Introducing Internet Search on Amazon Bedrock AgentCore

AI brokers are altering how organizations discover and act on info, however they share one structural limitation: their data is frozen at coaching time. Once you ask an agent that depends solely on its coaching information about at the moment’s inventory value, a sports activities rating, or a launch that shipped an hour in the past, it will possibly’t reply.

Internet Search on Amazon Bedrock AgentCore, now typically accessible, addresses that hole. This totally managed, Mannequin Context Protocol (MCP)-compatible net search functionality lets your brokers get info from the online with out infrastructure overhead. It’s accessible as a managed goal or connector that you simply hook up with your AgentCore Gateway. Brokers uncover it with an ordinary instruments/listing name and invoke it like different MCP instruments. There aren’t any search APIs to provision, no outbound credentials to handle, and no result-parsing glue to take care of.

Behind that single connector sits a purpose-built net index maintained by Amazon, spanning tens of billions of paperwork. Amazon refreshes the index frequently, reflecting new content material inside minutes. The privateness mannequin makes positive that queries don’t go away AWS. Retrieval can mix a data graph with semantic snippet extraction tuned for mannequin context.

On this put up, we stroll via what makes Internet Search on Amazon Bedrock AgentCore totally different, why it issues, and the best way to wire it in with just a few strains of code.

Determine 1: Your software connects to the AgentCore Gateway (AWS Identification and Entry Administration (IAM) or JSON Internet Token (JWT) inbound auth), which routes queries via a managed connector to the Internet Search instrument within the AWS service account. Question visitors stays inside AWS.

Grounding brokers within the net is the repair for stale data, nevertheless it’s additionally the place many groups get caught. Constructing it your self means:

Procuring a third-party search API and managing keys, quotas, and fee limits.
Parsing inconsistent outcome codecs throughout suppliers.
Reasoning about the place buyer queries journey and the way that information could be retained or reused.
Constructing snippet extraction logic, so fashions get related passages, not uncooked HTML.
Sustaining freshness, protection, and high quality over time.

Every of those is a undertaking in itself. Internet Search on Amazon Bedrock AgentCore addresses all of them.

A purpose-built net index

Many “add net search to your agent” options are wrappers round a third-party search engine. Internet Search on Amazon Bedrock AgentCore is backed by an internet index that Amazon operates instantly, spanning tens of billions of paperwork. That scale issues for protection. For instance, the long-tail query a couple of area of interest library or an obscure product spec could be answered extra successfully when the index is broad quite than restricted to the most well-liked pages.

Up to date frequently

Amazon refreshes the index on an ongoing foundation, reflecting new content material inside minutes. For brokers that reply to questions on value actions or not too long ago printed bulletins, that recency window is the distinction between a grounded response and a confidently mistaken one. When your agent searches for “what occurred at the moment,” the outcomes replicate what truly occurred at the moment.

Data graph for high-confidence details

Internet Search on Amazon Bedrock AgentCore features a built-in data graph that grounds entities and their relationships. For factual questions (like who holds a job or when one thing was based), the data graph supplies high-confidence responses quite than leaving the mannequin to deduce them from extracted web page textual content. This reduces the type of refined factual drift that creeps in when an agent stitches collectively a response from snippets alone.

Reasonably than handing the mannequin a uncooked HTML dump or a full web page and hoping it finds the related half, the instrument performs semantically related snippet extraction. It pulls the passages from every net web page that bear on the question, then returns them in a kind optimized for a mannequin’s context window. The mannequin sees the elements that matter, with fewer tokens spent on boilerplate and navigation chrome. This will help enhance the precision of cited responses.

Non-public by design

For a lot of enterprises, the query that stalls an internet search rollout isn’t “does it work.” It’s “the place do my customers’ queries go, and what occurs to them?” Internet Search on Amazon Bedrock AgentCore is constructed so the solutions to these questions are easy.

Queries don’t go away AWS

When your agent points a search, the question is served completely inside AWS infrastructure. Buyer queries don’t get despatched to a third-party search engine or go away AWS. The Gateway authenticates to the connector owned by AWS and routes the request internally, so the information path stays inside AWS finish to finish. For groups with data-residency or third-party egress considerations, this removes a whole class of evaluate.

Walkthrough

To get began with the Internet Search Instrument, you create an AgentCore Gateway (when you don’t need to use an current one), add the online search instrument goal, and invoke it from an agent utilizing MCP.

Conditions

To comply with together with the setup steps on this put up, you want the next:

An AWS account with permissions to create IAM roles and Amazon Bedrock AgentCore assets.
The AWS Command Line Interface (AWS CLI) v2 put in and configured, or entry to the AWS Administration Console.
Python 3.10 or later (for the SDK and Strands examples).
The boto3 SDK up to date to the most recent model.
An Amazon Bedrock AgentCore Gateway. You possibly can add the Internet Search Instrument as a goal to an current Gateway, or create a brand new one. For directions on making a Gateway, see Create an Amazon Bedrock AgentCore gateway within the Developer Information.

Be aware: Following these steps creates AWS assets that incur expenses. The Amazon Bedrock AgentCore Gateway and Internet Search invocations are billable. See the Pricing part that follows for particulars, and bear in mind to scrub up assets when completed to keep away from ongoing expenses.

Setup

Including net search to an agent comes right down to attaching a Internet Search Instrument goal to your Gateway utilizing connectorId: "web-search". The Gateway snapshots the instrument schema, provisions the combination, and handles schema administration, parameter governance, endpoint decision, and repair authentication for you.

import boto3

gateway_client = boto3.shopper("bedrock-agentcore-control", region_name="us-east-1")

# Add the Internet Search Instrument as a goal on an current Gateway
gateway_client.create_gateway_target(
    gatewayIdentifier=gateway_id,  # your current or newly created Gateway ID
    identify="web-search-tool",
    targetConfiguration={
        "mcp": {
            "connector": {
                "supply": {"connectorId": "web-search"},
                "configurations": [{"name": "WebSearch", "parameterValues": {}}],
            }
        }
    },
    credentialProviderConfigurations=[
        {"credentialProviderType": "GATEWAY_IAM_ROLE"}
    ],
)

Confirm that you simply added the goal by calling describe_gateway_target or list_gateway_targets and confirming that Internet Search-tool seems within the response.

The outbound function and permissions

Discover the previous credentialProviderConfigurations. That is the entire outbound-authorization story: as a substitute of you provisioning API keys or managing search credentials, the Gateway authenticates to the Internet Search backend utilizing its personal IAM service function.

That function wants a belief coverage (so AgentCore can assume it, scoped to your account and Area) and a permissions coverage with two actions:

{
  "Model": "2012-10-17",
  "Assertion": [
    {
      "Sid": "InvokeGateway",
      "Effect": "Allow",
      "Action": "bedrock-agentcore:InvokeGateway",
      "Resource": "arn:aws:bedrock-agentcore:us-east-1::gateway/"
    },
    {
      "Sid": "InvokeWebSearch",
      "Effect": "Allow",
      "Action": "bedrock-agentcore:InvokeWebSearch",
      "Resource": "arn:aws:bedrock-agentcore:us-east-1:aws:tool/web-search.v1"
    }
  ]
}

The InvokeWebSearch useful resource ARN is owned by AWS (account = aws). Authorization is enforced per invocation towards that ARN, so granting bedrock-agentcore:InvokeWebSearch on it’s what lets the Gateway name net search in your behalf.

A few boundaries to maintain clear:

This function is for outbound auth solely (Gateway reaching the Internet Search backend). Inbound auth (who can name your Gateway) is dealt with individually, sometimes with an OAuth or JWT authorizer resembling Amazon Cognito.
The function doesn’t embrace bedrock:InvokeModel. Mannequin entry belongs to no matter identification runs your agent, to not the Gateway service function.

Invoking from MCP-compatible frameworks

As a result of Internet Search is uncovered over MCP, an MCP-compatible framework like Strands, LangChain, LangGraph, CrewAI, or your individual can uncover and invoke it. The agent calls instruments/listing, finds WebSearchTool, and makes use of it routinely every time it wants present info:

from datetime import date
from strands import Agent
from strands.fashions.bedrock import BedrockModel
from strands.instruments.mcp import MCPClient
from mcp_proxy_for_aws.shopper import aws_iam_streamablehttp_client

gateway_url = "https://gateway-.gateway.bedrock-agentcore.us-east-1.amazonaws.com/mcp"

mcp_client = MCPClient(lambda: aws_iam_streamablehttp_client(
    endpoint=gateway_url,
    aws_region="us-east-1",
    aws_service="bedrock-agentcore",
))

mannequin = BedrockModel(model_id="us.anthropic.claude-sonnet-4-6")

system_prompt = (
    f"You're a useful assistant. At this time's date is {date.at the moment().isoformat()}. "
    "Use the accessible instruments if you want present info."
)

with mcp_client:
    instruments = mcp_client.list_tools_sync()  # WebSearch instrument found from the Gateway
    agent = Agent(mannequin=mannequin, instruments=instruments, system_prompt=system_prompt)

    outcome = agent("What are the most recent AI breakthroughs introduced this week?")
    print(outcome)

The agent determines it wants recent info, invokes WebSearchTool with an applicable question, and composes a grounded response with supply citations. No tool-specific code in your aspect.

Response format

Outcomes come again in the usual MCP instruments/name envelope. The instrument returns a single content material block of sort textual content that comprises a serialized JSON doc with the outcomes. Parse that inside textual content and also you get an id plus a outcomes array of observations:

{
  "publishedDate": "04:43AM, Wednesday, June 17 2026, PDT",
  "textual content": "The 2026 NBA Finals was the championship...",
  "title": "2026 NBA Finals",
  "url": "https://en.wikipedia.org/wiki/2026_NBA_Finals"
}

Every net index statement (at all times returned) carries title, url, publishedDate, and textual content. Data-graph observations (elective, for entity queries) have null title and url plus structured key/worth details within the textual content discipline.

If you have to floor an agent in your individual enterprise information, Amazon Bedrock Data Bases and Amazon Bedrock Managed Data Bases are the correct instruments. They ingest, index, and retrieve over content material you personal. The Internet Search Instrument is the complement. It grounds brokers within the public net, for questions whose responses dwell outdoors your group and alter by the minute. Many manufacturing brokers use each: a data base for “what do our paperwork say” and net seek for “what’s true on the earth proper now.”

Pricing

At $7 per 1,000 queries, you’ll be able to run a web-search agent for lower than a cent per query with a pay-as-you-go mannequin.

Clear up assets

In the event you created assets whereas following alongside, you’ll be able to take away them to keep away from ongoing expenses:

Delete the Gateway goal: name delete_gateway_target along with your gatewayIdentifier and targetId.
If the Gateway was created solely for this walkthrough, delete it with delete_gateway.

There isn’t any persistent infrastructure on the AWS aspect past these assets. After they’re eliminated, you cease incurring expenses.

Conclusion

The Amazon Bedrock AgentCore Internet Search Instrument provides your brokers present net data via a single connectorId. There aren’t any search APIs to provision and no result-parsing to take care of. Beneath that simplicity is an internet index that AWS builds itself (tens of billions of paperwork, refreshed inside minutes), a privateness mannequin the place queries don’t go away AWS, and retrieval that may mix a data graph with semantic snippet extraction tuned for mannequin context. The result’s an agent that responds to well timed questions precisely, cites its sources, and retains your information the place it belongs.

As a result of Amazon operates the complete search stack, enhancements to freshness, protection, relevance, and snippet high quality stream to your brokers routinely via the identical managed connector. No model upgrades or migrations are wanted in your aspect.

You possibly can entry the Internet Search Instrument connector at the moment in us-east-1 (US East (N. Virginia)).

To get began, see the Internet Search Instrument documentation.