akeyless-agentcore-rta

Akeyless Agentic Runtime Authority (ARA / RTA) for AWS Bedrock AgentCore.

Agents call list-secrets, query-db, service-execute, and list-sub-tools. Credentials stay on your Akeyless Gateway — tool responses contain paths, metadata, and query/action results only.

Not the secrets-fetch library. For get_secret() / pulling secret values into the agent, use akeyless-agentcore-runtime. You can use both in one architecture (bootstrap via secrets runtime; DB/cloud via this package).

Requirements

• Python 3.10+
• Akeyless Gateway with ARA enabled (not api.akeyless.io)
• Auth method your AgentCore role can use (production: AWS IAM cloud identity)

Install (local)

cd bedrock-agentcore-akeyless-rta
python3 -m venv .venv
source .venv/bin/activate
pip install -e ".[mcp,dev]"

Quick start — client

from akeyless_agentcore_rta import AkeylessRtaClient

client = AkeylessRtaClient()  # reads AKEYLESS_* env
for s in client.list_secrets():
    print(s.name, s.target_type)  # never prints credentials

rows = client.query_db("SELECT 1", secret_name="/prod/db/readonly")
print(rows.results)

Quick start — MCP on AgentCore

# env (required)
export AKEYLESS_GATEWAY_URL=https://gw.example.com:8000
export AKEYLESS_ACCESS_ID=p-xxxxx
export AKEYLESS_ACCESS_TYPE=aws_iam   # or access_key locally

python examples/mcp-server/server.py
# AgentCore: protocol MCP → examples/mcp-server/server.py

Environment

* Or AKEYLESS_TOKEN for a pre-issued session token.

Docs

Repository: github.com/akeyless-community/bedrock-agentcore-akeyless-rta

Development

pip install -e ".[mcp,dev]"
pytest

Run pytest inside this package directory so the workspace root does not collect unrelated tests.

Related

• Secrets at runtime (values in agent): akeyless-agentcore-runtime
• Product docs: Agentic Runtime Authority