Amazon WorkSpaces for AI Agents Adds Linux, Windows 11, and OAuth Support

In June, we announced the general availability of Amazon WorkSpaces for AI agents. That launch gave your agents a managed way to operate the desktop applications your business runs on, including ERP clients, claims systems, engineering tools, and internal apps that were never built with an API. Since then, many of you have put agents to work against those applications, and you have told us where you want to go next. Two requests came up again and again. You want agents to reach applications that do not run on the operating systems we supported at initial launch, and you want agents that you already use, or are building, to connect with less setup. This release focuses on those two themes, broader operating system support and agent integration. In this post, we walk through what is new, explain why each change matters, and then show you how to connect Kiro or Claude Code to WorkSpaces for AI agents in a few minutes.

Broader operating system support

Your applications decide which operating system an agent needs. Some line-of-business applications and developer tools run only on Linux, and some newer Windows applications require Windows 11. Until now, if an application fell outside the operating systems WorkSpaces for AI agents supported, you had to leave that workflow out of your automation plans or move the application to a different platform first. WorkSpaces for AI agents now supports Linux fleets and Windows 11 fleets. Windows 11 is available through Bring Your Own License (BYOL), so you use the Windows 11 licenses your organization already owns. You can point agents at the images and applications your teams already run, so an application’s operating system no longer limits which of your workflows you can automate.

Agent integration

An agent is only as good as what it knows about the tools in front of it. The Agent Toolkit for AWS is a free set of skills and an AWS MCP Server that work with the coding agents developers already use, including Kiro, Claude Code, and Codex. The toolkit now includes a WorkSpaces for AI agents skill. A skill is a package of instructions and reference material that the agent loads when a task calls for it. The WorkSpaces for AI agents skill teaches your agent how the service works: how to connect to a session, how to choose between blocking and polling connection modes, which desktop tools exist and how to batch actions to save tokens, how to use forwarded MCP tools, and how to fix common connection errors. Without the skill, an agent has to guess at tool names and connection settings, and those guesses cost time and fail more often. The skill works the same whether you use an existing coding agent or build your own agent and load the skill into it.

The second change removes the most common setup step. WorkSpaces for AI agents now supports OAuth authentication through the standard MCP OAuth flow and AWS Sign-In. If your agent supports OAuth for MCP servers, as Kiro and Claude Code do, you add the WorkSpaces for AI agents endpoint, sign in through your browser with your AWS identity, and start working. Security teams keep the controls they rely on, because OAuth requests use the same AWS Identity and Access Management (IAM) per-tool permissions as SigV4 requests, and AWS CloudTrail logs every connection. Access tokens are short-lived and renew automatically, which keeps long-term credentials off developer machines. With OAuth, you no longer need to generate a streaming URL or run a local proxy to sign requests, and your existing SigV4 connections keep working without changes.

Walkthrough

In this walkthrough, you install the WorkSpaces for AI agents skill, connect Kiro or Claude Code to your stack over OAuth, give the agent a desktop task, and then remove the connection.

Prerequisites

You need a WorkSpaces Applications stack with agent access enabled and a running fleet associated with that stack. To create one, follow Getting started with agent access in the WorkSpaces Applications Administrator Guide, or deploy the open-source sample-code-for-workspaces-agent-access repository. You also need an AWS identity in the account where WorkSpaces Applications is deployed, with IAM permissions to use the WorkSpaces for AI agents MCP tools. Finally, you need Node.js to run the skill installer and either Kiro CLI or Claude Code installed.

Connecting your agent

This section covers Kiro and Claude Code. Other agents that support MCP OAuth follow the same pattern.

Connect to the skill

Install the WorkSpaces for AI agents skill from the Agent Toolkit for AWS repository by running the command for your agent in your terminal. After installation, your agent activates the skill on its own when a task involves WorkSpaces for AI agents.

For Claude Code:

npx skills add aws/agent-toolkit-for-aws/skills --skill amazon-workspaces-agent-access -a claude-code

For Kiro:

npx skills add aws/agent-toolkit-for-aws/skills --skill amazon-workspaces-agent-access -a kiro-cli

Connect Kiro or Claude Code

Both agents connect to the same WorkSpaces for AI agents MCP endpoint. Before you run the commands, replace the following placeholders with your own values.

For Claude Code, run the following command in your terminal. The -s user flag makes the server available in all your projects.

claude mcp add --transport http -s user aws-agentaccess \
    https://agentaccess-mcp.REGION.api.aws/mcp \
    --header "x-amzn-agentaccess-workspaces-applications-stack: STACKNAME" \
    --header "x-amzn-agentaccess-workspaces-applications-user-id: AGENTUSER"

For Kiro, connecting takes two steps. First, add the server from your terminal.

kiro-cli mcp add --name aws-agentaccess --scope global \
    --url https://agentaccess-mcp.REGION.api.aws/mcp

Second, open ~/.kiro/settings/mcp.json and add the stack and user headers to the aws-agentaccess entry.

"aws-agentaccess": {
  "url": "https://agentaccess-mcp.REGION.api.aws/mcp",
  "headers": {
    "x-amzn-agentaccess-workspaces-applications-stack": "STACKNAME",
    "x-amzn-agentaccess-workspaces-applications-user-id": "AGENTUSER"
  }
}

Next, start a session in Kiro or Claude Code, run /mcp, and select the aws-agentaccess server to authenticate. Your browser opens to AWS Sign-In. Sign in to the AWS account where WorkSpaces Applications is deployed, using the identity with WorkSpaces for AI agents permissions. After you sign in, the agent receives a short-lived token and renews it automatically, so you do not sign in again for each session.

Test

Give your agent a desktop task. A good first prompt confirms that the connection works:

“Connect to my WorkSpaces desktop, take a screenshot, and tell me which applications are open.”

Before you give the agent a longer task, open the desktop so you can watch the agent work. To do this, create a streaming URL for the stack and user ID that the agent uses, and open it in your browser. With the session open, try a task that exercises the applications on your fleet, for example:

“Open Notepad on my WorkSpaces desktop, write a three-line summary of today’s date and the open applications, and save the file to the desktop as agent-test.txt.”

The agent uses the skill to choose a connection mode, take screenshots, and group clicks and keystrokes into batches. If you enabled user control mode on your stack, you can watch the agent work in the streaming session and stop it at any time. To review what the agent did afterward, check the connection and tool call records in CloudTrail and the session metrics in Amazon CloudWatch.

Cleanup

To remove the WorkSpaces for AI agents MCP server from your agent, run the command for your client.

For Claude Code:

claude mcp remove aws-agentaccess -s user

For Kiro:

kiro-cli mcp remove --name aws-agentaccess --scope global

If you created a stack and fleet for this walkthrough, stop the fleet in the WorkSpaces Applications console so it does not keep accruing charges, and delete the stack and fleet if you no longer need them. If you deployed the sample repository, follow its cleanup instructions to remove those resources.

Conclusion

This release brings WorkSpaces for AI agents to more of your applications and makes it simpler for your agents to connect. Linux support and Windows 11 BYOL support let agents reach applications that the initial launch could not. The WorkSpaces for AI agents skill in the Agent Toolkit for AWS teaches your agent how to use the service, so it spends less time guessing and more time finishing tasks. OAuth support lets you connect Kiro, Claude Code, and other MCP agents with a browser sign-in while keeping the IAM permissions and CloudTrail auditing your security team relies on. These features are available today in AWS Regions that offer the WorkSpaces Applications MCP endpoint. For the current list, see WorkSpaces Applications MCP endpoints in the Administrator Guide. To learn more, see the WorkSpaces Applications Administrator Guide, try the sample-code-for-workspaces-agent-access repository, and tell us which workflows you automate next.

	Dave Jaskie is a Senior AWS Applied AI Solutions Architect with 16 years of experience in the end-user computing space. He helps customers design, deploy, and optimize their virtual desktop and application streaming environments on AWS. Outside of work, Dave enjoys traveling and hiking with his wife and four kids.
	Robert Fountain is a Senior Agentic WorkSpaces Specialist Solutions Architect at AWS with nearly 20 years of experience in end user computing. He joined AWS in 2020. When he isn’t working, he patrols with the National Ski Patrol and spends time with his family.