AWS Bedrock provider support

- AWS Bedrock provider, supporting multiple model families (Anthropic Claude, Amazon Titan, Meta Llama, and Mistral).

Signed-off-by: Alvaro Saurin <[email protected]>

Author: inercia

docs/USAGE.md

@@ -15,7 +15,7 @@ agents with specialized capabilities and tools. It features:
 - **📦 Agent distribution** via Docker registry integration
 - **🔒 Security-first design** with proper client scoping and resource isolation
 - **⚡ Event-driven streaming** for real-time interactions
-- **🧠 Multi-model support** (OpenAI, Anthropic, Gemini, [Docker Model Runner (DMR)](https://docs.docker.com/ai/model-runner/))
+- **🧠 Multi-model support** (OpenAI, Anthropic, Gemini, Amazon Bedrock, [Docker Model Runner (DMR)](https://docs.docker.com/ai/model-runner/))
 
 
 ## Why?
@@ -141,7 +141,7 @@ cagent run ./agent.yaml --command ls
 
 | Property            | Type       | Description                                                                  | Required |
 |---------------------|------------|------------------------------------------------------------------------------|----------|
-| `provider`          | string     | Provider: `openai`, `anthropic`, `google`, `dmr`                             | ✓        |
+| `provider`          | string     | Provider: `openai`, `anthropic`, `google`, `amazon-bedrock`, `dmr`           | ✓        |
 | `model`             | string     | Model name (e.g., `gpt-4o`, `claude-sonnet-4-0`, `gemini-2.5-flash`)         | ✓        |
 | `temperature`       | float      | Randomness (0.0-1.0)                                                         | ✗        |
 | `max_tokens`        | integer    | Response length limit                                                        | ✗        |
@@ -156,7 +156,7 @@ cagent run ./agent.yaml --command ls
 ```yaml
 models:
   model_name:
-    provider: string # Provider: openai, anthropic, google, dmr
+    provider: string # Provider: openai, anthropic, google, amazon-bedrock, dmr
     model: string # Model name: gpt-4o, claude-3-5-sonnet-latest, gemini-2.5-flash, qwen3:4B, ...
     temperature: float # Randomness (0.0-1.0)
     max_tokens: integer # Response length limit
@@ -282,6 +282,12 @@ models:
     provider: google
     model: gemini-2.5-flash
 
+# Amazon Bedrock
+models:
+  bedrock-claude:
+    provider: amazon-bedrock
+    model: anthropic.claude-3-5-sonnet-20241022-v2:0
+
 # Docker Model Runner (DMR)
 models:
   qwen:
@@ -386,6 +392,57 @@ Troubleshooting:
 - Endpoint empty in status: ensure the Model Runner is running, or set `base_url` manually
 - Flag parsing: if using a single string, quote properly in YAML; you can also use a list
 
+#### Amazon Bedrock provider usage
+
+The `amazon-bedrock` provider enables access to various AI models hosted on AWS Bedrock, including Anthropic Claude, Amazon Titan, Meta Llama, and Mistral models.
+
+**Authentication:**
+
+The Bedrock provider supports two authentication methods:
+
+1. **Bearer Token** (via `AWS_BEDROCK_TOKEN` environment variable):
+   - Use for custom authentication services or proxy scenarios
+   - If set, the provider uses Bearer token authentication and skips AWS Signature v4 signing
+   - Example: `export AWS_BEDROCK_TOKEN="your-token-here"`
+
+2. **Standard AWS Credentials** (default chain):
+   - Environment variables: `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`
+   - AWS profile: `AWS_PROFILE` environment variable or default profile in `~/.aws/credentials`
+   - IAM role (for EC2/ECS/Lambda environments)
+
+**Configuration:**
+
+Basic configuration:
+
+```yaml
+models:
+  bedrock-claude:
+    provider: amazon-bedrock
+    model: anthropic.claude-3-5-sonnet-20241022-v2:0
+    temperature: 0.7
+    max_tokens: 4000
+```
+
+With custom region:
+
+```yaml
+models:
+  bedrock-claude:
+    provider: amazon-bedrock
+    model: anthropic.claude-3-5-sonnet-20241022-v2:0
+    provider_opts:
+      region: us-west-2  # Optional, defaults to AWS_REGION or us-east-1
+```
+
+With custom endpoint (for VPC endpoints or proxies):
+
+```yaml
+models:
+  bedrock-claude:
+    provider: amazon-bedrock
+    model: anthropic.claude-3-5-sonnet-20241022-v2:0
+    base_url: https://bedrock-runtime.us-east-1.amazonaws.com
+```
 
 ### Alloy models
 

examples/bedrock.yaml

@@ -0,0 +1,44 @@
+version: "2"
+
+agents:
+  root:
+    model: claude
+    description: "Test multi-tool agent"
+    instruction: |
+      You are a test agent that demonstrates multi-tool calling.
+      
+      ⚠️ CRITICAL INSTRUCTIONS - YOU MUST FOLLOW THESE EXACTLY:
+      
+      When the user asks you to call multiple tools:
+      1. Call the FIRST tool and wait for its result
+      2. After receiving the first result, you MUST call the SECOND tool
+      3. After receiving the second result, ONLY THEN respond to the user
+      
+      DO NOT respond with text after calling just one tool.
+      DO NOT say "I'll call the tools" - JUST CALL THEM.
+      DO NOT provide your final answer until you have called ALL required tools.
+      
+      If the task requires N tools, you must make N separate tool calls.
+      Each tool call must be followed by receiving its result before the next tool call.
+      
+      Example correct sequence:
+      - Tool Call 1 → Receive Result 1
+      - Tool Call 2 → Receive Result 2  
+      - Final Response with both results
+      
+      WRONG (do not do this):
+      - Tool Call 1 → Receive Result 1 → Final Response (MISSING TOOL 2!)
+
+    max_iterations: 20
+    toolsets:
+      - type: shell
+
+models:
+  claude:
+    provider: amazon-bedrock
+    model: us.anthropic.claude-sonnet-4-5-20250929-v1:0
+    temperature: 0.7
+    max_tokens: 4000
+    # Optional: specify AWS region (defaults to AWS_REGION env var or us-east-1)
+    # provider_opts:
+    #   region: us-west-2

go.mod

@@ -9,6 +9,10 @@ require (
 	github.com/alecthomas/chroma/v2 v2.20.0
 	github.com/anthropics/anthropic-sdk-go v1.14.0
 	github.com/atotto/clipboard v0.1.4
+	github.com/aws/aws-sdk-go-v2 v1.39.3
+	github.com/aws/aws-sdk-go-v2/config v1.31.13
+	github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.41.1
+	github.com/aws/smithy-go v1.23.1
 	github.com/aymanbagabas/go-udiff v0.3.1
 	github.com/charmbracelet/bubbles/v2 v2.0.0-beta.1.0.20250820203609-601216f68ee2
 	github.com/charmbracelet/bubbletea/v2 v2.0.0-beta.4.0.20250930175933-4cafc092c5e7
@@ -44,6 +48,17 @@ require (
 	cloud.google.com/go/auth v0.16.5 // indirect
 	cloud.google.com/go/compute/metadata v0.8.0 // indirect
 	github.com/JohannesKaufmann/dom v0.2.0 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.2 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.18.17 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.10 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.10 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.10 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.10 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.29.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.38.7 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/charmbracelet/colorprofile v0.3.2 // indirect

go.sum

@@ -26,6 +26,36 @@ github.com/anthropics/anthropic-sdk-go v1.14.0 h1:EzNQvnZlaDHe2UPkoUySDz3ixRgNbw
 github.com/anthropics/anthropic-sdk-go v1.14.0/go.mod h1:WTz31rIUHUHqai2UslPpw5CwXrQP3geYBioRV4WOLvE=
 github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
 github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
+github.com/aws/aws-sdk-go-v2 v1.39.3 h1:h7xSsanJ4EQJXG5iuW4UqgP7qBopLpj84mpkNx3wPjM=
+github.com/aws/aws-sdk-go-v2 v1.39.3/go.mod h1:yWSxrnioGUZ4WVv9TgMrNUeLV3PFESn/v+6T/Su8gnM=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.2 h1:t9yYsydLYNBk9cJ73rgPhPWqOh/52fcWDQB5b1JsKSY=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.2/go.mod h1:IusfVNTmiSN3t4rhxWFaBAqn+mcNdwKtPcV16eYdgko=
+github.com/aws/aws-sdk-go-v2/config v1.31.13 h1:wcqQB3B0PgRPUF5ZE/QL1JVOyB0mbPevHFoAMpemR9k=
+github.com/aws/aws-sdk-go-v2/config v1.31.13/go.mod h1:ySB5D5ybwqGbT6c3GszZ+u+3KvrlYCUQNo62+hkKOFk=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.17 h1:skpEwzN/+H8cdrrtT8y+rvWJGiWWv0DeNAe+4VTf+Vs=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.17/go.mod h1:Ed+nXsaYa5uBINovJhcAWkALvXw2ZLk36opcuiSZfJM=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.10 h1:UuGVOX48oP4vgQ36oiKmW9RuSeT8jlgQgBFQD+HUiHY=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.10/go.mod h1:vM/Ini41PzvudT4YkQyE/+WiQJiQ6jzeDyU8pQKwCac=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.10 h1:mj/bdWleWEh81DtpdHKkw41IrS+r3uw1J/VQtbwYYp8=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.10/go.mod h1:7+oEMxAZWP8gZCyjcm9VicI0M61Sx4DJtcGfKYv2yKQ=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.10 h1:wh+/mn57yhUrFtLIxyFPh2RgxgQz/u+Yrf7hiHGHqKY=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.10/go.mod h1:7zirD+ryp5gitJJ2m1BBux56ai8RIRDykXZrJSp540w=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 h1:WKuaxf++XKWlHWu9ECbMlha8WOEGm0OUEZqm4K/Gcfk=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4/go.mod h1:ZWy7j6v1vWGmPReu0iSGvRiise4YI5SkR3OHKTZ6Wuc=
+github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.41.1 h1:sscdABXtedWQ+5I0YnxawJwrX1YzbPhIs7TklRaRDpk=
+github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.41.1/go.mod h1:LVJ9jAJ1nuUyhovH5z7GAA/FktQOMarcZgGeqiHQJPo=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.2 h1:xtuxji5CS0JknaXoACOunXOYOQzgfTvGAc9s2QdCJA4=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.2/go.mod h1:zxwi0DIR0rcRcgdbl7E2MSOvxDyyXGBlScvBkARFaLQ=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.10 h1:DRND0dkCKtJzCj4Xl4OpVbXZgfttY5q712H9Zj7qc/0=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.10/go.mod h1:tGGNmJKOTernmR2+VJ0fCzQRurcPZj9ut60Zu5Fi6us=
+github.com/aws/aws-sdk-go-v2/service/sso v1.29.7 h1:fspVFg6qMx0svs40YgRmE7LZXh9VRZvTT35PfdQR6FM=
+github.com/aws/aws-sdk-go-v2/service/sso v1.29.7/go.mod h1:BQTKL3uMECaLaUV3Zc2L4Qybv8C6BIXjuu1dOPyxTQs=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.2 h1:scVnW+NLXasGOhy7HhkdT9AGb6kjgW7fJ5xYkUaqHs0=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.2/go.mod h1:FRNCY3zTEWZXBKm2h5UBUPvCVDOecTad9KhynDyGBc0=
+github.com/aws/aws-sdk-go-v2/service/sts v1.38.7 h1:VEO5dqFkMsl8QZ2yHsFDJAIZLAkEbaYDB+xdKi0Feic=
+github.com/aws/aws-sdk-go-v2/service/sts v1.38.7/go.mod h1:L1xxV3zAdB+qVrVW/pBIrIAnHFWHo6FBbFe4xOGsG/o=
+github.com/aws/smithy-go v1.23.1 h1:sLvcH6dfAFwGkHLZ7dGiYF7aK6mg4CgKA/iDKjLDt9M=
+github.com/aws/smithy-go v1.23.1/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
 github.com/aymanbagabas/go-udiff v0.3.1 h1:LV+qyBQ2pqe0u42ZsUEtPiCaUoqgA9gYRDs3vj1nolY=
 github.com/aymanbagabas/go-udiff v0.3.1/go.mod h1:G0fsKmG+P6ylD0r6N/KgQD/nWzgfnl8ZBcNLgcbrw8E=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=