Introducing Web Search to Amazon Bedrock AgentCore

0 1 8 minutes read

Introducing Web Search to Amazon Bedrock AgentCore

AI agents are changing the way organizations acquire and act on knowledge, but they share one structural limitation: their knowledge is reinforced during training. If you ask an agent who relies only on his training data about today's stock price, sports score, or the release submitted in the last hour, he cannot answer.

Web Search on Amazon Bedrock AgentCore, now generally available, addresses that gap. This fully managed, Model Context Protocol (MCP)-compatible web search capability allows your agents to find information on the web without infrastructure. It is available as a managed target or connector that you connect to your AgentCore Gateway. Agents get it by default tools/list call and invoke it like other MCP tools. There are no search APIs to provide, no outbound credentials to manage, and no result analysis glue to maintain.

Behind that single link sits a purpose-built web directory maintained by Amazon, which includes tens of billions of documents. Amazon updates the index continuously, displaying new content within minutes. The privacy model ensures that queries never leave AWS. Retrieval can include information graph and semantic snippet extraction captured in the context of the model.

In this post, we walk through what makes Web Search in Amazon Bedrock AgentCore unique, why it's important, and how to wire it up with just a few lines of code.

Figure 1: Your application connects to the AgentCore Gateway (AWS Identity and Access Management (IAM) or internal JSON Web Token (JWT) auth), which sends queries through a managed connector to the Web Search tool in the AWS service account. Query traffic resides within AWS.

The world's web agents are for fixing old information, but it's also where many groups get stuck. Self-build means:

Access to a third-party search API and manage keys, quotas, and rate limits.
Analyzing inconsistent results formats across providers.
Consultation about where customer inquiries go and how that data may be stored or reused.
Creating snippets to read snippets, so models get the relevant snippets, not raw HTML.
Maintaining freshness, coverage, and quality over time.

Each of these is a project in itself. Web search on Amazon Bedrock AgentCore addresses them all.

A purpose-built web directory

Most “add web search to your proxy” solutions are third-party search engine wrappers. Web search on Amazon Bedrock AgentCore is powered by Amazon's own live web index, which includes tens of billions of documents. That scale is important for integration. For example, a long-tail query about a niche library or an obscure product spec can be answered more effectively if the index is broad rather than limited to the most popular pages.

It is updated regularly

Amazon updates the index continuously, displaying new content within minutes. For agents answering questions about price movements or recently published announcements, that late window is the difference between a well-founded answer and a confidently incorrect one. When your agent searches for “what happened today,” the results show what actually happened today.

Information graph of high confidence facts

Web Search in Amazon Bedrock AgentCore includes a built-in information graph with a database of entities and their relationships. For factual questions (such as who has a role or when something was invented), the knowledge graph provides more reliable answers than leaving the model to figure it out on the extracted page text. This reduces the kind of implicit truth drift that occurs when the agent integrates feedback from snippets alone.

Rather than giving the model a raw HTML dump or a full page and hoping it will find the relevant part, the tool generates related snippets such as. It pulls snippets from each web page that matches the query, and returns them in the format configured for the model's context window. The model sees significant components, with a few tokens used on the boilerplate and chrome navigation. This can help improve the accuracy of the indicated answers.

It is confidential by design

For most businesses, the query that shuts down web search results is “not working”. “Where do my users' questions go, and what happens to them?” Amazon Bedrock AgentCore's web search is designed to make the answers to those questions easy.

Questions don't leave AWS

When your agent issues a search, the query is delivered entirely within the AWS infrastructure. Customer queries are not sent to a third-party search engine or leave AWS. The Gateway authenticates to the AWS-managed connector and sends the request internally, so the data route stays within AWS at the end. For groups with residential data or third-party outsourcing concerns, this removes the entire review stage.

Moving forward

To get started with the Web Search Tool, you create an AgentCore Gateway (if you don't want to use an existing one), add the Web Search Tool, and request it from an agent running MCP.

What is required

To follow the setup steps in this post, you need the following:

An AWS account with permissions to create IAM roles and Amazon Bedrock AgentCore services.
AWS Command Line Interface (AWS CLI) v2 installed and configured, or access to the AWS Management Console.
Python 3.10 or later (for SDK and Strands examples).
I boto3 The SDK has been updated to the latest version.
Amazon Bedrock AgentCore Gateway. You can add a Web Search Tool as a target to an existing Gateway, or create a new one. For instructions on creating a Gateway, see Create an Amazon Bedrock AgentCore gateway in the Developer Guide.

Note: Following these steps creates AWS services that incur costs. Amazon Bedrock AgentCore Gateway and Web Search applications are billable. See the next pricing section for details, and remember to clean the facilities when you're done to avoid ongoing costs.

Set up

Adding web search to the agent boils down to attaching the target Web Search Tool to your Gateway using connectorId: "web-search". Gateway captures the device schema, provides integration, and handles schema management, parameter governance, endpoint configuration, and service authentication for you.

import boto3

gateway_client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

# Add the Web Search Tool as a target on an existing Gateway
gateway_client.create_gateway_target(
    gatewayIdentifier=gateway_id,  # your existing or newly created Gateway ID
    name="web-search-tool",
    targetConfiguration={
        "mcp": {
            "connector": {
                "source": {"connectorId": "web-search"},
                "configurations": [{"name": "WebSearch", "parameterValues": {}}],
            }
        }
    },
    credentialProviderConfigurations=[
        {"credentialProviderType": "GATEWAY_IAM_ROLE"}
    ],
)

Make sure you add the target by calling describe_gateway_target or list_gateway_targets and ensuring that the Web Search tool appears in the response.

Outgoing role and permissions

Note the preceding credentialProviderConfigurations. This is the whole story of outbound authentication: instead of you providing API keys or managing search credentials, the Gateway authenticates the web search backup using its IAM service role.

That role requires a trust policy (for AgentCore to be able to retrieve it, installed on your account and Region) and a permissions policy with two actions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "InvokeGateway",
      "Effect": "Allow",
      "Action": "bedrock-agentcore:InvokeGateway",
      "Resource": "arn:aws:bedrock-agentcore:us-east-1::gateway/"
    },
    {
      "Sid": "InvokeWebSearch",
      "Effect": "Allow",
      "Action": "bedrock-agentcore:InvokeWebSearch",
      "Resource": "arn:aws:bedrock-agentcore:us-east-1:aws:tool/web-search.v1"
    }
  ]
}

I InvokeWebSearch The ARN resource is managed by AWS (account= aws). Authorization is enforced on a per-request basis against that ARN, provided so bedrock-agentcore:InvokeWebSearch in it is what allows the Gateway to call the web search for you.

A few parameters to keep clear:

This role is for outbound auth only (Gateway to Web Search endpoint). Inbound Auth (which can call your Gateway) is handled separately, usually via OAuth or JWT authorization such as Amazon Cognito.
The role does not include bedrock:InvokeModel. Access to the model is for whatever identity is running your agent, not the Gateway service role.

Requests from MCP compliant entities

Because Web Search is exposed through MCP, an MCP-compatible framework such as Strands, LangChain, LangGraph, CrewAI, or your own can find and invoke it. The agent calls tools/listyou get WebSearchTooland use it automatically whenever it needs current information:

from datetime import date
from strands import Agent
from strands.models.bedrock import BedrockModel
from strands.tools.mcp import MCPClient
from mcp_proxy_for_aws.client import aws_iam_streamablehttp_client

gateway_url = "https://gateway-.gateway.bedrock-agentcore.us-east-1.amazonaws.com/mcp"

mcp_client = MCPClient(lambda: aws_iam_streamablehttp_client(
    endpoint=gateway_url,
    aws_region="us-east-1",
    aws_service="bedrock-agentcore",
))

model = BedrockModel(model_id="us.anthropic.claude-sonnet-4-6")

system_prompt = (
    f"You are a helpful assistant. Today's date is {date.today().isoformat()}. "
    "Use the available tools when you need current information."
)

with mcp_client:
    tools = mcp_client.list_tools_sync()  # WebSearch tool discovered from the Gateway
    agent = Agent(model=model, tools=tools, system_prompt=system_prompt)

    result = agent("What are the latest AI breakthroughs announced this week?")
    print(result)

The agent decides that it needs new information, an invoice WebSearchTool to the relevant question, and formulates a well-founded answer with source citations. There is no tool-specific code on your side.

Response format

The results come back from the standard MCP tools/call an envelope. The tool returns one content type block text which contains a serialized JSON document with the results. Analyze that internal document and find out id plus a results visual list:

{
  "publishedDate": "04:43AM, Wednesday, June 17 2026, PDT",
  "text": "The 2026 NBA Finals was the championship...",
  "title": "2026 NBA Finals",
  "url": "
}

Each view of the web directory (which is always returned) carries title, url, publishedDateagain text. Viewing the information graph (optional, for business queries) is empty title again url and structured key/value facts in text field.

If you need to add an agent to your business data, Amazon Bedrock Knowledge Bases and Amazon Bedrock Managed Knowledge Bases are the right tools. Eat, index, and give back with your own content. The Web Search Tool is a complement. It supports agents on the public web, to questions where their answers live outside your organization and change by the minute. Most production agents use both: a knowledge base of “what our scripts say” and a web search of “what's true in the world right now.”

The price

At $7 per 1,000 queries, you can use a web search agent for less than a cent per query with a pay-as-you-go model.

Clean resources

If you created resources while following, you can remove them to avoid ongoing costs:

Remove Gateway target: call delete_gateway_target you too gatewayIdentifier again targetId.
If the Gateway is created only for this, remove it with delete_gateway.

There is no ongoing infrastructure on the AWS side beyond these services. After removal, you stop charging.

The conclusion

The Amazon Bedrock AgentCore Web Search Tool gives your agents the most up-to-date web information in one go connectorId. No search APIs should be provided and no analysis results should be stored. Under that simplicity there is a web index that AWS creates (tens of billions of documents, updated within minutes), a privacy model where queries do not leave AWS, and retrieval that can include a graph of information and extract semantic snippets prepared for the context of the model. The result is an agent that answers timely questions accurately, cites its sources, and stores your data where it belongs.

Because Amazon runs the full search stack, new optimization, coverage, relevance, and quality snippets flow to your agents automatically through the same managed connector. No version upgrade or migration is required on your end.

You can access the Web Search Tool connector today at us-east-1 (US East (N. Virginia)).

To get started, see the Web Search Tool documentation.