AWS bedrock-agentcore documentation change
Summary
Added new section 'MCP session management and microVM stickiness' explaining how the Mcp-Session-Id header is used for session state management and routing requests to the same microVM instance for both stateless and stateful MCP modes.
Security assessment
The change documents session management and routing behavior for performance optimization (avoiding cold starts). There is no mention of security vulnerabilities, authentication, authorization, or data protection. The focus is on session affinity and latency reduction.
Diff
diff --git a/bedrock-agentcore/latest/devguide/runtime-mcp-protocol-contract.md b/bedrock-agentcore/latest/devguide/runtime-mcp-protocol-contract.md index 890d19fc2..6fdd53248 100644 --- a//bedrock-agentcore/latest/devguide/runtime-mcp-protocol-contract.md +++ b//bedrock-agentcore/latest/devguide/runtime-mcp-protocol-contract.md @@ -40,0 +41,36 @@ Amazon Bedrock AgentCore also supports stateful MCP servers (`stateless_http=Fal +### MCP session management and microVM stickiness + +The Model Context Protocol (MCP) uses the `Mcp-Session-Id` header to manage session state and route requests. For the MCP specification, see [MCP Streamable HTTP Transport](https://modelcontextprotocol.io/specification/2025-03-26/basic/transports#streamable-http). + +**MicroVM Stickiness** : Amazon Bedrock AgentCore uses the `Mcp-Session-Id` header to route requests to the same microVM instance. Clients must capture the `Mcp-Session-Id` returned in the response and include it in all subsequent requests to ensure session affinity. Without a consistent session ID, each request may be routed to a new microVM, which may result in additional latency due to cold starts. + +**Stateless MCP** (`stateless_http=True`): + + * Platform generates the `Mcp-Session-Id` and includes it in the request to your MCP server. + + * Your MCP server must accept the platform-provided session ID (do not reject it). + + * Platform returns the same `Mcp-Session-Id` to the client in the response. + + * Client must include this session ID in all subsequent requests for microVM affinity. + + + + +**Stateful MCP** (`stateless_http=False`): + + * Client sends the initialize request without an `Mcp-Session-Id` header. + + * Platform returns `Mcp-Session-Id` in the response. + + * Client must include this `Mcp-Session-Id` in all subsequent requests for both session state and microVM affinity. + + + + +For more details on stateful MCP session management, see the [MCP session management specification](https://modelcontextprotocol.io/specification/2025-03-26/basic/transports#session-management). + +###### Note + +In both modes, Amazon Bedrock AgentCore always returns an `Mcp-Session-Id` header to clients. Always capture and reuse this header for optimal performance. +