AWS Launches AgentCore Web Search API for Parallel Dependency Monitoring

Summary:AWS has made the Amazon Bedrock AgentCore Web Search API generally available to agents and applications. A single API call returns current web results with titles, URLs, publication dates, relevant extracts, and domain or date constraints. Requests reuse AWS credentials through SigV4, avoiding a separate search-provider API key. AWS demonstrates the service through a LangGraph dependency watcher that researches npm, PyPI, and container base-image ecosystems in parallel. Critical controls—includ

---

Core Update

AWS has made the Amazon Bedrock AgentCore Web Search API generally available to agents and applications. A single API call returns current web results with titles, URLs, publication dates, and relevant extracts. Requests reuse existing AWS credentials through SigV4, eliminating the need to provision and rotate a separate search-provider API key.

The official reference implementation uses LangGraph to create a daily dependency watcher for npm packages, PyPI packages, and container base images. The model decides what to search for and drafts structured findings, while the date window, source blocklist, search budget, evidence checks, and deduplication logic remain in deterministic code.

Architecture: Let the Model Generate, Let Code Constrain

The example creates one LangGraph branch for each ecosystem. A fan_out node uses LangGraph's Send API to start the npm, PyPI, and container-image branches concurrently. Each branch calls Anthropic Claude through Amazon Bedrock and uses a toolkit created by create_web_search_toolkit.

The toolkit applies published_after and exclude_domains to every request and limits each branch to four searches with max_searches=4. Setting model_filters=False exposes only the query argument to the model, preventing it from changing the date boundary, blocklist, or search budget.

After the branches finish, the graph merges their outputs and invokes keep_new, which checks the LangGraph Store for previously reported findings. The model therefore produces candidates, but code determines which candidates become reportable.

Evidence Checks: Citation Validity Is Not Vulnerability Truth

Every finding must pass four deterministic checks: its cited URL appeared in that branch's search results; the source title or text names the package as a whole word; any CVE or advisory identifier appears in the source text; and the publication date falls within the monitoring window. A missing date is treated as out of range.

These checks can reject unsupported URLs, invented identifiers, and stale sources. They do not establish the correct severity, active exploitation status, affected versions, remediation suitability, or first-disclosure date. AWS therefore recommends validating production findings against authoritative vulnerability feeds and requiring human review before remediation.

Web search should be treated as a discovery and aggregation layer, not the sole source of truth for software-supply-chain decisions.

Parallelism Gains and Engineering Costs

In the reported test, the three branches made 12 searches and received 80 sources. Evidence validation rejected two findings: one source did not name the package, and one CVE identifier was absent from the cited text. Four findings passed, while the persistence layer suppressed two that had already been reported.

Parallel execution completed in 36 seconds, compared with 99 seconds when the branches ran serially, an approximately 64% reduction in wall-clock time. This should not be interpreted as a general scaling guarantee. End-to-end latency still depends on model concurrency limits, regional Web Search quotas, account-level request rates, and branch length.

The default quota is 10 Web Search requests per second per region for an account, shared across agents. Parallelism reduces waiting time but does not reduce total searches, model-token consumption, or indexed-search charges. Production systems should enforce per-branch and global search budgets, timeouts, and failure fallbacks.

Deployment: Runtime and Gateway

InMemoryStore is ephemeral within an AgentCore Runtime session and is insufficient for a long-running daily workflow. AWS recommends a durable store with exact key lookups, such as DynamoDBStore from langgraph-checkpoint-aws. The result fingerprint should be stable rather than based on a model-generated title.

AgentCore Runtime offers two compute models. MicroVMs isolate each session and suit workloads requiring stronger session separation. Runtime Instances run agents on AWS-managed EC2 instances inside the customer's account and fit multi-day sessions, GPU workloads, or multiple agents sharing one instance.

Search calls are signed by the runtime execution role, so the example requires only bedrock-agentcore:InvokeWebSearch against the web-search.v1 resource.

For platform-wide governance, AgentCore Gateway can expose the Web Search Tool and enforce an administrator-owned source policy. This path requires InvokeWebSearch for the gateway service role and InvokeGateway for the client identity. Teams with different requirements should receive separate Web Search Targets rather than relying on prompt-level compliance.

Deployment Recommendations

1. Define immutable policies in code: Set date windows, domain allowlists or blocklists, search limits, and concurrency caps in the toolkit rather than only in prompts.
2. Separate text from evidence artifacts: Use return_sources=True so model-readable search output and graph-verifiable source artifacts remain distinct.
3. Use durable deduplication: Keep InMemoryStore for development, but use DynamoDB-backed persistence for scheduled production jobs.
4. Cross-check authoritative feeds: Integrate CVE, OSV, NVD, or vendor advisories into a deterministic subgraph; use web search to discover candidate events.
5. Budget searches and model calls: Limit searches per branch, total tokens, runtime duration, and account quota to reduce cost and throttling risk.
6. Add a human gate: Require review before acting on severity, affected-version, or remediation decisions.
7. Audit the evidence chain: Preserve source URLs and map raw search results, validation outcomes, and final reports for traceability.

Capability Boundaries

The main engineering advantage is not unrestricted browsing. It is the integration of web search with existing AWS identity, IAM controls, and agent tooling. Applications do not need another search credential, while platform teams can apply centralized source policies and LangGraph can manage parallel orchestration and state.

Nevertheless, result quality still depends on the coverage, freshness, and extraction quality of the AWS-operated web index. The reference test demonstrates parallel scheduling, source constraints, and deterministic filtering, but it does not establish benchmark-level precision, recall, false-positive, or false-negative rates for vulnerability detection. Production security systems should retain authoritative vulnerability feeds as the factual baseline and use AgentCore Web Search for early discovery and aggregation.

---

Source: AWS Machine Learning Blog (2026-11-10)

— END —

Tags: #AWS Follow #AgentCore Follow #LangGraph Follow #Web Search Follow #Supply Chain Security Follow