Direct search without a gateway
AWS has launched a standalone Web Search API for Amazon Bedrock AgentCore, giving applications direct access to the same Amazon-operated index used by the existing AgentCore Gateway connector. Developers call the InvokeWebSearch operation through an AWS SDK or the command line and receive ranked text extracts with titles, URLs and publication times when available. No Gateway resource or separate API key is required, making the feature suitable for custom agents, dashboards, monitoring pipelines and fact-checking systems.
The release fills a gap between a managed agent tool plane and a low-level application primitive. Gateway remains AWS’s recommended path when teams want several tools behind one Model Context Protocol endpoint, central authentication and shared policy. The direct API is designed for software that already has orchestration, retry and caching logic. This distinction helps platform teams avoid building an MCP layer merely to issue a search query, while preserving Gateway for environments that benefit from centrally managed tools.
Calls use standard AWS Signature Version 4 credentials and a dedicated bedrock-agentcore:InvokeWebSearch permission. AWS checks the caller through IAM before searching its index, and the service can be reached from a virtual private cloud through PrivateLink. Search requests stay within AWS rather than being forwarded to a third-party search engine. Those controls simplify procurement and network review for existing AWS customers, although the public pages returned by the index remain external content that an application must treat as untrusted.
Controls travel with each request
Each request can include up to 100 domains and 100 exclusions, an inclusive publication date range and between one and 25 results. Search text is limited to 200 characters. These are useful policy surfaces: a dependency monitor can restrict results to vendor documentation, while a compliance assistant can exclude low-quality aggregators. Because filters travel with the direct request, application code must prevent an agent from quietly loosening them. Non-negotiable source rules belong outside the model’s editable tool arguments.
AWS returns a text extract for every result, while title, URL and publication time are conditional on index availability. That detail is important for grounded generation. A result without a date cannot support a claim about recency, and an extract is not a substitute for reading the source in context. Applications should preserve the URL, retrieve the underlying page when appropriate and show citations near the claims they support. Search expands access to evidence; it does not certify that evidence as correct.
The Amazon-operated index reduces dependency on an external search contract, but teams should still evaluate coverage, freshness, language support and ranking bias for their domain. A strong evaluation set includes breaking news, obscure official documentation, conflicting sources and pages that change after indexing. Developers should test whether the system can say that evidence is insufficient rather than filling a gap from model memory. Retrieval quality and answer quality need separate metrics so one does not hide the other.
Grounding still needs evidence discipline
Enterprise controls are integrated with familiar AWS services. CloudTrail can record InvokeWebSearch as a data event, although data events require explicit configuration. AWS says events record the selected search tool and maximum result count, not the query text or filters. That protects some sensitive content but limits forensic detail. Organisations should decide whether application-level logs need a redacted query fingerprint, source list or decision record, balancing investigation needs against privacy and data-minimisation obligations.
PrivateLink lets workloads in private subnets call the API without an internet gateway, NAT gateway or proxy. Endpoint policies and aws:SourceVpce conditions can restrict which roles use the service and require the private path. The same AgentCore data-plane endpoint can carry runtime, memory, identity, browser and code-interpreter traffic, so endpoint policy design deserves care. A broad allow statement intended for search should not accidentally grant other agent capabilities to every workload in the subnet.
AWS charges US$7 per 1,000 queries, with no Gateway fee when the standalone API is used. The service is available in six regions, including Asia Pacific Sydney. A simple unit price helps teams budget, but autonomous agents can multiply queries through decomposition, retries and parallel research. Put hard search budgets in the orchestration layer, cache suitable results and record queries per completed task. The useful number is the cost of an adequately supported answer, not the cheapest individual retrieval.
Pricing makes query budgets visible
The direct API makes AgentCore relevant beyond agents built entirely inside AWS’s managed stack. It offers a controlled retrieval building block that can be inserted into existing applications while using IAM, VPC and audit conventions teams already understand. The Sydney region is useful for local latency and architecture choices, but customers must still review where indexed source material and logs are processed. Its success will depend on how carefully developers preserve provenance and constrain tool use. Used as a source-discovery layer with verification, it can improve freshness. Used as an unquestioned feed into a fluent model, it can make uncertain web information look authoritative more efficiently.