📅 November 6, 2026 • AWS Machine Learning Blog
AWS publishes a serverless MCP pattern for agent data access
The AWS Machine Learning Blog describes a reference architecture that gives AI agents governed access to a data lake through a serverless MCP server - a FastMCP server on ECS Fargate, per AWS. The design targets enterprise deployments where agents need controlled data access instead of open database credentials, and it lays out both the request path and the control points around it.
Two data surfaces behind one protocol
The server exposes two capabilities to connected agents - SQL queries through Athena and semantic search through Bedrock Knowledge Bases. The SQL path is SELECT-only - anything else is rejected at the tool level, before a query reaches the data lake. Semantic search covers unstructured content through the Knowledge Bases layer, so agents work with documents and structured tables through the same endpoint.
Guardrails at the protocol layer
Bedrock Guardrails apply to all LLM interactions at the MCP server layer - grounding checks and prompt-injection blocking run for every connected agent. The control point is the protocol server itself, so protection does not depend on each individual agent implementing its own safety layer - every call that passes through the MCP server passes through the same guardrails.
The agent pipeline
The published pipeline runs in sequence - a metadata catalog describes available data, SQL generation goes through Bedrock, generated queries pass validation and auto-correction for Athena, execution follows, and the agent receives a natural-language answer built from the query results. Each stage is a separate checkpoint, which makes failures local and diagnosable.
Onboarding a dataset is one file
Connecting a new dataset requires one JSON metadata file covering the schema, business context and column semantics. Per AWS, this keeps expansion of agent data access a configuration task rather than a code change.
IMPACT
Data platform teams and agent developers in regulated environments are the direct audience. Daily work changes in concrete ways - data access moves from shared credentials to tool-level controls where only SELECT statements pass, guardrails are enforced once at the MCP server for all agents instead of per agent, and adding a dataset becomes a metadata edit instead of a pipeline change. The pattern also defines where review happens - the metadata file and the guardrail configuration become the audit surface for what agents are allowed to read, and the SELECT-only rule shifts query review from runtime monitoring to access design.
Sources: aws.amazon.com
Continue the conversation: https://t.me/AIAutomationArchitecture · Bluesky