Amazon Bedrock AgentCore Memory

# Fix list: Amazon Bedrock AgentCore Memory

From Anchor Terminal's listing at https://www.anchorterminal.com/tools/agentcore-memory, the October 2026 research run, assessed 8 October 2026. Grade A, 79.4 out of 100.

This is everything the published grade says the listing lacks, the biggest possible gain to the total first. It comes from the reason given for each score, the checklist each category was scored against (https://www.anchorterminal.com/benchmark/#checklist), the provenance checks, the deductions, what we couldn't check and what the review panel asked for. A fix counts at the next check, once it's public.

For a coding agent working on Amazon Bedrock AgentCore Memory: work through the items below in the product, its docs and its public pages. Each category gives the reason for its score, with the points each checklist item earned, and the checklist itself, so the gap is the items that earned less than their points. Change the product, not the wording, and keep a note of what you changed and where it's published.

## 1. Payments & pricing, 30 out of 100, up to 8.8 more on the total

Why it scored 30: No x402, MPP or L402 on the Memory endpoints (0). Per-GB, per-record and per-retrieval prices published without a login, with a worked example (20). No Memory-specific free tier or sandbox. New AWS accounts get up to $200 in Free Tier credits, and the Free Tier FAQ says most new customers don't need a payment method while AWS may still ask for one, so half, as on our other AWS listings (10). A person creates the AWS account and sets up IAM (0).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-payments):

The published rubric, also on the [x402 page](https://www.anchorterminal.com/x402/).

- 40, a machine payment protocol (x402, MPP or L402) on the tool's own endpoints. 10 to 30 when it covers only some endpoints or only goes through a third party, and the note says which.
- 20, per-call or per-unit pricing published without a login. 10 for public plan-only pricing, 0 for "contact sales" or prices behind a login.
- 20, a free tier or trial that doesn't need a card.
- 20, autonomous onboarding, meaning an agent can get access without a person signing up in a browser (keyless use, x402, a programmatic key API).

Payment platforms and agent wallets rarely charge for their own API over a machine protocol, so the first line has steps for them, and the highest one that applies counts. 40 when x402, MPP or L402 runs on all their own endpoints, 30 when it runs on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, and 0 when the only protocol is their own. Merchant acceptance sits above a facilitator because the platform's own customers can charge agents through it, while a facilitator settles for sellers who wire up the protocol themselves. The counter-argument (a facilitator does more for the protocol as a whole) has a point. Each note says which step applied.

Open-source software you run yourself is scored on its hosted or paid option if it has one. A free, self-hosted package with nothing to buy gets 20, 20 and 20 for the last three lines, and 0 to 40 for the first only if it ships a payment protocol.

## 2. Reliability, 88 out of 100, up to 2.4 more on the total

Why it scored 88: Graded as a hosted API, the AWS data plane that agents call. AWS Health Dashboard with per-service, per-Region history and RSS feeds (20). The Bedrock AgentCore us-east-1 feed had no items on 8 October 2026. The dashboard's history file names Bedrock AgentCore in one event in the last 90 days, 2 hours 40 minutes of packet loss in one zone of eu-south-2 on 4 October 2026, marked informational and in a Region where Memory is not sold, so the record reads as clean. The public dashboard lists only broad events (30). Per-second quotas published for every Memory operation, 200 `CreateEvent`, 30 `RetrieveMemoryRecords`, 5 `CreateEvent` per actor and session with conversational payloads, and 150,000 extraction tokens a minute (15). 429 `ThrottledException` says to reduce the request rate, 409 `RetryableConflictException` recommends exponential backoff, and `CreateEvent` takes a `clientToken` so a retry is ignored, though no Retry-After header is documented (13 of 15). No SLA found. The AgentCore SLA address returns 404, the SLA index does not name AgentCore, and the Bedrock SLA of 4 October 2023 covers the Bedrock APIs for models (0). Generally available since October 2025 per the release notes (10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-reliability):

Hosted APIs, MCP servers, models and platforms.

- 20, a public status page with component history (Statuspage, Instatus, BetterStack or the vendor's own).
- 0 to 30, the incident record for the last 90 days on that page. 30 for a clean record or trivial incidents only, 20 for minor incidents only, 10 for one major outage (an hour or more of a core API down, or errors across the board), 0 for several. 5 when there's no history we could read, and the note says so.
- 15, rate limits documented with numbers.
- 15, documented 429 or overload handling (Retry-After, backoff guidance), and idempotency keys or safe-retry guidance where writes are involved.
- 10, an SLA published for any paid tier.
- 10, the surface agents use is generally available, not beta or preview.

Local packages, SDKs, frameworks and stdio MCP servers.

- 20, installs from an official package with supported runtimes stated.
- 25, a public CI and test suite, passing on the default branch.
- 0 to 25, open crash or regression issues relative to activity (25 for few and handled, 0 for many, old and unanswered).
- 15, semver discipline and breaking changes called out in a changelog.
- 15, version 1.0 or later, or declared stable.

Protocols are read from their reference implementations, the public facilitators or servers, spec stability and test vectors.

## 3. Agent ergonomics, 86 out of 100, up to 2.3 more on the total

Why it scored 86: Graded on the API. `RetrieveMemoryRecords` returns record summaries with a relevance score, sized by `topK` (default 10, maximum 100) and `maxResults` (default 20), and long-term records stand in for full history, but no field selection was found (20 of 25). `nextToken` pagination, namespace and namespace path scoping, a strategy filter and metadata filters (20). Typed exceptions with HTTP codes and advice in each description. A quota breach returns 402 `ServiceQuotaExceededException` beside the 429 `ThrottledException`, which a generic client may misread (18 of 20). `clientToken` on `CreateEvent`, immutable events and side-effect-free reads. We did not confirm a token on `IngestData` or the batch operations (18 of 20). SDKs in Python, JavaScript, Java, Go and five other languages plus a higher-level Python SDK, but a memory resource must exist first (2 to 3 minutes to create), `eventTimestamp` is required and every call needs SigV4 signing (10 of 15). The awslabs MCP server's 21 Memory tools sit among 122, and one environment variable registers Memory alone.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-ergonomics):

- 0 to 25, context cost. For MCP, the number and size of the tool definitions (25 for ten or fewer compact tools, 15 for 11 to 30, 5 for more than 30, plus up to 10 back for toolsets, dynamic loading or read-only subsets). For APIs, whether responses can be sized (field selection, limits, summaries).
- 20, pagination, filtering and output-size controls.
- 20, actionable, documented error responses, codes and messages an agent can recover from.
- 20, idempotency or safe retries, and for MCP the `readOnlyHint` and `destructiveHint` annotations.
- 15, sensible defaults, few required parameters, and official SDKs in at least two languages.

Models are read for tool use, structured output, prompt caching, context length, batch and SDKs. Frameworks for how much code and how many defaults a tool-calling agent with MCP needs.

## 4. Security & auth, 87 out of 100, up to 2.3 more on the total

Why it scored 87: IAM with SigV4, roles and short-lived credentials, resource-based policies on the memory resource, and OAuth (JWT) for end users through an AgentCore Gateway (30). Each operation has its own permission, condition keys hold a caller to a namespace, and Gateway Cedar policies are deny-by-default per actor, namespace and operation. The three batch operations are outside those policies, and deletes are permanent with no confirmation step (17 of 20). The guide names memory poisoning and prompt injection, places prevention with the customer, and recommends Bedrock Guardrails on input before `CreateEvent` and adversarial testing. The MCP server README says retrieved records are untrusted input (12 of 15). CloudWatch metrics and optional vended logs for extraction. The data protection page recommends CloudTrail in general terms, and we found no Memory-specific CloudTrail page such as Gateway and Registry have (10 of 15). A vulnerability disclosure programme on HackerOne, Amazon Bedrock AgentCore in SOC scope on AWS's list updated 11 August 2026, and public security bulletins per our other AWS checks. The security.txt passed its Expires date on 24 September 2026 and no paid bounty was found, read as the other AWS listings were (18 of 20).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-security):

- 0 to 30, the credential model. 30 for OAuth 2.1 with scopes, or scoped and revocable keys with rotation. 20 for plain revocable API keys. 10 for one all-powerful key. 10 off when a secret can travel in a URL query string as a documented option.
- 0 to 20, read-only or least-privilege modes, and confirmation or approval for destructive actions.
- 0 to 15, prompt-injection posture where the tool returns untrusted content (documented mitigations or guidance). A tool that returns no untrusted content gets 10.
- 0 to 15, audit logs or per-call visibility for the operator.
- 0 to 20, a security programme. security.txt or a disclosure policy, a bug bounty, SOC 2 or ISO 27001, advisories handled in public.

Models are read for retention, whether API data trains models (and whether that's off by default), zero-retention options and certifications. Frameworks for telemetry defaults, approval hooks, guardrails and sandboxing.

## 5. Transparency & trust, 76 out of 100, up to 2.1 more on the total

Made of editorial 64, provenance 88.

Why it scored 76: Closed service under the AWS Customer Agreement and Service Terms (updated 1 October 2026), with the Python SDK and CLI under Apache-2.0 (18 of 30, as for S3). Section 50.3 of the Service Terms does not list Bedrock or AgentCore among the services whose content AWS may use for improvement, events expire after 7 to 365 days, records are encrypted at rest with KMS, and the terms carry the AWS DPA. The AgentCore data protection page has Gateway-specific statements and none for Memory, and no retention period for deleted records was found (22 of 30). The pricing page dates the short-term pricing change (through 5 October, as of 6 October 2026), but no deprecation policy for the Memory API was found (6 of 20). A sub-processor page updated 28 July 2026 and a per-Region availability table. Built-in strategies may process event text in another Region of the same geography, which the cross-Region inference page states (18 of 20).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-transparency):

- 0 to 30, source availability and licence clarity. 30 for open source under an OSI licence, 15 for closed with clear terms, 0 for unclear terms.
- 0 to 30, data handling and retention statements that agree with each other (privacy policy, DPA, retention periods, subprocessors).
- 0 to 20, a deprecation policy or notices with dates.
- 0 to 20, telemetry disclosed with an opt-out (local software), or subprocessors and data locations disclosed (hosted).

The other half of Transparency and trust is the provenance score, computed from checked facts (below). The category score is the mean of the two.

Provenance checks not met in full (half of this category, computed from checked facts):

- Terms of service: read, states 6 of the 7 things a reader expects, and has 3 clauses that cost points (3.1 of 10)
- security.txt: published but past its Expires date (5 of 10)

## 6. Maintenance & community, 83 out of 100, up to 1.5 more on the total

Why it scored 83: The short-term memory price model changed on 6 October 2026, and the official `bedrock-agentcore` Python SDK shipped 1.24.1 on 6 October and a Memory fix in 1.23.1 on 16 September 2026. The newest Memory API additions in the release notes are from August 2026, which a strict reading would score 20. We date the product by the SDK, as the Secrets Manager listing was dated by its client (30). Three Memory entries in the August 2026 release notes (`IngestData`, flexible namespaces, `json` payloads) and four SDK releases since 11 September (20). Public release notes with RSS and AWS re:Post. The SDK repository has 135 open issues and pull requests, and several Memory issues from September and October have no reply yet (10 of 15). Current official SDKs, `@aws-sdk/client-bedrock-agentcore` 3.1148.0 and `bedrock-agentcore` 1.24.1 (15). The SDK repository has CI, integration, breaking-change and security-scanning workflows and Dependabot. We did not confirm the default branch passes (8 of 10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-maintenance):

- 0 to 30, time since the last release, or the last published model or API change for a closed service. 30 within 30 days, 20 within 90, 10 within 180, 0 older.
- 20, at least three releases or dated changelog entries in the last 90 days.
- 0 to 25, responsiveness. Issues and pull requests answered on GitHub (the open issues and how recent the replies are). For closed services, a public changelog and a support or community channel that answers, 0 to 15.
- 15, presence in the official MCP registry under a verified namespace (MCP servers), or current official SDKs (APIs and models).
- 10, package health, current dependencies and CI.

Models are read for deprecation notice periods and model churn rather than release counts.

## 7. Schema & documentation, 92 out of 100, up to 1.3 more on the total

Why it scored 92: The SDKs are generated from AWS's published service models, and the API reference gives every field with type, length, pattern and valid values (25). The developer guide has an llms.txt of 671 lines with 73 naming memory, and serves each page as .md (10). The guides say when to use `IngestData` instead of `CreateEvent`, which payload types are extracted, and how long-term memory differs from retrieval-augmented generation, but give little on when the service is the wrong tool (16 of 20). Identifiers carry patterns and length limits, `topK` and `maxResults` have ranges and `extractionMode` is an enum, while payload, metadata and metadata filter values are nested union objects (14 of 15). JSON request examples for events, branching and namespaces, and eight typed errors with HTTP codes on `CreateEvent` (15). Release notes with an RSS feed, dated by month and not by day, and no version in the API path (12 of 15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-schema):

APIs and MCP servers.

- 25, a machine-readable contract (a public OpenAPI file or similar; for MCP, typed JSON Schema inputs on every tool).
- 10, llms.txt or Markdown docs served for agents.
- 0 to 20, descriptions that say what a tool is for, when to use it and when not to, read from the tool definitions in the source or the API reference.
- 0 to 15, typed inputs with enums, constraints and required fields, and no free-form JSON blobs.
- 0 to 15, examples and documented error responses.
- 15, versioning and a public changelog.

Models are read from the API reference, the OpenAPI file, llms.txt, the structured-output and tool-use docs and the model cards. Frameworks from docs a model can follow, typed interfaces, examples and the API reference.

## What we couldn't check

What we couldn't read counted as absent. Publishing it on a page a plain HTTP fetch can read (not only in a browser) lets the next check count it.

- unchecked: weekly PyPI downloads for `bedrock-agentcore`. pypistats.org answered with its rate limit and we did not retry.
- unchecked: whether Memory data-plane calls such as `CreateEvent` are logged by CloudTrail as data events. No Memory page in the developer guide says so.
- unchecked: the data-plane host. The curl in `connect` is assembled from the API reference path and the `bedrock-agentcore.<region>.amazonaws.com` service name in the KMS policy example, and was not run.
- unchecked: annotations (readOnlyHint, destructiveHint) on the MCP server's Memory tools. A search of the Memory tool sources found no `readOnlyHint`.
- Release notes give months, not days, so the August 2026 Memory entries cannot be dated more closely.
- Maintenance recency is 30 on the SDK and pricing dates. Reading only the Memory API entries in the release notes would give 20.
- The amazon.com registration date is copied from our other AWS listings and was not looked up again.
- No knowledge-graph memory was found, so `memory.graph` is left out.

## Weaknesses

- Long-term extraction is asynchronous. The docs say records appear within seconds to minutes after a write
- No SLA names AgentCore. The Bedrock SLA of 4 October 2023 covers the Bedrock APIs for models
- Built-in strategies use cross-Region inference, so event text can be processed in another Region of the same geography
- Short-term memory billing moved from per event to per GB on 6 October 2026, with each event billed as at least 12 KB
- No Memory-specific CloudTrail page was found in the developer guide, and an AWS account needs a person to create it

## What costs an agent a turn today

The notes we give agents before they call it. Each one is a workaround an agent shouldn't need.

- Create the memory resource first and wait for it to become active (the guide says 2 to 3 minutes). Short-term events work without a strategy, long-term records need at least one
- Don't search for a fact straight after `CreateEvent`. Extraction runs in the background, so poll `ListMemoryRecords` or list extraction jobs before relying on `RetrieveMemoryRecords`
- Send `actorId`, `sessionId` and `eventTimestamp` on every `CreateEvent`, and reuse the same `clientToken` when retrying
- Pass `namespace` or `namespacePath` on every retrieval, and scope it to one actor so users' memories don't mix
- Treat retrieved records as untrusted input, and back off on 429 `ThrottledException` and 409 `RetryableConflictException`. A quota breach returns 402 `ServiceQuotaExceededException`

## When it's done

Send what changed and where it's published as a dispute (https://www.anchorterminal.com/builders/#disputes, or `POST https://www.anchorterminal.com/api/v1/contact` with `"kind": "dispute"`). Disputes are answered in public, and the listing is checked again by the same checklist. Paying for an audit or a listing claim changes nothing here.