Claude Security Review: no high-confidence findings. (run)

Hi @Tommypop2 , the export fix is correct - the exported load.py dropped model.maxTokens for non-Mantle BedrockModel, and this threads it through.

But I traced #1718 through the managed-harness path and I don't think this PR closes it. The issue's repro is agentcor e dev → "Max output tokens" in Harness Settings, and that field never touches load.py. load.py only exists on the agentcore export → code-based-agent path (export converts a managed harness into a standalone Python agent you deploy yourself). A managed harness interprets its model config server-side, it never renders load.py.

On the managed path, model.maxTokens is already wired end to end.

So the "field is empty" symptom isn't reproduced by the current code on the managed path. Before merging as "Closes #1718", can you confirm:

1. Did you repro via agentcore dev (managed harness) or export + deploy (code-based agent)?
2. What CLI / agent-inspector version?
3. Was the value under model.maxTokens, not the top-level execution maxTokens, in harness.json?

If it's a managed-harness issue it's likely either an older UI version or server-side (harness service not honoring BedrockModelConfig.MaxTokens), and should stay open.

Claude Security Review: no high-confidence findings. (run)

Hi!
I encounted and tested with agentcore dev as that's where I initially found the error. Happy to test more on a deployed agent to verify the fix works for both. (Though I'd appreciate some guidance on reliably using enough tokens as consistently getting the model to error even with the lower token limit was sometimes unreliable even in dev)
The value was under model.maxTokens as follows:

"model": {
    "provider": "bedrock",
    "modelId": "global.anthropic.claude-sonnet-5",
    "maxTokens": 32000
  },

The changes did seem to fix the issue, though I guess that can't be true if the agentcore dev flow doesn't use load.py. I am creating the agents in typescript (rather than the declarative harnesses), but keeping the harness.json so the CLI commands can still work.

I'm on CLI version v0.23.0.

Thanks!

Done some more testing:
When I was testing, I was still running agentcore deploy -y so I'm assuming that's what meant that the maxTokens in dev was updated.
I have a fix that I've tested to actually update the maxTokens value in dev without deployment (tested by setting a small maxTokens value then prompting and looking for token overflow). I've added it to this PR for now, but happy to split them into separate PRs and issues if needed

Thanks :)

Claude Security Review: no high-confidence findings. (run)