Getting started with Web Answer on Amazon Bedrock AgentCore

Today, we are announcing the general availability of Web Answer on Amazon Bedrock AgentCore. With Web Answer, agent builders get a synthesized, source-cited answer to a natural-language question with a single tool call. They no longer build a search, retrieve, synthesize, and citation pipeline themselves.

If you have built agents that need to answer questions from current web sources, you know the pattern: call a search API, decide which results to trust, retrieve and clean page content, prompt a model to synthesize, and engineer citation extraction so the output traces back to a source. Every step is code you maintain, and every step is another place things can go wrong: hallucination when evidence is insufficient, stale content when the index moves, and broken attribution when a claim and its source drift apart.

The Web Answer collapses that entire pipeline into one request. You send a question. You get back a cited answer in seconds. In this post, we explain what Web Answer does, compare it with Web Search on AgentCore, show how it works and what it returns, and walk through adding Web Answer to a gateway and calling it from an agent.

Figure 1: Request flow from an agent through the Gateway to Web Answer and back

Your agent sends a question to your AgentCore Gateway, a capability of Amazon Bedrock AgentCore. The Gateway authenticates the call with AWS Identity and Access Management (AWS IAM) or a JSON Web Token (JWT). The Gateway calls Web Answer, a managed connector that AWS owns, using its own service role. Web Answer plans its searches, runs several in parallel, and reads key pages to check the facts. When the evidence is insufficient, it searches again. It then writes an answer that ties each claim to its source URL. The Gateway returns the answer and its citations to your agent as a Model Context Protocol (MCP) tool result.

Web Answer is a managed AgentCore Gateway tool that takes a natural-language question and returns a synthesized answer in seconds grounded in current web sources. Here is what you get back:

Figure 2: Demo video showing how to add Web Answer to an AgentCore Gateway, from setup to a finished, cited answer

Web Answer and the Web Search tools both support retrieval use cases, with different levels of integration complexity. The dividing line is who runs the model:

Many customers will use both. An agent might use Web Search for broad research tasks where it needs raw results, and Web Answer for specific factual questions where it needs a quick, cited answer.

Web Answer is a connector that AWS owns. You reference it by ID, and the Gateway handles the tool schema, parameter governance, endpoint resolution, and authentication to the backend. In this walkthrough, you give your Gateway’s service role permission to call Web Answer, add a Web Answer target, and call it from a Strands agent.

Getting started takes minutes. A Gateway administrator adds Web Answer as a target on an existing AgentCore Gateway, and the tool appears to any attached agent over MCP through tools/list and tools/call.

pip install boto3 strands-agents mcp mcp-proxy-for-aws Note: Following these steps creates AWS resources that incur charges. The Gateway and Web Answer invocations are billable. See the Pricing section that follows for details, and when you finish, delete the resources you created (see “Clean up resources”).

The Gateway uses its service role to act on your behalf. The role’s trust policy allows bedrock-agentcore.amazonaws.com to assume it, scoped to your account. For Web Answer, the role needs:

Attach the policy to the service role as an inline policy:

import json import boto3 iam = boto3.client("iam") iam.put_role_policy( RoleName="<gateway-service-role>", PolicyName="WebAnswerGuide", PolicyDocument=json.dumps({ "Version": "2012-10-17", "Statement": [ { "Sid": "InvokeWebAnswer", "Effect": "Allow", "Action": "bedrock-agentcore:InvokeWebAnswer", "Resource": "arn:aws:bedrock-agentcore:us-east-1:aws:tool/web-answer.v1", } ], }), ) The role controls only the Gateway’s outbound calls. Who can call your Gateway is set by its inbound authorizer. The role also doesn’t need bedrock:InvokeModel: your agent’s model runs under your agent’s own identity.

Add Web Answer as a connector target. The connectorId tells the Gateway which managed integration to provision: in this case, an agent that searches the web and writes a cited answer.

import boto3 gateway_client = boto3.client("bedrock-agentcore-control", region_name="us-east-1") target_response = gateway_client.create_gateway_target( name="web-answer-tool", gatewayIdentifier=gateway_id, targetConfiguration={ "mcp": { "connector": { "source": {"connectorId": "web-answer"}, "configurations": [{"name": "WebAnswer", "parameterValues": {}}], } } }, credentialProviderConfigurations=[ {"credentialProviderType": "GATEWAY_IAM_ROLE"} ], ) target_id = target_response["targetId"] Outbound authentication is automatic for connectors. With GATEWAY_IAM_ROLE, the Gateway calls the Web Answer backend with the service role from Step 1, so you don’t create or store any credentials for the tool. Wait until get_gateway_target reports the target status as READY before you call it.

As the Gateway administrator, you can also set a domain filter on the target. The filter applies to every call that goes through the target. To limit the target to a set of domains, set parameterValues to {"domainFilter": {"include": ["bis.org"], "exclude": ["unreliable-source.net"]}}.

Your agent discovers Web Answer through the Gateway’s tools/list and calls it with tools/call, like any other MCP tool. This works with Strands Agents, LangChain, LangGraph, CrewAI, or any other MCP-compatible client.

from strands import Agent from strands.models.bedrock import BedrockModel from strands.tools.mcp import MCPClient from mcp_proxy_for_aws.client import aws_iam_streamablehttp_client gateway_url = "https://gateway-<id>.gateway.bedrock-agentcore.us-east-1.amazonaws.com/mcp" mcp_client = MCPClient(lambda: aws_iam_streamablehttp_client( endpoint=gateway_url, aws_region="us-east-1", aws_service="bedrock-agentcore", aws_profile="<aws-profile-id>", # identity with bedrock-agentcore:InvokeGateway on the Gateway )) model = BedrockModel(model_id="us.anthropic.claude-sonnet-5", max_tokens=1024) with mcp_client: tools = mcp_client.list_tools_sync() # Web Answer tool discovered from the Gateway agent = Agent(model=model, tools=tools) result = agent("What are the Basel III minimum requirements for Tier 1 capital?") print(result.message) When a question needs current information, your agent calls the Web Answer tool ( web-answer-tool___WebAnswer ). Web Answer runs the agentic search and returns a finished answer with citations.

Besides the question, the Web Answer tool takes optional arguments that your agent can set on each call: a domain filter to include or exclude sites, a published-date range, and a country to localize results. The agent’s domain filter is combined with the target’s filter. The agent can exclude more domains, or limit results to some of the target’s included domains, but it can’t add a domain that the target’s filter blocks.

Web Answer returns an MCP tool result with both content and structuredContent fields. The answer is markdown text with inline citation markers like [ 1 ], and structuredContent.answer carries the same text alongside a structured citations list:

{ "content": [ { "type": "text", "text": "Under Basel III, banks must hold Common Equity Tier 1 capital of at least 4.5% of risk-weighted assets [(https://www.bis.org/...)]..." } ], "structuredContent": { "answer": [ { "text": "Under Basel III, banks must hold Common Equity Tier 1 capital of at least 4.5% of risk-weighted assets [(https://www.bis.org/...)]...", "citations": [ { "domain": "bis.org", "url": "https://www.bis.org/..." } ] } ] }, "isError": false, "_meta": { "latencyMs": 5210 } } structuredContent.answer normally holds a single block. Each citation carries the source url and, when available, the domain.

Delete the Web Answer target when you no longer need it:

gateway_client.delete_gateway_target(gatewayIdentifier=gateway_id, targetId=target_id) If you created the Gateway only for this walkthrough, delete its targets first, then the Gateway (delete_gateway), and then the service role and its policy. There is no persistent infrastructure on the AWS side beyond these resources. After they are removed, you stop incurring charges.

Web Answer inherits the same enterprise controls as other AgentCore tools:

Web Answer helps agents retrieve current, cited information to support a range of knowledge-intensive workflows. Example scenarios include:

Web Answer is available in US East (N. Virginia) (us-east-1), with more AWS Regions coming soon.

Web Answer on Amazon Bedrock AgentCore is priced at $10 per 1,000 tool calls.

In this post, we showed how Web Answer gives your agents current, cited answers through agentic search, with no search pipeline for you to build or maintain. We granted a Gateway service role access to Web Answer, added a Web Answer target, called it from a Strands agent, and read the answer and its citations from the response. Use Web Search on AgentCore when your own model should reason over raw results, and Web Answer when your agent needs a finished, cited answer.

Adrianna is a Senior Software Development Engineer at Amazon AGI, where she develops Web Answer on Amazon Bedrock AgentCore. She works on web search and agentic question answering for foundation models and AI agents, helping them give accurate, cited answers based on current information. Since she joined Amazon in 2020, she has built large-scale knowledge systems, first for Alexa and now for AWS.

Gaurav is a Senior Software Development Engineer at Amazon AGI with nine years of experience at Amazon building large-scale distributed systems. He works on the information retrieval, grounding, and agentic AI services that power foundation models and AI agents, including capabilities available through Amazon Bedrock AgentCore. His work helps AI agents access accurate, real-time information and perform complex research tasks, improving the reliability of agentic applications at scale.

Kalyan is a Principal Product Manager at Amazon AGI, where he leads the development and launch of web search capabilities for Amazon Bedrock AgentCore. His work focuses on solving a core limitation of modern AI agents; their inability to access real-time, factual information; by enabling agents to ground their reasoning in live web data. Kalyan lives in the Bay Area with his family.

Kamrul is a Solutions Architect on the Product Marketing Demo Engineering team at AWS, specializing in AI/ML with Amazon Bedrock and Amazon Bedrock AgentCore. He combines interactive demos with technical storytelling to make complex technologies more accessible. Outside of work, he enjoys hiking in the Pacific Northwest, reading, and attending electronic music shows.

Omar is a Technical Product Marketing Manager at Amazon Web Services (AWS), where he focuses on AI products including Agentic AI and Web Search. He holds a Ph.D. in Computer Science and enjoys working at the intersection of AI, technology, and go-to-market strategy to help customers build innovative applications.