Amazon Web Services announced a standalone Web Search API for Amazon Bedrock AgentCore on November 11, 2026, letting applications retrieve ranked web results with one signed call and no gateway to create. AWS bills searches at $7 per 1,000 queries, with the API designed for custom agents, data pipelines and existing applications.
Before this launch, Web Search on AgentCore was delivered through AgentCore Gateway, which required a gateway, a web search target and a Model Context Protocol (MCP) client. The new InvokeWebSearch operation instead works through AWS SDKs or the AWS CLI with standard AWS Identity and Access Management (IAM) credentials and Signature Version 4 authentication, without a separate API key or secret. Results contain text extracts and, when available, page titles, URLs and publication times.
Direct Search for Custom Orchestration
The API is intended for custom agent loops and frameworks such as LangChain or LlamaIndex, as well as non-agent workloads including dashboards, fact-checking pipelines, content enrichment and monitoring systems. It also lets developers manage retries, caching and error handling themselves rather than delegating those functions to a gateway.
The service searches an Amazon-operated web index. AWS says queries are served inside AWS rather than sent to a third-party search engine, and that the operation uses the same search infrastructure as Alexa+, Kiro, Quick and other Amazon products.
Queries can be up to 200 characters, with callers requesting between 1 and 25 results and receiving up to 25 when maxResults is omitted. Domain include and exclude lists each hold as many as 100 entries, and a root domain also matches its subdomains. Publication filters accept UTC timestamps in RFC 3339 format, and both publishedAfter and publishedBefore bounds are inclusive.
Python callers need Boto3 1.43.127 or later; support is also included in langchain-aws 1.9.3 and AgentCore Python SDK 1.26.0. In the AgentCore console, users can test queries with result-count, date and domain settings, inspect result metadata and call latency, then generate an integration snippet or create a gateway target.
Identity and Private Network Controls
Callers need bedrock-agentcore:InvokeWebSearch permission on the AWS-managed web search tool, the same action and rean apply guardrails across accounts, allowing organizations to govern direct search alongside other AWS permissions
For workloads in private subnets, AWS PrivateLink can route calls through an interface endpoint in a virtual private cloud (VPC), keeping traffic on the AWS network without an internet gateway, NAT gateway or proxy. Endpoint policies, security groups, subnet placement and an aws: paths may invoke search
CloudTrail records InvokeWebSearch requests as data events, but these are not logged by default. A trail or event data store needs an event selector for the AWS::BedrockAgentCore::WebSearch remaxResults, not the search text or filters. The applicable acceptable-use terms also require customers to retain and display the
Availability and the Gateway Boundary
The API meters to the same usage type as the gateway connector but incurs no gateway charges on the direct path. Its default quota is 10 requests per second per account in each Region, and customers can request an increase. Availability at launch covers US East (N. Virginia), US East (Ohio), US West (Oregon), Europe (Ireland), Asia Pacific (Tokyo) and Asia Pacific (Sydney).
AWS still recommends AgentCore Gateway for most agentic workloads, particularly deployments that combine MCP-compatible tools behind one endpoint, use optional MCP sessions or apply one administrator-controlled source policy across teams. Both routes search the same index, but the gateway can also authorize callers with JSON Web Tokens, while the standalone API uses IAM only. Gateway administrators can enforce target-level domain lists hidden from calling agents; direct API requests carry their own filters.
The launch makes Amazon’s web index accessible without requiring an application to adopt MCP or the gateway stack. The dividing line is operational control: direct callers own request handling and filtering, while shared agent environments retain the gateway’s centralized tool, authentication and
