AWS bedrock-agentcore documentation change
Summary
Updated MCP server documentation to support both stateless and stateful modes, adding details about stateful features for multi-turn interactions
Security assessment
This change documents feature enhancements to support stateful MCP servers for advanced capabilities like elicitation and sampling. While stateful sessions could have security implications, there's no evidence this addresses a specific security vulnerability.
Diff
diff --git a/bedrock-agentcore/latest/devguide/runtime-mcp.md b/bedrock-agentcore/latest/devguide/runtime-mcp.md index 4628be2fa..e4d411e98 100644 --- a//bedrock-agentcore/latest/devguide/runtime-mcp.md +++ b//bedrock-agentcore/latest/devguide/runtime-mcp.md @@ -55 +55,3 @@ When you configure a Amazon Bedrock AgentCore Runtime with the MCP protocol, the -Amazon Bedrock AgentCore requires stateless streamable-HTTP servers because the Runtime provides session isolation by default. The platform automatically adds a `Mcp-Session-Id` header for any request without it, so MCP clients can maintain connection continuity to the same Amazon Bedrock AgentCore Runtime session. +Amazon Bedrock AgentCore supports both stateless and stateful streamable-HTTP MCP servers. By default, stateless mode (`stateless_http=True`) is recommended for basic MCP servers. The platform automatically adds an `Mcp-Session-Id` header for any request without one, so MCP clients can maintain connection continuity to the same Amazon Bedrock AgentCore Runtime session. + +For MCP servers that require multi-turn interactions (elicitation), LLM-generated content (sampling), or progress notifications, stateful mode (`stateless_http=False`) enables these capabilities. In stateful mode, the runtime preserves MCP session state across requests within the same invocation. For more information, see [Stateful MCP server features](./mcp-stateful-features.html).