AWS opensearch-service documentation change
Summary
Added VPC limitation note, expanded agent support list, added 'Use without skills' section with API examples, and added 'Use with agent frameworks' section with code samples
Security assessment
The VPC note clarifies deployment limitations but doesn't address a vulnerability. New sections demonstrate feature usage without introducing security-specific content or fixing vulnerabilities.
Diff
diff --git a/opensearch-service/latest/developerguide/aws-mcp-server.md b/opensearch-service/latest/developerguide/aws-mcp-server.md index 7db2b1df6..cdbca31a0 100644 --- a//opensearch-service/latest/developerguide/aws-mcp-server.md +++ b//opensearch-service/latest/developerguide/aws-mcp-server.md @@ -7 +7 @@ -PrerequisitesInstall the pluginConfigure directlyVerify the setupSecurity considerationsTroubleshootingMore information +PrerequisitesInstall the pluginConfigure directlyWithout skillsVerify the setupSecurity considerationsTroubleshootingUse with agent frameworksMore information @@ -12,0 +13,4 @@ The AWS MCP Server is a managed Model Context Protocol server from the Agent Too +###### Note + +The AWS MCP Server connects to public Amazon OpenSearch Service endpoints. It does not support domains or collections deployed in a VPC. If your OpenSearch Service domain or OpenSearch Serverless collection uses VPC access, use the open source [opensearch-mcp-server-py](https://github.com/opensearch-project/opensearch-mcp-server-py) instead, which supports VPC connectivity through local configuration. + @@ -15 +19 @@ The AWS MCP Server is a managed Model Context Protocol server from the Agent Too - * An AI coding agent that supports the Agent Toolkit for AWS (such as Claude Code or Codex). + * An AI coding agent that supports the Agent Toolkit for AWS (such as Kiro, Claude Code, Cursor, and Codex). @@ -41 +45,28 @@ Then launch Codex and run `/plugins` to browse and install the `aws-data-analyti -If your agent does not support plugins, configure the AWS MCP Server directly. Follow _Setting up the AWS MCP Server_ in the Agent Toolkit for AWS documentation, then ask your agent an OpenSearch question – it discovers the `amazon-opensearch-service` skill at runtime through the server. +If your agent does not support plugins, configure the AWS MCP Server directly. Follow [Setting up the AWS MCP Server](https://docs.aws.amazon.com/agent-toolkit/latest/userguide/getting-started-aws-mcp-server.html) in the Agent Toolkit for AWS documentation, then ask your agent an OpenSearch question – it discovers the `amazon-opensearch-service` skill at runtime through the server. + +## Use the AWS MCP Server without skills + +You can use the AWS MCP Server directly without loading the `amazon-opensearch-service` skill. In this mode, the agent uses the server's built-in `call_aws` tool to invoke AWS API operations directly. This is useful for ad-hoc operations or when you want precise control over the API calls your agent makes. + +For example, to create an OpenSearch Serverless collection: + + + Create an OpenSearch Serverless search collection named "my-collection" in us-east-1 + +The agent calls the OpenSearch Serverless `CreateCollection` API on your behalf using your configured credentials: + + + { + "name": "my-collection", + "type": "SEARCH", + "description": "My search collection" + } + +You can also run operations against existing resources without skills. For example: + + + List all my OpenSearch Service domains in us-east-1 + Show the cluster health for my domain named production-domain + Create an index called products in my collection endpoint + +The AWS MCP Server handles authentication and translates your natural language requests into the appropriate AWS API or OpenSearch API calls. @@ -75,0 +107,74 @@ The AWS MCP Server runs with the credentials you provide. Follow these practices +## Use with agent frameworks + +You can integrate the AWS MCP Server into Python agent frameworks for programmatic workflows. The following examples connect to the AWS MCP Server endpoint, which provides authenticated access to OpenSearch and other AWS services. + +### Strands Agents + +[Strands Agents](https://strandsagents.com) is an AWS-native agent SDK with built-in MCP support and Amazon Bedrock as the default model provider. + + + import boto3 + import os + from strands import Agent + from strands.tools.mcp import MCPClient + from mcp.client.streamable_http import streamablehttp_client + + # Get credentials for signing + session = boto3.Session() + credentials = session.get_credentials().get_frozen_credentials() + + opensearch_client = MCPClient( + lambda: streamablehttp_client( + "https://aws-mcp.us-east-1.api.aws/mcp", + headers={ + "AWS_REGION": os.environ.get("AWS_REGION", "us-east-1"), + } + ) + ) + + with opensearch_client: + agent = Agent(tools=opensearch_client.list_tools_sync()) + response = agent("List all OpenSearch Service domains and show the cluster health for each") + print(response) + +### LangGraph + +[LangGraph](https://github.com/langchain-ai/langgraph) is a low-level orchestration framework for building stateful agents. The following example uses `langchain-mcp-adapters` to load AWS MCP tools into a LangGraph ReAct agent backed by Amazon Bedrock. + + + import asyncio + import os + from langchain_aws import ChatBedrock + from langchain_mcp_adapters.client import MultiServerMCPClient + from langgraph.prebuilt import create_react_agent + + async def main(): + async with MultiServerMCPClient( + { + "aws-mcp": { + "url": "https://aws-mcp.us-east-1.api.aws/mcp", + "transport": "streamable_http", + "headers": { + "AWS_REGION": os.environ.get("AWS_REGION", "us-east-1"), + }, + } + } + ) as mcp_client: + tools = mcp_client.get_tools() + model = ChatBedrock( + model_id="anthropic.claude-3-5-sonnet-20241022-v2:0", + region_name=os.environ["AWS_REGION"], + ) + agent = create_react_agent(model, tools) + result = await agent.ainvoke( + {"messages": [{"role": "user", "content": "Check cluster health and list all OpenSearch indexes"}]} + ) + print(result["messages"][-1].content) + + asyncio.run(main()) + +Install the required packages: + + + pip install langchain-aws langchain-mcp-adapters langgraph +