HEMA built internal AI assistant HAL on MCP and Amazon Bedrock AgentCore

HEMA's engineers used to portal-hop for answers across disconnected wikis, service catalogs and IT portals. The 100-year-old Dutch retailer with more than 750 stores replaced that with HAL, an internal AI assistant built on the Model Context Protocol (MCP) and Amazon Bedrock AgentCore.

The gap: procedural knowledge

Structured knowledge was in decent shape: a service catalog mapped people to teams, teams to services, services to APIs. The gap was procedural — how to request API access, provision a group, find the rule for a case. Those answers never had one home; as the company grew, asking a colleague stopped scaling, and what once took three or four portals now takes seconds.

Why MCP and Amazon Bedrock AgentCore

HAL consolidates fragmented knowledge into one governed source of truth; MCP delivers it inside the tools people already use — the HAL chat, Kiro, Claude and other agents. AgentCore enabled the build without custom MCP server infrastructure: Gateway turns OpenAPI specifications and AWS Lambda functions into MCP tools, Identity handles JWT authentication and OAuth2, and Runtime hosts the agent as a container. Security is anchored in Microsoft Entra ID, with no AWS credentials on the client.

Building HAL in two steps

Step 1 was a standalone assistant: a Next.js web chat backed by a Strands agent in a Linux/ARM64 container on AgentCore Runtime. It answers from managed knowledge bases (IT documentation, API specifications, Kafka topics, the service catalog) via the Amazon Bedrock Retrieve API, and reaches live APIs over MCP with AWS IAM SigV4 authentication. Step 2 added a second gateway with a custom JWT via Microsoft Entra ID for clients such as Kiro and Claude, sharing only the read-only knowledge bases with the agent.

An MCP auth proxy on a single Lambda reconciles the MCP OAuth specification with Entra ID, and dynamic client registration is emulated by a stub returning a fixed client ID. HAL spent a month in staging with engineers and business users before production.

Cross-role use — and the move to actions

Developers use HAL for documentation, API specs and Kafka topics from Kiro and chat; product owners for process knowledge; business analysts for infrastructure questions. HAL is read-only today, but the portals are already API-enabled and tied to Entra ID single sign-on, so operations can become action tools under the same authentication — starting with creating an AWS account from chat.