AWS engineers tunnel MCP from a cloud agent to a laptop through a Chrome extension

AWS Machine Learning Blog·medium signalXBlueskyLinkedInCopy link

An AWS post details a bridge letting a cloud-hosted Bedrock AgentCore agent call MCP servers running on a user's own machine, chaining four hops: SigV4-signed WebSocket from AgentCore to a browser extension, Chrome native messaging (32-bit little-endian length framing) from extension to a local bridge, then stdio JSON-RPC to the MCP server. Presigned URLs expire after 5 minutes and auto-renew every 2 seconds so expiry is invisible; AWS credentials never leave the machine. It's a notably hacky answer to a real problem — cloud agents can't see local files or tools — and the recommended hardening list (JWT handshakes, Ed25519 payload signing, filesystem allowlists) signals how much is left to the implementer.