Deploys Claude Code agents to Amazon Bedrock AgentCore Runtime using Claude models on Amazon Bedrock, with IAM-scoped access to AWS resources and optional AgentCore Gateway tools for Lambda, S3, DynamoDB, SQS, EventBridge, OpenAPI, and remote MCP servers.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@c3-gateway send a notification that the nightly deploy succeeded"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
C3 (Claude Code Cloud) is an open-source AWS CDK construct library that deploys a real Claude Code workspace to Amazon Bedrock AgentCore Runtime, with Claude models on Amazon Bedrock. You give the agent explicit, least-privilege access to your AWS resources.
Reuse your workspace as is. CLAUDE.md, .claude/agents, .claude/skills, settings.json,
hooks and .mcp.json keep working. There is no new agent DSL.
One construct. new ClaudeCodeAgent(...) lives in an ordinary CDK app. You deploy it with
cdk deploy.
Explicit AWS access. grant() adds IAM permissions. connect() exposes specific operations
as MCP tools through AgentCore Gateway. Neither does anything you did not ask for.
Open underneath. The runtime, role, gateway and targets are all regular CDK constructs, and you can reach every one of them.
C3 is an independent project. It isnot affiliated with or endorsed by Anthropic or AWS.
It is early-stage software (0.x): read Status before using it in production.
npm install c3-aws aws-cdk-lib constructsimport { App, Stack } from 'aws-cdk-lib';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as s3 from 'aws-cdk-lib/aws-s3';
import { ClaudeCodeAgent } from 'c3-aws';
const app = new App();
const stack = new Stack(app, 'Agents');
const reviewer = new ClaudeCodeAgent(stack, 'Reviewer', {
source: './agents/reviewer', // a normal Claude Code workspace
model: 'sonnet',
});
// IAM only: lets Bash/SDK scripts inside Claude Code read these objects. No tool is created.
const documents = new s3.Bucket(stack, 'Documents');
reviewer.grant(documents, { actions: ['s3:ListBucket', 's3:GetObject'], prefixes: ['documents/*'] });
// An MCP tool backed by your Lambda function, served through AgentCore Gateway.
declare const notification: lambda.IFunction;
reviewer.connect(notification, {
name: 'send_notification',
description: 'Send a user notification',
inputSchema: {
type: 'object',
properties: { message: { type: 'string', description: 'Notification text' } },
required: ['message'],
},
});npx cdk deploy # needs Docker (ARM64 builds) and a bootstrapped account
node scripts/invoke.mjs <AgentRuntimeArn> "Review the latest report"Your workspace stays a native Claude Code project:
agents/reviewer/
├── CLAUDE.md
├── .claude/
│ ├── agents/ # subagents
│ ├── skills/
│ └── settings.json # permissions are honored in the cloud too
└── .mcp.json # optionalRelated MCP server: Gate22
your CDK app
└─ ClaudeCodeAgent
├─ ARM64 container: Claude Code CLI (version-pinned) + your workspace + tiny HTTP adapter
├─ AgentCore Runtime (HTTP protocol) + execution role scoped to Claude models on Bedrock
└─ AgentCore Gateway (IAM auth), created only when you call connect()
└─ targets: your Lambda functions, or C3's audited S3 / DynamoDB / SQS / EventBridge adapters
invoke → AgentCore Runtime → claude -p … (stream-json) → Claude on Amazon Bedrock
└─ MCP: c3-gateway → SigV4 proxy → AgentCore Gateway → toolsThe adapter in runtime-assets/entrypoint implements the
AgentCore HTTP contract
(POST /invocations, GET /ping). For each request it runs the official CLI in headless mode.
It is glue code, not an agent loop. See docs/architecture.md.
grant() vs connect()
|
| |
What it does | Adds IAM permissions to the agent's execution role | Makes specific operations available as MCP tools |
Who calls AWS | Claude Code itself (Bash, AWS CLI, SDK scripts) | A Gateway target (your Lambda, or a C3 adapter) |
Creates a tool | No | Yes, |
Runtime role gets resource access | Yes, exactly the listed actions | No, only |
Resource | Tools | Scope enforced by IAM and the adapter |
| Your explicit schema(s) | Gateway role may invoke only that function |
|
|
|
|
| Declared indexes, |
|
| One queue, body size cap |
|
| Fixed |
OpenAPI ( | From the spec | Explicit outbound credentials |
Remote MCP server ( | From the server | Credentials required |
The full options and the IAM each connector creates are in docs/connections.md.
new ClaudeCodeAgent(stack, 'Agent', {
source: './agents/reviewer',
model: ClaudeModel.fromInferenceProfileId('us.anthropic.claude-sonnet-4-6'), // pin for stability
claudeCodeVersion: '2.1.311',
permissionMode: PermissionMode.DONT_ASK, // default: only pre-approved tools run
allowedTools: ['Read', 'Grep'],
maxBudgetUsd: 2, // per invocation
invocationTimeout: Duration.minutes(15),
installAwsCli: false,
network: RuntimeNetworkConfiguration.usingVpc(stack, { vpc }),
lifecycle: { idleRuntimeSessionTimeout: Duration.minutes(15) },
platformVersion: PlatformVersion.V2, // opt in after checking regional support
tracing: true,
applicationLogs: { retention: RetentionDays.ONE_MONTH },
sessionStorage: { bucket: sessionsBucket }, // optional durability across microVMs
});IAM has the final say. Claude Code permission rules are an extra layer on top of it, not a replacement.
The defaults give no access to your AWS resources. Claude Code runs with dontAsk, so only tools
that are pre-approved in your settings or allowedTools can run.
Connected tools are read-only unless the connection is a write by nature (SQS, EventBridge), and even then it is scoped to one resource.
C3 rejects environment variables that look like secrets, and its runtime adapter never logs prompts or model output.
Tool output and workspace files can carry prompt injection. Read docs/security.md.
cdk deploy creates billable resources: AgentCore Runtime (per vCPU/GB-hour while sessions are
active), Bedrock model tokens, ECR image storage, CloudWatch Logs, and, when you call connect(),
AgentCore Gateway plus Lambda adapters. See docs/costs.md. Run cdk destroy when
you are done.
Area | State |
| Implemented, unit-tested with CDK assertions |
Examples synthesize ( | Implemented, run in CI |
Docker image build, deploy, invoke, Lambda tool round-trip | Not yet verified on AWS. An opt-in test exists in |
Claude Code → Gateway auth through | Unverified until the integration test passes |
Session durability ( | Experimental |
Known limitations are listed in docs/limitations.md.
examples/hello-agent: the smallest deployable agent
examples/lambda-tool: a Lambda function exposed as an MCP tool
examples/aws-data: read-only S3 and DynamoDB tools, plus grant()
npm ci
npm run typecheck && npm run lint && npm test
npm run synth:examples
C3_INTEGRATION=1 AWS_PROFILE=dev npm run test:integration # billable, opt-inContributions are welcome. Please read CONTRIBUTING.md and SECURITY.md.
MIT © Alejandro Santana. Claude Code itself is not distributed with this project; it is installed from npm under Anthropic's terms when you build the image. See NOTICE.
This server cannot be deployed
One MCP endpoint for Claude, GPT & Gemini: 100+ tools + no-code connectors + agent workers.
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
The OpenRouter for tools. One MCP connection gives any AI agent 254 hosted tools, pay per call.
Governed app access for AI agents: 1,000+ apps & 12,000+ tools via Code Mode MCP.
