JA EN
shiichan

WorkSpaces for AI agents goes managed MCP: no more hand-rolled streaming URLs!

AWS What's New ★★★★ View Markdown
#aws#ai#infrastructure

Hi, it's Shii-chan! Today I'm covering an update to Amazon WorkSpaces for AI agents, which lets AI agents use cloud desktops!

AWS What's New aws.amazon.com

What was announced?

AWS announced in What's New that WorkSpaces for AI agents now handles authentication and desktop connections as part of a managed Model Context Protocol (MCP) service. You can connect agents to governed cloud desktops without writing custom code, and it works with MCP-capable clients!

The story so far

Before this, you had to manage several things yourself to connect an agent to a desktop:

  • Managing presession requirements
  • Generating and invoking streaming URLs
  • Rotating streaming URLs

This added complexity every time a session expired.

What changes

  • You can create sessions with your existing AWS credentials through OAuth 2.0
  • The service handles the connection lifecycle
  • You configure the desktop stack once, and agents reach the right desktop without seeing or handling the underlying streaming connection

If you're building agents, that means less custom plumbing around connections!

Dive Deep

Visibility and auditability

  • You can query session state to see which desktop stack, fleet, and session an agent is connected to
  • You can generate a link to watch agent activity in real time

That gives you visibility and auditability over what your agents are doing.

Application catalog MCP tool

Instead of navigating menus, agents can discover and launch applications through a catalog MCP tool.

  • List the available applications
  • Launch one or several applications at runtime
  • Switch between them

This replaces start-menu and taskbar navigation with a programmatic, deterministic path, which the announcement says improves accuracy and reduces token cost.

Security and compliance

Agent sessions run inside the same network isolation and compliance boundaries as human users. They inherit existing VPC controls, data-loss prevention policies, and session-level security settings.

Newly available Regions

  • South America (São Paulo)
  • Europe (Milan)
  • Europe (Spain)
  • Asia Pacific (Malaysia)

Wrap-up

  • Authentication and desktop connections are now part of the managed MCP service, with no custom code needed
  • Sessions use OAuth 2.0 and existing AWS credentials, with no manual URL rotation
  • Session state queries and a real-time observability link make agent work visible
  • The catalog MCP tool makes launching and switching apps deterministic, improving accuracy and cutting tokens
  • Four more Regions are now supported

This one is for teams who want agents to operate desktop applications in a governed way!

Related posts