skills.rest
dennisvink
dennisvinkCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

amazon-workspaces-agent-access

Connects AI agents to remote Windows desktops on Amazon WorkSpaces Applications via the Agent Access MCP server.

Updated Sep 8, 2026
Search Tags:#aws#computer use#mcp server#desktop automation#appstream#sigv4#amazon workspaces
One-click install
npx skills add https://github.com/dennisvink/yolomancer --skill amazon-workspaces-agent-access-dennisvink
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: amazon-workspaces-agent-access
Source: https://github.com/dennisvink/yolomancer/tree/main/skills/aws/specialized-skills/end-user-computing-skills/amazon-workspaces-agent-access
Command: npx skills add https://github.com/dennisvink/yolomancer --skill amazon-workspaces-agent-access-dennisvink

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires mcp-proxy-for-aws, and includes references (resource) components.

What problem does it solve? Connecting an AI agent to a remote Windows desktop on Amazon WorkSpaces Applications (AppStream 2.0) involves non-obvious details — SigV4 signing, HTTP-header-based connect modes, SAML federation for domain-joined fleets, and screenshot-budget discipline — that agents frequently get wrong, causing failed connections and wasted automation runs. ## Core Features & Use Cases - MCP Connection Setup: Guides SigV4-signed Streamable HTTP connections to the agentaccess-mcp endpoint, including streaming-URL auth for non-domain-joined fleets and SAML assertion via MCP _meta keys for domain-joined fleets. - Desktop Automation Guidance: Documents the computer-use tool set (screenshot, click, type, key, scroll), BLOCKING vs POLLING connect modes, action batching, and screenshot-budget discipline for reliable GUI automation. - Troubleshooting & Lifecycle: Maps exact error strings (dcv session not ready, client_disconnected, 400 signing-region) to causes and fixes, plus session lifecycle, expire-on-delete, and MCP tool forwarding. - Use Case: An agent needs to open Notepad on a remote Windows fleet, type text, and verify the result — this Skill provides the connection code, the correct POLLING header usage, and the batching strategy to do it without burning screenshot tokens. ## Quick Start Connect my agent to the Agent Access MCP server for my AppStream stack in us-east-1 and take a screenshot of the desktop.

Frequently Asked Questions about amazon-workspaces-agent-access

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I connect an AI agent to an Amazon WorkSpaces Applications desktop?▼

Connect to https://agentaccess-mcp.{region}.api.aws/mcp over Streamable HTTP, SigV4-signed with service name agentaccess-mcp. Pass a streaming URL from CreateStreamingURL as the X-Amzn-AgentAccess-Streaming-Session-Url header; mcp-proxy-for-aws handles the signing.

What is the difference between BLOCKING and POLLING connect modes?▼

BLOCKING (default) waits until the desktop is ready before tools/list returns the full tool set. POLLING returns immediately with only the connection_status tool, which you poll until CONNECTED. The mode is set via the X-Amzn-AgentAccess-Connect-Mode HTTP header, not a tool parameter.

How do I connect to a domain-joined AppStream fleet with SAML?▼

Domain-joined fleets require a signed base64 SAML assertion passed via MCP _meta keys aws.agentaccess/workspacesApplicationsSamlAssertion and aws.agentaccess/workspacesApplicationsStackArn, not a streaming URL header. Certificate-Based Authentication is required for agent sessions.

Why am I getting a 400 Bad Request error from the Agent Access MCP server?▼

A 400 Bad Request means the SigV4 signing region does not match the fleet's region. Set AWS_REGION and the MCP signing region to the fleet's region and use the matching regional endpoint.

What does the client_disconnected error mean and how do I fix it?▼

client_disconnected means the session was stopped or the auth expired — do not retry the same connection. Reconnect with fresh auth: a new streaming URL for non-domain-joined fleets or a new SAML assertion for domain-joined fleets.

Can I use this with Amazon WorkSpaces Personal or Core virtual desktops?▼

No. This Skill covers only Amazon WorkSpaces Applications (AppStream 2.0) agent access. It does not apply to WorkSpaces Personal/Core virtual desktops or general AppStream fleet administration unrelated to agent access.

Related Skills

Explore More Software Engineering Skills→
richardnromanrichardnroman

aws-iam

Generates least-privilege IAM policies and corrects common IAM configuration pitfalls.

Community
Advanced
balsm-healthbalsm-health
2

detecting-s3-data-exfiltration-attempts

Detect AWS S3 data exfiltration attempts by analyzing CloudTrail logs.

Official
Advanced
aws-samplesaws-samples
18

incident-response

Automate incident response workflows for CloudWatch and Prometheus alarms.

Official
Advanced
I-OnlabsI-Onlabs
3

aws-agentic-ai

Orchestrate AWS Bedrock AgentCore service deployment and management across Gateway, Runtime, Memory, and Identity.

Community
Advanced