Source: aws.amazon.com/blogs/machine-learning/introducing-the-web-search-api-on-amazon-bedrock-agentcore
Until now, web search for AgentCore agents went through AgentCore Gateway, which requires creating a gateway and a web search target before an MCP client can call the tool. The new InvokeWebSearch operation on the bedrock-agentcore data plane lets code call search directly through the AWS SDKs or the AWS CLI, signed with existing IAM credentials. No resources need to be created beforehand.
Each request can return up to 25 results and can include include and exclude lists of up to 100 domains each, plus a publication date range. Results carry a text extract and, when available, the page title, URL and publication time. Amazon operates the index, and queries are served inside AWS rather than sent to a third-party search engine.
Access is controlled with the bedrock-agentcore:InvokeWebSearch IAM permission, and calls can be routed through an interface VPC endpoint using AWS PrivateLink and restricted with an aws:SourceVpce condition. Each account can send up to 10 requests per second in each Region by default, and the API is available in US East (N. Virginia), US East (Ohio), US West (Oregon), Europe (Ireland), Asia Pacific (Tokyo) and Asia Pacific (Sydney).
Why it matters if you build agents
Developers building their own agent loops, using LangChain or LlamaIndex, or running data pipelines and dashboards can add web grounding without deploying a gateway. Teams that need one shared search policy across many agents should still use AgentCore Gateway, which adds JWT authorization and admin-set domain lists that calling agents cannot see. The API and the gateway tool use different field names, so code written for one needs changes to use the other.
Get stories like this every weekday
One short email with the day's agent tooling news.