# How to Contribute to the AWS Agent Toolkit Repository: Bug Reports, Feature Requests, and Security Disclosures

> Learn how to contribute to the AWS Agent Toolkit repository. Submit bug reports, feature requests, and security disclosures effectively through GitHub issues and AWS security channels. Your feedback shapes the toolkit.

- Repository: [Amazon Web Services/agent-toolkit-for-aws](https://github.com/aws/agent-toolkit-for-aws)
- Tags: how-to-guide
- Published: 2026-06-30

---

**The AWS Agent Toolkit does not accept external code contributions; instead, the project welcomes community involvement through structured bug reports, feature requests, and security vulnerability disclosures via GitHub issue templates and direct AWS security channels.**

The **AWS Agent Toolkit for AWS** (`aws/agent-toolkit-for-aws`) is a collection of plugins, skills, and rule files that enable AI coding agents to interact with AWS services through the AWS MCP Server. If you want to contribute to this repository, you must follow the issue-based workflow defined in [`CONTRIBUTING.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/CONTRIBUTING.md), as the maintainers do not merge external pull requests for code changes.

## Understanding the Contribution Model

According to the official [`CONTRIBUTING.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/CONTRIBUTING.md) policy, the project **does not accept external code contributions** at this time. The repository is organized around three core components that are maintained internally:

- **Plugins**: Bundled MCP Server configurations located in `plugins/aws-core/`, `plugins/aws-agents/`, `plugins/aws-data-analytics/`, and `plugins/aws-agents-for-devsecops/`
- **Skills**: Markdown-based instruction packages stored in `skills/` (e.g., `aws-serverless`, `cdk`, `billing-and-cost-management`)
- **Rules files**: Project-level configuration guides like [`rules/aws-agent-rules.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/rules/aws-agent-rules.md)

Because these components integrate directly with the managed AWS MCP Server endpoint, all code changes are handled by AWS engineers. Community members contribute by improving documentation, reporting defects, or requesting new capabilities.

## How to Report Bugs and Request Features

All non-security contributions flow through GitHub Issues using standardized templates.

### Filing a Bug Report

Before opening a new issue, ensure you are running the latest version of the relevant plugin and search existing issues to avoid duplicates. Then, open a bug report using the dedicated template:

1. Navigate to the **Bug Report** template at `https://github.com/aws/agent-toolkit-for-aws/issues/new?template=bug_report.yml`
2. Provide your environment details (agent type, plugin version, operating system)
3. Include minimal reproduction steps and expected vs. actual behavior
4. Reference specific files like [`plugins/aws-core/README.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/README.md) or [`rules/aws-agent-rules.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/rules/aws-agent-rules.md) if relevant

### Submitting a Feature Request

New capabilities and improvements should use the **Feature Request** template:

1. Use the template at `https://github.com/aws/agent-toolkit-for-aws/issues/new?template=feature_request.yml`
2. Describe the specific AWS service integration or skill enhancement needed
3. Explain the use case and which plugin component (e.g., `aws-data-analytics`) would benefit

## Reporting Security Vulnerabilities

Security findings must **never** be reported via public GitHub issues. Instead, follow AWS security protocols:

- Email `aws-security@amazon.com` with the vulnerability details
- Alternatively, submit through the official AWS vulnerability reporting page at `https://aws.amazon.com/security/vulnerability-reporting/`
- Include reproduction steps and potential impact assessment

This process ensures sensitive information remains confidential while AWS security teams assess and patch the issue.

## Testing and Reproducing Issues

When reporting bugs, include the exact commands used to install and configure the plugin. This helps maintainers reproduce your environment.

### Installing the Core Plugin for Claude Code

```text
/plugin install aws-core@claude-plugins-official
/plugin reload-plugins

```

This command installs the `aws-core` plugin from `plugins/aws-core/`, which adds the MCP Server configuration and default skill set.

### Installing the Core Plugin for Codex

```bash
codex plugin marketplace add aws/agent-toolkit-for-aws

```

After execution, navigate to the Codex UI and select `/plugins → install → aws-core`.

### Adding Skills via CLI

To test the complete skill suite referenced in your issue:

```bash
npx skills add aws/agent-toolkit-for-aws/skills

```

This pulls every skill definition from the `skills/` directory into your agent's knowledge base.

### Example: Reproducing MCP Server Interactions

If your bug involves the AWS MCP Server capabilities (documentation search, skill retrieval, or AWS API calls), include the specific invocation. For example, to demonstrate documentation search functionality:

```text
/search_documentation "How to enable X-Ray tracing for Lambda"

```

Or to show AWS API interaction via the sandboxed execution environment:

```python
import boto3, json
cf = boto3.client('cloudformation')
with open('template.yaml') as f:
    template_body = f.read()
response = cf.create_stack(
    StackName='repro-stack',
    TemplateBody=template_body,
    Capabilities=['CAPABILITY_IAM']
)
print(json.dumps(response, default=str))

```

## Summary

- The AWS Agent Toolkit repository (`aws/agent-toolkit-for-aws`) **does not accept pull requests** for code modifications according to [`CONTRIBUTING.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/CONTRIBUTING.md)
- Contribute by filing **bug reports** and **feature requests** through the GitHub issue templates
- Report **security vulnerabilities** exclusively via `aws-security@amazon.com` or the AWS security portal, never through public issues
- Include specific plugin installation commands and MCP Server invocations when reporting issues to aid reproduction
- Reference the repository structure (`plugins/`, `skills/`, `rules/`) when suggesting documentation improvements or new capabilities

## Frequently Asked Questions

### Can I submit a pull request to add new skills or plugins?

No, the repository does not accept external code contributions or pull requests. All skills in the `skills/` directory and plugins in `plugins/aws-core/` or other plugin directories are maintained by AWS. Instead, submit a feature request describing the skill or plugin you need, and the maintainers will evaluate it for internal implementation.

### How do I report a bug in the AWS MCP Server functionality?

Use the GitHub Bug Report template at `https://github.com/aws/agent-toolkit-for-aws/issues/new?template=bug_report.yml`. Include the specific MCP Server capability affected (such as `search_documentation`, `retrieve_skill`, `call_aws`, or `run_script`) and provide reproduction steps using the plugin installation commands from [`plugins/aws-core/README.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/README.md).

### What is the process for reporting security vulnerabilities?

Do not create a public GitHub issue. Email `aws-security@amazon.com` or use the official AWS vulnerability reporting page at `https://aws.amazon.com/security/vulnerability-reporting/`. Provide detailed information about the vulnerability, affected components (such as the MCP Server or specific skills), and potential impact.

### Where can I find the rules and guidelines for how agents should use AWS services?

The recommended rules are documented in [`rules/aws-agent-rules.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/rules/aws-agent-rules.md). This file contains project-level configuration that guides agents on safe AWS usage, MCP Server interaction patterns, and preferred documentation sources. When submitting feature requests related to agent behavior, reference specific sections of this rules file.