AWS Details MCP Bridge Architecture Connecting Cloud-Hosted AI Agents to Local Files and Tools

The Problem: Cloud Agents, Local Files

AWS engineers published a detailed architecture for connecting AI agents hosted on Amazon Bedrock AgentCore to Model Context Protocol (MCP) servers running on a user's local machine — solving a gap in the MCP specification that has no native transport for remote clients talking to local servers.

MCP, introduced by Anthropic in November 2024, standardizes how AI models connect to external tools and data through a client-server architecture. The protocol natively supports two transports: stdio for same-machine communication, and streamable HTTP for remote server-to-client connections. Neither transport covers the case where the MCP client (the agent) runs remotely in the cloud while the MCP server (the tool) runs locally on a user's laptop — the exact situation financial analysts face when an AI agent needs to read a spreadsheet that never leaves their machine.

AWS says it built and shipped this pattern internally for a production finance assistant that has logged over 41,000 conversations in the year since launch. The blog post recreates a simplified version of that system and has published the full source code on GitHub.

How the Bridge Works

The architecture has four components:

• AgentCore runtime: Hosts a Strands agent in the cloud, acting as the MCP client that issues tool discovery and invocation requests.
• Browser extension: Runs the chat UI and relays MCP messages bidirectionally — over WebSocket to AgentCore, and over native messaging to the local bridge.
• MCP Bridge: A FastMCP proxy running locally, spawned by the browser via native messaging host registration, translating between the native messaging envelope and raw MCP JSON-RPC.
• MCP Server: A standard local MCP server, communicating with the bridge over stdio since both run on the same machine.

The browser extension connects to AgentCore over a presigned WebSocket URL, SigV4-signed using the user's local AWS credentials and valid for 5 minutes. AWS notes that credentials never leave the user's machine or enter the browser. If the connection drops, the extension automatically requests a new presigned URL after a 2-second delay and reconnects.

Each tool call passes through three hops, with each layer stripping one wrapper: the agent sends a JSON envelope over WebSocket to the extension, the extension relays the unwrapped MCP payload to the bridge over native messaging, and the bridge forwards raw JSON-RPC 2.0 to the local MCP server over stdio. Responses travel the reverse path.

Request-response correlation uses unique JSON-RPC IDs registered against asyncio Futures keyed by session ID, allowing multiple concurrent tool calls without ambiguity. Tool discovery happens on every user message via a tools/list call, meaning new tools added to the local MCP server become available to the agent immediately with no code changes required.

Native Messaging Constraints

The bridge relies on Chrome and Firefox's native messaging APIs to launch a long-running local process without requiring network permissions or repeated user prompts. Messages are JSON-serialized, UTF-8 encoded, and prefixed with a 32-bit little-endian length header. Chrome enforces a 1 MB cap on messages sent from the native host to the browser, and a 64 MiB cap in the reverse direction.

What This Means

This is an infrastructure pattern, not a model release, but it addresses a real deployment gap for enterprises wanting centrally managed AI agents that still need to touch local, sensitive files — a category of problem Anthropic's own Claude Cowork product also targets. AWS's contribution is a fully self-hosted, open-source alternative built on Bedrock AgentCore, letting organizations use their own models and custom tool servers rather than depend on a vendor's hosted agent platform.

The approach trades some complexity — three hops of JSON wrapping, native messaging manifest registration, credential handling entirely on the client side — for a genuine security property: AWS credentials and local file contents never transit through the browser extension's cloud-facing components in plaintext beyond what's needed per request. For regulated industries like finance, where the 41,000-conversation internal deployment originated, that tradeoff is likely the whole point. Teams evaluating this pattern should weigh the native messaging installation overhead against simpler alternatives like local HTTP proxies, particularly for less security-sensitive use cases.