Java topics happening in 2026 and 2027, with the call for papers open today. Finally, for each conference, apply individually for it with the talk just created." Content-Type:text/plain.

Here is the correct LLM response again:

Cool, we created AgentCore Gateway, which gives us centralized access to the MCP tools that we need or the agent needs to accomplish the goal.

Conclusion

In this article, we looked at how to provide the MCP Tools for the Conference application via AgentCore Gateway in a centralized way.

As we saw in this and previous articles, the local MCP client for the Conference application, to talk to AgentCore Runtime or Gateway, became quite big. If we have many customers using such a client, changing and operating it can become quite challenging. That's why, in the next article, we look at how to deploy and run our MCP client on AgentCore Runtime.

Update to Spring AI 2.0

After I published this article, Spring AI 2.0 became generally available. I also used the opportunity to update the example to use Spring Boot version 4.1. You can find the working example in my spring-ai-2.0-conference-app-agent-local.

I have noticed several major differences in the implementation of the MCP local client in the SpringAIAgentController controller.

The first one is that ChatClient now requires passing the ChatOptions.Builder object to the defaultOptions method instead of the ChatOptions object itself:

var options = ToolCallingChatOptions.builder()
        .model("us.anthropic.claude-sonnet-4-6")
        .maxTokens(2000);

this.chatClient = builder.defaultOptions(options)
        ...
        .build();

private McpClientTransport getMcpClientTransport(String token) {

 var mcpServerConfig= this.getMCPServerConfig();
 var headerValue = "Bearer " + token;

 var httpRequestBuilder = HttpRequest.newBuilder()
     .header("Authorization", headerValue);

 return HttpClientStreamableHttpTransport.builder(mcpServerConfig.baseUrl)
     .connectTimeout(Duration.ofMinutes(3))
     .endpoint(mcpServerConfig.endpoint)        
     .requestBuilder(httpRequestBuilder)
     .build();
}

It also requires splitting the MCP endpoint URL into 2 parts: base URL (domain) and endpoint itself (/mcp), which we did in the application.properties:

amazon.bedrock.agentcore.gateway.base.url=https://spring-ai-conference-search-agentcore-gateway-xizwpytsgm.gateway.bedrock-agentcore.us-east-1.amazonaws.com
amazon.bedrock.agentcore.gateway.endpoint=/mcp

Lastly, Spring AI 2.0 introduced some changes to how to use the MCP tools. This is how the code looked in the previous Spring AI 1.x versions:

return this.chatClient.prompt().user(prompt)
   .tools(new DateTimeTools())
   .toolCallbacks(asyncMcpToolCallbackProvider.getToolCallbacks())
   .stream().content();

The code in Spring AI 2.0 uses the tools method, capable of accepting the local tools as well as tool callbacks as its parameters:

return this.chatClient.prompt().user(prompt)
    .tools(new DateTimeTools(),syncMcpToolCallbackProvider.getToolCallbacks())
    .stream().content();

Also, we need to additionally define the ToolCallingManager Spring bean in the main SpringAIConferenceLocalMCPClient class:

@Bean ToolCallingManager toolCallingManager() {
   return ToolCallingManager.builder().build();
}

Everything else remains the same.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.

Building AI Agents with Spring AI and Amazon Bedrock AgentCore - Part 3 Develop local MCP client for Conference application

Vadym Kazulkin — Mon, 11 May 2026 15:03:58 +0000

Introduction

Develop local MCP client for Conference application

You can find the source code of the MCP client in my spring-ai-1.1-conference-app-agent-local repository.

Let's go step-by-step through it.

First, in pom.xml, we include, among others, those dependencies:

spring-ai-bom - to include the general Spring AI functionality.
spring-boot-starter-web - as we develop the MCP client as a web application.
spring-ai-starter-model-bedrock-converse -as we use foundational models on Amazon Bedrock.
spring-ai-starter-mcp-client-webflux - to develop an asynchronous Spring AI MCP Client. We can use spring-ai-starter-mcp-client to develop a synchronous one.

SpringAIConferenceLocalMCPClient class is the main entry point to our application.

Second, in application.properties, we define some properties. Those are Spring AI-related:

spring.ai.bedrock.aws.region=us-east-1
spring.ai.bedrock.aws.timeout=10m
spring.ai.bedrock.converse.chat.options.max-tokens=100
spring.ai.bedrock.converse.chat.options.model=amazon.nova-lite-v1:0
spring.ai.mcp.client.type=ASYNC

We define the region where we host our application, and the timeout when talking to the Amazon Bedrock models. Then we also set the default Amazon Bedrock to use and a maximum number of tokens, and the MCP client type to ASYNC. We can also set SYNC instead, but we need to use another Spring AI MCP client dependency as described above.

We also include some application-related properties:

cognito.user.pool.name=UserPoolForAgentCoreMCP
cognito.user.pool.client.name=UserPoolClientWithUserAndPasswordForAgentCoreMCP
cognito.auth.token.resource.server.id=AgentCoreResourceServerId
amazon.bedrock.agentcore.runtime.id=spring_ai_conference_search_agentcore_runtime-6dnMIL9455

These are individual properties whose values we need to set from the deployment of the Conference search MCP server. We described the configuration, creation process, and those properties of the MCP server in part 2.

Please ignore other properties like amazon.bedrock.agentcore.gateway.url as we will need them when we extend our application in the next articles.

The whole application logic is in the SpringAIAgentController class.

We inject the values of individual properties and build AWS service clients (STS and Cognito). This is how we create the ChatClient, which is the main interface of Spring AI to talk to the LLMs:

public SpringAIAgentController(ChatClient.Builder builder, ChatMemory chatMemory, @Value("${aws.region}") String awsRegion) {
   var options = ToolCallingChatOptions.builder()
    .model("us.anthropic.claude-sonnet-4-6")
    .maxTokens(2000)
    .build();

    this.chatClient = builder.defaultOptions(options).build();
}

We show here that we can optionally build ToolCallingChatOptions and override the default model name and the maximum number of tokens defined in application.properties. Then, we build the ChatClient and can optionally set ToolCallingChatOptions.

Below is how the code for the method looks, which will receive the prompt from the user:

@GetMapping(value = "/conference", consumes = "text/plain")
public Flux<String> conferenceSearch(@RequestParam String prompt) {
  var token = getAuthTokenViaHttpClient();
  var client = McpClient.async(getMcpClientTransport(token)).build();
  client.initialize();
  var toolsResult = client.listTools(); 
  for (var tool : toolsResult.block().tools()) { 
    logger.info("tool found " + tool); 
  }

  var asyncMcpToolCallbackProvider = AsyncMcpToolCallbackProvider.builder()
     .mcpClients(client)
     .build();


  return this.chatClient.prompt().user(prompt)  
        .tools(new DateTimeTools())
        .toolCallbacks(asyncMcpToolCallbackProvider.getToolCallbacks())
        .stream()
        .content();
}

Let's break this code down and explain it. First, we need to obtain the JWT token:

var token = getAuthTokenViaHttpClient();

This, in turn, uses a bunch of Amazon Cognito services to achieve this goal:

private String getAuthTokenViaHttpClient() {
  var userPool = getUserPool();
  var userPoolClient = getUserPoolClient(userPool);
  var userPoolClientType = describeUserPoolClient(userPoolClient);
  var userPoolId = userPool.id();
  userPoolId = userPoolId.replace("_", "").toLowerCase();
  var url = "https://" + userPoolId + ".auth." + Region.US_EAST_1.id() + ".amazoncognito.com/oauth2/token";

  var SCOPE_STRING = RESOURCE_SERVER_ID + "/*";
  var entity = "grant_type=client_credentials&" + "client_id=" + userPoolClientType.clientId() + "&"
    + "client_secret=" + userPoolClientType.clientSecret() + "&" + "scope=" + SCOPE_STRING;

  try (var httpClient = HttpClients.createDefault()) {
     var httpPost = ClassicRequestBuilder.post(url)
       .setHeader("Content-Type", "application/x-www-form-urlencoded").setEntity(entity).build();
     return httpClient.execute(httpPost, new AuthTokenResponseHandler());       
}

Here, we use the configuration of the user (client ) names and the resource server ID from application.properties to obtain the user (client) pool. Then we construct the URL and the body (entity) of the HTTP request to obtain the authentication token. After that, we execute this request and obtain the token from the response:

private class AuthTokenResponseHandler implements HttpClientResponseHandler<String> {
@Override
  public String handleResponse(ClassicHttpResponse response) throws HttpException, IOException {
    var inputStream = response.getEntity().getContent();
    var responseString = new String(inputStream.readAllBytes(), StandardCharsets.UTF_8);
    var responseMap = objectMapper.readValue(responseString, new TypeReference<Map<String, Object>>() {});
    return (String) responseMap.get("access_token");
   }
}

After we have obtained the token, we're ready to create the (asynchronous as configured) MCP client:

  var client = McpClient.async(getMcpClientTransport(token)).build();

Let's describe what happens when we invoke the getMcpClientTransport method:

private McpClientTransport getMcpClientTransport(String token) {        
  var MCP_SERVER_ENDPOINT= this.getMCPServerEndpoint();
  var headerValue = "Bearer " + token;
  var webClientBuilder = WebClient.builder()
     .defaultHeader("Authorization", headerValue)
     .defaultHeader("accept","application/json, text/event-stream")
     .defaultHeader("Content-Type","application/json");
     return WebClientStreamableHttpTransport
       .builder(webClientBuilder)
       .endpoint(MCP_SERVER_ENDPOINT).build();
}

We first construct the MCP_SERVER_ENDPOINT URL from the AgentCore Runtime ID configured in application.properties. In the next article, I'll add the use case to also add the AgentCore Gateway URL. Then, we create the WebClientBuilder by passing some HTTP headers, including the bearer token. After that, we create WebClientStreamableHttpTransport and set the web client builder and the MCP server endpoint. It's important to use the HTTP Streamable web client because AgentCore Runtime (and Gateway) only supports it.

If we use the public AgentCore Gateway (no authentication) or the Gateway with IAM authentication, we can simplify our code. In this case, we can declare the Gateway endpoint in the application.properties and autowire the MCP (a)synchronous client. I refer to the article for the usage example.

Now we are ready to initialize our MCP client and obtain the list of tools from it:

client.initialize();
var toolsResult = client.listTools(); 
for (var tool : toolsResult.block().tools()) { 
    logger.info("tool found " + tool); 
}

We get all 4 tools that our Conference Search application from part 2 exposes, which we deployed on AgentCore Runtime.

Next, we need to create the list of tool callbacks from the MCP Client to pass to the ChatClient:

var asyncMcpToolCallbackProvider = AsyncMcpToolCallbackProvider.builder()
     .mcpClients(client)
     .build();

If you don't need all the tools, you can filter them and, for example, only leave those tools whose name contains Conference_Search_Tool_By_Topic as a substring, as shown below:

var asyncMcpToolCallbackProvider = 
AsyncMcpToolCallbackProvider.builder().mcpClients(client)
  .toolFilter(new McpToolFilter() {              
       @Override public boolean test(McpConnectionInfo info, Tool tool) { 
        return tool.name().toLowerCase()
                .contains("Conference_Search_Tool_By_Topic"); 
             } 
         }
      )
    .build();

Next, to enable search prompts such as "Please provide me with the list of conferences including their IDs, with Java topic happening in 2027, with call for papers open today", we need to obtain the current date. LLM doesn't know the current date, and for this, I wrote a small tool with the name DateTimeTools :

@Tool(description = "Get the current date ")
String getLocalDate() {
        return LocalDate.now().toString();       
}

It contains only one tool to get the current date. Then, we pass this local tool to the ChatClient by invoking the tools method. We also pass the tool callback list from the AsyncMcpToolCallbackProvider by invoking the toolCallbacks method. The last step is to use the ChatClient with the given prompt and tool (callbacks) to produce an answer to the prompt. This answer will be streamed back to the user:

  return this.chatClient.prompt().user(prompt)  
   .tools(new DateTimeTools())
   .toolCallbacks(asyncMcpToolCallbackProvider.getToolCallbacks())
   .stream()
   .content();

Let's build our application with mvn clean package and start it with: mvn spring-boot:run.

Now we can use CURL or HTTPie to send some prompts. For example:

"Please provide me with the list of conferences, including their IDs, with Java topics happening in 2027".

Here is an example of the request with HTTPie:

http GET http://localhost:8080/conference?prompt="Please provide me with the list of conferences, including their IDs, with Java topics happening in 2027" Content-Type:text/plain.

Here is the correct LLM response:

As you can see from the description and logs, the LLM used the tool Conference_Search_Tool_By_Topic_And_Date from the MCP server to produce the answer. Let's try another prompt:

http GET http://localhost:8080/conference?prompt="Please provide me with the list of conferences, including their IDs, with Java topics happening in 2026 and 2027, with the call for papers open today" Content-Type:text/plain.

Here is the correct LLM response again:

As you can see from the description and logs, the LLM used the tools to produce the answer. Conference_Search_Tool_By_Topic_Date_CFP_Open from the MCP server and the local tool Get_The_Current_Date to produce the answer.

Conclusion

In this article, we developed the (MCP-) client, capable of talking to our application running on AgentCore Runtime. In the next article, we'll look at another alternative to AgentCore Runtime to host MCP servers on AgentCore Gateway. We'll also compare both alternatives. In one of the next articles, I'll show you how to deploy and run this MCP client on the AgentCore Runtime as well, using the HTTP protocol. It's not always appropriate to work with the client locally.

Update to Spring AI 2.0

I have noticed several major differences in the implementation of the MCP local client in the SpringAIAgentController controller.

The first one is that ChatClient now requires passing the ChatOptions.Builder object to the defaultOptions method instead of the ChatOptions object itself:

var options = ToolCallingChatOptions.builder()
        .model("us.anthropic.claude-sonnet-4-6")
        .maxTokens(2000);

this.chatClient = builder.defaultOptions(options)
        ...
        .build();

private McpClientTransport getMcpClientTransport(String token) {

 var mcpServerConfig= this.getMCPServerConfig();
 var headerValue = "Bearer " + token;

 var httpRequestBuilder = HttpRequest.newBuilder()
     .header("Authorization", headerValue);

 return HttpClientStreamableHttpTransport.builder(mcpServerConfig.baseUrl)
     .connectTimeout(Duration.ofMinutes(3))
     .endpoint(mcpServerConfig.endpoint)        
     .requestBuilder(httpRequestBuilder)
     .build();
}

Lastly, Spring AI 2.0 introduced some changes to how to use the MCP tools. This is how the code looked in the previous Spring AI 1.x versions:

return this.chatClient.prompt().user(prompt)
   .tools(new DateTimeTools())
   .toolCallbacks(asyncMcpToolCallbackProvider.getToolCallbacks())
   .stream().content();

The code in Spring AI 2.0 uses the tools method, capable of accepting the local tools as well as tool callbacks as its parameters:

return this.chatClient.prompt().user(prompt)
    .tools(new DateTimeTools(),syncMcpToolCallbackProvider.getToolCallbacks())
    .stream().content();

Also, we need to additionally define the ToolCallingManager Spring bean in the main SpringAIConferenceLocalMCPClient class:

@Bean ToolCallingManager toolCallingManager() {
   return ToolCallingManager.builder().build();
}

Everything else remains the same.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.

Building AI Agents with Spring AI and Amazon Bedrock AgentCore - Part 2 Deploy Conference Search application on AgentCore Runtime

Vadym Kazulkin — Mon, 04 May 2026 14:23:19 +0000

Introduction

In the article Introduction to Spring AI, we introduced the sample application to search for conferences. We also exposed its functionality as a set of MCP-compatible tools. In the article Explore Spring AI MCP Server with Streamable HTTP protocol, we ran this application as an MCP-Server locally and connected to it using the MCP Inspector or Amazon Q Developer.
Of course, running the application locally is not an enterprise-ready solution. That's why, in this article, we'll explain how to deploy and run our conference search application on the Amazon Bedrock AgentCore Runtime as the MCP server.

Adjustments to the conference search application

I decided to make some adjustments to the conference search application, which will act as the MCP server by exposing its functionality through tools. Please review the above-mentioned to gain a basic understanding of how to use the Spring AI framework with its rich set of features, including the MCP client and server functionality. You can find the updated version of our application in the spring-ai-1.1-conference-search-app-bedrock-agentcore-runtime-mcp-server repository.

I updated the examples to use Java 25 and recent Spring Boot 4 and Spring AI 1.1.x versions. You can update it to the newest minor versions if you wish. And there is the Spring AI 2.x branch for Spring Boot 4 applications. The last one is currently in development and not GA. When it's released, I'll also provide my examples for the Spring AI 2.x version.

I also adjusted the static list of conferences to search for. Additionally, I updated the conference properties to set the conference (fake) dates in the future (the previous ones were mostly for 2025). And I also added 3 additional properties: conferenceId, callForPapersStartDate, and callForPapersEndDate. This enables us to search not only for all conferences, conferences by topic, and additionally by the date range, but also for the date when the call for papers is still open. In the course of the series, I'll use this functionality to apply for the conference when we extend our application.

With this, the Conference domain class looks like this:

public record Conference (Integer conferenceId, String name, Set<String> topics, String homepage, 
        LocalDate startDate, LocalDate endDate, LocalDate callForPapersStartDate, LocalDate callForPapersEndDate, 
        String city, String linkToCallforPapers) {
}

I also added one additional tool in the ConferenceSearchTool.

It's responsible for answering the following prompt: "Please provide me with the list of conferences, including their IDs, with a Java topic happening in 2027, with a call for papers open today." Here is how it's implemented:

@Tool(name = "Conference_Search_Tool_By_Topic_Date_CFP_Open", description = "Search for the conference list for exactly one topic provided, conference dates and the call for papers still open on the given date")
public Set<Conference> search(@ToolParam(description = "conference topic") String topic,
            @ToolParam(description = " the conference earliest start date") LocalDate earliestStartDate,
            @ToolParam(description = " the conference latest start date") LocalDate latestStartDate,
            @ToolParam(description = " the call for papers still open on this date") LocalDate callForPapersStillOpenOnThisDate) {

this.conferences.stream()
   .filter(c -> c.topics().contains(topic))
   .filter(c -> isConferenceStartDateInDateRange(c, earliestStartDate, latestStartDate))
   .filter(c -> isCallForPapersOpenOnThisDate(c, callForPapersStillOpenOnThisDate))
   .collect(Collectors.toSet());
}

We can run this updated version of the application locally as the MCP server, as described in the Explore Spring AI MCP Server with Streamable HTTP protocol.

Deploying the conference search application on the Amazon Bedrock AgentCore Runtime

I've written the whole article series about this service. So I refer to it for the overview of this service. AgentCore Runtime also lets us deploy and run Model Context Protocol (MCP) servers in the AgentCore Runtime; see Deploying MCP servers in AgentCore Runtime. In the next article, we'll develop the (MCP-) client, capable of talking to our application (MCP server).

One important thing is to understand How Amazon Bedrock AgentCore supports MCP. AgentCore supports both stateless and stateful streamable-HTTP MCP servers. By default, stateless mode (stateless_http=True) is recommended for basic MCP servers. The platform automatically adds an Mcp-Session-Id header for any request without one, so MCP clients can maintain connection continuity to the same Amazon Bedrock AgentCore Runtime session. Spring AI also supports Stateless Streamable-HTTP MCP Servers. To configure them, we need to add some properties to application.properties :

spring.ai.mcp.server.type=SYNC
spring.ai.mcp.server.protocol=STATELESS
server.port=8000
server.address=0.0.0.0

I tried to automate as much as possible for the IaC with AWS CDK for Java. Please read the article Getting started with the AWS CDK for the overview and installation. I usually use AWS SAM, but it currently doesn't have Bedrock AgentCore support. CDK AgentCore L2 construct is currently still alpha. Even with CDK, it turned out to be challenging because of the discovered issues and difficulties in fully automating roles, permissions, and Docker image creation with IaC. I'll give some guidance on how to proceed. You can find the whole IaC in the spring-ai-1.1-conference-app-bedrock-agentcore-cdk repository.

Let's first comment out the definition of the GatewayTargetStack stack in the CDKApp class:

public interface CDKApp {

String appName = "spring-ai-conference-search-agentcore";

static void main(String... args) {
   var app = new App();
   new UserClientPoolStack(app, appName, stackProperties());
   new RuntimeWithMCPStack(app, appName, stackProperties());
   //new GatewayTargetStack(app, appName, stackProperties());
   app.synth();  
 }

It contains the Stack using the AgentCore Gateway service, which we'll explore in later articles. AgentCore Gateway also provides the functionality of the managed MCP server. I'll then give some recommendations on when to use the Runtime (directly) and when to use the Gateway.

Now, let's take a look at the RuntimeWithMCPStack, which we'll deploy later:

 var runtime = Runtime.Builder.create(this, "MCPRuntime-123")
    .runtimeName(appName.replace("-", "_")+ "_runtime")               
    .authorizerConfiguration(RuntimeAuthorizerConfiguration.usingJWT(UserClientPoolStack.COGNITO_DISCOVERY_URL, List.of(UserClientPoolStack.userPoolClient.getUserPoolClientId()), null))
                .description("AgenCore Runtime with MCP protocol for running conference search app")
                .protocolConfiguration(ProtocolType.MCP)
                .agentRuntimeArtifact(agentRuntimeArtifact)
                .executionRole(role)
                .build();

  CfnOutput.Builder.create(this, "RuntimeIdOutput").value(runtime.getAgentRuntimeId()).build();

We start with some easy parts: we give the AgentCore runtime a name and description, and define the protocol as MCP. Finally, the deployed runtime ID will be placed as the output variable RuntimeIdOutput. We'll see it in the console after the deployment of this stack is finished.

Let's cover the artifact part. You can automate the steps of building the Docker file, uploading it to the Amazon Elastic Container Registry, and referencing the image URL completely. The AgentRuntimeArtifact class offers different from* methods (fromCode, fromAsset, and so on). I prefer to do those steps separately and only reference the image URI. This is how publishing to ECR works :

# build the application
mvn clean package 

# build the Docker image
sudo docker build --no-cache -t spring-ai-1.1-conference-search-bedrock-agentcore-runtime-mcp-server:v1 

# Login to ECR
aws ecr get-login-password --region {region} | sudo docker login --username AWS --password-stdin {account_id}.dkr.ecr.{region}.amazonaws.com  

# Create ECR repository (if it doesn't exist)
aws ecr create-repository --repository-name spring-ai-1.1-conference-search-bedrock-agentcore-runtime-mcp-server --image-scanning-configuration scanOnPush=true --region {region}  

# Tag the Docker image
sudo docker tag spring-ai-1.1-conference-search-bedrock-agentcore-runtime-mcp-server:v1 {account_id}.dkr.ecr.{region}.amazonaws.com/spring-ai-1.1-conference-search-bedrock-agentcore-runtime-mcp-server:v1

# Push the Docker Image to the ECR repository
sudo docker push {account_id}.dkr.ecr.{region}.amazonaws.com/spring-ai-1.1-conference-search-bedrock-agentcore-runtime-mcp-server:v1

Please replace AWS {account_id} and {region} with our own values. Also, your version may not be v1 but a different one.

We can also build the Docker image by using Buildpack support built into Spring instead of a Dockerfile. Just use the Maven task spring-boot:build-image.

Let's look at the relevant code parts to assign this code artifact to the AgentCore Runtime:

var ecrImageURI=ConventionalDefaults
.getContextVariableValueWithReplacedAccountId(this, "ecrImageURIForConferenceSearchAndApplicationAppAsMCPServer");          
var agentRuntimeArtifact = AgentRuntimeArtifact.fromImageUri(ecrImageURI);

Runtime.Builder.create(this, "MCPRuntime-123")
  .runtimeName(appName.replace("-", "_")+ "_runtime")
  ...                                
  .agentRuntimeArtifact(agentRuntimeArtifact)
  ...
  .build();

First, we get the value of the variable ecrImageURIForConferenceSearchAndApplicationAppAsMCPServer, which points to the imageURI in the ECR. This is typically done in the cdk.json:

{
  "app": "mvn -e -q compile exec:java",
  "context": {
      "ecrImageURIForConferenceSearchAndApplicationAppAsMCPServer": "{AWS_ACCOUNT_ID}.dkr.ecr.us-east-1.amazonaws.com/spring-ai-1.1-conference-search-bedrock-agentcore-runtime-mcp-server:v17",
...
 }
}

Let's ignore all the content variables we defined there for a moment. Please adjust the value so that it matches your imageURI. We use the placeholder {AWS_ACCOUNT_ID} there. The reason for it is that I don't want to expose the AWS account ID publicly. That's why I wrote the following utility method getContextVariableValueWithReplacedAccountId in the ConventionalDefaults class to replace the placeholder with the real value :

static String getContextVariableValueWithReplacedAccountId(Stack stack, String contextVariableName) {
   var awsAccountId=(String)stack.getNode().tryGetContext("awsAccountId");
   if(awsAccountId == null || awsAccountId.trim().isEmpty()) {
      System.out.println("please provide your aws account id as as content to the call, for example: cdk deploy -c awsAccountId=1234567890101");
    }
   var contextVariableValue= getContextVariableValue(stack, contextVariableName);
   return replaceAWSAccountID(contextVariableValue, awsAccountId);
 }

static String getContextVariableValue(Stack stack, String contextVariableName) {
   return (String)stack.getNode().tryGetContext(contextVariableName);
 }

private static String replaceAWSAccountID(String configParam, String awsAccountId) {
   return configParam.replace("{AWS_ACCOUNT_ID}", awsAccountId);
}

The command to deploy this stack later is:

cdk deploy spring-ai-conference-search-agentcore-runtime-with-mcp-server-stack -c awsAccountId={YOUR_AWS_ACCOUNT_ID}

Don't do it now, as we first need to create inbound authentication.

spring-ai-conference-search-agentcore-runtime-with-mcp-server-stack is the name of our stack, and you need to pass your AWS account ID. Here, I assume you operate everything (AgentCore, IAM Role, ECR) in the same AWS account. Otherwise, you'll need to adjust the code to adapt to your needs.

Now, let's cover the part of defining the authorizer configuration and assigning it to the AgentCore Runtime. This configuration is responsible for creating the inbound authentication type. As we deploy our application on the Runtime publicly, we need to secure the access. For the Runtime MCP protocol, there are inbound authentication types :

IAM permissions - This will use the IAM username that you used to sign in to the AWS console)
JSON Web Tokens (JWT) - Configure JWT (like an OAuth token) as the Inbound Auth to validate incoming token signatures and scopes.

We'll use JWT issued by Amazon Cognito as an identity provider. For this, we need to define the Discovery URL from Cognito and JWT Authorization Configuration ( "allowed client IDs"); see the relevant code from the RuntimeWithMCPStack class:

 runtime = Runtime.Builder.create(this, "MCPRuntime-123")
   .runtimeName(appName.replace("-", "_")+ "_runtime")               
 .... 
 .authorizerConfiguration(RuntimeAuthorizerConfiguration
 .usingJWT(UserClientPoolStack.COGNITO_DISCOVERY_URL,  
 List.of(UserClientPoolStack.userPoolClient.getUserPoolClientId()), null))
 ...
 .build();

But how do we get those values? For this, we need to set up an Amazon Cognito user pool, user domain (to use the JWT token), and user client pool. I define all this in the UserClientPoolStack.

I'll leave it up to you to understand this stack in detail, because it requires Cognito knowledge and is not strictly related to AgentCore. But the basic steps are:

Create a user pool with the given ID.
Create a resource server with the scope (I created the full access scope).
Add the resource server to the already created user pool.
Construct the discovery URL, which always has a predefined schema: https://cognito-idp."+{region}+".amazonaws.com/"+{userPoolId}+"/.well-known/openid-configuration".
Create a user client pool with the given name with only the default user flow, client credentials, and the scopes with the resource server we defined for the user pool. Add the already created user pool to the user client pool and generate the secret for it.
Add the domain to the user pool we created to issue the token.

Initially, I thought I could automate this part completely. We don't even need to run the UserClientPoolStack stack individually, as we made the COGNITO_DISCOVERY_URL and the userPoolClient publicly there:

public static String COGNITO_DISCOVERY_URL;
public static UserPoolClient userPoolClient;

We also used them both from the RuntimeWithMCPStack as shown in the example above. With that, CDK understands that the RuntimeWithMCPStack stack depends on the UserClientPoolStack stack and executes the latter automatically first.

What should have worked out of the box is to create the domain prefix from the user pool ID. By definition, the prefix should be the user pool ID with lowercase letters, and the character _ stripped:

userPool.addDomain("UserPoolForAgentCoreMCPDomain", UserPoolDomainOptions.builder()
     .cognitoDomain(CognitoDomainOptions.builder()
     .domainPrefix(userPoolId.replace("_", "").toLowerCase()).build()).build());

Cognito doesn't accept setting other domain prefixes. But unfortunately, I encountered one issue with the creation of the user pool domain, which I described here. The only workaround I currently found was to comment out the user domain creation in the UserClientPoolStack :

/*
userPool.addDomain("UserPoolForAgentCoreMCPDomain", UserPoolDomainOptions.builder()
   .cognitoDomain(CognitoDomainOptions.builder()
   .domainPrefix(cognitoDomainPrefix.replace("_", "")
      .toLowerCase()).build()).build());
*/

Then, execute this stack individually: cdk deploy spring-ai-conference-search-agentcore-user-client-pool-stack -c awsAccountId={YOUR_AWS_ACCOUNT_ID}.

Then, grab the value of the output variable CognitoUserPoolIdOutput and configure it in the cdk.json :

{
  "app": "mvn -e -q compile exec:java",
  "context": {
      "cognitoDomainPrefix":"us-east-1_JbjQPT5GJ",
      ...
  }
}

Finally, uncomment the user domain creation, which uses the value of this variable to construct the domain name :

 var cognitoDomainPrefix=ConventionalDefaults
  .getContextVariableValue(this, "cognitoDomainPrefix");
 userPool.addDomain("UserPoolForAgentCoreMCPDomain", UserPoolDomainOptions.builder()
   .cognitoDomain(CognitoDomainOptions.builder()
   .domainPrefix(cognitoDomainPrefix.replace("_", "")
   .toLowerCase()).build()).build());

And re-run the command: cdk deploy spring-ai-conference-search-agentcore-user-client-pool-stack -c awsAccountId={YOUR_AWS_ACCOUNT_ID}.
When AWS has fixed the issue with the domain prefixes, we can completely remove this workaround. We also won't need to deploy this stack separately.

Now let's cover the last missing part - defining the IAM execution role.
It's very difficult to automate this part as it takes plenty of time. If I find it, I'll provide the IaC part in the future :). I refer you to the article IAM Permissions for AgentCore Runtime for more information. You can also read my article Amazon Bedrock AgentCore Runtime - Part 2 Using Bedrock AgentCore Runtime Starter Toolkit with Strands Agents SDK, where I explained this part. In that article, we developed the agent in Python with the Strands Agents framework and deployed it on AgentCore Runtime.

Once we have defined the IAM role, we need to configure it in the cdk.json :

{
  "app": "mvn -e -q compile exec:java",
  "context": {
      "roleArnForTheAgentCoreRuntime": "arn:aws:iam::{AWS_ACCOUNT_ID}:role/service-role/AmazonBedrockAgentCoreRuntimeDefaultServiceRole-q8xp1",
    ....
   }
}

   var roleArnForTheAgentCoreRuntime=ConventionalDefaults
  .getContextVariableValueWithReplacedAccountId(this, "roleArnForTheAgentCoreRuntime");

   role=Role.fromRoleArn(this,"roleArnForTheAgentCoreRuntimeRole", roleArnForTheAgentCoreRuntime);

   Runtime.Builder.create(this, "MCPRuntime-123")
     .runtimeName(appName.replace("-", "_")+ "_runtime")
     ...
     .executionRole(role)
     .build();

Now we're completely ready and can deploy the conference-search-agentcore-runtime-with-mcp-server-stack stack with: cdk deploy spring-ai-conference-search-agentcore-runtime-with-mcp-server-stack -c awsAccountId={YOUR_AWS_ACCOUNT_ID}.

We'll need some values for the configuration of the (Spring AI) MCP client, which we'll cover in the next article:

user pool name, user client pool name, and auth token resource server ID, which we defined as constants in the UserClientPoolStack. You can also see them in the output of the cdk deploy command.
agentcore runtime ID from the RuntimeWithMCPStack. This value will only be there after the deployment of this stack. You can also see it in the output of the cdk deploy command (variable name RuntimeIdOutput).

Here is how the AgentCore Runtime looks in the console after its creation:

Conclusion

In this article, we explained how to deploy and run our conference search application on the Amazon Bedrock AgentCore Runtime as the MCP server. In the next article, we'll develop the (MCP-) client, capable of talking to our application running on AgentCore Runtime.

Update to Spring AI 2.0

The only change I need to make in the application is to comment out the following code in the SpringConferenceSearchMCPServerApplication class :

/*
@Bean
public List<ToolCallback> conferenceSearchTools(ConferenceSearchTools conferenceSearchTool) {
   return List.of(ToolCallbacks.from(conferenceSearchTool));
}
*/

With Spring AI 2.0, all methods annotated with @McpTool will be automatically exposed as tool callbacks. In our case, all these tools are located in the ConferenceSearchTools class. You can reuse the same IaC repository.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.

Building AI Agents with Spring AI and Amazon Bedrock AgentCore - Part 1 Introduction to the series

Vadym Kazulkin — Mon, 27 Apr 2026 12:16:00 +0000

Introduction to the series

I've already started the article series Spring AI with Amazon Bedrock, where I've published articles to :

Introduce to Spring AI and the sample application to search for technical conferences.
Explore Spring AI MCP Server with STDIO protocol.
Explore Spring AI MCP Server with SSE protocol.
Explore Spring AI MCP Server with Streamable HTTP protocol.
Explore Amazon Bedrock AgentCore with Spring AI. Here, I used another sample application, which I implemented in Python with the Strands Agents framework and ported the parts of it to Spring AI. I deployed the application on the AgentCore Runtime. The application also used Spring AI MCP Client to talk to the AgentCore Gateway. It acts as the managed MCP server to expose the functionality provided by another application as MCP-compatible tools. This application stores and retrieves orders, which I implemented with API Gateway, Lambda, and Aurora DSQL.

Why did I decide to start a separate article series to cover building AI Agents with Spring AI and Amazon Bedrock AgentCore if the last-mentioned article also covers it? Because there is more to cover and to be released by AWS and Broadcom (the company behind the Spring development). I'll use the conference application example to cover the following topics in this series:

Deploy Spring AI MCP server on AgentCore Runtime with MCP protocol instead of locally, as mentioned in the examples above.
Discuss the use case where it's more beneficial to deploy the MCP server on AgentCore Gateway instead of AgentCore Runtime.
Use Spring AI MCP client to talk to the MCP server deployed on AgentCore Runtime and AgentCore Gateway. This MCP client itself can be deployed either locally or on the AgentCore Runtime.
Explore the functionality of the Spring AI AgentCore. It provides easier integration between Spring AI and the Amazon Bedrock AgentCore services, such as the Runtime, but also short-term, long-term, and episodic AgentCory Memory. In my example to explore Amazon Bedrock AgentCore with Spring AI, I didn't use AgentCore Memory at all, as such integration was an immense effort. With Spring AI AgentCore Memory, this integration becomes much easier.
How to set up so-called collector-less Observability for the Amazon Bedrock AgentCore resources using AWS Distro for OpenTelemetry (ADOT) SDK for Spring AI applications hosted in AgentCore Runtime.
Last but not least, I'll update the examples to use Java 25, Spring Boot 4, and the recent Spring AI version. There is a Spring AI 1.1* branch for Spring Boot versions before Spring Boot 4. And there is the Spring AI 2.x branch for Spring Boot 4 applications. The last one is currently in development and not GA. When it's released, I'll also provide my examples for the Spring AI 2.x version.

You can already preview some of my examples, where I'll cover the above-mentioned topics in my amazon-bedrock-agentcore-spring-ai GitHub repository.

If you like my content, please follow me on GitHub and give my repositories a star!

Please also check out my website for more technical content and upcoming public speaking activities.