AWS opens AgentCore web search as a direct API at $7 per 1,000 queries

AWS announced the Web Search API on Amazon Bedrock AgentCore on 11 November 2026. It lets any code with AWS credentials search the web in one call and get back ranked results with text extracts. Until now, AWS says, AgentCore's web search reached agents only through AgentCore Gateway, which meant creating a gateway and a search target and calling the tool from a Model Context Protocol (MCP) client.

The price is $7 per 1,000 queries, the same rate as the gateway connector, with no gateway charges because no gateway is involved. For a team that already runs on AWS and wants search inside its own agent loop, a pipeline or a dashboard, the change is that there is nothing to provision and no second vendor's API key to store.

What the call does

• The operation is InvokeWebSearch on the bedrock-agentcore data plane, signed with AWS Signature Version 4. Access is one IAM permission, bedrock-agentcore:InvokeWebSearch, on an AWS-managed resource.
• A query can be up to 200 characters and returns between 1 and 25 results. Each result has a text extract and, when the index has them, a title, URL and publication time.
• Filters travel with each request: up to 100 domains to include and 100 to exclude, and a published-after and published-before range.
• AWS says queries are served from a web index that Amazon operates, the same one behind Alexa+, Kiro and Quick, and are not sent to a third-party search engine.
• It works over AWS PrivateLink, so code in a private subnet can search without an internet or NAT gateway. An aws:SourceVpce condition can deny the same call from outside the VPC.
• Regions at launch: N. Virginia, Ohio, Oregon, Ireland, Tokyo and Sydney.
• Client support starts at Boto3 1.43.127, langchain-aws 1.9.3 and the AgentCore Python SDK 1.26.0, AWS says.

What it costs

Billing is per query submitted, according to AWS's pricing page, with no minimum. The page's own example prices 200,000 queries a month at $1,400. The default quota is 10 requests per second per account in each Region, and AWS says you can ask for more. PrivateLink endpoints are billed separately at standard rates.

For comparison, DeepSeek's change log priced its Search API at $0.75 per 1,000 successful requests when it launched on 17 October, as we reported then. That is roughly a ninth of AWS's rate. Neither vendor has published a quality comparison. What AWS sells for the difference is a call that stays inside its network, IAM and compliance programmes.

When AWS says to keep the gateway

AWS still calls AgentCore Gateway "the recommended path for most agentic workloads". Both routes search the same index. The gateway puts search behind one MCP endpoint with other tools, can authorise callers with a JSON Web Token as well as IAM, and lets an administrator set domain lists that apply to every request without the calling agent seeing them. With the direct API, each request carries its own filters, so a domain policy is only as strong as the code that builds the request. The field names also differ between the two, so code does not move across unchanged.

The catches

• Audit is opt-in and partial. AWS says CloudTrail records InvokeWebSearch as a data event, which is not logged by default, and that events record the tool and maxResults, "not the search text or filters". If you need to know what an agent searched for, your own code has to log it.
• Citations are a condition of use. AWS says the Web Search Tool terms apply to API results, "including the requirement to retain and display the source citations and links that come with each result".
• The announcement gives no figure for the size or freshness of the index, no latency number and no relevance benchmark. It does not say how long a text extract is, whether a query that returns nothing is billed, or how long AWS keeps query text.

A first test is cheap: run a few hundred of your agents' real queries with your allowed domains, count how many results carry a URL and a publication date, and time the calls. The AgentCore console has a test panel that shows result counts and call duration.