Introducing Internet Search on Amazon Bedrock AgentCore

AI brokers are altering how organizations discover and act on info, however they share one structural limitation: their information is frozen at coaching time. Once you ask an agent that depends solely on its coaching information about at present’s inventory value, a sports activities rating, or a launch that shipped an hour in the past, it could actually’t reply.

Internet Search on Amazon Bedrock AgentCore, now usually obtainable, addresses that hole. This totally managed, Mannequin Context Protocol (MCP)-compatible internet search functionality lets your brokers get info from the net with out infrastructure overhead. It’s obtainable as a managed goal or connector that you just hook up with your AgentCore Gateway. Brokers uncover it with a regular instruments/checklist name and invoke it like different MCP instruments. There are not any search APIs to provision, no outbound credentials to handle, and no result-parsing glue to take care of.

Behind that single connector sits a purpose-built internet index maintained by Amazon, spanning tens of billions of paperwork. Amazon refreshes the index regularly, reflecting new content material inside minutes. The privateness mannequin makes positive that queries don’t depart AWS. Retrieval can mix a information graph with semantic snippet extraction tuned for mannequin context.

On this put up, we stroll by what makes Internet Search on Amazon Bedrock AgentCore completely different, why it issues, and learn how to wire it in with a couple of strains of code.

Determine 1: Your software connects to the AgentCore Gateway (AWS Identification and Entry Administration (IAM) or JSON Internet Token (JWT) inbound auth), which routes queries by a managed connector to the Internet Search device within the AWS service account. Question site visitors stays inside AWS.

Grounding brokers within the internet is the repair for stale information, nevertheless it’s additionally the place many groups get caught. Constructing it your self means:

Procuring a third-party search API and managing keys, quotas, and price limits.
Parsing inconsistent consequence codecs throughout suppliers.
Reasoning about the place buyer queries journey and the way that information is perhaps retained or reused.
Constructing snippet extraction logic, so fashions get related passages, not uncooked HTML.
Sustaining freshness, protection, and high quality over time.

Every of those is a venture in itself. Internet Search on Amazon Bedrock AgentCore addresses all of them.

A purpose-built internet index

Many “add internet search to your agent” options are wrappers round a third-party search engine. Internet Search on Amazon Bedrock AgentCore is backed by an online index that Amazon operates straight, spanning tens of billions of paperwork. That scale issues for protection. For instance, the long-tail query a few area of interest library or an obscure product spec could be answered extra successfully when the index is broad moderately than restricted to the most well-liked pages.

Up to date regularly

Amazon refreshes the index on an ongoing foundation, reflecting new content material inside minutes. For brokers that reply to questions on value actions or just lately printed bulletins, that recency window is the distinction between a grounded response and a confidently fallacious one. When your agent searches for “what occurred at present,” the outcomes mirror what really occurred at present.

Data graph for high-confidence information

Internet Search on Amazon Bedrock AgentCore features a built-in information graph that grounds entities and their relationships. For factual questions (like who holds a task or when one thing was based), the information graph supplies high-confidence responses moderately than leaving the mannequin to deduce them from extracted web page textual content. This reduces the sort of refined factual drift that creeps in when an agent stitches collectively a response from snippets alone.

Fairly than handing the mannequin a uncooked HTML dump or a full web page and hoping it finds the related half, the device performs semantically related snippet extraction. It pulls the passages from every internet web page that bear on the question, then returns them in a type optimized for a mannequin’s context window. The mannequin sees the components that matter, with fewer tokens spent on boilerplate and navigation chrome. This may also help enhance the precision of cited responses.

Non-public by design

For a lot of enterprises, the query that stalls an online search rollout isn’t “does it work.” It’s “the place do my customers’ queries go, and what occurs to them?” Internet Search on Amazon Bedrock AgentCore is constructed so the solutions to these questions are easy.

Queries don’t depart AWS

When your agent points a search, the question is served solely inside AWS infrastructure. Buyer queries don’t get despatched to a third-party search engine or depart AWS. The Gateway authenticates to the connector owned by AWS and routes the request internally, so the info path stays inside AWS finish to finish. For groups with data-residency or third-party egress considerations, this removes a complete class of evaluate.

Walkthrough

To get began with the Internet Search Instrument, you create an AgentCore Gateway (if you happen to don’t need to use an present one), add the net search device goal, and invoke it from an agent utilizing MCP.

Conditions

To comply with together with the setup steps on this put up, you want the next:

An AWS account with permissions to create IAM roles and Amazon Bedrock AgentCore assets.
The AWS Command Line Interface (AWS CLI) v2 put in and configured, or entry to the AWS Administration Console.
Python 3.10 or later (for the SDK and Strands examples).
The boto3 SDK up to date to the most recent model.
An Amazon Bedrock AgentCore Gateway. You’ll be able to add the Internet Search Instrument as a goal to an present Gateway, or create a brand new one. For directions on making a Gateway, see Create an Amazon Bedrock AgentCore gateway within the Developer Information.

Observe: Following these steps creates AWS assets that incur expenses. The Amazon Bedrock AgentCore Gateway and Internet Search invocations are billable. See the Pricing part that follows for particulars, and keep in mind to wash up assets when completed to keep away from ongoing expenses.

Setup

Including internet search to an agent comes right down to attaching a Internet Search Instrument goal to your Gateway utilizing connectorId: "web-search". The Gateway snapshots the device schema, provisions the combination, and handles schema administration, parameter governance, endpoint decision, and repair authentication for you.

import boto3

gateway_client = boto3.consumer("bedrock-agentcore-control", region_name="us-east-1")

# Add the Internet Search Instrument as a goal on an present Gateway
gateway_client.create_gateway_target(
    gatewayIdentifier=gateway_id,  # your present or newly created Gateway ID
    title="web-search-tool",
    targetConfiguration={
        "mcp": {
            "connector": {
                "supply": {"connectorId": "web-search"},
                "configurations": [{"name": "WebSearch", "parameterValues": {}}],
            }
        }
    },
    credentialProviderConfigurations=[
        {"credentialProviderType": "GATEWAY_IAM_ROLE"}
    ],
)

Confirm that you just added the goal by calling describe_gateway_target or list_gateway_targets and confirming that Internet Search-tool seems within the response.

The outbound position and permissions

Discover the previous credentialProviderConfigurations. That is the entire outbound-authorization story: as an alternative of you provisioning API keys or managing search credentials, the Gateway authenticates to the Internet Search backend utilizing its personal IAM service position.

That position wants a belief coverage (so AgentCore can assume it, scoped to your account and Area) and a permissions coverage with two actions:

{
  "Model": "2012-10-17",
  "Assertion": [
    {
      "Sid": "InvokeGateway",
      "Effect": "Allow",
      "Action": "bedrock-agentcore:InvokeGateway",
      "Resource": "arn:aws:bedrock-agentcore:us-east-1::gateway/"
    },
    {
      "Sid": "InvokeWebSearch",
      "Effect": "Allow",
      "Action": "bedrock-agentcore:InvokeWebSearch",
      "Resource": "arn:aws:bedrock-agentcore:us-east-1:aws:tool/web-search.v1"
    }
  ]
}

The InvokeWebSearch useful resource ARN is owned by AWS (account = aws). Authorization is enforced per invocation in opposition to that ARN, so granting bedrock-agentcore:InvokeWebSearch on it’s what lets the Gateway name internet search in your behalf.

A few boundaries to maintain clear:

This position is for outbound auth solely (Gateway reaching the Internet Search backend). Inbound auth (who can name your Gateway) is dealt with individually, usually with an OAuth or JWT authorizer comparable to Amazon Cognito.
The position doesn’t embrace bedrock:InvokeModel. Mannequin entry belongs to no matter identification runs your agent, to not the Gateway service position.

Invoking from MCP-compatible frameworks

As a result of Internet Search is uncovered over MCP, an MCP-compatible framework like Strands, LangChain, LangGraph, CrewAI, or your individual can uncover and invoke it. The agent calls instruments/checklist, finds WebSearchTool, and makes use of it robotically each time it wants present info:

from datetime import date
from strands import Agent
from strands.fashions.bedrock import BedrockModel
from strands.instruments.mcp import MCPClient
from mcp_proxy_for_aws.consumer import aws_iam_streamablehttp_client

gateway_url = "https://gateway-.gateway.bedrock-agentcore.us-east-1.amazonaws.com/mcp"

mcp_client = MCPClient(lambda: aws_iam_streamablehttp_client(
    endpoint=gateway_url,
    aws_region="us-east-1",
    aws_service="bedrock-agentcore",
))

mannequin = BedrockModel(model_id="us.anthropic.claude-sonnet-4-6")

system_prompt = (
    f"You're a useful assistant. Right this moment's date is {date.at present().isoformat()}. "
    "Use the obtainable instruments whenever you want present info."
)

with mcp_client:
    instruments = mcp_client.list_tools_sync()  # WebSearch device found from the Gateway
    agent = Agent(mannequin=mannequin, instruments=instruments, system_prompt=system_prompt)

    consequence = agent("What are the most recent AI breakthroughs introduced this week?")
    print(consequence)

The agent determines it wants contemporary info, invokes WebSearchTool with an applicable question, and composes a grounded response with supply citations. No tool-specific code in your facet.

Response format

Outcomes come again in the usual MCP instruments/name envelope. The device returns a single content material block of sort textual content that accommodates a serialized JSON doc with the outcomes. Parse that internal textual content and also you get an id plus a outcomes array of observations:

{
  "publishedDate": "04:43AM, Wednesday, June 17 2026, PDT",
  "textual content": "The 2026 NBA Finals was the championship...",
  "title": "2026 NBA Finals",
  "url": "https://en.wikipedia.org/wiki/2026_NBA_Finals"
}

Every internet index commentary (at all times returned) carries title, url, publishedDate, and textual content. Data-graph observations (non-obligatory, for entity queries) have null title and url plus structured key/worth information within the textual content discipline.

If it’s good to floor an agent in your individual enterprise information, Amazon Bedrock Data Bases and Amazon Bedrock Managed Data Bases are the proper instruments. They ingest, index, and retrieve over content material you personal. The Internet Search Instrument is the complement. It grounds brokers within the public internet, for questions whose responses dwell outdoors your group and alter by the minute. Many manufacturing brokers use each: a information base for “what do our paperwork say” and internet seek for “what’s true on the planet proper now.”

Pricing

At $7 per 1,000 queries, you may run a web-search agent for lower than a cent per query with a pay-as-you-go mannequin.

Clear up assets

When you created assets whereas following alongside, you may take away them to keep away from ongoing expenses:

Delete the Gateway goal: name delete_gateway_target along with your gatewayIdentifier and targetId.
If the Gateway was created solely for this walkthrough, delete it with delete_gateway.

There isn’t any persistent infrastructure on the AWS facet past these assets. After they’re eliminated, you cease incurring expenses.

Conclusion

The Amazon Bedrock AgentCore Internet Search Instrument offers your brokers present internet information by a single connectorId. There are not any search APIs to provision and no result-parsing to take care of. Beneath that simplicity is an online index that AWS builds itself (tens of billions of paperwork, refreshed inside minutes), a privateness mannequin the place queries don’t depart AWS, and retrieval that may mix a information graph with semantic snippet extraction tuned for mannequin context. The result’s an agent that responds to well timed questions precisely, cites its sources, and retains your information the place it belongs.

As a result of Amazon operates the total search stack, enhancements to freshness, protection, relevance, and snippet high quality stream to your brokers robotically by the identical managed connector. No model upgrades or migrations are wanted in your facet.

You’ll be able to entry the Internet Search Instrument connector at present in us-east-1 (US East (N. Virginia)).

To get began, see the Internet Search Instrument documentation.