CMN-C1-637 — AWS Agent Toolkit MCP Server & Skill Governance Q&A Agent

Category: Cat 1 (single technical capability, use-case-agnostic) Industry: Common (industry-agnostic)

Overview

Question-answering over a curated knowledge base of governance guidance for a cloud provider's agent toolkit, its MCP server catalogue and agent skills. Given a question such as "What least-privilege IAM policy does an S3-read agent need?", the agent infers the scope (MCP catalogue, IAM or financial-sector data residency), retrieves matching catalogue entries, extracts a least-privilege IAM policy built from placeholders only, adds data-residency notes with region flags based on Japan's financial-sector security guidelines, and assembles a cited answer with configuration snippets. Retrieval and policy assembly are deterministic; no LLM is called. A question with no matching entry receives an explicit out-of-scope answer, an answer whose claims cannot be cited is not published, credential-shaped strings are redacted, and every answer carries an advisory disclaimer. The knowledge base shipped here is a small curated sample — replace it with your own catalogue.

This is an agent template built with the AGENTIC STAR development platform and the AgentCore Framework. It is intended to be taken as a starting point: fork it, adapt it to your own data and policies, and run it inside your own AGENTIC STAR deployment.

Related MCP server: OntoRamp Graph Query

Requirements

This template does not run standalone. It requires:

pip install -e .

Behaviour without the platform

The framework is designed to run only on AGENTIC STAR. There is no fallback or degraded mode. If the platform is unreachable or the SDK version does not match, the agent raises PlatformRequired during graph compile / start-up preflight rather than starting in a partially working state. This is intentional — a half-running agent is worse than one that refuses to start.

Known limitations

Product names can be masked by the platform before retrieval. AGENTIC STAR's personal-data protection runs before this template's code and replaces any run of two or more Title-Case words with [MASKED] — "Agent Toolkit", "Amazon Bedrock" and "Secrets Manager" included — and the template cannot switch it off. Measured on AgentCore 1.0.3:

When part of a question was masked, limitations holds the code QUERY_TERMS_MASKED and the answer says so; a question with nothing left to match is not_evaluated, not out of scope. The flag also appears when the masked words did not change the answer (for example "Secrets Manager" in a question that other words already match). Write product names in lower case ("bedrock", "agent toolkit", "secrets manager") to get a complete answer.

Quick Start

python -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"
python -m pytest tests/ -v

Tests run without a platform connection. Running the agent itself does not.

Project Structure

src/          agent implementation (nodes, services, schemas)
tests/        unit, integration and boundary tests
config/       agent configuration
docs/         design and operational documentation

See docs/02_design.md for the design and docs/03_test_spec.md for the test specification.

Customising

1. Adjust config/ for your own environment and policies.

2. Replace the knowledge sources and sample data with your own.

3. Review the node implementations under src/nodes/ for domain-specific logic.

4. Re-run the test suite.

License

MIT — see LICENSE.

Status of this repository

This template is published as is, by its individual author, under the MIT license. It carries no warranty and no support commitment, and no organisation stands behind its behaviour or fitness for any purpose. Issues and pull requests may or may not receive a response; that is at the sole discretion of the repository owner.