July 20, 2026 4 min read Python fork

sample geospatial agent on aws

Abstract

An AI agent that analyzes satellite imagery for any location on Earth using natural language. Ask about vegetation health, water bodies, or wildfire damage — get real results from Sentinel-2 imagery, rendered on an interactive map.

Forked from aws-samples/sample-geospatial-agent-on-aws

The Problem

Organizations needing geospatial intelligence face barriers: building satellite analysis pipelines requires geospatial expertise, Sentinel-2 data management, and custom tooling. This repository provides a ready-made AI agent that lowers that barrier by accepting natural language queries about vegetation health, water bodies, or wildfire damage and returning rendered results.

What This Does

The repository contains four semi-independent projects. geo_agent/ (31 files, 20 code files) is the core: a Python agent using Strands Agents with Claude Sonnet 4.6 on Bedrock AgentCore Runtime, equipped with tools for Sentinel-2 analysis (NDVI, NDWI, NBR), OSM boundaries, and Amazon Location Service queries. react-ui/ (56 files) provides the TypeScript/React frontend with MapLibre GL, Cognito auth, and CloudFront distribution. frontend-cdk/ (19 files) and titiler-cdk/ (9 files) define the infrastructure as code for the tile server and UI deployment. Data flows from Sentinel-2 imagery through the agent’s analysis tools (defined in geo_agent/utils/tools.py, geo_agent/utils/sentinel_utils.py, geo_agent/utils/ndvi_utils.py) to the tile server, then to the React UI. The agent makes outbound network calls to S3 and AWS Location Service; tile rendering occurs in the CDK-deployed TiTiler stack.

How It Is Wired

Execution starts at geo_agent/awslabs/aws_location_server/server.py:769 (main), which reaches two internal functions. The most connected module is geo_agent/utils/tools.py (Ca=1, Ce=7, instability=0.88), defining 19 functions including bbox_around_point, create_bbox_from_coordinates, and download_geometry_from_s3 (called from 8 places). The call graph shows run_change_detection -> download_band x12 and run_change_detection -> _read_band x11 as the heaviest edges. geo_agent/utils/sentinel_utils.py (5 functions) handles Sentinel-2 collection search and raster clipping, making an outbound network call and reading/writing files. Downstream, geo_agent/utils/ndvi_utils.py (3 functions) calculates NDVI/NDWI/NBR stats. The CDK stacks (frontend-cdk/lib/geospatial-agent-stack.ts, titiler-cdk/) provision the ECS Fargate service, CloudFront, and tile endpoints. The reactor pattern: user query -> frontend Express server -> Bedrock AgentCore Runtime -> agent tool execution -> S3 data fetch -> TiTiler rendering -> map tile return to UI.

How To Use It

Setup: AWS CLI configured with permissions, Docker running, Node.js 20+, Python 3.10+, AWS CDK installed globally, AgentCore CLI (pip install bedrock-agentcore==1.1.2 bedrock-agentcore-starter-toolkit==0.3.0). Set shell variables from the README: export AWS_ACCOUNT=$(aws sts get-caller-identity --query Account --output text), export AWS_REGION=us-east-1, export S3_BUCKET_NAME=geospatial-agent-on-aws-${AWS_ACCOUNT}.

Deploy the geo agent: cd geo_agent && cp .env.example .env then python geo_agent/agentcore_utils/create_cdk_agent_role.py --agent-name geospatial-agent-on-aws --s3-bucket ${S3_BUCKET_NAME}. Configure environment values in .env (AWS_REGION, S3_BUCKET_NAME, AGENTCORE_ARN).

Deploy TiTiler and frontend: cd frontend-cdk && cdk deploy geospatial-agent-stack and cd titiler-cdk && cdk deploy. The README provides step-by-step CDK deployment commands for all three components, totaling ~15 minutes.

Run: After deployment, the frontend URL accepts natural language queries like "Show vegetation health for Central Park, New York".

Real-World Use

A disaster-response team needs to assess flood extent after a storm. They open the React UI, enter "Compare water levels for Folsom Lake, California 2021 vs 2022". The frontend forwards the query to the Bedrock AgentCore Runtime, which invokes the agent’s search_sentinel2_collection and get_filtered_images tools (defined in geo_agent/utils/sentinel_utils.py). The agent queries S3 for relevant Sentinel-2 granules, computes NDWI via geo_agent/utils/ndvi_utils.py, and the TiTiler stack renders a water-body map tile. The UI displays the interactive map with OSM boundary overlay. The team downloads the result or shares the link with stakeholders.

Code Health & Issues

The static analysis identified 26 findings across 6 kinds:

[CRITICAL] Upgrade pinned dependency carrying a critical advisory: pillow@11.3.0 CVE-2026-59198 — the vulnerable code installs as pinned, reachable over the network without credentials. Fix: upgrade and commit lockfile.
[HIGH] Upgrade pinned dependencies with published advisories: starlette@0.50.0 CVE-2026-54283, mcp@1.25.0 CVE-2026-52870, aws-cdk-lib@2.189.1 CVE-2026-11417, bedrock-agentcore@1.1.2 CVE-2026-16796, and 3 more.
[HIGH] No test suite: 51 source files, zero test files. Any change ships with no signal existing behavior holds.
[HIGH] No CI configuration: 51 source files with no automated build/test gate.
[HIGH] Build gate missing for deployment artifact geo_agent/.bedrock_agentcore/geospatial_agent_on_aws/Dockerfile: image builds with no validated step.
[MEDIUM] Dependabot/Renovate not enabled: 5 manifest(s), no update bot configured.
[MEDIUM] Container base image not pinned by digest: public.ecr.aws/docker/library/python:3.12-slim — mutable base means build-to-build CVE drift with no record.
[MEDIUM] Large binaries in repository: 5 blobs over 5MB including ndwi-2020-09-27.tif 19.0MB.
[MEDIUM] Outbound requests have no timeout: 1 call(s) with no timeout configured, risking worker hangs.
[LOW] Missing convention files: .editorconfig, .gitattributes, formatter config absent.

The Bottom Line

This repo delivers a functional, deployable geospatial AI agent with real Sentinel-2 data and a working React UI in about 15 minutes — a significant time-saving compared to building the stack from scratch. The codebase shows reasonable structure for a portfolio piece but carries production risk: critical and high-severity unpatched CVEs in pinned dependencies, no test or CI gate, oversized files with deep nesting, and mutable container bases. It is suitable for evaluation, prototyping, or internal tooling where the dependency and operational risks can be mitigated, but not yet for unsupervised production use without the recommended upgrades, test additions, and pipeline gates.

What the analyser found

Deployment readiness

5/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

145 files

Python20
JSON19
TypeScript18
TSX12
Markdown11
Shell9

ReactExpressDocker

Module dependencies

The 10 most depended-upon modules of 51, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_react_ui_frontend_src_theme["theme"] n1_react_ui_frontend_src_types["types"] n2_t_ui_frontend_src_utils_auth["auth"] n3_geo_agent_utils_raster_utils["raster_utils"] n4_ui_frontend_src_services_api["api"] n5_eo_agent_utils_geocode_utils["geocode_utils"] n6_geo_agent_utils_ndvi_utils["ndvi_utils"] n7_o_agent_utils_sentinel_utils["sentinel_utils"] n8_geo_agent_utils_aws_utils["aws_utils"] n9_react_ui_frontend_src_config["config"] n6_geo_agent_utils_ndvi_utils --> n3_geo_agent_utils_raster_utils n6_geo_agent_utils_ndvi_utils --> n8_geo_agent_utils_aws_utils n7_o_agent_utils_sentinel_utils --> n5_eo_agent_utils_geocode_utils n7_o_agent_utils_sentinel_utils --> n3_geo_agent_utils_raster_utils n4_ui_frontend_src_services_api --> n1_react_ui_frontend_src_types n4_ui_frontend_src_services_api --> n2_t_ui_frontend_src_utils_auth

Dependencies

22 of 108 declared dependencies are a major version behind. Resolved 108 of 108 against the registry.

Package	Declared	Latest	Behind
`rpds-py`	==0.30.0	2026.6.3	2026 major
`@types/node`	20.14.9	26.2.0	6 major
`apache-arrow`	^18.1.0	21.2.0	3 major
`typescript`	~5.5.3	7.0.2	2 major
`websockets`	==15.0.1	17.0.1	2 major
`chardet`	==5.2.0	7.6.0	2 major
`@types/jest`	^29.5.12	30.0.0	1 major
`cdk-nag`	^2.37.55	3.0.2	1 major

Findings

MediumNo test files detected - untested code paths repository-wide
MediumNo CI/CD pipeline detected - no automated build/test gate .github/ or CI config

Open in Code Brain → See its neighbourhood →

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

critical1

high4

medium4

low1

Upgrade the pinned dependency carrying a critical advisorycritical36 occurrences

pillow@11.3.0 CVE-2026-59198 (critical) +35 more

The manifest pins the exact version the advisory covers, so this is not a warning about drift: the vulnerable code is what installs, and a critical rating means it is reachable over the network without credentials or user interaction.

Fix: Upgrade to the fixed version named in the advisory, then commit the lockfile.

Upgrade the pinned dependency carrying a published advisoryhigh87 occurrences

starlette@0.50.0 CVE-2026-54283 (high) +9 more; mcp@1.25.0 CVE-2026-52870 (high) +5 more; aws-cdk-lib@2.189.1 CVE-2026-11417 (high) +2 more; bedrock-agentcore@1.1.2 CVE-2026-16796 (high) +1 more; and 3 more package(s)

The pinned version is the one that installs, so a published advisory against it describes this deployment rather than a hypothetical one, and the advisory is also a public description of how to exploit it.

Fix: Upgrade to the fixed version named in the advisory, then commit the lockfile.

Add a test suite; this repository has nonehigh51 occurrences

51 source files, no test files

Any change ships with no signal that existing behaviour still holds, so a regression reaches production undetected.

Fix: Add one test per public entry point, then a CI step that runs them.

Add a workflow that builds and tests this repositoryhigh

51 source files, no CI configuration

Every change merges with nobody having run the build once, which across this estate is 499 repositories.

Fix: Add a workflow running the project build and test command on push and pull_request.

Add a build gate for the deployable artifacts herehigh8 occurrences

geo_agent/.bedrock_agentcore/geospatial_agent_on_aws/Dockerfile

deployment artifacts with no workflow

Something in the repo is meant to reach a server and no automated step has ever validated it, which is the state of 125 repositories here.

Fix: Add a workflow that at least builds the image and validates the manifests.

Enable Dependabot or Renovatemedium

5 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Pin the container base image by digestmedium

geo_agent/.bedrock_agentcore/geospatial_agent_on_aws/Dockerfile

public.ecr.aws/docker/library/python:3.12-slim

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Move large binaries to Git LFS or out of the repositorymedium5 occurrences

use-cases/lake-mead-water/before/ndwi-2020-09-27.tif

5 blobs over 5MB: ndwi-2020-09-27.tif 19.0MB, ndwi-2025-10-01.tif 18.2MB, tci-2020-09-27.tif 12.9MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Give the outbound request a timeoutmedium

geo_agent/.bedrock_agentcore/geospatial_agent_on_aws/Dockerfile

1 outbound call(s) with no timeout

requests has no default timeout, so a peer that accepts the connection and then says nothing holds the worker forever, and with a small worker pool a single slow dependency takes the whole service down without anything appearing to fail.

Fix: Pass timeout= on every call, or use a session with one configured.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.

View on GitHub All Projects