One CLI owns the AgentCore project lifecycle
AgentCore CLI scaffolds an agent, starts a local server, packages it, deploys AWS infrastructure, invokes the deployed runtime, and retrieves status, logs, or traces. Projects keep resource declarations in agentcore/agentcore.json, deployment targets in aws-targets.json, and generated application code under app/. That gives a platform team reviewable configuration instead of a collection of console clicks.
The scope is far wider than four lifecycle commands. The CLI can add memory, credentials, gateways, gateway targets, evaluators, online evaluations, knowledge bases, policy engines, datasets, config bundles, runtime endpoints, and payment components. A harness can bundle runtime, model, tools, skills, memory, and observability without handwritten agent code. Each resource still becomes something the team must permission, monitor, update, and pay for in AWS.
A 936-package install fronts managed AWS infrastructure
Our clean Node container installed commit 5c0c744 in 53 seconds. Npm added 936 packages and used 848 MB on disk. The repository itself contained 1,679 files, roughly 264,488 lines of source, and occupied 11.2 MB. The small checkout therefore understates the local dependency cost, though most users can install the published @aws/agentcore package globally instead of cloning it.
Node.js 20 or later is required, and generated Python agents use uv. Deployment adds AWS credentials, account and region selection, CDK, CloudFormation, and IAM permissions. Non-Bedrock models need their own provider keys. Gateway targets may point at Lambda, MCP, OpenAPI, Smithy, API Gateway, web search, or a knowledge base, each with a different authentication and network story.
What happened when we ran it
Our build completed successfully in 16 seconds after the 53-second install. The test command ran for 221 seconds and exited with code 1. Vitest reported 6,030 passed, 23 failed, and 95 skipped out of 6,148 tests. The summary also showed 406 passing and 22 failing test files out of 428.
The supplied tail lists successful tests around deployed-state carry-forward, payment cleanup, error classification, and subprocess exit codes before printing the failure totals. It does not include the failed assertions or names for all 23 failures. We cannot assign a cause from that output, so the practical finding is simply that commit 5c0c744 built but did not pass its full suite in the fresh container.
Npm audit reported 0 known vulnerabilities at critical, high, moderate, or low severity. The repository had 21 CI workflow files, while our scan found no Dockerfile and no top-level tests directory. Tests live beside source under __tests__, as the tail paths show. Those are healthy engineering signals, but they do not turn 23 failures into a passing result.
CloudFormation names can collide across separate projects
Open issue 2104 reports that two directories with the same project name and target, deployed to the same AWS account and region, resolve to the same AgentCore-<name>-<target> CloudFormation stack. In the reproduction, the second deployment updates the first project's stack rather than creating a separate one. The report points to stack identity being derived only from the two human-chosen names.
Until that issue is closed and the fix is verified, enforce unique project and target pairs across each account and region. A central registry or naming prefix is cheap protection. Also inspect existing stack tags before the first deployment from a newly cloned directory. Infrastructure tools need identity stronger than a successful exit because a successful update can still target the wrong resource set.
Evaluations and policies add services, not certainty
The CLI supports custom model-based judges, online evaluations, batch runs, recommendations, and A/B tests. These are useful operating tools, especially when tied to traces and versioned config bundles. They do not establish that a judge is correct or that a promoted prompt will behave safely outside the sampled traffic. Teams need reviewed datasets, stable metrics, cost limits, and a rollback path for every promotion.
Cedar policies can run before or after calls, with content filters, prompt-attack detection, and sensitive-information redaction. Failure-pattern insights are labeled preview. Payment connectors can sign a payment after an x402 response and retry the tool call, so tool allowlists and transaction limits deserve direct review. A convenience command can create financially or operationally meaningful resources.
Version 0.28.0 is moving quickly
GitHub showed 267 stars, 222 combined issues and pull requests, and a last push on August 27, 2026. Release v0.28.0 was published on August 24 with CDK dependency updates, a Windows tool-shim fix, evaluator work, and a quick-create payment connector. Push and issue activity are current; the combined queue is not a confirmed bug count.
The pre-1.0 version and broad command set call for pinning. Read the export notes generated for harness applications, run validate, inspect the CDK diff, and deploy first to a disposable AWS target with spending alerts. AgentCore CLI reduces the typing involved in an AWS agent platform. It does not reduce the ownership of IAM, state, names, credentials, evaluations, or bills.