
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@aws/agentcore
Advanced tools
Amazon Bedrock AgentCore enables you to deploy and operate AI agents securely at scale using any framework and model. AgentCore provides tools and capabilities to make agents more effective, purpose-built infrastructure to securely scale agents, and controls to operate trustworthy agents. This CLI helps you create, develop locally, and deploy agents to AgentCore with minimal configuration.
Upgrading from the Bedrock AgentCore Starter Toolkit? If the old Python CLI is still installed, you'll see a warning after install asking you to uninstall it. Both CLIs use the
agentcorecommand name, so having both can cause confusion. Uninstall the old one using whichever tool you originally used:pip uninstall bedrock-agentcore-starter-toolkit # if installed via pip pipx uninstall bedrock-agentcore-starter-toolkit # if installed via pipx uv tool uninstall bedrock-agentcore-starter-toolkit # if installed via uv
npm install -g @aws/agentcore
Use the terminal UI to walk through all commands interactively, or run each command individually:
# Launch terminal UI
agentcore
# Create a new project (wizard guides you through agent setup)
agentcore create
cd my-project
# Test locally
agentcore dev
# Deploy to AWS
agentcore deploy
# Test deployed agent
agentcore invoke
| Framework | Notes |
|---|---|
| Strands Agents | AWS-native, streaming support |
| LangChain/LangGraph | Graph-based workflows |
| Google ADK | Gemini models only |
| OpenAI Agents | OpenAI models only |
| Provider | API Key Required | Default Model |
|---|---|---|
| Amazon Bedrock | No (uses AWS credentials) | claude-sonnet-4-5-20250929-v1 |
| Anthropic | Yes | claude-sonnet-4-5-20250929 |
| Google Gemini | Yes | gemini-2.5-flash |
| OpenAI | Yes | gpt-4o |
| Command | Description |
|---|---|
create | Create a new AgentCore project |
dev | Start local development server |
deploy | Deploy infrastructure to AWS |
invoke | Invoke deployed agents |
| Command | Description |
|---|---|
add | Add agents, memory, identity, evaluators, targets |
remove | Remove resources from project |
Note: Run
agentcore deployafteraddorremoveto update resources in AWS.
| Command | Description |
|---|---|
add evaluator | Add a custom LLM-as-a-Judge evaluator |
add online-eval | Add continuous evaluation for live traffic |
run eval | Run on-demand evaluation against agent traces |
evals history | View past eval run results |
pause online-eval | Pause a deployed online eval config |
resume online-eval | Resume a paused online eval config |
my-project/
├── agentcore/
│ ├── .env.local # API keys (gitignored)
│ ├── agentcore.json # Resource specifications
│ ├── aws-targets.json # Deployment targets
│ └── cdk/ # CDK infrastructure
├── app/ # Application code
├── app/ # Application code
│ └── <AgentName>/ # Agent directory
│ ├── main.py # Agent entry point
│ ├── pyproject.toml # Python dependencies
│ └── model/ # Model configuration
Projects use JSON schema files in the agentcore/ directory:
agentcore.json - Agent specifications, memory, identity, evaluators, online evalsdeployed-state.json - Runtime state in agentcore/.cli/ (auto-managed)aws-targets.json - Deployment targets (account, region)Found a bug or have a feature request? Open an issue on GitHub.
See SECURITY for reporting vulnerabilities and security information.
This project is licensed under the Apache-2.0 License.
FAQs
CLI for Amazon Bedrock AgentCore
The npm package @aws/agentcore receives a total of 1,136 weekly downloads. As such, @aws/agentcore popularity was classified as popular.
We found that @aws/agentcore demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 20 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.