# AWS publishes a serverless MCP reference design for agent data access > Source: > Published: 2026-11-06 20:08:54+00:00 📅 November 6, 2026 • AWS Machine Learning Blog **AWS publishes a serverless MCP pattern for agent data access** The AWS Machine Learning Blog describes a reference architecture that gives AI agents governed access to a data lake through a serverless MCP server - a FastMCP server on ECS Fargate, per AWS. The design targets enterprise deployments where agents need controlled data access instead of open database credentials, and it lays out both the request path and the control points around it. **Two data surfaces behind one protocol** The server exposes two capabilities to connected agents - SQL queries through Athena and semantic search through Bedrock Knowledge Bases. The SQL path is **SELECT-only** - anything else is rejected at the tool level, before a query reaches the data lake. Semantic search covers unstructured content through the Knowledge Bases layer, so agents work with documents and structured tables through the same endpoint. **Guardrails at the protocol layer** Bedrock Guardrails apply to all LLM interactions at the MCP server layer - grounding checks and prompt-injection blocking run for every connected agent. The control point is the protocol server itself, so protection does not depend on each individual agent implementing its own safety layer - every call that passes through the MCP server passes through the same guardrails. **The agent pipeline** The published pipeline runs in sequence - a metadata catalog describes available data, SQL generation goes through Bedrock, generated queries pass validation and auto-correction for Athena, execution follows, and the agent receives a natural-language answer built from the query results. Each stage is a separate checkpoint, which makes failures local and diagnosable. **Onboarding a dataset is one file** Connecting a new dataset requires **one JSON metadata file** covering the schema, business context and column semantics. Per AWS, this keeps expansion of agent data access a configuration task rather than a code change. **IMPACT** Data platform teams and agent developers in regulated environments are the direct audience. Daily work changes in concrete ways - data access moves from shared credentials to tool-level controls where only SELECT statements pass, guardrails are enforced once at the MCP server for all agents instead of per agent, and adding a dataset becomes a metadata edit instead of a pipeline change. The pattern also defines where review happens - the metadata file and the guardrail configuration become the audit surface for what agents are allowed to read, and the SELECT-only rule shifts query review from runtime monitoring to access design. **Sources:** aws.amazon.com **Continue the conversation:** [https://t.me/AIAutomationArchitecture](https://t.me/AIAutomationArchitecture) · [Bluesky](https://bsky.app/profile/delimitter.bsky.social)