VulneraAI: Bedrock AgentCore Security Assistant

Inspiration

The rise of low-code and AI-assisted development has empowered anyone to build apps — but most launch without proper security validation. We wanted to change that.

VulneraAI helps every developer — even non-security experts — identify and fix vulnerabilities using natural language. Built entirely on AWS Bedrock AgentCore, it democratizes cybersecurity through explainable, AI-driven reasoning.

What it does

VulneraAI acts as an autonomous security assessment assistant that:

🔍 Scans user-submitted code snippets, URLs, or app descriptions for vulnerabilities.

🧭 Maps findings to OWASP Top-10 categories (Injection, Misconfiguration, Broken Access Control, etc.).

💬 Provides human-readable explanations and actionable remediation steps.

🧠 Uses Bedrock AgentCore reasoning to dynamically decide when to fetch data, analyze code, or explain results — optimizing accuracy and speed.

How we built it

🧱 AWS Bedrock AgentCore — Orchestrates reasoning, tool calls, and adaptive analysis.

🔐 Amazon Cognito — Handles secure OAuth2 / JWT authentication and provides access tokens for direct runtime invocation.

⚡ AWS Amplify (React + Vite) — Hosts the frontend web app with a ChatGPT-style interface for real-time conversations.

AgentCore Tools — Modular internal tools for specialized tasks:

Fetch Tool → Retrieves OWASP and NIST guidelines for context.

Scan Tool → Performs pattern-based vulnerability checks.

This architecture eliminates the need for any backend (like Lambda). Cognito authentication connects users directly to Bedrock AgentCore Runtime via HTTPS, ensuring low latency and high security.

Challenges we ran into

⚙️ Configuring JWT-based OAuth authorization between Cognito and AgentCore.

🌐 Managing CORS and HTTPS communication between Amplify and Bedrock runtime.

🧾 Debugging aud and client_id claim mismatches during OAuth setup.

🎨 Designing a user interface that makes complex security guidance conversational and intuitive.

Accomplishments we’re proud of

✅ Built a fully serverless Bedrock AgentCore pipeline — no Lambda or backend required.

🔒 Achieved direct Cognito → AgentCore runtime integration with secure token validation.

💬 Delivered real-time vulnerability analysis through an Amplify web chat.

📚 Implemented cached OWASP guidance for consistent, explainable AI responses.

⚡ Achieved smooth, low-latency interaction between Amplify, Cognito, and Bedrock services.

What we learned

How to configure Bedrock AgentCore with OAuth2/JWT authentication via Cognito.

Best practices for secure, frontend-only integration with Bedrock runtimes.

How to structure autonomous reasoning loops in Bedrock AgentCore.

The importance of explainability and transparency in AI-powered security tools.

That AI can democratize cybersecurity — empowering every developer to understand and fix vulnerabilities.

What’s next for VulneraAI

🤖 Expand into AI vulnerability detection — identifying risks like prompt injection, data leakage, and model poisoning in GenAI systems.

🧠 Expand into a multi-agent system (scanner, explainer, remediator).

🎙️ Add voice and multimodal interaction for accessibility.

📦 Package as a plug-and-play SDK for secure-by-design development.

Built With

• aws-amplify
• aws-bedrock
• aws-sdk
• bedrock-agentcore
• css
• langchain
• python
• react-(vite)
• tailwind
• typescript