How to Contribute to the AWS Agent Toolkit Repository: Bug Reports, Feature Requests, and Security Disclosures

The AWS Agent Toolkit does not accept external code contributions; instead, the project welcomes community involvement through structured bug reports, feature requests, and security vulnerability disclosures via GitHub issue templates and direct AWS security channels.

The AWS Agent Toolkit for AWS (aws/agent-toolkit-for-aws) is a collection of plugins, skills, and rule files that enable AI coding agents to interact with AWS services through the AWS MCP Server. If you want to contribute to this repository, you must follow the issue-based workflow defined in CONTRIBUTING.md, as the maintainers do not merge external pull requests for code changes.

Understanding the Contribution Model

According to the official CONTRIBUTING.md policy, the project does not accept external code contributions at this time. The repository is organized around three core components that are maintained internally:

• Plugins: Bundled MCP Server configurations located in plugins/aws-core/, plugins/aws-agents/, plugins/aws-data-analytics/, and plugins/aws-agents-for-devsecops/
• Skills: Markdown-based instruction packages stored in skills/ (e.g., aws-serverless, cdk, billing-and-cost-management)
• Rules files: Project-level configuration guides like rules/aws-agent-rules.md

Because these components integrate directly with the managed AWS MCP Server endpoint, all code changes are handled by AWS engineers. Community members contribute by improving documentation, reporting defects, or requesting new capabilities.

How to Report Bugs and Request Features

All non-security contributions flow through GitHub Issues using standardized templates.

Filing a Bug Report

Before opening a new issue, ensure you are running the latest version of the relevant plugin and search existing issues to avoid duplicates. Then, open a bug report using the dedicated template:

1. Navigate to the Bug Report template at https://github.com/aws/agent-toolkit-for-aws/issues/new?template=bug_report.yml
2. Provide your environment details (agent type, plugin version, operating system)
3. Include minimal reproduction steps and expected vs. actual behavior
4. Reference specific files like plugins/aws-core/README.md or rules/aws-agent-rules.md if relevant

Submitting a Feature Request

New capabilities and improvements should use the Feature Request template:

1. Use the template at https://github.com/aws/agent-toolkit-for-aws/issues/new?template=feature_request.yml
2. Describe the specific AWS service integration or skill enhancement needed
3. Explain the use case and which plugin component (e.g., aws-data-analytics) would benefit

Reporting Security Vulnerabilities

Security findings must never be reported via public GitHub issues. Instead, follow AWS security protocols:

• Email aws-security@amazon.com with the vulnerability details
• Alternatively, submit through the official AWS vulnerability reporting page at https://aws.amazon.com/security/vulnerability-reporting/
• Include reproduction steps and potential impact assessment

This process ensures sensitive information remains confidential while AWS security teams assess and patch the issue.

Testing and Reproducing Issues

When reporting bugs, include the exact commands used to install and configure the plugin. This helps maintainers reproduce your environment.

Installing the Core Plugin for Claude Code

/plugin install aws-core@claude-plugins-official
/plugin reload-plugins

This command installs the aws-core plugin from plugins/aws-core/, which adds the MCP Server configuration and default skill set.

Installing the Core Plugin for Codex

codex plugin marketplace add aws/agent-toolkit-for-aws

After execution, navigate to the Codex UI and select /plugins → install → aws-core.

Adding Skills via CLI

To test the complete skill suite referenced in your issue:

npx skills add aws/agent-toolkit-for-aws/skills

This pulls every skill definition from the skills/ directory into your agent's knowledge base.

Example: Reproducing MCP Server Interactions

If your bug involves the AWS MCP Server capabilities (documentation search, skill retrieval, or AWS API calls), include the specific invocation. For example, to demonstrate documentation search functionality:

/search_documentation "How to enable X-Ray tracing for Lambda"

Or to show AWS API interaction via the sandboxed execution environment:

import boto3, json
cf = boto3.client('cloudformation')
with open('template.yaml') as f:
    template_body = f.read()
response = cf.create_stack(
    StackName='repro-stack',
    TemplateBody=template_body,
    Capabilities=['CAPABILITY_IAM']
)
print(json.dumps(response, default=str))

Summary

• The AWS Agent Toolkit repository (aws/agent-toolkit-for-aws) does not accept pull requests for code modifications according to CONTRIBUTING.md
• Contribute by filing bug reports and feature requests through the GitHub issue templates
• Report security vulnerabilities exclusively via aws-security@amazon.com or the AWS security portal, never through public issues
• Include specific plugin installation commands and MCP Server invocations when reporting issues to aid reproduction
• Reference the repository structure (plugins/, skills/, rules/) when suggesting documentation improvements or new capabilities

Frequently Asked Questions

Can I submit a pull request to add new skills or plugins?

No, the repository does not accept external code contributions or pull requests. All skills in the skills/ directory and plugins in plugins/aws-core/ or other plugin directories are maintained by AWS. Instead, submit a feature request describing the skill or plugin you need, and the maintainers will evaluate it for internal implementation.

How do I report a bug in the AWS MCP Server functionality?

Use the GitHub Bug Report template at https://github.com/aws/agent-toolkit-for-aws/issues/new?template=bug_report.yml. Include the specific MCP Server capability affected (such as search_documentation, retrieve_skill, call_aws, or run_script) and provide reproduction steps using the plugin installation commands from plugins/aws-core/README.md.

What is the process for reporting security vulnerabilities?

Do not create a public GitHub issue. Email aws-security@amazon.com or use the official AWS vulnerability reporting page at https://aws.amazon.com/security/vulnerability-reporting/. Provide detailed information about the vulnerability, affected components (such as the MCP Server or specific skills), and potential impact.

Where can I find the rules and guidelines for how agents should use AWS services?

The recommended rules are documented in rules/aws-agent-rules.md. This file contains project-level configuration that guides agents on safe AWS usage, MCP Server interaction patterns, and preferred documentation sources. When submitting feature requests related to agent behavior, reference specific sections of this rules file.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}