This reference was generated from agentcore --help for version 1.0.0.
- Global options
- Project commands
agentcore createagentcore addagentcore add harnessagentcore add runtimeagentcore add runtime-endpointagentcore add gatewayagentcore add gateway-targetagentcore add gateway-connectoragentcore add policy-engineagentcore add policyagentcore add credentialsagentcore add memoryagentcore add evaluatoragentcore add online-evalagentcore add config-bundleagentcore add payment-manageragentcore add payment-connector
agentcore devagentcore deployagentcore invokeagentcore statusagentcore logsagentcore tracesagentcore exportagentcore migrateagentcore removeagentcore build
- Resource commands
agentcore harnessagentcore runtimeagentcore gatewayagentcore identityagentcore memoryagentcore evalagentcore eval evaluatoragentcore eval online-evalagentcore eval datasetagentcore eval batch-evaluationagentcore eval ondemandagentcore eval config-bundleagentcore eval ab-testagentcore eval recommendation
agentcore payment
- CLI settings and feedback
agentcore [options] [command]
the platform for production AI agents
Options
--region <region>: AWS region--debug: debug logging (default: false)--json: JSON output (default: false)-V, --version: display the CLI version
agentcore create [options]
create a new project
Options
--name <name>: name of the project to create (required)--template <template>: the template to scaffold the Runtime from (default: "empty")--skip-install: skip installing dependencies (npm install, uv sync) (default: false)--skip-git: skip initializing a git repository (default: false)
agentcore add [options] [command]
add project resources
agentcore add harness [options]
add a harness to the current project (not available in China regions)
Options
--name <name>: the name of the harness--model <model>: model configuration (JSON)--api-key <api-key>: API key for a non-Bedrock --model; '-' for stdin, 'file://path' for file--system-prompt <system-prompt>: the agent's system prompt--tags <tags...>: tags as repeated key=value entries or one JSON object--tools <tools>: tools available to the agent (JSON)--allowed-tools <allowed-tools...>: tool allowlist patterns (e.g. * or @serverName/toolName)--skills <skills>: skills available to the agent (JSON)--memory <memory>: memory configuration (JSON)--truncation <truncation>: context truncation configuration (JSON)--max-iterations <max-iterations>: max agent loop iterations per invocation--max-tokens <max-tokens>: max total output tokens per invocation--timeout-seconds <timeout-seconds>: max duration in seconds per invocation--container-uri <container-uri>: ECR container image URI; alternative to --dockerfile--dockerfile <dockerfile>: path to local Dockerfile to build the harness image; alternative to --container-uri--environment-variables <environment-variables>: environment variables (JSON object of key/value strings)--network-mode <network-mode>: network mode for the harness environment (PUBLIC or VPC)--network-config <network-config>: VPC network configuration (JSON)--lifecycle-config <lifecycle-config>: session idle timeout and instance lifetime configuration (JSON)--session-storage-path <session-storage-path>: mount path for session storage--efs-access-points <efs-access-points>: EFS access point configurations (JSON; requires VPC)--s3-access-points <s3-access-points>: S3 access point configurations (JSON; requires VPC)--execution-role-arn <execution-role-arn>: IAM role the harness assumes; a default role is created when omitted--authorizer-type <authorizer-type>: inbound authorizer type (AWS_IAM or CUSTOM_JWT)--authorizer-configuration <authorizer-configuration>: inbound authorizer configuration (JSON)
agentcore add runtime [options]
add a Runtime to the current project
Options
--name <name>: the name of the Runtime (required)--language <language>: language you will write the Runtime in: python or typescript (required unless --agent-id imports a Bedrock Agent)--protocol <protocol>: protocol the Runtime serves: HTTP (default), MCP, A2A, or AGUI--description <description>: an optional description of the Runtime--tags <tags...>: tags as repeated key=value entries or one JSON object--environment-variables <environment-variables>: environment variables (JSON object of key/value strings)--network-mode <network-mode>: network mode for the Runtime environment (PUBLIC or VPC)--network-config <network-config>: VPC network configuration (JSON)--lifecycle-configuration <lifecycle-configuration>: session idle timeout and instance lifetime configuration (JSON)--filesystem-configurations <filesystem-configurations>: filesystem mount configurations (JSON)--role-arn <role-arn>: IAM role ARN that provides permissions for the Runtime--additional-policies <additional-policies...>: additional IAM policy ARNs or policy document paths for the execution role--authorizer-type <authorizer-type>: inbound authorizer type (AWS_IAM or CUSTOM_JWT)--authorizer-configuration <authorizer-configuration>: inbound authorizer configuration (JSON)--request-header-allowlist <request-header-allowlist...>: request headers to pass through to the Runtime--agent-id <agent-id>: Bedrock Agent ID to import; translates that agent version into runtime code instead of writing docs--agent-alias-id <agent-alias-id>: Bedrock Agent Alias ID selecting the version to import; must point at a prepared version, not DRAFT (requires --agent-id)--framework <framework>: agent framework for an imported Bedrock Agent: strands or langgraph (requires --agent-id)
agentcore add runtime-endpoint [options]
add a named endpoint (version alias) to a runtime
Options
--runtime <runtime>: the parent runtime name (required)--name <name>: the endpoint name (e.g., prod, staging) (required)--version <version>: the runtime version this endpoint points to (default: 1)--description <description>: description of the endpoint
agentcore add gateway [options]
add a Gateway to the current project
Options
--name <name>: the Gateway name (required)--role-arn <role-arn>: IAM role the Gateway assumes; a default role is created when omitted--protocol-type <protocol-type>: restrict the Gateway to MCP Targets--enable-semantic-search: enable semantic search for tools on the Gateway (default: false)--authorizer-type <authorizer-type>: inbound authorizer: AWS_IAM, CUSTOM_JWT, or NONE--description <description>: Gateway description--authorizer-configuration <authorizer-configuration>: project authorizerConfiguration (JSON; inline, file://<path>, or - for stdin)--policy-engine-name <policy-engine-name>: name of a Policy Engine declared in this project--policy-engine-mode <policy-engine-mode>: Policy Engine mode: log-only or enforce--exception-level <exception-level>: exception detail level: debug--tags <tags...>: tags as repeated key=value entries or one JSON object
agentcore add gateway-target [options]
add a Target to a project Gateway
Options
--gateway <gateway>: name of the parent Gateway in this project (required)--name <name>: the Target name for endpoint or Runtime shortcuts--endpoint <endpoint>: external MCP server HTTPS endpoint--runtime <runtime>: name of a Runtime declared in this project--runtime-endpoint <runtime-endpoint>: named endpoint on the selected Runtime--target-configuration <target-configuration>: complete agentCoreGateways[].targets[] object (JSON; inline, file://<path>, or - for stdin)--outbound-auth <outbound-auth>: shortcut Target authentication: none, oauth, or api-key--credential-name <credential-name>: name of a compatible credential declared in this project--scope <scope...>: OAuth scope
agentcore add gateway-connector [options]
add a connector-backed Target to a project Gateway (not available in China regions)
Options
--gateway <gateway>: name of the parent Gateway in this project (required)--name <name>: the Target name for a connector shortcut--connector <connector>: curated connector [bedrock-knowledge-bases | web-search]--connector-configuration <connector-configuration>: complete connector agentCoreGateways[].targets[] object (JSON; inline, file://<path>, or - for stdin)--knowledge-base <knowledge-base>: external ten-character Knowledge Base ID; only for bedrock-knowledge-bases
agentcore add policy-engine [options]
add a Policy Engine to the current project (not available in China regions)
Options
--name <name>: the Policy Engine name (required)--description <description>: Policy Engine description--encryption-key-arn <encryption-key-arn>: KMS encryption key ARN--tags <tags...>: tags as repeated key=value entries or one JSON object--attach-to-gateways <attach-to-gateways...>: names of project Gateways to attach this engine to--attach-mode <attach-mode>: attached Gateway enforcement mode: log-only or enforce (default enforce)
agentcore add policy [options]
add a Cedar Policy to a project Policy Engine (not available in China regions)
Options
--engine <engine>: name of the parent Policy Engine in this project (required)--name <name>: the Policy name (required)--description <description>: Policy description--statement <statement>: Cedar policy statement (inline, file://<path>, or - for stdin) (required)--validation-mode <validation-mode>: validation mode: fail-on-any-findings or ignore-all-findings--enforcement-mode <enforcement-mode>: enforcement mode: active or log-only--authorization-phase <authorization-phase>: authorization phase: initiate or return-output (default inferred from the statement)
agentcore add credentials [options] [command]
add AgentCore Identity credential providers to the current project
agentcore add credentials api-key [options]
add an API key credential provider to the current project
Options
--name <name>: the name of the credential provider (required)--api-key <api-key>: the API key (file://path or - for stdin; inline values are rejected)--api-key-secret-reference <api-key-secret-reference>: external secret reference JSON: {"secretId":"<arn>","jsonKey":"<key>"}
agentcore add credentials oauth [options]
add an OAuth2 credential provider to the current project
Options
--name <name>: the name of the credential provider (required)--vendor <vendor>: the OAuth2 vendor (e.g. GithubOauth2); custom providers use the guided flags instead (default: "CustomOauth2")--client-id <client-id>: OAuth2 client ID (guided custom OAuth2)--discovery-url <discovery-url>: OAuth2 discovery URL (guided custom OAuth2)--scopes <scopes...>: OAuth2 scopes the provider grants (guided custom OAuth2)--provider-configuration <provider-configuration>: complete secret-free Oauth2ProviderConfigInput JSON (required for vendored providers)--client-secret <client-secret>: the client secret (file://path or - for stdin; inline values are rejected)--client-secret-reference <client-secret-reference>: external secret reference JSON: {"secretId":"<arn>","jsonKey":"<key>"}
agentcore add credentials payment [options]
add a payment credential provider to the current project
Options
--name <name>: the name of the credential provider (required)--provider <provider>: the payment provider: CoinbaseCDP or StripePrivy (required)--api-key-id <api-key-id>: Coinbase CDP API key ID--api-key-secret <api-key-secret>: Coinbase CDP API key secret (file://path or - for stdin; inline values are rejected)--wallet-secret <wallet-secret>: Coinbase CDP wallet secret (file://path or - for stdin; inline values are rejected)--app-id <app-id>: Privy application ID--app-secret <app-secret>: Privy application secret (file://path or - for stdin; inline values are rejected)--authorization-private-key <authorization-private-key>: Stripe/Privy authorization private key (file://path or - for stdin; inline values are rejected)--authorization-id <authorization-id>: Stripe/Privy authorization identifier
agentcore add memory [options]
add a Memory to the current project (not available in China regions)
Options
--name <name>: the name of the Memory (required)--description <description>: a description of what the Memory stores--event-expiry-duration <event-expiry-duration>: how long raw events are retained, in days (3-365) (default: 30)--strategies <strategies>: long-term Memory strategies: comma-separated types, or the JSON strategies[] as stored in agentcore.json--indexed-keys <indexed-keys>: metadata keys indexed for filtering (JSON IndexedKey[]); requires at least one strategy--stream-delivery-resources <stream-delivery-resources>: destinations Memory records are streamed to (JSON StreamDeliveryResources)--encryption-key-arn <encryption-key-arn>: customer managed KMS key ARN used to encrypt the Memory--execution-role-arn <execution-role-arn>: IAM role the Memory assumes; a default role is created when omitted--tags <tags...>: tags as repeated key=value entries or one JSON object
agentcore add evaluator [options] [command]
add a custom evaluator to the current project (not available in China regions)
agentcore add evaluator llm-as-a-judge [options]
add an LLM-as-a-Judge evaluator to the current project
Options
--name <name>: the name of the evaluator (required)--level <level>: what to score: SESSION, TRACE, or TOOL_CALL (required)--model-provider <model-provider>: model provider for the judge: Bedrock (default) or OpenResponses--model <model>: judge model: a Bedrock model ID / inference-profile-or-foundation-model ARN, or an OpenResponses model ID (required)--instructions <instructions>: scoring instructions for the judge (inline text, 'file://<path>', or '-' for stdin); use level placeholders like '{context}' (required)--rating-scale <rating-scale>: a rating scale preset (1-5-quality, 1-3-simple, pass-fail, good-neutral-bad) or an inline JSON rating scale (required)--description <description>: a description of what this evaluator measures--kms-key-arn <kms-key-arn>: customer-managed KMS key ARN to encrypt the evaluator--tags <tags...>: tags as repeated key=value entries or one JSON object
agentcore add evaluator code-based [options]
add a code-based evaluator to the current project
Options
--name <name>: the name of the evaluator (required)--level <level>: what to score: SESSION, TRACE, or TOOL_CALL (required)--lambda-arn <lambda-arn>: ARN of an existing Lambda that scores a session--timeout-seconds <timeout-seconds>: evaluator timeout in seconds (1-300)--description <description>: a description of what this evaluator measures--kms-key-arn <kms-key-arn>: customer-managed KMS key ARN to encrypt the evaluator--tags <tags...>: tags as repeated key=value entries or one JSON object
agentcore add online-eval [options]
add an online evaluation config to the current project (not available in China regions)
Options
--name <name>: the name of the online evaluation config (required)--agent <agent>: Runtime name whose traffic to sample (mutually exclusive with --log-group-name)--endpoint <endpoint>: the agent endpoint qualifier to scope monitoring to (requires --agent)--log-group-name <log-group-name...>: CloudWatch log group name(s) for custom data sources (1-5; mutually exclusive with --agent)--service-name <service-name...>: service name(s) to filter traces for custom data sources (requires --log-group-name)--evaluators <evaluators...>: evaluator name(s), Builtin.* IDs, or ARNs to apply (required)--sampling-rate <sampling-rate>: percentage of sessions to sample (0.01-100) (required)--description <description>: a description of the config's monitoring purpose--enable-on-create <enable-on-create>: enable evaluation immediately after deploy (default true; pass false to add it paused)--tags <tags...>: tags as repeated key=value entries or one JSON object
agentcore add config-bundle [options]
add a configuration bundle to the current project (not available in China regions)
Options
--name <name>: the name of the configuration bundle (required)--description <description>: a description of the configuration bundle--components <components>: component configuration map (JSON inline, file://<path>, or - for stdin) (required)--branch-name <branch-name>: branch name for the initial configuration (default: "mainline")--commit-message <commit-message>: message describing the initial configuration--kms-key-arn <kms-key-arn>: customer managed KMS key ARN for component configurations
agentcore add payment-manager [options]
add a payment manager to the current project (not available in China regions)
Options
--name <name>: the payment manager name (required)--authorizer-type <authorizer-type>: payment authorization type (default: "AWS_IAM")--discovery-url <discovery-url>: OIDC discovery URL for CUSTOM_JWT authorization--allowed-clients <allowed-clients...>: allowed JWT client IDs--allowed-audience <allowed-audience...>: allowed JWT audiences--allowed-scopes <allowed-scopes...>: allowed JWT scopes--description <description>: payment manager description--no-auto-payment: disable automatic payment settlement--default-spend-limit <default-spend-limit>: default payment-session spend limit (default: "10.00")--tool-allowlist <tool-allowlist...>: tools eligible for automatic payment--network-preferences <network-preferences...>: preferred payment networks
agentcore add payment-connector [options]
add a connector to a project payment manager (not available in China regions)
Options
--manager <manager>: the parent payment manager (required)--name <name>: the payment connector name (required)--credential <credential>: an existing payment credential to reuse--quick-create: create a CoinbaseCDP connector through Quick Create (default: false)
agentcore dev [options]
develop and test project agents
Options
--agent <agent>: runtime or harness to run--ui-port <ui-port>: port for the Agent Inspector web UI (browser mode)--mode <mode>: how to run: browser (Agent Inspector web UI) or headless (runtime output or harness invoke guidance) (default: "headless")--port <port>: port for the development server--no-traces: disable local OTEL trace collection--target <target>: name of the aws-targets.json entry to deploy; the default target is created automatically from your AWS account and region on first deploy (default: "default")--yes: confirm removing the target's stack when the project declares nothing to deploy (default: false)--skip-deploy: skip deployment and use the deployed harnesses (default: false)
agentcore deploy [options]
build and deploy project resources to an AWS target
Options
--target <target>: name of the aws-targets.json entry to deploy; the default target is created automatically from your AWS account and region on first deploy (default: "default")--yes: confirm removing the target's stack when the project declares nothing to deploy (default: false)
agentcore invoke [options]
invoke a Runtime, harness, or Gateway
Options
--runtime <runtime>: the Runtime to invoke: its name in this project, its ID, or its ARN--harness <harness>: the harness to invoke: its name in this project, its ID, or its ARN--gateway <gateway>: the Gateway to invoke: its name in this project, its ID, or its ARN--target <target>: project deployment target (default: "default")--local: invoke the local development server (project Runtime only) (default: false)--port <port>: local development server port (defaults: HTTP/AG-UI 8080, MCP 8000, A2A 9000)--payload <payload>: the inline payload to send--qualifier <qualifier>: the Runtime endpoint qualifier--content-type <content-type>: the payload content type--accept <accept>: the accepted response content type--session-id <session-id>: the Runtime session ID--user-id <user-id>: the user ID to invoke as--header <header...>: an ordered application header--bearer-token <bearer-token>: the CUSTOM_JWT bearer token--mcp-session-id <mcp-session-id>: the MCP session ID--mcp-protocol-version <mcp-protocol-version>: the MCP protocol version--output-file <output-file>: the response output file--mcp-method <mcp-method>: the MCP method--mcp-name <mcp-name>: the MCP tool, resource, or prompt name--trace-id <trace-id>: the X-Ray trace ID--trace-parent <trace-parent>: the W3C trace parent--trace-state <trace-state>: the W3C trace state--baggage <baggage>: the W3C baggage--prompt <prompt>: the message to send to the harness--path <path>: the path relative to the Gateway origin--method <method>: the HTTP request method
agentcore status [options]
inspect deployed project resources for an AWS target
Options
--target <target>: name of the aws-targets.json entry to report on (default: "default")
agentcore logs [options] [command]
stream or search logs for resources in the current project
agentcore logs runtime [options]
stream or search logs for a Runtime in the current project
Options
--name <name>: the logical project Runtime name--target <target>: project deployment target (default: "default")--qualifier <qualifier>: the Runtime endpoint qualifier--since <since>: search window start: "5m", "1h", ISO 8601, epoch ms, or "now"--until <until>: search window end: "5m", "1h", ISO 8601, epoch ms, or "now"--tail: tail new log records (default: false)--level <level>: filter by log level (error, warn, info, debug)--query <query>: CloudWatch Logs filter pattern--limit <limit>: maximum number of log records to return in search mode
agentcore logs harness [options]
stream or search logs for a Harness in the current project
Options
--name <name>: the logical project Harness name--target <target>: project deployment target (default: "default")--qualifier <qualifier>: the Harness endpoint qualifier--since <since>: search window start: "5m", "1h", ISO 8601, epoch ms, or "now"--until <until>: search window end: "5m", "1h", ISO 8601, epoch ms, or "now"--tail: tail new log records (default: false)--level <level>: filter by log level (error, warn, info, debug)--query <query>: CloudWatch Logs filter pattern--limit <limit>: maximum number of log records to return in search mode
agentcore traces [options] [command]
inspect traces for resources in the current project
agentcore traces runtime [options] [command]
inspect a Runtime's traces
agentcore traces runtime list [options]
list a Runtime's recent traces
Options
--name <name>: the logical project Runtime name--target <target>: project deployment target (default: "default")--qualifier <qualifier>: the Runtime endpoint qualifier--limit <limit>: maximum number of traces to display (default: 20)--since <since>: window start: "5m", "1h", "2d", ISO 8601, epoch ms, or "now" (default 12h ago)--until <until>: window end: "5m", "1h", "2d", ISO 8601, epoch ms, or "now" (default now)
agentcore traces runtime get [options] <trace-id>
download a trace's log records to a JSON file
Arguments
trace-id(required): the trace ID to download
Options
--name <name>: the logical project Runtime name--target <target>: project deployment target (default: "default")--qualifier <qualifier>: the Runtime endpoint qualifier--output <output>: the output file path (default: <traceId>.json in the current directory)--since <since>: window start: "5m", "1h", "2d", ISO 8601, epoch ms, or "now" (default 12h ago)--until <until>: window end: "5m", "1h", "2d", ISO 8601, epoch ms, or "now" (default now)
agentcore traces harness [options] [command]
inspect a Harness's traces
agentcore traces harness list [options]
list a Harness's recent traces
Options
--name <name>: the logical project Harness name--target <target>: project deployment target (default: "default")--qualifier <qualifier>: the Harness endpoint qualifier--limit <limit>: maximum number of traces to display (default: 20)--since <since>: window start: "5m", "1h", "2d", ISO 8601, epoch ms, or "now" (default 12h ago)--until <until>: window end: "5m", "1h", "2d", ISO 8601, epoch ms, or "now" (default now)
agentcore traces harness get [options] <trace-id>
download a Harness trace's log records to a JSON file
Arguments
trace-id(required): the trace ID to download
Options
--name <name>: the logical project Harness name--target <target>: project deployment target (default: "default")--qualifier <qualifier>: the Harness endpoint qualifier--output <output>: the output file path (default: <traceId>.json in the current directory)--since <since>: window start: "5m", "1h", "2d", ISO 8601, epoch ms, or "now" (default 12h ago)--until <until>: window end: "5m", "1h", "2d", ISO 8601, epoch ms, or "now" (default now)
agentcore export [options] [command]
convert project resources into editable code you own
agentcore export harness [options]
convert a managed harness into a code-defined harness with the Strands Harness SDK, creating a project if needed
Options
--project-name <project-name>: name of the project to create when exporting outside a project--name <name>: the name of an in-project harness to export--arn <arn>: the ARN of a deployed harness to fetch from the service and export--target-agent-name <target-agent-name>: the name of the generated Runtime agent (default <harnessName>Agent)
agentcore migrate [options]
migrate an AgentCore CLI v0 project to the current project format, keeping its deployed resources
Options
--target <target>: the deployment target to migrate (required when the project is deployed to several)--yes: apply the changes without asking, when they are ready (default: false)
agentcore remove [options] [resource]
remove a resource from the project
Arguments
resource(optional): type of resource to remove ('all' empties every resource collection)
Options
--name <name>: name of the resource to remove--gateway <gateway>: name of the parent Gateway for a Target--engine <engine>: name of the parent Policy Engine for a Policy--manager <manager>: name of the parent payment manager for a connector--runtime <runtime>: name of the parent runtime for a runtime-endpoint--yes: skip the confirmation prompt when removing all resources (default: false)
agentcore build [options]
build the project's deployable artifacts
agentcore harness [options] [command]
manage config-defined agents and their versions
agentcore harness create [options]
create a harness
Options
--name <name>: the name of the harness (required)--execution-role-arn <execution-role-arn>: IAM role the harness assumes; a default role is created when omitted--system-prompt <system-prompt>: the agent's system prompt--model <model>: model configuration (JSON HarnessModelConfiguration)--tools <tools>: tools available to the agent (JSON HarnessTool[])--skills <skills>: skills available to the agent (JSON HarnessSkill[])--allowed-tools <allowed-tools...>: tool allowlist patterns (e.g. * or @serverName/toolName)--memory <memory>: memory configuration (JSON HarnessMemoryConfiguration)--truncation <truncation>: context truncation configuration (JSON HarnessTruncationConfiguration)--environment <environment>: compute environment configuration (JSON HarnessEnvironmentProviderRequest)--environment-artifact <environment-artifact>: environment artifact, e.g. a container image (JSON HarnessEnvironmentArtifact)--environment-variables <environment-variables>: environment variables (JSON object of key/value strings)--authorizer-configuration <authorizer-configuration>: inbound authorizer configuration (JSON AuthorizerConfiguration)--max-iterations <max-iterations>: max agent loop iterations per invocation--max-tokens <max-tokens>: max total output tokens per invocation--timeout-seconds <timeout-seconds>: max duration in seconds per invocation--tags <tags...>: tags as repeated key=value entries or one JSON object
agentcore harness get [options]
get a harness
Options
--id <id>: the ID of the harness (required)
agentcore harness list [options]
list harnesses
Options
--next-token <next-token>: next token to use on paginated--max-results <max-results>: max number of items to return
agentcore harness update [options]
update a harness (creates a new version)
Options
--id <id>: the ID of the harness to update (required)--execution-role-arn <execution-role-arn>: IAM role the harness assumes--system-prompt <system-prompt>: the agent's system prompt--model <model>: model configuration (JSON HarnessModelConfiguration)--tools <tools>: tools available to the agent (JSON HarnessTool[])--skills <skills>: skills available to the agent (JSON HarnessSkill[])--allowed-tools <allowed-tools...>: tool allowlist patterns (e.g. * or @serverName/toolName)--memory <memory>: memory configuration (JSON HarnessMemoryConfiguration)--clear-memory <clear-memory>: clear the memory configuration (pass true)--truncation <truncation>: context truncation configuration (JSON HarnessTruncationConfiguration)--environment <environment>: compute environment configuration (JSON HarnessEnvironmentProviderRequest)--environment-artifact <environment-artifact>: environment artifact, e.g. a container image (JSON HarnessEnvironmentArtifact)--clear-environment-artifact <clear-environment-artifact>: clear the environment artifact (pass true)--environment-variables <environment-variables>: environment variables (JSON object; replaces all existing)--authorizer-configuration <authorizer-configuration>: inbound authorizer configuration (JSON AuthorizerConfiguration)--clear-authorizer-configuration <clear-authorizer-configuration>: clear the authorizer configuration (pass true)--max-iterations <max-iterations>: max agent loop iterations per invocation--max-tokens <max-tokens>: max total output tokens per invocation--timeout-seconds <timeout-seconds>: max duration in seconds per invocation
agentcore harness delete [options]
delete a harness
Options
--id <id>: the ID of the harness to delete (required)--delete-managed-memory <delete-managed-memory>: whether to also delete the managed Memory (default true; pass false to keep it)
agentcore harness invoke [options]
invoke a harness
Options
--id <id>: the ID of the harness (required)--prompt <prompt>: the message to send to the harness--user-id <user-id>: the end-user ID for user-scoped AgentCore Identity credentials--session-id <session-id>: the Runtime session ID to continue (33-100 characters)--qualifier <qualifier>: the harness endpoint qualifier to invoke (default DEFAULT)
agentcore harness exec [options]
run a shell command in a harness
Options
--id <id>: the ID of the harness (required)--command <command>: the shell command to run--session-id <session-id>: the Runtime session ID to run in (33-100 characters)--qualifier <qualifier>: the harness endpoint qualifier to run in (default DEFAULT)--timeout <timeout>: seconds to wait for the command (1-3600)
agentcore harness shell [options]
open an interactive shell in a harness
Options
--id <id>: the ID of the harness (required)--qualifier <qualifier>: the harness endpoint qualifier--session-id <session-id>: the Runtime session ID to use--shell-id <shell-id>: the shell ID to resume (requires --session-id)--bearer-token <bearer-token>: the CUSTOM_JWT bearer token
agentcore harness logs [options]
stream or search a harness's logs
Options
--id <id>: the ID of the harness (required)--qualifier <qualifier>: the harness endpoint qualifier--since <since>: search window start: "5m", "1h", ISO 8601, epoch ms, or "now"--until <until>: search window end: "5m", "1h", ISO 8601, epoch ms, or "now"--tail: tail new log records (default: false)--level <level>: filter by log level (error, warn, info, debug)--query <query>: CloudWatch Logs filter pattern--limit <limit>: maximum number of log records to return in search mode
agentcore harness traces [options] [command]
inspect a harness's traces
agentcore harness traces list [options]
list a harness's recent traces
Options
--id <id>: the ID of the harness (required)--qualifier <qualifier>: the harness endpoint qualifier--limit <limit>: maximum number of traces to display (default: 20)--since <since>: window start: "5m", "1h", "2d", ISO 8601, epoch ms, or "now" (default 12h ago)--until <until>: window end: "5m", "1h", "2d", ISO 8601, epoch ms, or "now" (default now)
agentcore harness traces get [options] <trace-id>
download a harness trace's log records to a JSON file
Arguments
trace-id(required): the trace ID to download
Options
--id <id>: the ID of the harness (required)--qualifier <qualifier>: the harness endpoint qualifier--output <output>: the output file path (default: <traceId>.json in the current directory)--since <since>: window start: "5m", "1h", "2d", ISO 8601, epoch ms, or "now" (default 12h ago)--until <until>: window end: "5m", "1h", "2d", ISO 8601, epoch ms, or "now" (default now)
agentcore harness endpoint [options] [command]
manage harness endpoints
agentcore harness endpoint create [options]
create a harness endpoint
Options
--id <id>: the ID of the harness (required)--name <name>: the name of the endpoint (required)--target-version <target-version>: the harness version the endpoint points to (default latest)--tags <tags...>: tags as repeated key=value entries or one JSON object
agentcore harness endpoint get [options]
get a harness endpoint
Options
--id <id>: the ID of the harness (required)--qualifier <qualifier>: the endpoint name (qualifier) (required)
agentcore harness endpoint list [options]
list a harness's endpoints
Options
--id <id>: the ID of the harness (required)--next-token <next-token>: next token to use on paginated--max-results <max-results>: max number of items to return
agentcore harness endpoint update [options]
update a harness endpoint
Options
--id <id>: the ID of the harness (required)--qualifier <qualifier>: the endpoint name (qualifier) (required)--target-version <target-version>: the harness version the endpoint points to
agentcore harness endpoint delete [options]
delete a harness endpoint
Options
--id <id>: the ID of the harness (required)--qualifier <qualifier>: the endpoint name (qualifier) (required)
agentcore harness version [options] [command]
inspect harness versions
agentcore harness version get [options]
get a specific version of a harness
Options
--id <id>: the ID of the harness (required)--version <version>: the harness version to get (required)
agentcore harness version list [options]
list a harness's versions
Options
--id <id>: the ID of the harness (required)--next-token <next-token>: next token to use on paginated--max-results <max-results>: max number of items to return
agentcore runtime [options] [command]
inspect hosted agent code, its endpoints, and versions
agentcore runtime get [options]
get an AgentCore Runtime
Options
--id <id>: the ID of the Runtime (required)
agentcore runtime list [options]
list AgentCore Runtimes
Options
--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return
agentcore runtime invoke [options]
invoke a Runtime
Options
--id <id>: the ID of the Runtime (required)--payload <payload>: the inline payload to send--qualifier <qualifier>: the Runtime endpoint qualifier--content-type <content-type>: the payload content type--accept <accept>: the accepted response content type--session-id <session-id>: the Runtime session ID--user-id <user-id>: the Runtime user ID (default "default")--header <header...>: an ordered application header--bearer-token <bearer-token>: the CUSTOM_JWT bearer token--mcp-session-id <mcp-session-id>: the MCP session ID--mcp-protocol-version <mcp-protocol-version>: the MCP protocol version--mcp-method <mcp-method>: the MCP method--mcp-name <mcp-name>: the MCP tool, resource, or prompt name--trace-id <trace-id>: the X-Ray trace ID--trace-parent <trace-parent>: the W3C trace parent--trace-state <trace-state>: the W3C trace state--baggage <baggage>: the W3C baggage--output-file <output-file>: the response output file
agentcore runtime shell [options]
open an interactive shell in a Runtime
Options
--id <id>: the ID of the Runtime (required)--qualifier <qualifier>: the Runtime endpoint qualifier--session-id <session-id>: the Runtime session ID to use--shell-id <shell-id>: the shell ID to resume (requires --session-id)--bearer-token <bearer-token>: the CUSTOM_JWT bearer token
agentcore runtime exec [options]
run a shell command in a Runtime
Options
--id <id>: the ID of the Runtime (required)--command <command>: the command to run--qualifier <qualifier>: the endpoint qualifier (default DEFAULT)--session-id <session-id>: the Runtime session ID--timeout <timeout>: command timeout in seconds (1-3600)
agentcore runtime version [options] [command]
inspect AgentCore Runtime versions
agentcore runtime version get [options]
get a specific Runtime version
Options
--id <id>: the ID of the Runtime (required)--version <version>: the Runtime version to get (required)
agentcore runtime version list [options]
list a Runtime's versions
Options
--id <id>: the ID of the Runtime (required)--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return
agentcore runtime endpoint [options] [command]
inspect AgentCore Runtime endpoints
agentcore runtime endpoint get [options]
get a Runtime endpoint
Options
--id <id>: the ID of the Runtime (required)--qualifier <qualifier>: the endpoint name (qualifier) (required)
agentcore runtime endpoint list [options]
list a Runtime's endpoints
Options
--id <id>: the ID of the Runtime (required)--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return
agentcore runtime logs [options]
stream or search a Runtime's logs
Options
--id <id>: the ID of the Runtime (required)--qualifier <qualifier>: the Runtime endpoint qualifier--since <since>: search window start: "5m", "1h", ISO 8601, epoch ms, or "now"--until <until>: search window end: "5m", "1h", ISO 8601, epoch ms, or "now"--tail: tail new log records (default: false)--level <level>: filter by log level (error, warn, info, debug)--query <query>: CloudWatch Logs filter pattern--limit <limit>: maximum number of log records to return in search mode
agentcore runtime traces [options] [command]
inspect a Runtime's traces
agentcore runtime traces list [options]
list a Runtime's recent traces
Options
--id <id>: the ID of the Runtime (required)--qualifier <qualifier>: the Runtime endpoint qualifier--limit <limit>: maximum number of traces to display (default: 20)--since <since>: window start: "5m", "1h", "2d", ISO 8601, epoch ms, or "now" (default 12h ago)--until <until>: window end: "5m", "1h", "2d", ISO 8601, epoch ms, or "now" (default now)
agentcore runtime traces get [options] <trace-id>
download a trace's log records to a JSON file
Arguments
trace-id(required): the trace ID to download
Options
--id <id>: the ID of the Runtime (required)--qualifier <qualifier>: the Runtime endpoint qualifier--output <output>: the output file path (default: <traceId>.json in the current directory)--since <since>: window start: "5m", "1h", "2d", ISO 8601, epoch ms, or "now" (default 12h ago)--until <until>: window end: "5m", "1h", "2d", ISO 8601, epoch ms, or "now" (default now)
agentcore gateway [options] [command]
inspect MCP tool gateways and their targets
agentcore gateway get [options]
get an AgentCore Gateway
Options
--id <id>: the ID of the Gateway (required)
agentcore gateway list [options]
list AgentCore Gateways
Options
--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return
agentcore gateway invoke [options]
invoke an AgentCore Gateway
Options
--id <id>: the ID of the Gateway (required)--path <path>: the path relative to the Gateway origin--method <method>: the HTTP request method--payload <payload>: the inline payload to send--content-type <content-type>: the payload content type--accept <accept>: the accepted response content type--header <header...>: an ordered application header--bearer-token <bearer-token>: the Gateway bearer token--session-id <session-id>: the Runtime target session ID--mcp-session-id <mcp-session-id>: the MCP session ID--mcp-protocol-version <mcp-protocol-version>: the MCP protocol version--output-file <output-file>: the response output file
agentcore gateway target [options] [command]
manage Targets for an AgentCore Gateway
agentcore gateway target get [options]
get a Gateway Target
Options
--gateway-id <gateway-id>: the ID of the Gateway (required)--target-id <target-id>: the ID of the Gateway Target (required)
agentcore gateway target list [options]
list Targets for an AgentCore Gateway
Options
--gateway-id <gateway-id>: the ID of the Gateway (required)--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return
agentcore gateway connector [options] [command]
manage connectors configured for an AgentCore Gateway
agentcore gateway connector get [options]
get a connector-backed Gateway Target
Options
--gateway-id <gateway-id>: the ID of the Gateway (required)--id <id>: the ID of the connector-backed Gateway Target (required)
agentcore gateway connector list [options]
list connectors configured for an AgentCore Gateway
Options
--gateway-id <gateway-id>: the ID of the Gateway (required)--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return
agentcore gateway rule [options] [command]
manage Rules for an AgentCore Gateway
agentcore gateway rule get [options]
get a Gateway Rule
Options
--gateway-id <gateway-id>: the ID of the Gateway (required)--rule-id <rule-id>: the ID of the Gateway Rule (required)
agentcore gateway rule list [options]
list Rules for an AgentCore Gateway
Options
--gateway-id <gateway-id>: the ID of the Gateway (required)--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return
agentcore gateway policy [options] [command]
generate Cedar policies for an AgentCore Gateway
agentcore gateway policy generate [options]
generate a Cedar policy for a Gateway from a natural-language prompt
Options
--gateway-id <gateway-id>: the ID or ARN of the Gateway the policy applies to (required)--policy-engine-id <policy-engine-id>: the ID or ARN of the Policy Engine (default the Gateway's attached engine)--prompt <prompt>: what the policy should allow or deny (inline, file://<path>, or - for stdin)--name <name>: name of the generation request (default cli_generation_<timestamp>)
agentcore identity [options] [command]
manage API key and OAuth credential providers
agentcore identity api-key-credential-provider [options] [command]
manage API key credential providers
agentcore identity api-key-credential-provider create [options]
create an API key credential provider
Options
--name <name>: the name of the API key credential provider (required)--api-key <api-key>: the API key (file://path or - for stdin; inline values are rejected)--api-key-secret-reference <api-key-secret-reference>: external secret reference JSON: {"secretId":"<arn>","jsonKey":"<key>"}--tags <tags...>: tags as repeated key=value entries or one JSON object
agentcore identity api-key-credential-provider get [options]
get an API key credential provider
Options
--name <name>: the name of the API key credential provider (required)
agentcore identity api-key-credential-provider list [options]
list API key credential providers
Options
--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return
agentcore identity api-key-credential-provider update [options]
update an API key credential provider
Options
--name <name>: the name of the API key credential provider (required)--api-key <api-key>: the new API key (file://path or - for stdin; inline values are rejected)--api-key-secret-reference <api-key-secret-reference>: external secret reference JSON: {"secretId":"<arn>","jsonKey":"<key>"}
agentcore identity api-key-credential-provider delete [options]
delete an API key credential provider
Options
--name <name>: the name of the API key credential provider (required)
agentcore identity oauth2-credential-provider [options] [command]
manage OAuth2 credential providers
agentcore identity oauth2-credential-provider create [options]
create an OAuth2 credential provider
Options
--name <name>: the name of the OAuth2 credential provider (required)--vendor <vendor>: the OAuth2 vendor (e.g. CustomOauth2, GithubOauth2) (required)--client-secret <client-secret>: the client secret (file://path or - for stdin; inline values are rejected)--client-secret-reference <client-secret-reference>: external secret reference JSON: {"secretId":"<arn>","jsonKey":"<key>"}--client-id <client-id>: OAuth2 client ID (guided custom OAuth2)--discovery-url <discovery-url>: OAuth2 discovery URL (guided custom OAuth2)--authorization-server-metadata <authorization-server-metadata>: authorization server metadata JSON (guided custom OAuth2)--provider-configuration <provider-configuration>: complete OAuth2 provider configuration JSON (alternative to guided flags)--tags <tags...>: tags as repeated key=value entries or one JSON object
agentcore identity oauth2-credential-provider get [options]
get an OAuth2 credential provider
Options
--name <name>: the name of the OAuth2 credential provider (required)
agentcore identity oauth2-credential-provider list [options]
list OAuth2 credential providers
Options
--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return
agentcore identity oauth2-credential-provider update [options]
update an OAuth2 credential provider
Options
--name <name>: the name of the OAuth2 credential provider (required)--vendor <vendor>: the OAuth2 vendor--client-secret <client-secret>: the client secret (file://path or - for stdin; inline values are rejected)--client-secret-reference <client-secret-reference>: external secret reference JSON: {"secretId":"<arn>","jsonKey":"<key>"}--client-id <client-id>: OAuth2 client ID (guided custom OAuth2)--discovery-url <discovery-url>: OAuth2 discovery URL (guided custom OAuth2)--authorization-server-metadata <authorization-server-metadata>: authorization server metadata JSON (guided custom OAuth2)--provider-configuration <provider-configuration>: complete OAuth2 provider configuration JSON (alternative to guided flags)
agentcore identity oauth2-credential-provider delete [options]
delete an OAuth2 credential provider
Options
--name <name>: the name of the OAuth2 credential provider (required)
agentcore identity payment-credential-provider [options] [command]
manage payment credential providers
agentcore identity payment-credential-provider get [options]
get a payment credential provider
Options
--name <name>: the payment credential provider name (required)
agentcore identity payment-credential-provider list [options]
list payment credential providers
Options
--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return
agentcore memory [options] [command]
inspect agent memory: sessions, events, and records
agentcore memory get [options]
get an AgentCore Memory
Options
--id <id>: the ID of the Memory (required)--view <view>: response view
agentcore memory list [options]
list AgentCore Memories
Options
--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return
agentcore memory event [options] [command]
inspect AgentCore Memory events
agentcore memory event get [options]
get an AgentCore Memory Event
Options
--id <id>: the ID of the Memory (required)--actor-id <actor-id>: the ID of the actor (required)--session-id <session-id>: the session ID (required)--event-id <event-id>: the event ID (required)
agentcore memory event list [options]
list AgentCore Memory events
Options
--id <id>: the ID of the Memory (required)--actor-id <actor-id>: the ID of the actor (required)--session-id <session-id>: the session ID (required)--include-payloads: includes event payloads in the response (default: false)--branch <branch>: filter events by branch name--include-parent-branches: includes parent branches when filtering by branch (default: false)--metadata-filters <metadata-filters>: event metadata filters as JSON--max-results <max-results>: maximum number of events to return; default 20--next-token <next-token>: pagination token returned by a previous request
agentcore memory record [options] [command]
inspect AgentCore Memory records
agentcore memory record get [options]
get an AgentCore Memory record
Options
--id <id>: the ID of the Memory (required)--record-id <record-id>: the ID of the Memory record (required)
agentcore memory record list [options]
list AgentCore Memory records
Options
--id <id>: the ID of the Memory (required)--namespace <namespace>: filter by namespace prefix--namespace-path <namespace-path>: filter by namespace hierarchy--strategy-id <strategy-id>: filter by Memory strategy ID--metadata-filters <metadata-filters>: Memory record metadata filters as JSON--max-results <max-results>: maximum number of records to return--next-token <next-token>: pagination token returned by a previous request
agentcore memory actor [options] [command]
inspect actors in AgentCore Memories
agentcore memory actor list [options]
list actors in an AgentCore Memory
Options
--id <id>: the ID of the Memory (required)--max-results <max-results>: maximum number of actors to return--next-token <next-token>: pagination token returned by a previous request
agentcore memory session [options] [command]
inspect sessions in AgentCore Memories
agentcore memory session list [options]
list sessions in an AgentCore Memory
Options
--id <id>: the ID of the Memory (required)--actor-id <actor-id>: the ID of the actor (required)--max-results <max-results>: maximum number of sessions to return--next-token <next-token>: pagination token returned by a previous request
agentcore eval [options] [command]
evaluate and optimize agents with evaluators and A/B tests
agentcore eval evaluator [options] [command]
manage AgentCore evaluators
agentcore eval evaluator get [options]
get an evaluator by ID
Options
--id <id>: the ID of the evaluator (required)
agentcore eval evaluator list [options]
list evaluators
Options
--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return
agentcore eval evaluator delete [options]
delete an evaluator by ID
Options
--id <id>: the ID of the evaluator to delete (required)
agentcore eval evaluator llm-as-a-judge [options] [command]
manage LLM-as-a-Judge evaluators
agentcore eval evaluator llm-as-a-judge create [options]
create an LLM-as-a-Judge evaluator
Options
--name <name>: the name of the evaluator (required)--level <level>: evaluation level (SESSION | TRACE | TOOL_CALL) (required)--model-provider <model-provider>: model provider for the judge: Bedrock (default) or OpenResponses--model <model>: judge model: a Bedrock model ID / ARN, or an OpenResponses model ID (required)--instructions <instructions>: evaluation instructions (inline, file://<path>, or - for stdin) (required)--rating-scale <rating-scale>: rating scale: a preset (1-5-quality | 1-3-simple | pass-fail | good-neutral-bad) or a custom RatingScale (JSON inline, file://<path>, or - for stdin) (required)--kms-key-arn <kms-key-arn>: customer managed KMS key ARN for evaluator data--tags <tags...>: tags as repeated key=value entries or one JSON object
agentcore eval evaluator llm-as-a-judge update [options]
update an LLM-as-a-Judge evaluator
Options
--id <id>: the ID of the evaluator to update (required)--instructions <instructions>: evaluation instructions (inline, file://<path>, or - for stdin)--model-provider <model-provider>: model provider for the judge: Bedrock (default) or OpenResponses--model <model>: judge model: a Bedrock model ID / ARN, or an OpenResponses model ID (required when changing provider)--rating-scale <rating-scale>: rating scale: a preset (1-5-quality | 1-3-simple | pass-fail | good-neutral-bad) or a custom RatingScale (JSON inline, file://<path>, or - for stdin)--kms-key-arn <kms-key-arn>: customer managed KMS key ARN for evaluator data
agentcore eval evaluator code-based [options] [command]
manage code-based (Lambda-backed) evaluators
agentcore eval evaluator code-based create [options]
create a code-based (Lambda-backed) evaluator
Options
--name <name>: the name of the evaluator (required)--level <level>: evaluation level (SESSION | TRACE | TOOL_CALL) (required)--lambda-arn <lambda-arn>: ARN of the Lambda function that scores a session (required)--timeout <timeout>: Lambda timeout in seconds (1-300)--kms-key-arn <kms-key-arn>: customer managed KMS key ARN for evaluator data--tags <tags...>: tags as repeated key=value entries or one JSON object
agentcore eval evaluator code-based update [options]
update a code-based (Lambda-backed) evaluator
Options
--id <id>: the ID of the evaluator to update (required)--lambda-arn <lambda-arn>: ARN of the Lambda function that scores a session--timeout <timeout>: Lambda timeout in seconds (1-300)--kms-key-arn <kms-key-arn>: customer managed KMS key ARN for evaluator data
agentcore eval online-eval [options] [command]
manage AgentCore online evaluation configs
agentcore eval online-eval create [options]
create an online evaluation config
Options
--name <name>: the name of the online evaluation config (required)--description <description>: a description of the config's monitoring purpose--enable-on-create <enable-on-create>: whether to enable evaluation immediately (default true; pass false to create it paused)--tags <tags...>: tags as repeated key=value entries or one JSON object--agent <agent>: harness ID or Runtime ID whose traffic to sample--data-source-config <data-source-config>: the traces to sample (JSON DataSourceConfig), as an alternative to --agent--endpoint <endpoint>: the agent endpoint qualifier to scope monitoring to (default DEFAULT)--evaluators <evaluators...>: the ID(s) of the evaluators to apply (required)--sampling-rate <sampling-rate>: percentage of sessions to sample (0.01-100) (required)--session-timeout-minutes <session-timeout-minutes>: minutes of inactivity before a session is considered complete (1-1440, default 15)--filters <filters>: trace filters (JSON Filter[])--output-config <output-config>: where results and metrics are written (JSON OutputConfig)--role-arn <role-arn>: IAM role the online evaluation assumes (default auto-provisioned)
agentcore eval online-eval get [options]
get an online evaluation config by ID
Options
--id <id>: the ID of the online evaluation config (required)
agentcore eval online-eval list [options]
list online evaluation configs
Options
--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return
agentcore eval online-eval update [options]
update an online evaluation config
Options
--id <id>: the ID of the online evaluation config to update (required)--description <description>: replace the description of the config's monitoring purpose--agent <agent>: repoint at a different harness ID or Runtime ID--data-source-config <data-source-config>: replace the traces to sample (JSON DataSourceConfig)--endpoint <endpoint>: re-scope monitoring to a different agent endpoint qualifier--clear-endpoint <clear-endpoint>: reset the endpoint scope to the default qualifier (pass true)--evaluators <evaluators...>: the ID(s) of the evaluators to apply (replaces the existing list)--sampling-rate <sampling-rate>: percentage of sessions to sample (0.01-100)--session-timeout-minutes <session-timeout-minutes>: minutes of inactivity before a session is considered complete (1-1440)--filters <filters>: replace the trace filters (JSON Filter[])--output-config <output-config>: where results and metrics are written (JSON OutputConfig)--role-arn <role-arn>: replace the IAM role the online evaluation assumes
agentcore eval online-eval pause [options]
pause an online evaluation config
Options
--id <id>: the ID of the online evaluation config to pause (required)
agentcore eval online-eval resume [options]
resume a paused online evaluation config
Options
--id <id>: the ID of the online evaluation config to resume (required)
agentcore eval online-eval delete [options]
delete an online evaluation config by ID
Options
--id <id>: the ID of the online evaluation config to delete (required)
agentcore eval online-eval logs [options]
stream or search online-eval logs
Options
--id <id>: the ID of the online-eval resource (required)--since <since>: search window start: "5m", "1h", ISO 8601, epoch ms, or "now"--until <until>: search window end: "5m", "1h", ISO 8601, epoch ms, or "now"--tail: tail new log records (default: false)--level <level>: filter by log level (error, warn, info, debug)--query <query>: CloudWatch Logs filter pattern--limit <limit>: maximum number of log records to return in search mode
agentcore eval dataset [options] [command]
manage AgentCore evaluation datasets
agentcore eval dataset create [options]
create a dataset from JSONL examples
Options
--name <name>: the name of the dataset (required)--source <source>: dataset examples: a JSONL file (file://<path>), an S3 JSONL object (s3://<bucket>/<key>), or - for stdin (required)--schema-type <schema-type>: the structure of the dataset's examples, immutable after creation (predefined | simulated) (required)--description <description>: a description of the dataset--kms-key-arn <kms-key-arn>: customer managed KMS key ARN for dataset data--tags <tags...>: tags as repeated key=value entries or one JSON object
agentcore eval dataset get [options]
get a dataset's metadata, optionally downloading its examples
Options
--id <id>: the ID of the dataset (required)--version <version>: the version to retrieve (DRAFT or a version number, default DRAFT)--file-path <file-path>: write the version's examples to this path as JSONL, in addition to printing metadata
agentcore eval dataset list [options]
list datasets
Options
--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return
agentcore eval dataset delete [options]
delete a dataset, or one of its published versions
Options
--id <id>: the ID of the dataset to delete (required)--version <version>: delete only this published version, leaving the dataset in place; omit to delete the entire dataset
agentcore eval dataset update [options]
update a dataset DRAFT from a local JSONL file
Options
--id <id>: the ID of the dataset to update (required)--file-path <file-path>: local JSONL file to reconcile into the DRAFT (required)
agentcore eval dataset publish [options]
publish the current DRAFT as a new immutable version
Options
--id <id>: the ID of the dataset to publish (required)
agentcore eval batch-evaluation [options] [command]
run and inspect AgentCore batch evaluations
agentcore eval batch-evaluation evaluate [options]
evaluate existing sessions service-side (async; returns a job ID)
Options
--name <name>: batch evaluation name (must be unique in the account) (required)--description <description>: optional description--kms-key-arn <kms-key-arn>: KMS key to encrypt evaluation data at rest--agent <agent>: harness ID or Runtime ID whose sessions to use--online-eval <online-eval>: use sessions an online-eval config already sampled--data-source-config <data-source-config>: the traces to read (JSON DataSourceConfig); escape hatch--endpoint <endpoint>: Runtime endpoint qualifier (default DEFAULT; only with --agent)--start-time <start-time>: window start (ISO-8601, with --end-time)--end-time <end-time>: window end (ISO-8601, with --start-time)--session-ids <session-ids...>: specific session IDs (only with --agent)--evaluators <evaluators...>: evaluator ID(s) to apply (required)--ground-truth <ground-truth>: expected answers for the sessions (JSON SessionMetadataShape[])--output-config <output-config>: where results and metrics are written (JSON OutputConfig)
agentcore eval batch-evaluation simulate [options]
replay a dataset against a Runtime, then batch-evaluate the resulting sessions
Options
--runtime-id <runtime-id>: Runtime ID to invoke per scenario (required)--endpoint <endpoint>: Runtime endpoint qualifier (default DEFAULT)--payload-template <payload-template>: request body per example (JSON object); {input} is replaced with the input (required)--header <header...>: an ordered application header (repeatable)--bearer-token <bearer-token>: CUSTOM_JWT bearer token (for JWT-auth Runtimes)--user-id <user-id>: Runtime user ID--dataset <dataset>: dataset source: local JSONL path or a dataset ID (required)--dataset-version <dataset-version>: dataset version (with a dataset ID)--ingestion-wait-ms <ingestion-wait-ms>: ms to wait for span ingestion before grading (default 180000; 0 to skip)--name <name>: batch evaluation name (unique in the account) (required)--description <description>: description for the batch evaluation--kms-key-arn <kms-key-arn>: KMS key to encrypt evaluation data at rest--evaluators <evaluators...>: evaluator ID(s) to apply (required)--output-config <output-config>: where results and metrics are written (JSON OutputConfig)
agentcore eval batch-evaluation get [options]
get a batch evaluation by ID, with CloudWatch-backed results, insights, and errors when available
Options
--id <id>: the ID of the batch evaluation (required)--disable-cw-results: skip CloudWatch result retrieval and return only service-side job metadata (default: false)
agentcore eval batch-evaluation list [options]
list batch evaluations
Options
--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return
agentcore eval batch-evaluation stop [options]
stop a running batch evaluation
Options
--id <id>: the ID of the batch evaluation to stop (required)
agentcore eval ondemand [options] [command]
evaluate existing sessions synchronously, client-side
agentcore eval ondemand evaluate [options]
evaluate existing sessions client-side (synchronous; prints scores)
Options
--agent <agent>: harness ID or Runtime ID whose sessions to evaluate (required)--endpoint <endpoint>: Runtime endpoint qualifier (default DEFAULT)--lookback-days <lookback-days>: evaluate sessions from the last N days--start-time <start-time>: window start (ISO-8601, with --end-time)--end-time <end-time>: window end (ISO-8601, with --start-time)--session-ids <session-ids...>: specific session IDs--trace-id <trace-id>: a single trace ID (session ID is read off the span)--evaluators <evaluators...>: evaluator ID(s) to apply (required)--ground-truth <ground-truth>: expected answers (JSON EvaluationReferenceInput[])
agentcore eval ondemand simulate [options]
replay a dataset against a Runtime, then evaluate the sessions client-side
Options
--runtime-id <runtime-id>: Runtime ID to invoke per scenario (required)--endpoint <endpoint>: Runtime endpoint qualifier (default DEFAULT)--payload-template <payload-template>: request body per example (JSON object); {input} is replaced with the input (required)--header <header...>: an ordered application header (repeatable)--bearer-token <bearer-token>: CUSTOM_JWT bearer token (for JWT-auth Runtimes)--user-id <user-id>: Runtime user ID--dataset <dataset>: local JSONL path or a dataset ID (required)--dataset-version <dataset-version>: dataset version (with a dataset ID)--evaluators <evaluators...>: evaluator ID(s) to apply (required)--ingestion-wait-ms <ingestion-wait-ms>: ms to wait for span ingestion before grading (default 180000; 0 to skip)
agentcore eval config-bundle [options] [command]
manage AgentCore configuration bundles
agentcore eval config-bundle create [options]
create a configuration bundle and its initial immutable version
Options
--name <name>: the name of the configuration bundle (required)--components <components>: complete component configuration map (JSON inline, file://<path>, or - for stdin) (required)--branch-name <branch-name>: branch name for the initial configuration--commit-message <commit-message>: message describing the initial configuration--kms-key-arn <kms-key-arn>: customer managed KMS key ARN for component configurations
agentcore eval config-bundle get [options]
get the latest or a specific configuration bundle version
Options
--id <id>: the ID of the configuration bundle (required)--version <version>: the immutable version ID to retrieve--branch-name <branch-name>: branch used when retrieving the latest version (default: "mainline")
agentcore eval config-bundle list [options]
list configuration bundles
Options
--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return
agentcore eval config-bundle update [options]
create a new immutable configuration bundle version
Options
--id <id>: the ID of the configuration bundle (required)--components <components>: replacement component configuration map (JSON inline, file://<path>, or - for stdin) (required)--commit-message <commit-message>: message describing the configuration bundle update (required)--branch-name <branch-name>: branch to update (default: "mainline")--kms-key-arn <kms-key-arn>: customer managed KMS key ARN to rotate component encryption to
agentcore eval config-bundle delete [options]
delete a configuration bundle and all of its versions
Options
--id <id>: the ID of the configuration bundle (required)
agentcore eval config-bundle version [options] [command]
inspect immutable configuration bundle versions
agentcore eval config-bundle version list [options]
list immutable versions of a configuration bundle
Options
--id <id>: the ID of the configuration bundle (required)--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return
agentcore eval ab-test [options] [command]
manage AgentCore A/B tests
agentcore eval ab-test get [options]
get an A/B test by ID, with per-evaluator comparison metrics
Options
--id <id>: the ID of the A/B test (required)
agentcore eval ab-test list [options]
list A/B tests
Options
--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return
agentcore eval ab-test pause [options]
pause a running A/B test
Options
--id <id>: the ID of the A/B test (required)
agentcore eval ab-test resume [options]
resume a paused A/B test
Options
--id <id>: the ID of the A/B test (required)
agentcore eval ab-test stop [options]
stop an A/B test (terminal)
Options
--id <id>: the ID of the A/B test (required)
agentcore eval ab-test delete [options]
delete a stopped A/B test
Options
--id <id>: the ID of the A/B test (required)
agentcore eval ab-test config-based [options] [command]
run config-based A/B tests
agentcore eval ab-test config-based run [options]
run an A/B test between two config-bundle versions on one Gateway
Options
--name <name>: the A/B test name (required)--gateway <gateway>: deployed Gateway ID (required)--control <control>: control JSON {"config-bundle","bundle-version"} (inline, file://, or -) (required)--treatment <treatment>: treatment JSON {"config-bundle","bundle-version"} (inline, file://, or -) (required)--online-eval <online-eval>: online-evaluation config ID (required)--treatment-weight <treatment-weight>: 1-99; control weight = 100 - this (default 50)--gateway-filter <gateway-filter>: GatewayFilter JSON, e.g. {"targetPaths":["/orders"]} (inline, file://, or -)--role-arn <role-arn>: execution-role override (default auto-provisioned)--enable-on-create <enable-on-create>: whether to start the test immediately (default true; pass false to create it paused)
agentcore eval ab-test target-based [options] [command]
run target-based A/B tests
agentcore eval ab-test target-based run [options]
run an A/B test between two Gateway Targets and their online evaluations
Options
--name <name>: the A/B test name (required)--gateway <gateway>: deployed Gateway ID (required)--control <control>: control JSON {"gateway-target":"<name>","online-eval":"<id>"} (inline, file://, or -) (required)--treatment <treatment>: treatment JSON {"gateway-target":"<name>","online-eval":"<id>"} (inline, file://, or -) (required)--treatment-weight <treatment-weight>: 1-99; control weight = 100 - this (default 50)--gateway-filter <gateway-filter>: GatewayFilter JSON, e.g. {"targetPaths":["/orders"]} (inline, file://, or -)--role-arn <role-arn>: execution-role override (default auto-provisioned)--enable-on-create <enable-on-create>: whether to start the test immediately (default true; pass false to create it paused)
agentcore eval recommendation [options] [command]
manage AgentCore recommendations
agentcore eval recommendation start [options]
start an asynchronous recommendation
Options
--name <name>: the name of the recommendation (required)--type <type>: the recommendation type (SYSTEM_PROMPT_RECOMMENDATION | TOOL_DESCRIPTION_RECOMMENDATION) (required)--recommendation-config <recommendation-config>: recommendation configuration (JSON inline, file://<path>, or - for stdin) (required)--description <description>: a description of the recommendation--kms-key-arn <kms-key-arn>: customer managed KMS key ARN for recommendation data--tags <tags...>: tags as repeated key=value entries or one JSON object
agentcore eval recommendation get [options]
get a recommendation by ID
Options
--id <id>: the ID of the recommendation (required)
agentcore eval recommendation list [options]
list recommendations
Options
--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return--status-filter <status-filter>: return only recommendations with this status (PENDING | IN_PROGRESS | COMPLETED | FAILED | DELETING)
agentcore eval recommendation delete [options]
delete a recommendation by ID
Options
--id <id>: the ID of the recommendation to delete (required)
agentcore payment [options] [command]
inspect payment managers, sessions, and instruments
agentcore payment manager [options] [command]
manage AgentCore payment managers
agentcore payment manager get [options]
get a payment manager by id
Options
--id <id>: the payment manager ID (required)
agentcore payment manager list [options]
list payment managers
Options
--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return
agentcore payment connector [options] [command]
manage connectors under a payment manager
agentcore payment connector get [options]
get a payment connector by id
Options
--manager-id <manager-id>: the parent payment manager ID (required)--connector-id <connector-id>: the payment connector ID (required)
agentcore payment connector list [options]
list the connectors of a payment manager
Options
--manager-id <manager-id>: the parent payment manager ID (required)--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return
agentcore payment connector rotate-credentials [options]
rotate service-managed credentials for a Quick Create Coinbase connector
Options
--manager-id <manager-id>: the parent payment manager ID (required)--connector-id <connector-id>: the payment connector ID (required)--secrets <secrets...>: credential kinds to rotate: API_KEY, WALLET_SECRET, or both (not secret values) (required)--client-token <client-token>: idempotency token for this request
agentcore payment session [options] [command]
manage payment sessions (budget-limited payment contexts)
agentcore payment session get [options]
get a payment session by id
Options
--manager-id <manager-id>: the parent payment manager ID (required)--session-id <session-id>: the payment session ID (required)--user-id <user-id>: the application user ID associated with the session (required)--agent-name <agent-name>: optional observability label, not an agent selector
agentcore payment session list [options]
list an application user's payment sessions under a payment manager
Options
--manager-id <manager-id>: the parent payment manager ID (required)--user-id <user-id>: the application user ID to list sessions for (required)--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return--agent-name <agent-name>: optional observability label, not an agent selector
agentcore payment instrument [options] [command]
manage payment instruments (embedded crypto wallets)
agentcore payment instrument get [options]
get a payment instrument by id
Options
--manager-id <manager-id>: the parent payment manager ID (required)--instrument-id <instrument-id>: the payment instrument ID (required)--user-id <user-id>: the application user ID associated with the instrument (required)--connector-id <connector-id>: optionally restrict the lookup to this payment connector--agent-name <agent-name>: optional observability label, not an agent selector
agentcore payment instrument list [options]
list an application user's payment instruments under a payment manager
Options
--manager-id <manager-id>: the parent payment manager ID (required)--user-id <user-id>: the application user ID to list instruments for (required)--connector-id <connector-id>: optionally filter instruments by this payment connector--next-token <next-token>: pagination token returned by a previous request--max-results <max-results>: maximum number of items to return--agent-name <agent-name>: optional observability label, not an agent selector
agentcore payment instrument balance [options]
get a payment instrument's token balance on a specific chain
Options
--manager-id <manager-id>: the parent payment manager ID (required)--connector-id <connector-id>: the instrument's payment connector ID (required)--instrument-id <instrument-id>: the payment instrument ID (required)--user-id <user-id>: the application user ID associated with the instrument (required)--chain <chain>: the blockchain chain to query (BASE | BASE_SEPOLIA | ETHEREUM | SOLANA | SOLANA_DEVNET) (required)--token <token>: the token to query (USDC) (default: "USDC")--agent-name <agent-name>: optional observability label, not an agent selector
agentcore feedback [options] <message>
send feedback about AgentCore to the team
Arguments
message(required): the feedback message to send
Options
--screenshot <screenshot>: path to a PNG or JPG screenshot to attach (max 100MB)--yes: accept the AWS Customer Agreement and skip the consent prompt (default: false)
agentcore config [options] [key] [value]
read/write global config values
Arguments
key(optional): the config key in JSON path notation (e.g. telemetry.enabled)value(optional): the value to set for the key
agentcore update [options]
check for and install CLI updates
Options
--check: check for updates without installing (default: false)