Add AgentCore AWS Specialist Agent sample

README.md

@@ -20,6 +20,7 @@ While [FAST](https://github.com/awslabs/fullstack-solution-template-for-agentcor
 | [CopilotKit Generative UI](#copilotkit-generative-ui) | Generative UI, shared state, and human-in-the-loop interactions via CopilotKit |
 | [LLM Council](#llm-council) | An implementation of "Council of LLMs" pattern on AWS. Builds consensus among multiple diverse LLMs.|
 | [Dual Monitoring System](#dual-monitoring-system) | Dual-layer monitoring for agentic solutions using AgentCore Evaluations and AWS DevOps Agent |
+| [AgentCore AWS Specialist Agent](#agentcore-aws-specialist-agent) | AWS specialist chat agent with Gateway MCP tools, long-term memory, web search, Skills on Runtime, and a NAT-free VPC |
 
 <!-- Add new samples to the table above as they are added -->
 
@@ -70,6 +71,17 @@ While [FAST](https://github.com/awslabs/fullstack-solution-template-for-agentcor
 
 ![Architecture Diagram](samples/dual-monitoring-system/docs/architecture-diagram/Dual-monitoring-20260407.jpg)
 
+### [AgentCore AWS Specialist Agent](samples/aws-specialist-agent/)
+**Description**: An AWS specialist chat agent showcased at the AgentCore booth at AWS Summit Japan 2026. The agent reasons about AWS, calls AWS APIs and managed tools through AgentCore Gateway, searches the web, executes code, and remembers facts across sessions.
+
+**Built on FAST**: v0.4.1
+
+**Key Differences from FAST**: Adds selectable models (Claude and OpenAI GPT on Bedrock via a CDK model registry), AgentCore Memory long-term memory with an LTM-listing MCP server, the Amazon-managed Web Search connector, a chat-history sidebar (API Gateway + Lambda + DynamoDB), a fully closed NAT-free VPC using only VPC endpoints, AWS Skills mounted from S3 Files at `/mnt/skills`, speculative pre-warming to cut cold-start latency, and multi-MCP-server management gated per user department by Cedar ABAC.
+
+**Use Case**: Building production-oriented specialist agents that need fine-grained per-user tool authorization, private networking, long-term memory, and multiple MCP tool sources on AgentCore.
+
+![AgentCore AWS Specialist Agent UI](samples/aws-specialist-agent/docs/img/screenshot.png)
+
 <!-- Template for new samples:
 ### [Sample Name](samples/sample-directory-name/)
 **Description**: Brief description of what this sample demonstrates

samples/aws-specialist-agent/.ash/ash.yaml

@@ -0,0 +1,56 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/awslabs/automated-security-helper/refs/heads/main/automated_security_helper/schemas/AshConfig.json
+# ASH (Automated Security Helper) configuration.
+# Suppressions below are false positives or intentional design decisions;
+# each entry records the reason for security-review (PCSR) traceability.
+project_name: aws-specialist-agent
+
+global_settings:
+  severity_threshold: MEDIUM
+
+  ignore_paths:
+    - path: "**/.pytest_cache/**"
+      reason: "Local pytest cache (git-ignored); never shipped"
+    - path: "frontend/build/**"
+      reason: "Vite build output (git-ignored); scanned at source level instead"
+    - path: "**/node_modules/**"
+      reason: "Third-party dependency tree; audited via npm audit, not shipped in the sample"
+    - path: "**/*.tsbuildinfo"
+      reason: "TypeScript incremental build cache (git-ignored); high-entropy hashes are not secrets"
+
+  suppressions:
+    # --- bandit B104 (hardcoded_bind_all_interfaces) -----------------------
+    # The AgentCore Runtime MCP contract requires servers to listen on
+    # 0.0.0.0:8000 inside the container; the listener is only reachable
+    # through the Runtime endpoint (JWT-authorized), never exposed directly.
+    - rule_id: "B104"
+      path: "gateway/tools/ltm_mcp_server/server.py"
+      reason: "AgentCore Runtime MCP contract mandates binding 0.0.0.0:8000 in-container"
+    - rule_id: "B104"
+      path: "gateway/tools/strands_mcp_server/server.py"
+      reason: "AgentCore Runtime MCP contract mandates binding 0.0.0.0:8000 in-container"
+    - rule_id: "B104"
+      path: "tests/unit/test_ltm_mcp_server.py"
+      reason: "Test asserts the AgentCore MCP contract host value; no listener is opened"
+    - rule_id: "B104"
+      path: "tests/unit/test_strands_mcp_server.py"
+      reason: "Test asserts the AgentCore MCP contract host value; no listener is opened"
+
+    # --- detect-secrets ----------------------------------------------------
+    - rule_id: "SECRET-SECRET-KEYWORD"
+      path: "skills/agent-toolkit-for-aws/creating-secrets-using-best-practices/references/create-secrets-using-best-practices.md"
+      reason: "Vendored upstream AWS skill documentation; placeholder example values, not real secrets"
+    - rule_id: "SECRET-SECRET-KEYWORD"
+      path: "test-scripts/test-runtime-vpc-e2e.py"
+      reason: "Throwaway test password generated at runtime from uuid4; not a stored secret"
+    - rule_id: "SECRET-SECRET-KEYWORD"
+      path: "test-scripts/test-skills-e2e.py"
+      reason: "Throwaway test password generated at runtime from uuid4; not a stored secret"
+    - rule_id: "SECRET-SECRET-KEYWORD"
+      path: "tests/unit/test_models.py"
+      reason: "Unit-test fixture literal ('token-for-us-east-1'); not a credential"
+    - rule_id: "SECRET-HEX-HIGH-ENTROPY-STRING"
+      path: "skills-lock.json"
+      reason: "SHA-256 content hashes of vendored skills (integrity pins), not secrets"
+    - rule_id: "SECRET-HEX-HIGH-ENTROPY-STRING"
+      path: "scripts/vendor-skills.py"
+      reason: "Pinned upstream git commit SHA for reproducible vendoring, not a secret"