AWS Agent Registry Is Now Generally Available on Bedrock AgentCore

AWS Agent Registry is now generally available as part of Amazon Bedrock AgentCore, giving engineering teams a centralized catalog for registering, governing, and discovering AI agents, tools, and skills across an organization. The service targets what has become the dominant scaling bottleneck for agentic deployments: not building agents, but knowing what already exists, who owns it, and whether it can be trusted. For teams managing dozens or hundreds of autonomous capabilities across business units, that gap translates directly into duplicated infrastructure, security blind spots, and governance failures.

As agentic architectures grow in complexity, the absence of a shared contract between teams compounds quickly — a pattern explored in four agent control layers with no shared contract. Registry is AWS's infrastructure-layer answer to that coordination failure.

Two-Plane Architecture

Registry separates its internal design into two distinct planes. The Governance Plane is the comprehensive store — it holds every registered resource regardless of lifecycle state, including drafts, rejected submissions, and deprecated entries. Admins configure compliance and security metadata, discovery policies based on role or team entitlement, and custom metadata schemas that enforce organization-specific fields such as cost center, data classification, and SLA tier.

The Discovery Plane is what consumers and autonomous agents interact with at runtime. It surfaces only records that have cleared the organization's approval bar, is built for high-throughput programmatic queries without rate limits, and supports both semantic search (intent-based, e.g., "find a tool for ticket routing") and lexical search across the approved catalog. Trust signals appear in summarized form rather than raw governance detail.

Four Record Types and the Publishing Lifecycle

Registry catalogs four resource types: MCP (Model Context Protocol server, including its tools, resources, and prompts); Agent (Agent2Agent agent cards defining agents and their skills); Skill (agent skill definitions in markdown files with associated code or packages); and Custom (any valid JSON descriptor).

Publishing flows through a governed state machine: DRAFT → PENDING_APPROVAL → APPROVED or REJECTED, with a DEPRECATED terminal state curators can invoke at any lifecycle point. EventBridge fires on state transitions, so approval workflows — security scans, de-duplication checks, compliance evaluations, human sign-off — wire in through existing tooling. CI/CD pipelines can push records via CLI, SDK, or Console. Registry can also synchronize metadata automatically from live MCP or A2A servers using OAuth, IAM, or unauthenticated access depending on server configuration. AWS CloudTrail captures a complete audit trail of every action on every record.

Organization-wide auto-detection extends governance to shadow agents: an admin enables endpoint detection once at the AWS Organization level, and Registry automatically detects agents and MCP servers running on AgentCore Runtime and AgentCore Gateway across every account. Detected resources surface as draft records that flow into the standard governance lifecycle without requiring action from the publishing team.

Deployment Topology

AWS's own guidance: start with the fewest registry instances that satisfy hard isolation requirements and split further only when concrete compliance or authorization requirements demand it. Each additional instance carries its own IAM policies, standards enforcement, and approval workflows.

Each registry instance can be independently configured for OAuth-based or IAM-based authentication for both publishers and consumers. For locked-down network environments, AWS PrivateLink keeps registry endpoints reachable without opening external traffic paths. Discovery from MCP-compatible IDEs — including Kiro and Claude Code — uses Dynamic Client Registration so developers can query the catalog inline via natural-language requests without pre-provisioned OAuth credentials.

What Customers Report

Southwest Airlines — with more than 70,000 employees — moved from agents and tools scattered across multiple technology teams with no shared record to a single governed catalog. PepsiCo and Syngenta are both treating Registry as a system-of-record problem at enterprise scale.

Roadmap

The GA release ships core publishing, governance, and discovery workflows. Four roadmap themes are publicly documented: richer governance signals (security and vulnerability assessments, compliance evaluations, de-duplication analysis surfaced within approval workflows); expanded auto-detection across EC2, EKS, and ECS — and eventually non-AWS and on-premises environments through federation partnerships; policy-driven visibility that scopes discovery by consumer identity rather than binary search permission; and a standalone web application with OAuth/SSO authentication that removes the requirement for an AWS Console account entirely, including public registries for cross-organizational discovery.

The security surface a registry introduces is worth flagging directly: tool metadata can expose internal endpoints and architectural details that represent real threat vectors if access controls are misconfigured. The risk of agent hijack through exposed credentials remains a live concern in agentic infrastructure, and Registry's per-instance IAM and OAuth configuration is the primary control surface against it. AWS Agent Registry represents a maturation of the agentic infrastructure layer from ad-hoc tooling into governed platform — the question for most engineering organizations is whether their governance workflows are ready to wire into the hooks it now provides.