AWS bedrock-agentcore documentation change
Summary
Added documentation for stateful MCP server support with stateless_http=False flag, enabling session context maintenance for multi-turn interactions and sampling capabilities
Security assessment
The change introduces stateful mode capabilities but does not disclose or mitigate any specific security vulnerabilities. While session management is mentioned, this appears to be a feature enhancement rather than a security fix.
Diff
diff --git a/bedrock-agentcore/latest/devguide/runtime-mcp-protocol-contract.md b/bedrock-agentcore/latest/devguide/runtime-mcp-protocol-contract.md index 9f11e8211..0e3f2aa73 100644 --- a//bedrock-agentcore/latest/devguide/runtime-mcp-protocol-contract.md +++ b//bedrock-agentcore/latest/devguide/runtime-mcp-protocol-contract.md @@ -30 +30 @@ Your MCP server must implement these specific protocol requirements: - * **Transport** : Stateless streamable-http only \- Ensures compatibility with AWS's session management and load balancing + * **Transport** : Streamable-http transport is required. By default, use stateless mode (`stateless_http=True`) for compatibility with AWS's session management and load balancing. @@ -32 +32 @@ Your MCP server must implement these specific protocol requirements: - * **Session Management** : Platform automatically adds `Mcp-Session-Id` header for session isolation, servers must support stateless operation so as to not reject platform generated `Mcp-Session-Id` header + * **Session Management** : Platform automatically adds `Mcp-Session-Id` header for session isolation. In stateless mode, servers must support stateless operation so as to not reject platform generated `Mcp-Session-Id` header. @@ -36,0 +37,4 @@ Your MCP server must implement these specific protocol requirements: +###### Stateful MCP for elicitation and sampling + +Amazon Bedrock AgentCore also supports stateful MCP servers (`stateless_http=False`) that enable capabilities such as elicitation (multi-turn user interactions) and sampling (LLM-generated content). Stateful mode is required when your MCP server needs to maintain session context across multiple requests within the same tool invocation. For more information and examples, see [Stateful MCP server features](./mcp-stateful-features.html). +