Celonis Agent Tools (MCP Server) to Amazon Bedrock AgentCore

This topic provides step-by-step instructions for connecting Celonis Agent Tools (MCP Server) to an Amazon Bedrock AgentCore Runtime agent. This connection enables the agent to securely access Celonis process mining tools through OAuth 2.0 authentication.

Before you begin, ensure that you have:

• Administrative access to your Celonis environment
• An AWS account with permissions to configure IAM, Cognito, ECR, and Bedrock AgentCore
• AWS CLI installed and configured with credentials for your target account
• Python 3.11+ installed
• Docker is not required (CodeBuild handles ARM64 container builds in the cloud)
• A Celonis knowledge model configured in Studio with an MCP Server asset deployed

1. Navigate to Admin & Settings → Applications.
2. Click Add New Application and select "OAuth Client".
3. Configure the OAuth client as follows:
   • Name: OAuthClientCelonis (or your preferred name)
   • Grant Type: Client Credentials
   • Authentication Methods: Select both "Client Secret Basic" and "Client Secret Post" checkboxes
4. Click Define Scopes.
5. Select mcp-asset.tools:execute.
6. Click Create.

1. Open Studio and navigate to your application.
2. Click + New Asset → Agent Tools (MCP).
3. Configure the MCP Server:
   • Asset Name: MCP Server (or your preferred name).
   • Knowledge Model: Select your target knowledge model.
4. Click Create.
5. Configure available tools based on your requirements by clicking + Add Tools. Available tools include:
   • load_data — Retrieves data from the knowledge model based on KPI/metric IDs.
   • get_knowledge_model — Returns the full knowledge model schema including all KPIs.
   • search_data — Searches for relevant columns or instances from the knowledge model.
6. Toggle on the tools you want to enable.

1. Click Package Settings → Permissions.
2. Search for your OAuth client application (e.g., "OAuthClientCelonis").
3. Grant the Use permission to the OAuth client.
4. Click Save.

1. Click Deploy to publish the MCP Server.
2. After deployment, copy the generated MCP Server URL. It will be in the following format: https://<your-environment>.celonis.cloud/studio-copilot/api/v1/mcp-servers/mcp/<server-id>
3. Save this URL. You will need it in the AWS configuration steps below.

1. Clone the integration repository:

   git clone https://github.com/aws-samples/sample-celonis-bedrock-agentcore-integration
   cd sample-celonis-bedrock-agentcore-integration
   

2. Create a Python virtual environment and install dependencies:

   python -m venv .venv && source .venv/bin/activate
   pip install -r requirements.txt
   pip install bedrock-agentcore-starter-toolkit
   

3. Copy .env.example to .env and complete the following values:

   # Celonis MCP Server Configuration
   CELONIS_MCP_SERVER_URL=https://<your-environment>.celonis.cloud/studio-copilot/api/v1/mcp-servers/mcp/<server-id>
   CELONIS_TOKEN_URL=https://<your-environment>.celonis.cloud/oauth2/token
   CELONIS_CLIENT_ID=<client-id-from-step-1>
   CELONIS_CLIENT_SECRET=<client-secret-from-step-1>
   CELONIS_OAUTH_SCOPE=mcp-asset.tools:execute
   
   # AWS Configuration
   AWS_ACCOUNT_ID=<your-aws-account-id>
   AWS_REGION=<your-target-region>
   

Run the setup script to create all required AWS resources:

AWS_REGION=<your-region> python setupAWSbackend.py

Resources created:

• IAM Role CelonisAgentCoreRuntime-<region>: Execution role for the agent container.
• IAM Role CelonisAgentCoreGateway-<region>: Role for the AgentCore Gateway.
• AgentCore Identity credential provider: Stores Celonis OAuth credentials securely.
• AgentCore MCP Gateway: Proxies MCP calls to Celonis.
• Cognito User Pool CelonisAgentCorePool: Issues JWT tokens for inbound authentication.
• Cognito App Client celonis-caller: Client credentials for callers.

1. Open the IAM Console and find the CelonisAgentCoreRuntime-<region\> role.
2. Edit the inline policy named BedrockInvokeModel.
3. Add the following actions to the existing Bedrock statement:
   • bedrock:Converse
   • bedrock:ConverseStream
4. Save the policy.

The agent uses Claude via Amazon Bedrock:

1. Open the Bedrock Model Catalog in your target region.
2. Search for "Claude Sonnet 4.5".
3. Click the model and submit the Request model access use case form.

AWS_REGION=<your-region> agentcore launch

After deployment, copy the Agent ID from .bedrock\_agentcore.yaml and add it to .env:

AGENTCORE_AGENT_ID=<agent-id-from-yaml>

1. Caller sends POST request with Cognito JWT.
2. AgentCore Runtime fetches OAuth token from Celonis.
3. Agent connects to Celonis MCP Server with Bearer token.
4. Amazon Bedrock (Claude) processes data and returns response.
5. Agent optionally POSTs result to a callback_url.

{
  "prompt": "Are there any PR lines with contract leakage this week?",
  "callback_url": "https://hooks.slack.com/triggers/..."
}

source .venv/bin/activate
AWS_REGION=<your-region> python test_local.py

AWS_REGION=<your-region> python test_remote.py "Are there any PR lines with contract leakage?"

Configure an HTTP action in Celonis with:

• URL: https://bedrock-agentcore.<region\>.amazonaws.com/runtimes/<url-encoded-agent-arn>/invocations?qualifier=DEFAULT
• Headers: Authorization: Bearer <cognito-jwt>
• Body:
  {  
  "prompt": "{{your_celonis_variable}}",  
  "callback_url": "https://hooks.slack.com/triggers/..."  
  }

• Model Access Error: Ensure the Anthropic use case form is approved.
• AccessDeniedException: Double-check the IAM role has bedrock:Converse permissions.
• 401 Unauthorized: Check that the Celonis OAuth client has Use permission on the MCP asset.
• No tools discovered: Ensure the MCP Server is deployed in Celonis Studio.

• Store secrets in AWS Secrets Manager for production environments.
• Inbound authentication uses Cognito JWT tokens.
• Outbound tokens to Celonis are short-lived (15 minutes).