AgentCore, One Primitive at a Time

An agent harness wraps a model with tools, context, memory, persistence, safety, recovery, and orchestration. The model reasons; the harness makes it operational.

AgentCore Gateway is a managed front door between agents and tools. It handles inbound auth, outbound auth, and protocol translation once, so any API or Lambda becomes an MCP tool that every connected agent can call. Here is how the wiring actually works.

Amazon Bedrock AgentCore is not one service — it is a set of primitives you can use à la carte. Here is the map: what each piece does, which problem it solves, and how they compose, so the names stop blurring together.

When you expose a tool to agents through an AgentCore Gateway, the real decision is who is allowed to call it — SigV4/IAM for callers inside your AWS boundary, or a JWT authorizer for everyone else. Here are the three patterns and when each fits.

A valid token proves who is calling. AgentCore Policy is a Cedar engine on the gateway that answers who-may-call-what per user, per tool, per argument — default-deny, before the tool runs. I wired one up and watched it allow, then deny, the same call.

AgentCore is a governed server-side hub: Runtime hosts the agent, Gateway authorizes tool calls, and Identity hands token exchange to the provider.

AgentCore Runtime hosts each agent session in a managed microVM behind an HTTP server contract. Seven test sessions ran with zero errors.

Harness gives you a working agent in 20 seconds with 25 lines of configuration. Runtime takes 398 lines of code. Both run on the same compute. The graduation trigger that matters is not hooks or custom loops — it's per-user outbound identity.

AgentCore Memory recalled preferences across microVM sessions and isolated three tenants, but asynchronous extraction can briefly return stale values.

Two agents shared context through one AgentCore Memory store while actor namespaces isolated a third. Semantic extraction required a two-turn exchange.

Semantic search finds things that sound related. Sometimes you need a WHERE clause instead — filter by priority, by date, by category. I tested metadata filtering in AgentCore Memory and found a quiet gate: custom keys silently drop unless declared as indexed keys. Here's what works and what decides whether any of it works at all.

AgentCore Code Interpreter ran a Pareto frontier over 528 models and matched the known-good result; tampering collapsed 13 results to one.

AgentCore Gateway now ships a native bedrock-knowledge-bases connector that replaces the Lambda wrapper entirely. Attach the KB to the Gateway and it auto-exposes Retrieve and AgenticRetrieveStream over MCP. The constraint: it only works with Managed Knowledge Bases, not customer-managed ones.

Amazon Bedrock AgentCore WebSearch is a managed MCP connector backed by an Amazon-operated index, authorized through IAM, and priced at $7 per 1,000 queries.

Bedrock models reason; AgentCore hosts, remembers, authorizes, and observes. Four use-case architectures show how the managed harness fits together.

An agent that only calls APIs hits a wall when the answer lives in a rendered page, a computation, or last month's session. I wired a four-tool loop inside an AgentCore Runtime — search, browser, Code Interpreter, Memory — and ran it live. The prescriptive prompt is the product surface; the infrastructure is fixed.

Hardcoded runtime ARNs are the visible pain, and Registry does fix them — but agent discovery is fundamentally a governance problem, not a routing problem.

I built a test suite for a support agent and found three classes of bugs that escape human review, output-quality scoring, and code review — and the regressions they taught me how to catch permanently.

Eight AgentCore debugging lessons cover dead runtimes, missing spans, cross-agent loops, protocol noise, cold starts, and off-runtime telemetry.

Some tasks only exist on a screen. The reflex is to run Playwright on a box. AgentCore Browser is the managed alternative: a per-session, isolated Chromium you drive over CDP, with session isolation, live-view human takeover, and replay-to-S3 audit built in. Here's what the primitive is, how you reach it, and the ceiling it doesn't cross.

AgentCore Browser supplies governed Chromium; Browser Use adds a natural-language agent and cached reruns. Eleven experiments expose the tradeoffs.