amazon-workspaces-agent-access

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: automation, debugging, desktop, mcp, web.

What it does

Connects AI agents to remote Windows desktop applications on Amazon WorkSpaces Applications (AppStream 2.0) through the managed Agent Access MCP server, and guides reliable desktop automation. Covers connecting an agent to the MCP endpoint (SigV4, streaming URL, and Active Directory SAML/Domain Join), BLOCKING vs POLLING connect modes, the computer-use tools (screenshot, click, type, key, scroll), screenshot-budget and action-batching discipline, MCP tool forwarding (forwarded___ tools), session lifecycle and expire-on-delete, and troubleshooting connection errors. Use when building or debugging an agent that drives a remote Windows desktop or GUI application via WorkSpaces Applications / AppStream — including "dcv session not ready", "client_disconnected", 400 signing-region, POLLING/connection_status, SAML assertion, or forwarded tool questions. Not for Amazon WorkSpaces Personal/Core virtual desktops or general AppStream fleet administration unrelated to agent access.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill amazon-workspaces-agent-access

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/end-user-computing-skills/amazon-workspaces-agent-access ~/.claude/skills/amazon-workspaces-agent-access

Safety box score

Grade D, elevated risk: 61 of 100 risk points, rated 2026-09-23. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill connects an agent to AWS WorkSpaces Applications/AppStream remote Windows desktops and can also enable tool forwarding and stack configuration. The main risks are broad GUI control of a remote session, transmission of screenshots/typed input and bearer auth material to AWS services, and admin-level changes to IAM, stack, and fleet settings.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	The docs include runnable AWS CLI commands and a `uvx mcp-proxy-for-aws ...` client example, and forwarded tools launch host processes, but the scope is mainly setup and remote automation rather than arbitrary local script execution.
Network access	3 (high)	It connects to `https://agentaccess-mcp.{region}.api.aws/mcp`, sends auth headers on every request, and may upload screenshots and logs to AWS services and S3, so desktop contents can leave the machine over the network.
Filesystem reach	1 (low)	There are no shipped local file editors or delete scripts, but the workflow can read/write files in the remote session and requires a fleet-side manifest at `C:/ProgramData/NICE/dcv/mcp_server_redirection_config.json`.
Secrets & credentials	3 (high)	The skill treats the streaming URL as a "bearer credential," says not to log SAML assertions, and warns that screenshots and `type_text` can capture secrets and tokens.
Privilege & persistence	2 (moderate)	Enabling agent access requires `CreateStack`/`UpdateStack`, scoped `agentaccess-mcp` IAM permissions, and optionally system-wide fleet-image configuration for tool forwarding.
Instruction hijack surface	0 (none)	I saw no prompt-injection or instruction-hijacking text that tells the agent to ignore policies, skip confirmations, or hide actions.
Irreversible actions	3 (high)	The skill explicitly enables arbitrary desktop control with tools like `screenshot`, `left_click`, and `type_text`, and says to treat agent-driven desktop actions as capable of arbitrary UI operations.
Transparency	1 (low)	The skill depends on an external `uvx mcp-proxy-for-aws` package and live AWS docs, but the skill files themselves are readable and contain no binaries or embedded opaque blobs.

Before installing

Read `references/connection-setup.md` and confirm the IAM actions/stack scope you are willing to grant.
Decide whether screenshots, typed input, CloudTrail, and optional S3 screenshot storage may contain secrets you cannot expose.
Verify you trust the external `uvx mcp-proxy-for-aws` dependency and any forwarded MCP server binaries you plan to install on the fleet.
Test first in a throwaway stack/user with the minimum `agentaccess-mcp` permissions and no long-lived credentials.

Rated 2026-09-23 by an automated review of 9 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/end-user-computing-skills/amazon-workspaces-agent-access/SKILL.md
Branch: main
Updated: 2026-09-19

chrome-mcp-troubleshooting — Diagnose and fix Claude in Chrome MCP extension connectivity issues.
browser-testing-with-devtools — Tests in real browsers via Chrome DevTools MCP. Use when building or debugging anything that runs in a browser.
comprehensive-research-agent — Ensure thorough validation, error recovery, and transparent reasoning in research tasks with multiple tool calls
hyperframes-registry — Search, install, and wire registry blocks and components into HyperFrames compositions.
mcp-developer — Use when building, debugging, or extending MCP servers or clients that connect AI systems with external tools and data sources.
playwright-expert — Use when writing E2E tests with Playwright, setting up test infrastructure, or debugging flaky browser tests.