Add BedrockGovernedMcpServer sample for AWS.Bedrock.MAG

Demonstrates the package's primary MCP path end-to-end:
AddMcpServer().WithGovernance(...).WithBedrockGovernance(...), with the
toolkit's GovernanceKernel governed by the Bedrock Guardrails policy
backend, PII sanitization, and CloudWatch audit.

Runs against real AWS in two modes: inline checks (InvokeGuardrailChecks,
no guardrail resource) by default, or full guardrail + output PII redaction
when MAG_GUARDRAIL_ID is set. Verified end-to-end over stdio (benign call
allowed, SSN-in-argument denied by the Bedrock backend).

README documents two behaviors found while building: WithGovernance denies
all calls unless RequireAuthenticatedAgentId is relaxed or an AgentIdResolver
is set, and prompt-attack/content-filter inline checks false-positive on the
JSON tool-call context (use a prose ContextSerializer).

Author: GarrettBeatty

AWS.DotNetAI.slnx

@@ -9,6 +9,7 @@
     <Project Path="sampleapps/NativeAotAnnotations/NativeAotAnnotations.csproj" />
     <Project Path="sampleapps/AspireAppHost/AspireAppHost.csproj" />
     <Project Path="sampleapps/RemoteMcpAgent/RemoteMcpAgent.csproj" />
+    <Project Path="sampleapps/BedrockGovernedMcpServer/BedrockGovernedMcpServer.csproj" />
     <Project Path="sampleapps/ServiceDefaults/ServiceDefaults.csproj" />
   </Folder>
   <Folder Name="/src/">

sampleapps/BedrockGovernedMcpServer/.gitignore

@@ -0,0 +1,2 @@
+# Fallback error log written by AWS.Logger.Core (the CloudWatch audit sink) when it can't reach CloudWatch.
+aws-logger-errors.txt

sampleapps/BedrockGovernedMcpServer/BedrockGovernedMcpServer.csproj

@@ -0,0 +1,26 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <OutputType>Exe</OutputType>
+        <!-- net8.0 to match AWS.Bedrock.MAG, which is net8.0-only (the toolkit targets net8.0). -->
+        <TargetFramework>net8.0</TargetFramework>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <Nullable>enable</Nullable>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\..\src\AWS.Bedrock.MAG\AWS.Bedrock.MAG.csproj" />
+    </ItemGroup>
+
+    <ItemGroup>
+        <!-- Microsoft's toolkit MCP adapter: provides .WithGovernance() on IMcpServerBuilder. -->
+        <PackageReference Include="Microsoft.AgentGovernance.Extensions.ModelContextProtocol" Version="5.0.0" />
+        <!-- Generic host so the MCP stdio transport and MAG's startup hosted service run. -->
+        <PackageReference Include="Microsoft.Extensions.Hosting" Version="8.0.1" />
+    </ItemGroup>
+
+    <ItemGroup>
+        <None Update="policies\mcp.yaml" CopyToOutputDirectory="PreserveNewest" />
+    </ItemGroup>
+
+</Project>

sampleapps/BedrockGovernedMcpServer/Program.cs

@@ -0,0 +1,86 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Sample: an MCP server governed by Microsoft's Agent Governance Toolkit with the AWS Bedrock backends
+// layered on top. It follows the primary path from the AWS.Bedrock.MAG README:
+//
+//     AddMcpServer().WithGovernance(...).WithBedrockGovernance(...)
+//
+// .WithGovernance(...)        comes from Microsoft.AgentGovernance.Extensions.ModelContextProtocol and
+//                             registers the toolkit's GovernanceKernel + policy engine on the MCP server.
+// .WithBedrockGovernance(...) comes from AWS.Bedrock.MAG and attaches the Bedrock Guardrails policy
+//                             backend, Bedrock PII sanitization, and the CloudWatch audit sink.
+//
+// See README.md for prerequisites, IAM, and how to drive it.
+
+using Amazon;
+using AgentGovernance.Extensions.ModelContextProtocol;
+using BedrockGovernedMcpServer.Tools;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+
+var builder = Host.CreateApplicationBuilder(args);
+
+// A stdio MCP server speaks the protocol over stdout, so all logging MUST go to stderr — otherwise log
+// lines corrupt the protocol stream.
+builder.Logging.AddConsole(o => o.LogToStandardErrorThreshold = LogLevel.Trace);
+
+// Region and guardrail come from the environment so the sample stays runnable without editing code.
+var region = RegionEndpoint.GetBySystemName(
+    Environment.GetEnvironmentVariable("MAG_TEST_REGION") ?? "us-west-2");
+var guardrailId = Environment.GetEnvironmentVariable("MAG_GUARDRAIL_ID");
+
+builder.Services
+    .AddMcpServer()
+    .WithStdioServerTransport()
+    // Microsoft's toolkit: loads YAML policy and stands up the GovernanceKernel this server governs with.
+    .WithGovernance(o =>
+    {
+        o.PolicyPaths.Add("policies/mcp.yaml");
+        o.ServerName = "bedrock-governed-sample";
+        o.DefaultAgentId = "did:mcp:sample-agent";
+
+        // The toolkit requires an authenticated agent identity by default and denies every call before it
+        // reaches the Bedrock backend. For a self-contained sample we allow the DefaultAgentId fallback.
+        // In production, leave this on and set an AgentIdResolver that maps your authenticated principals.
+        o.RequireAuthenticatedAgentId = false;
+    })
+    // AWS backends. Two modes, chosen by whether you supply a pre-created guardrail:
+    //   MAG_GUARDRAIL_ID set   -> full path: guardrail-based policy + PII sanitization of tool output + audit.
+    //   MAG_GUARDRAIL_ID unset -> inline-checks policy (InvokeGuardrailChecks, no guardrail resource) with
+    //                             PII sanitization off, since inline checks detect but do not mask text.
+    .WithBedrockGovernance(o =>
+    {
+        o.Region = region;
+        o.Audit.LogGroupName = "/agent-governance/bedrock-sample";
+
+        if (!string.IsNullOrWhiteSpace(guardrailId))
+        {
+            o.Policy.GuardrailId = guardrailId;   // ApplyGuardrail on tool-call input.
+            o.EnablePiiSanitization = true;       // Reuses the policy guardrail to redact tool-output PII.
+        }
+        else
+        {
+            o.EnablePiiSanitization = false;
+            o.Policy.InlineChecks = new AWS.Bedrock.MAG.GuardrailChecksOptions
+            {
+                // PII detection on the (JSON) tool-call context: a call whose arguments contain an SSN or
+                // email is denied. This is the reliable inline-check demo.
+                SensitiveInformationEntities = { "US_SOCIAL_SECURITY_NUMBER", "EMAIL" },
+                ConfidenceThreshold = 0.5,
+
+                // NOTE: content-filter and prompt-attack categories are intentionally left off here. By
+                // default the tool-call context is serialized to compact JSON, and the prompt-attack
+                // classifier reads that structured JSON as an injection attempt and denies benign calls. To
+                // use those categories, project the context to prose first via Policy.ContextSerializer, e.g.:
+                //   o.Policy.ContextSerializer = ctx => $"Tool {ctx["tool"]} called with {string.Join(", ", ctx)}";
+                // and then add:
+                //   PromptAttackCategories = { "PROMPT_INJECTION", "JAILBREAK" },
+                //   ContentFilterCategories = { "HATE", "INSULTS", "VIOLENCE" }, SeverityThreshold = 0.5,
+            };
+        }
+    })
+    .WithTools<SupportTools>();
+
+await builder.Build().RunAsync();

sampleapps/BedrockGovernedMcpServer/README.md

@@ -0,0 +1,63 @@
+# BedrockGovernedMcpServer
+
+A minimal MCP server governed by [Microsoft's Agent Governance Toolkit](https://devblogs.microsoft.com/dotnet/announcing-agent-governance-toolkit-mcp-extensions-for-dotnet/) with the AWS backends from [`AWS.Bedrock.MAG`](../../src/AWS.Bedrock.MAG) layered on top. It shows the package's primary path:
+
+```csharp
+builder.Services.AddMcpServer()
+    .WithStdioServerTransport()
+    .WithGovernance(...)          // Microsoft.AgentGovernance.Extensions.ModelContextProtocol
+    .WithBedrockGovernance(...)   // AWS.Bedrock.MAG
+    .WithTools<SupportTools>();
+```
+
+- `.WithGovernance(...)` (Microsoft's MCP extensions package) loads the YAML policy and stands up the toolkit's `GovernanceKernel`.
+- `.WithBedrockGovernance(...)` (this repo) attaches the Bedrock Guardrails **policy backend**, Bedrock **PII sanitization** of tool output, and the **CloudWatch audit** sink to that kernel.
+
+The server exposes two toy "customer support" tools (`Tools/SupportTools.cs`). `lookup_customer` deliberately returns PII so you can watch sanitization redact it.
+
+## Two modes
+
+The sample picks a mode from the environment so it runs with or without a pre-created guardrail:
+
+| `MAG_GUARDRAIL_ID` | Policy | PII sanitization | AWS resource needed |
+|---|---|---|---|
+| **unset** (default) | Inline checks (`InvokeGuardrailChecks`) — PII detection on the tool-call arguments | off (inline checks detect but don't mask) | none — just IAM |
+| **set** to a guardrail id | `ApplyGuardrail` on the tool-call input | on — redacts PII in tool output using the same guardrail | a Bedrock guardrail |
+
+## Prerequisites
+
+- .NET 8 SDK.
+- AWS credentials in the default chain (env vars, profile, or role). Region defaults to `us-west-2` (override with `MAG_TEST_REGION`).
+- IAM for the mode you run:
+  - Inline-checks mode: `bedrock:InvokeGuardrailChecks`.
+  - Guardrail mode: `bedrock:ApplyGuardrail` on the guardrail, plus `logs:CreateLogGroup`, `logs:CreateLogStream`, `logs:PutLogEvents` (and `cloudwatch:PutMetricData` if metrics are on) for audit.
+
+## Run it
+
+```bash
+cd sampleapps/BedrockGovernedMcpServer
+dotnet run
+```
+
+It's a stdio MCP server, so it talks JSON-RPC over stdin/stdout and logs to stderr. Point any MCP client at `dotnet run` in this directory, or drive it by hand — send an `initialize`, then a `tools/call`:
+
+```jsonc
+// benign call -> allowed, tool runs
+{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"lookup_customer","arguments":{"customerId":"C-1024"}}}
+
+// argument contains an SSN -> denied by the Bedrock policy backend
+{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"lookup_customer","arguments":{"customerId":"my ssn is 123-45-6789"}}}
+```
+
+In default (inline-checks) mode the first returns the customer record and the second comes back with `isError: true` and `"External policy backend 'bedrock-guardrails' denied the request."`
+
+To exercise the full path (guardrail policy + output PII redaction + CloudWatch audit), create a Bedrock guardrail that anonymizes `US_SOCIAL_SECURITY_NUMBER` and run with `MAG_GUARDRAIL_ID=<id> dotnet run`. The `lookup_customer` output SSN then comes back redacted.
+
+## Two things worth knowing (learned building this sample)
+
+1. **`WithGovernance` requires an authenticated agent identity by default.** With it on, every call is denied before reaching Bedrock. This sample sets `RequireAuthenticatedAgentId = false` to use the `DefaultAgentId` fallback. In production, leave it on and set an `AgentIdResolver` that maps your authenticated principals.
+2. **Prompt-attack / content-filter inline checks false-positive on the JSON tool-call context.** The tool-call context is serialized to compact JSON by default, and the prompt-attack classifier reads that structure as an injection attempt — denying benign calls. This sample uses PII inline checks (which score cleanly on JSON). To use prompt-attack or content-filter categories, project the context to prose first via `Policy.ContextSerializer` (see the commented example in `Program.cs`).
+
+## Package versions
+
+`AWS.Bedrock.MAG` pins `ModelContextProtocol` 2.1.0; `Microsoft.AgentGovernance.Extensions.ModelContextProtocol` 5.0.0 builds against 1.4.1. NuGet unifies to 2.1.0 and the two compose on the same `IMcpServerBuilder` — verified by this sample building and running end-to-end.

sampleapps/BedrockGovernedMcpServer/Tools/SupportTools.cs

@@ -0,0 +1,38 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+using System.ComponentModel;
+using ModelContextProtocol.Server;
+
+namespace BedrockGovernedMcpServer.Tools;
+
+/// <summary>
+/// A tiny "customer support" MCP tool surface used to exercise the two Bedrock governance paths:
+/// <list type="bullet">
+///   <item>Policy evaluation runs on the tool-call <b>input</b> (tool name + arguments), so passing a
+///   blocked word or PII in an argument lets the Bedrock policy backend deny the call.</item>
+///   <item>PII sanitization runs on the tool-call <b>output</b> text, so <see cref="LookupCustomer"/>
+///   deliberately returns an SSN to show it redacted (when a guardrail is configured).</item>
+/// </list>
+/// </summary>
+[McpServerToolType]
+public sealed class SupportTools
+{
+    [McpServerTool(Name = "lookup_customer")]
+    [Description("Look up a customer's contact record by their customer id.")]
+    public string LookupCustomer(
+        [Description("The customer id, e.g. \"C-1024\".")] string customerId)
+    {
+        // Returns PII in the text block on purpose: with a guardrail configured the Bedrock sanitizer
+        // redacts the SSN before this reaches the caller. See the README for what to expect.
+        return $"Customer {customerId}: Jane Doe, jane.doe@example.com, SSN 123-45-6789, status ACTIVE.";
+    }
+
+    [McpServerTool(Name = "get_account_balance")]
+    [Description("Get the current account balance for a customer.")]
+    public string GetAccountBalance(
+        [Description("The customer id, e.g. \"C-1024\".")] string customerId)
+    {
+        return $"Customer {customerId} balance: $482.10 USD.";
+    }
+}

sampleapps/BedrockGovernedMcpServer/policies/mcp.yaml

@@ -0,0 +1,12 @@
+# Microsoft Agent Governance Toolkit policy for the MCP server.
+#
+# This baseline lets every tool call through at the toolkit layer (default_action: allow) and leaves the
+# real decisions to the AWS Bedrock policy backend added by .WithBedrockGovernance(...): guardrail /
+# inline-check evaluation of each tool call. That keeps the sample focused on the Bedrock integration.
+#
+# To also gate tools at the toolkit layer, add entries under `rules:` (see the toolkit docs for the rule
+# schema: name, action, priority, condition).
+apiVersion: governance.toolkit/v1
+name: bedrock-governed-sample
+default_action: allow
+rules: []